plaidctf2015 uncorrupt png

　　代码的执行时间挺长的，好囧！

　　参考了https://13c5.wordpress.com/2015/04/20/plaidctf-2015-png-uncorrupt/的代码

　　通过这个题目，也对Png文件格式更深入地理解了！

　　使用这个代码的前提是将png signature里面的0x0a修改为0x0d0a

 from itertools import combinations
 import binascii
 import os

 def find_all(source,aim):
      start=
      while True:
           start=source.find(aim,start)
           if start==-:
                return
           yield start
           start +=len(aim)

 def repair(source,aim,filedes,num,crc):
      matchlist=list(find_all(source,'\x0a'))

      for subnet in combinations(matchlist,num):
           subnet=sorted(subnet)
           temp=''
           if(num==):
                temp=source[:subnet[]]+'\x0d\x0a'+source[subnet[]+:subnet[]]+'\x0d\x0a'+source[subnet[]+:subnet[]]+'\x0d\x0a'+source[subnet[]+:]
           if(num==):
                temp=source[:subnet[]]+'\x0d\x0a'+source[subnet[]+:subnet[]]+'\x0d\x0a'+source[subnet[]+:]
           if(num==):
                temp=source[:subnet[]]+'\x0d\x0a'+source[subnet[]+:]
           if "%08x" % (binascii.crc32(temp)&0xFFFFFFFF)==crc:
                filedes.write(temp)
                filedes.write(binascii.a2b_hex(crc))
                filedes.flush()
                print "success"
                break;
      print "fail"

 uncfile=open("corrupt_735acee15fa4f3be8ecd0c6bcf294fd4.png","rb")
 cocfile=open("correct.png","wb")
 #first write
 correct=uncfile.read(0x6d)
 cocfile.write(correct)
 cocfile.flush()

 correct=uncfile.read(0x4)#length
 cocfile.write(correct)
 cocfile.flush()

 uncorrect=uncfile.read(0x20000-0x1+0x4)
 crc=uncfile.read(0x4)
 crc=binascii.hexlify(crc)
 print crc
 repair(uncorrect,'\x0a',cocfile,,crc)#
 #second write
 correct=uncfile.read(0x4)#length
 cocfile.write(correct)
 cocfile.flush()
 uncorrect=uncfile.read(0x20000-0x3+0x4)
 crc=uncfile.read(0x4)
 crc=binascii.hexlify(crc)
 print crc
 repair(uncorrect,'\x0a',cocfile,,crc)#
 #third write
 correct=uncfile.read(0x4)#length
 cocfile.write(correct)
 cocfile.flush()
 uncorrect=uncfile.read(0x20000-0x1+0x4)
 crc=uncfile.read(0x4)
 crc=binascii.hexlify(crc)
 print crc
 repair(uncorrect,'\x0a',cocfile,,crc)#
 #fourth write
 correct=uncfile.read(0x4+0x4+0x20000+0x4)
 cocfile.write(correct)
 cocfile.flush()
 #fifth write
 correct=uncfile.read(0x4)#length
 cocfile.write(correct)
 cocfile.flush()
 uncorrect=uncfile.read(0x20000-0x3+0x4)
 crc=uncfile.read(0x4)
 crc=binascii.hexlify(crc)
 print crc
 repair(uncorrect,'\x0a',cocfile,,crc)#
 #6th
 correct=uncfile.read(0x4)#length
 cocfile.write(correct)
 cocfile.flush()
 uncorrect=uncfile.read(0x20000-0x1+0x4)
 crc=uncfile.read(0x4)
 crc=binascii.hexlify(crc)
 print crc
 repair(uncorrect,'\x0a',cocfile,,crc)#
 #7th
 correct=uncfile.read(0x4)
 cocfile.write(correct)
 cocfile.flush()
 uncorrect=uncfile.read(0x20000-0x2+0x4)
 crc=uncfile.read(0x4)
 crc=binascii.hexlify(crc)
 print crc
 repair(uncorrect,'\x0a',cocfile,,crc)#
 #8th
 correct=uncfile.read(0x4+0x4+0x20000+0x4)
 cocfile.write(correct)
 cocfile.flush()
 #9th
 correct=uncfile.read(0x4)
 cocfile.write(correct)
 cocfile.flush()
 uncorrect=uncfile.read(0x20000-0x1+0x4)
 crc=uncfile.read(0x4)
 crc=binascii.hexlify(crc)
 print crc
 repair(uncorrect,'\x0a',cocfile,,crc)#
 #10th
 correct=uncfile.read(0x4+0x4+0x216f)
 cocfile.write(correct)
 cocfile.flush()

 uncfile.close()
 cocfile.close()

　　

　　结果：

参考文献：

　　http://blog.csdn.net/gogor/article/details/5265710

　　http://www.libpng.org/pub/png/apps/pngcheck.html

　　http://www.libpng.org/pub/png/book/chapter08.html

　　http://stackoverflow.com/questions/27238021/png-images-not-loaded

　　https://13c5.wordpress.com/2015/04/20/plaidctf-2015-png-uncorrupt/