How can I detect hidden images in file?

Question

I'm trying to write a bash script that, given a file in this form, detects that in this file there is an hidden image:

[random data][image file][random data]

My first approach is to search with grep for

[random data][image header][random data][image footer][random data]

in the file, but I can't found a table with all headers and footers of all image file formats. Does someone have this table, or can you suggest another way to proceed?

What you are talking about is "magic numbers". These are the file specific hex codes. The good start point for you may be https://en.wikipedia.org/wiki/List_of_file_signatures. All the best. — t6nand, Apr 26 '18 at 13:34
You are looking for a forensic tool. [This answer](https://stackoverflow.com/a/19483559/2834978) and the accepted one could help. — LMC, Apr 26 '18 at 14:31

score 0 · Answer 1 · answered Apr 26 '18 at 16:51

0

I would suggest using forensic tools as Luis suggested. In the past, I personally found binwalk appropriate to detect and split files all joined into one in sequence from linux shell.

answered Apr 26 '18 at 16:51

NeverGoodEnough

352
1
5

Alex_DeLarge · Accepted Answer · 2018-04-30T08:15:16.347

If you are interested, I found this:

#!/bin/bash
# Given a file as argument, scan for hidden images in file.
# written by Cosimo Colaci


#   Hex signature       File format
#
#   47 49 46 38 37 61   gif
#   47 49 46 38 39 61   gif
#   FF D8 FF DB         jpeg
#   FF D8 FF E0         jpg
#   4A 46 49 46 00 01   jpeg
#   89 50 4E 47 0D 0A   png
#   1A 0A               png
#   42 4D               bmp
# etc...

# Declarations
E_NOFILE=66
E_NOREAD=67


# Check filename
filename="$1"

if [ ! -f "$filename" ]
then
  echo "Error! No such file!"
  exit $E_NOFILE
fi

if [ ! -r "$filename" ]
then
  echo "Unable to read \"$filename\"."
  exit $E_NOREAD
fi


# Scan file for hidden image
cat "$filename" | grep '47\\49\\46\\38\\37\\61' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a GIF may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '47\\49\\46\\38\\39\\61' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a GIF may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep 'FF\\D8\\FF\\DB' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a JPEG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep 'FF\\D8\\FF\\E0' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a JPG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '4A\\46\\49\\46\\00\\01' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a JPEG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '89\\50\\4E\\47\\0D\\0A' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a PNG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '1A\\0A' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a PNG may be hidden in $filename."
  echo
  exit 0
fi

cat "$filename" | grep '42\\4D' 1>/dev/null
if [ $? -eq 0 ]
then
  echo
  echo "Warning: a BMP may be hidden in $filename."
  echo
  exit 0
fi

# etc. etc....


# If nothing found...
echo "$filename: File seems OK."
exit 0

# To scan all regular files nested in /some/directory:
# find /some/directory -type f -exec /home/cosimo/Università/Sistemi\ Operativi/scripts/esame99.sh {} \;

How can I detect hidden images in file?

2 Answers2