search

zed-0xff / zsteg

detect stegano-hidden data in PNG & BMP
http://zed.0xff.me
1.33k stars 142 forks source link

If you're still here, I have a question about inflating extracted data from a steg file #1

Closed themaddoctor closed 4 years ago

themaddoctor commented 6 years ago

One of your samples: ndh2k12_sp113.bmp

zsteg -a ndh2k12_sp113.bmp
...
b1,rgb,lsb,yx       .. zlib: data="%PDF-1.4\n%\xC3\xA4\xC3\xBC\xC3\xB6\xC3\x9F\n2 0 obj\n<</Length 3 0 R/Filter/FlateDecode>>\nstream\nx\x9C\x8DT\xC9n\xDB@\f\xBD\xCFW\xF0\x1C \x13\x92\xB3\x03\x86\x80\xC8K\xD1\xDE\\\b\xE8\xA1...", offset=4, size=186                                                                                  
...

But I can't figure out how to inflate the data after I have extracted it. I have tried zlib-inflate, pigz, and faking headers for gzip.

Thanks

zed-0xff commented 4 years ago

fixed in zsteg-0.2.1 now you can extract it with zsteg samples/ndh2k12_sp113.bmp --extract b1,rgb,lsb,yx,zlib > data.pdf

themaddoctor commented 4 years ago

Thank you. I just upgraded zpng for this, and every time I run it I get fatal: Not a git repository (or any parent up to mount point /mnt/quadrupole) Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).

Since I am not trying to manage a git repository, but want to use the program on my local system, how do I get rid of these messages?

themaddoctor commented 4 years ago

/usr/lib64/ruby/2.1.0/rubygems/dependency.rb:298:in `to_specs': Could not find 'rainbow' (~> 2.0.0) - did find: [rainbow-3.0.0] (Gem::LoadError)

zed-0xff commented 4 years ago

Hi. I believe it’s some weird your-system local problem( I had never seen such messages. reboot? relogin? try “which zsteg” try “irb” and then “require zsteg” are you using rvm?

вт, 14 янв. 2020 г. в 19:56, themaddoctor notifications@github.com:

Thank you. I just upgraded zpng for this, and every time I run it I get fatal: Not a git repository (or any parent up to mount point /mnt/quadrupole) Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).

Since I am not trying to manage a git repository, but want to use the program on my local system, how do I get rid of these messages?

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub https://github.com/zed-0xff/zsteg/issues/1?email_source=notifications&email_token=AAABOYTDDDKHDME7IECYKPLQ5XVCBA5CNFSM4FPLYLE2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEI5K7PA#issuecomment-574271420, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAABOYTZWGIFRXPCZUS4IATQ5XVCBANCNFSM4FPLYLEQ .

themaddoctor commented 4 years ago

I found the problem with git; there was a problem with rainbow's spec file. But what about finding rainbow 3 but wanting 2?

zed-0xff commented 4 years ago

I think problem is in the new gem dependencies. I’ll try to fix it tomorrow

вт, 14 янв. 2020 г. в 20:14, themaddoctor notifications@github.com:

I found the problem with git; there was a problem with rainbow's spec file. But what about finding rainbow 3 but wanting 2?

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub https://github.com/zed-0xff/zsteg/issues/1?email_source=notifications&email_token=AAABOYW5DQCHQ3A5RAXJQVTQ5XXITA5CNFSM4FPLYLE2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEI5M7WY#issuecomment-574279643, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAABOYWEUYXXWKNPZHRWK73Q5XXITANCNFSM4FPLYLEQ .

themaddoctor commented 4 years ago

Thanks

zed-0xff commented 4 years ago

@themaddoctor please check now

themaddoctor commented 4 years ago

All is good. Thank you. Cnacu6o