SHARE
TWEET

Untitled

a guest Mar 6th, 2011 782 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. sing foremost there is a jpeg of a notepad with the text "The key", followed by corruption. This is because the jpeg was fragmented in the original filesystem. At offset 0x9000 is the start of the Webdings font. To find the other part, the following Python script finds compressed data and end-of-jpeg markers:
  2.  
  3. Python:
  4.  
  5. #!/usr/bin/python
  6. import io
  7.  
  8. def meanstdv(x):
  9.     from math import sqrt
  10.     n, mean, std = len(x), 0, 0
  11.     for a in x:
  12.         mean = mean + a
  13.     mean = mean / float(n)
  14.     for a in x:
  15.         std = std + (a - mean)**2
  16.     std = sqrt(std / float(n-1))
  17.     return mean, std
  18.  
  19. f = io.open("for200", "rb")
  20. data = f.read()
  21. f.close()
  22.  
  23. for i in range(0, len(data), 4096):
  24.         cluster = data[i:i+4096]
  25.         dist = [0] * 256
  26.         for j in range(0, 4096):
  27.                 dist[ord(cluster[j])] += 1
  28.         mean, std = meanstdv(dist)
  29.         if std < 20:
  30.                 print "Possible compressed data at %x" % i
  31.         idx = cluster.rfind("\xff\xd9")
  32.         if idx != -1:
  33.                 rest = cluster[idx+2:].strip("\x00")
  34.                 if len(rest) == 0:
  35.                         print "End of JPEG at %x" % i
  36.         if cluster[6:10] == "JFIF":
  37.                 print "Start of JPEG at %x" % i
  38.         if len(cluster.strip("\x00")) < 3000:
  39.                 print "Possible end of file at %x" % i
  40. At offset 0x1427000 in the original file is compressed data followed by an end-of-jpeg marker, but without a start-of-jpeg marker before it. Appending it to the first jpeg gives an image with the following URL, which is the key:
  41.  
  42. www.youtube.com/watch?v=uLQokDjcivU
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top