[Code-Crunchers] identifying images in a binary (fwd)

[Jason Geffner]

Or better yet, hope for width * height = semiprime number :)

- Jason

From: Roee Shenberg [mailto:shenberg at gmail.com]
Sent: Monday, December 04, 2006 2:20 PM
To: Carlos Pizano
Cc: code-crunchers at whitestar.linuxbox.org
Subject: Re: [Code-Crunchers] identifying images in a binary (fwd)

Actually, there are relatively simple ways to automatically determine constant-sized data boundaries (in this case, the width of the image) - auto-correlation. Say that each 1 bit is 1.0 and each 0 bit is -1.0, and compute the convolution between the data and itself. The result is a new function that tells you essentially, at which distance in bits is the original data as close to itself as possible. The implementation is relatively simple - if you have matlab, xcorr does it for you, and if you don't, compute the FFT of your data, square it and then IFFT the result (since convolutions in time domain are multiplications in frequency, basically, you move to frequencies, multiply, and then return to time, and get the convolution of the data with itself).

Whew, auto-correlation is probably explained elsewhere on the 'net better, but I hope that points you in the right direction. The advantage is that as long as each row is of the same length, it'll work. Of course, even the simplest compression or even not constant-sized encoding will screw it.



On 11/29/06, Carlos Pizano <carlos.pizano at greenborder.com<mailto:carlos.pizano at greenborder.com>> wrote:
I don't expect the usb stream to contain the image in any standard
format such as bmp or gif or whatever, in fact for a fingerprint reader
the logical choice would be to send the raw values:

[number of rows]...[pixels per row]..[bytes per-pixel]...[row 0][row 1]

Where '...' would be any random-looking stuff. Of course maybe if the
device only supports one resolution then there would be no point to send
anything but the rows.

I think best would be to diff two fingerprint captures, with the same
parameters and hope that the format will become obvious.

CPU


-----Original Message-----
From: Gadi Evron [mailto: ge at linuxbox.org<mailto:ge at linuxbox.org>]
Sent: Friday, November 24, 2006 3:46 AM
To: code-crunchers at whitestar.linuxbox.org<mailto:code-crunchers at whitestar.linuxbox.org>
Subject: Re: [Code-Crunchers] identifying images in a binary (fwd)



---------- Forwarded message ----------
Date: Wed, 22 Nov 2006 08:51:23 +0100
From: Greg Leclercq <ggregl at gmail.com<mailto:ggregl at gmail.com>>
To: offset < offset at ubersecurity.org<mailto:offset at ubersecurity.org>>
Cc: pen-test at securityfocus.com<mailto:pen-test at securityfocus.com>
Subject: Re: identifying images in a binary
Resent-Date: Fri, 24 Nov 2006 00:45:11 -0700 (MST)
Resent-From: pen-test-return-1078483017 at securityfocus.com<mailto:pen-test-return-1078483017 at securityfocus.com>

On 11/21/06, offset <offset at ubersecurity.org<mailto:offset at ubersecurity.org>> wrote:

Hi offset,

> I'm currently looking at a usb fingerprint reader and I'm needing some
tools for identifying media (images) from a binary stream.
>
> I'd like to run a tool against a usb dump and identify any fingerprint
images (ie. pgm format, etc)

Hachoir [ http://hachoir.org/ ] may help you.

Cheers,
--
.::[ Greg ]::.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
00000008bOW
------------------------------------------------------------------------

_______________________________________________
Code-Crunchers mailing list
Code-Crunchers at whitestar.linuxbox.org<mailto:Code-Crunchers at whitestar.linuxbox.org>
http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers
_______________________________________________
Code-Crunchers mailing list
Code-Crunchers at whitestar.linuxbox.org<mailto:Code-Crunchers at whitestar.linuxbox.org>
http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://whitestar.linuxbox.org/pipermail/code-crunchers/attachments/20061204/30b7a30b/attachment.htm