如何检测文件中的隐藏图像？

Question

我正在尝试编写一个 bash 脚本，给定一个这种形式的文件，检测到该文件中有一个隐藏图像：

[random data][image file][random data]

我的第一种方法是用 grep 搜索

[random data][image header][random data][image footer][random data] 

在文件中，但我找不到包含所有图像文件格式的所有页眉和页脚的表格。有人有这张桌子吗，或者你能建议另一种方法吗？

Answer 1

如果你有兴趣，我发现了这个：

#!/bin/bash
# Given a file as argument, scan for hidden images in file.
# written by Cosimo Colaci


#   Hex signature       File format
#
#   47 49 46 38 37 61   gif
#   47 49 46 38 39 61   gif
#   FF D8 FF DB         jpeg
#   FF D8 FF E0         jpg
#   4A 46 49 46 00 01   jpeg
#   89 50 4E 47 0D 0A   png
#   1A 0A               png
#   42 4D               bmp
# etc...

# Declarations
E_NOFILE=66
E_NOREAD=67


# Check filename
filename="$1"

if [ ! -f "$filename" ]
then
  echo "Error! No such file!"
  exit $E_NOFILE
fi

if [ ! -r "$filename" ]
then
  echo "Unable to read \"$filename\"."
  exit $E_NOREAD
fi


# Scan file for hidden image
cat "$filename" | grep '47\\49\\46\\38\\37\\61' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a GIF may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '47\\49\\46\\38\\39\\61' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a GIF may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep 'FF\\D8\\FF\\DB' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a JPEG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep 'FF\\D8\\FF\\E0' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a JPG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '4A\\46\\49\\46\\00\\01' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a JPEG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '89\\50\\4E\\47\\0D\\0A' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a PNG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '1A\\0A' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a PNG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '42\\4D' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a BMP may be hidden in $filename."
  echo
  exit 0
fi

# etc. etc....


# If nothing found...
echo "$filename: File seems OK."
exit 0

# To scan all regular files nested in /some/directory:
# find /some/directory -type f -exec /home/cosimo/Università/Sistemi\ Operativi/scripts/esame99.sh {} \;

Answer 2

我建议按照 Luis 的建议使用取证工具。 过去，我个人发现binwalk 适合检测和拆分所有从linux shell 依次合并为一个的文件。