decode_hex_image.py

#!/usr/bin/env python3
from PIL import Image, UnidentifiedImageError
import sys

BLOCK_SIZE = 6


def extract_cipher_bytes_from_png(path):
    img = Image.open(path)
    w, h = img.size
    pixels = img.load()

    data = bytearray()
    for y in range(h):
        for x in range(w):
            r, g, b = pixels[x, y]
            data.append(b)
    return data


def decrypt_chain(cipher: bytes) -> bytes:
    # Nur volle Blöcke verwenden (Rest abschneiden)
    usable_len = len(cipher) - (len(cipher) % BLOCK_SIZE)
    cipher = cipher[:usable_len]

    blocks = [cipher[i:i + BLOCK_SIZE] for i in range(0, len(cipher), BLOCK_SIZE)]
    if len(blocks) < 2:
        return b""

    pt = bytearray()

    # Erster Block: unbekannt (C0 XOR K) -> Platzhalter
    pt += b"??????"

    # Alle folgenden: Pi = Ci XOR C(i-1)
    for i in range(1, len(blocks)):
        c_prev = blocks[i - 1]
        c_cur = blocks[i]
        pt_block = bytes(c_cur[j] ^ c_prev[j] for j in range(BLOCK_SIZE))
        pt += pt_block

    return bytes(pt)


def main():
    if len(sys.argv) < 2:
        print("usage: decode_hex_image.py <input_file> [output.bin]")
        sys.exit(1)

    in_file = sys.argv[1]
    out_file = sys.argv[2] if len(sys.argv) > 2 else None

    # 1) Versuchen als PNG
    try:
        cipher = extract_cipher_bytes_from_png(in_file)
        print(f"[+] Interpreted '{in_file}' as PNG (blue channel).")
    except (UnidentifiedImageError, OSError):
        # 2) Fallback: rohe Bytes
        print(f"[!] '{in_file}' is not a valid PNG, treating it as raw cipher bytes.")
        with open(in_file, "rb") as f:
            cipher = f.read()

    print(f"[i] Cipher length: {len(cipher)} bytes (len % {BLOCK_SIZE} = {len(cipher) % BLOCK_SIZE})")

    plain = decrypt_chain(cipher)

    if out_file:
        with open(out_file, "wb") as f:
            f.write(plain)
        print(f"[+] Wrote decrypted data to: {out_file}")
    else:
        sys.stdout.buffer.write(plain)


if __name__ == "__main__":
    main()