KnightCTF 2022

Unknown File – Digital Forensics Challenge Writeup | KnightCTF 2022

Analysis

Opening the file in a hex editor showed the header: 00 10 56 65 0D 0A 1A 0A 00 00 00 0D 49 48 44 52

This did not match any standard file signature. However, further down the bytes 49 48 44 52 clearly spell IHDR, which is part of a PNG header. That suggested the file was actually a PNG with a corrupted magic number.

Fix

The correct PNG header should begin with: 89 50 4E 47 0D 0A 1A 0A

So I replaced the first four bytes with 89 50 4E 47

After saving the file and giving it the .png extension, the image opened successfully.

0 people love this