[Code-Crunchers] identifying images in a binary (fwd)

[Roee Shenberg]

Actually, there are relatively simple ways to automatically determine
constant-sized data boundaries (in this case, the width of the image) -
auto-correlation. Say that each 1 bit is 1.0 and each 0 bit is -1.0, and
compute the convolution between the data and itself. The result is a new
function that tells you essentially, at which distance in bits is the
original data as close to itself as possible. The implementation is
relatively simple - if you have matlab, xcorr does it for you, and if you
don't, compute the FFT of your data, square it and then IFFT the result
(since convolutions in time domain are multiplications in frequency,
basically, you move to frequencies, multiply, and then return to time, and
get the convolution of the data with itself).

Whew, auto-correlation is probably explained elsewhere on the 'net better,
but I hope that points you in the right direction. The advantage is that as
long as each row is of the same length, it'll work. Of course, even the
simplest compression or even not constant-sized encoding will screw it.



On 11/29/06, Carlos Pizano <carlos.pizano at greenborder.com> wrote:
>
> I don't expect the usb stream to contain the image in any standard
> format such as bmp or gif or whatever, in fact for a fingerprint reader
> the logical choice would be to send the raw values:
>
> [number of rows]...[pixels per row]..[bytes per-pixel]...[row 0][row 1]
>
> Where '...' would be any random-looking stuff. Of course maybe if the
> device only supports one resolution then there would be no point to send
> anything but the rows.
>
> I think best would be to diff two fingerprint captures, with the same
> parameters and hope that the format will become obvious.
>
> CPU
>
>
> -----Original Message-----
> From: Gadi Evron [mailto:ge at linuxbox.org]
> Sent: Friday, November 24, 2006 3:46 AM
> To: code-crunchers at whitestar.linuxbox.org
> Subject: Re: [Code-Crunchers] identifying images in a binary (fwd)
>
>
>
> ---------- Forwarded message ----------
> Date: Wed, 22 Nov 2006 08:51:23 +0100
> From: Greg Leclercq <ggregl at gmail.com>
> To: offset <offset at ubersecurity.org>
> Cc: pen-test at securityfocus.com
> Subject: Re: identifying images in a binary
> Resent-Date: Fri, 24 Nov 2006 00:45:11 -0700 (MST)
> Resent-From: pen-test-return-1078483017 at securityfocus.com
>
> On 11/21/06, offset <offset at ubersecurity.org> wrote:
>
> Hi offset,
>
> > I'm currently looking at a usb fingerprint reader and I'm needing some
> tools for identifying media (images) from a binary stream.
> >
> > I'd like to run a tool against a usb dump and identify any fingerprint
> images (ie. pgm format, etc)
>
> Hachoir [ http://hachoir.org/ ] may help you.
>
> Cheers,
> --
> .::[ Greg ]::.
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
> 00000008bOW
> ------------------------------------------------------------------------
>
> _______________________________________________
> Code-Crunchers mailing list
> Code-Crunchers at whitestar.linuxbox.org
> http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers
> _______________________________________________
> Code-Crunchers mailing list
> Code-Crunchers at whitestar.linuxbox.org
> http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://whitestar.linuxbox.org/pipermail/code-crunchers/attachments/20061205/a3edb0f3/attachment.htm