Editing Images Using HEX Editors

[Guest]

I made a quick video about editing images using HEX. It' simple, but it could be used to hide things in images. I am currently teaching myself low level parts of computers, and working with the raw code of images, so this is part of my 'learning process.'

The video:

I'm also trying to learn assembly, so I might do something with that.

[Nuke]

i am quite fond of tga myself. its like an 18 byte header followed by raw data, which you can do whatever you want with. ive also been able to hack bmp and uncompressed dds formats (i needed to dump a z buffer from a software renderer i was working on, and needed a 16 bit grayscale format).

[justidutch]

What exactly do you intend to do with this knowledge: being able to "hide things in images"? My mind immediately jumps to inserting malicious code; but I assume that is not your intention. What sort of interesting things can be done with this knowhow?

[Stargate525]

[quote name='justidutch']What exactly do you intend to do with this knowledge: being able to "hide things in images"? My mind immediately jumps to inserting malicious code; but I assume that is not your intention. What sort of interesting things can be done with this knowhow?[/QUOTE]
Most people don't look for messages in image raw data, in my experience.

[K^2]

Pro tip: .com executables are just raw image files loaded at cs:0x100, with es=ds=cs. So you can write your own .com in machine language using a hex editor, then run it with something like DOSBox. It's a good way to learn more about computer architecture as you're learning Assembly.

[vitorboschi]

[quote name='justidutch']What exactly do you intend to do with this knowledge: being able to "hide things in images"? My mind immediately jumps to inserting malicious code; but I assume that is not your intention. What sort of interesting things can be done with this knowhow?[/QUOTE]

This is called [URL="https://en.wikipedia.org/wiki/Steganography"]Steganography[/URL], and can be used to conceal any kind of information in many kinds of file (images and audio files are the usual examples). It is used when you don't want people questioning you (which may happen if you simply use criptography) about your data.

Image file decoders usually are simple enough so that it'd be really hard to find some flaw that would enable code execution (but sometimes [URL="https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability"]such flaws are found anyway[/URL]) Edited November 16, 2015 by vitorboschi

[K^2]

Done this way? Yeah. But there are techniques and tools for encoding data into images that are very secure. As in, if you don't know the key, it will look like compression noise, and you won't even know there is hidden data there.

[vitorboschi]

[quote name='llanthas']It's visible to anyone that knows how to look for it though, right? Doesn't sound secure, in any way... just sneaky?[/QUOTE]

And nothing prevents one from using cryptography AND steganography at the same time

[WinkAllKerb'']

[quote name='justidutch']What sort of interesting things can be done with this knowhow?[/QUOTE]

like most of thoose kind of stuff:

short term / wow now i m the boss
medium term / in fact not
long term / much more trouble than expected at first and long story short ... so iinteresting is a little questionnable word in that case ...

[micr0wave]

Some graphicsuites have a plugin for putting invisible watermarks into bitmaps.

[magnemoe]

[quote name='micr0wave']Some graphicsuites have a plugin for putting invisible watermarks into bitmaps.[/QUOTE]
A watermark is something else, its an overlay to the actual image who will survive taking an screen-shot of image and save as new image.
Closed betas/ preview versions sometimes add this to the rendered image to make it possible to track leaks.
Images can often have extra metadata, typically time taken and camera information location.

[Kerbart]

[quote name='magnemoe']A watermark is something else, its an overlay to the actual image who will survive taking an screen-shot of image and save as new image.[/QUOTE]

While technically true, it's generally accepted in photography that a "hidden watermark" means metadata hidden (e.g. not the regular exif data) that can be retrieved using special software. It's useful in cases against magazines and publishers who lifted an image and removed a visible watermark. But as damages are limited in a US court when the image isn't registered, the simpler and more s cure approach is to register images with the copyright office in the first place.

Some photographers do indeed hide their watermarks by cleverly incorparating the copyright notice into their pictures. Those are truly hidden watermarks and while technically true that's not what generally is understood as a "hidden watermark"

[jwenting]

[quote name='llanthas']I'm curious, too. I can't imagine a legitimate use for this...[/QUOTE]

people have used it to store copyright information inside an image file. Which is a seemingly smart way to do things but in reality is easily circumvented by any IP thief because it gets removed the moment the image is then opened and saved again in an image editor.