0

I have a file, which is a image in a format JPEG. I want to find out whether it has hidden content (video files). Is there something I can attempt to find the hidden content (video files) in this specific situation? We can assume it is not a method that hides the data into the image itself, i.e., it doesn't change any bits of the image data itself.

Related question I asked yesterday which got closed: How to find hidden files inside image files (Jpg/Gif/Png)

The hidden file can be in front of the image or at the tail. I am open to examining the image bit-by-bit or any other methods which might provide great accuracy, even if not 100%

Community
  • 1
  • 1
Jayson
  • 167
  • 1
  • 3
  • 7
  • 3
    Did it come to your mind that if the question has been closed yesterday there may be a reason that will probably apply as well today? – Luigi R. Viggiano Jan 22 '13 at 22:19
  • yes, yes it did - http://stackoverflow.com/questions/14451109/how-to-find-hidden-files-inside-image-files-jpg-gif-png#comment20126374_14451336 – Jayson Jan 22 '13 at 22:22
  • 2
    Just scan for the headers as you have described. – sean Jan 22 '13 at 22:30
  • @LuigiR.Viggiano while both questions are not particularly fully-defined, this is one is more appropriate than the other one. – mmgp Jan 23 '13 at 00:03

1 Answers1

1

If you have a file that is identified as a JPEG, then the hidden file cannot be in front of it. Otherwise that other file would be identified in place of the JPEG. Thus, all you need to do is finding where your JPEG ends. If it ends at the end of your file, then you have no hidden file.

Here is a way to find where the JPEG ends (indicated by the EOI tag -- End of Image, 0xffd9). Note that it is possible to have JPEGs inside a JPEG, so to make this more robust, you have to handle the SOI tag -- Start of Image (0xffd8) too.

import sys

data = open(sys.argv[1]).read()

eoi_start = False
for i, c in enumerate(data):
    if ord(c) == 0xff:
        eoi_start = True
    elif ord(c) == 0xd9 and eoi_start:
        print 'JPEG ends at byte %d' % (i + 1)
        break
    else:
        eoi_start = False

print 'Total size: %d' % len(data)
mmgp
  • 18,901
  • 3
  • 53
  • 80
  • how do i find where the JPEG ends?? – Jayson Jan 23 '13 at 02:44
  • It is a matter of finding the bytes `0xff 0xd9` with some basic extra care for the possibility of more than one SOI tag (ignored in the edited answer). – mmgp Jan 23 '13 at 02:49
  • could other image formats like png/tiff/gif etc. have hidden files in front of the image? – Jayson Jan 23 '13 at 04:02
  • @Jayson do you mean after the image ? – mmgp Jan 23 '13 at 04:06
  • "If you have a file that is identified as a JPEG, then the hidden file cannot be in front of it" So thats why I was wondering whether other image formats allow hidden file to be in front – Jayson Jan 23 '13 at 13:15
  • @Jayson you are making this question pointless again. I can create a fake file with a JPEG header (or any other header), anyone can, so the typical programs will identify the file as JPEG while it is in fact not. – mmgp Jan 23 '13 at 16:43