# Problem Statement:Whoops. It seems Luffy played with my picture and I'm not able to open it anymore. Please help me.
Creator: 2phi
[7uffy_original](https://raw.githubusercontent.com/asd007/CTF_WRITEUPS/master/SharkyCTF-2020/Images/7uffy.png)
# Analysis
First, the obvious. Image does not load.
Is this a png file?
    asd007@host:/mnt/e/ctf$ file 7uffy.png    7uffy_1.png: PNG image data, 1113 x 885, 8-bit/color RGBA, non-interlaced
So the header must be right, stating it's a PNG
Let's check for "hidden" stuff
    asd007@host:/mnt/e/ctf$ binwalk 7uffy.png    DECIMAL       HEXADECIMAL     DESCRIPTION    --------------------------------------------------------------------------------    0             0x0             PNG image, 1113 x 885, 8-bit/color RGBA, non-interlaced
No luck here.
Metadata? Strings? 
    asd007@host:/mnt/e/ctf$ identify -verbose 7uffy.png    asd007@host:/mnt/e/ctf$ strings 7uffy.png No dice. ImageMagick listed nothing. Strings listed some mangled random printable chars, nothing useful.
Ok, time to bring the big guns:
    asd007@host:/mnt/e/ctf$ sudo apt-get install pngtools    [moments later]    asd007@host:/mnt/e/ctf$ pngchunks 7uffy.png    Chunk: Data Length 13 (max 2147483647), Type 1380206665 [IHDR]      Critical, public, PNG 1.2 compliant, unsafe to copy      IHDR Width: 1113      IHDR Height: 885      IHDR Bitdepth: 8      IHDR Colortype: 6      IHDR Compression: 0      IHDR Filter: 0      IHDR Interlace: 0      IHDR Compression algorithm is Deflate      IHDR Filter method is type zero (None, Sub, Up, Average, Paeth)      IHDR Interlacing is disabled      Chunk CRC: -1537989379    Chunk: Data Length 6 (max 2147483647), Type 1145523042 [bKGD]      Ancillary, public, PNG 1.2 compliant, unsafe to copy      ... Unknown chunk type      Chunk CRC: -113001601    Chunk: Data Length 9 (max 2147483647), Type 1935231088 [pHYs]      Ancillary, public, PNG 1.2 compliant, safe to copy      ... Unknown chunk type      Chunk CRC: 10132504    Chunk: Data Length 7 (max 2147483647), Type 1162692980 [tIME]      Ancillary, public, PNG 1.2 compliant, unsafe to copy      ... Unknown chunk type      Chunk CRC: 1626594388    Chunk: Data Length 29 (max 2147483647), Type 1951945833 [iTXt]      Ancillary, public, PNG 1.2 compliant, safe to copy      ... Unknown chunk type      Chunk CRC: 1680762119    Chunk: Data Length 8192 (max 2147483647), Type 1498628421 [EASY]      Critical, public, PNG 1.2 compliant, unsafe to copy      ... Unknown chunk type      Chunk CRC: -2090358537    Chunk: Data Length 8192 (max 2147483647), Type 1498628421 [EASY]      Critical, public, PNG 1.2 compliant, unsafe to copy      ... Unknown chunk type      Chunk CRC: 558130939    Chunk: Data Length 8192 (max 2147483647), Type 1498628421 [EASY]      Critical, public, PNG 1.2 compliant, unsafe to copy      ... Unknown chunk type      Chunk CRC: 1857725745    Chunk: Data Length 2584 (max 2147483647), Type 1498628421 [EASY]      Critical, public, PNG 1.2 compliant, unsafe to copy      ... Unknown chunk type      Chunk CRC: 43823534    Chunk: Data Length 0 (max 2147483647), Type 1145980233 [IEND]      Critical, public, PNG 1.2 compliant, unsafe to copy      IEND contains no data      Chunk CRC: -1371381630
Bingo! 8 "unknown" chunks We need a closer look
# Solution
    asd007@host:/mnt/e/ctf$ pngcheck -v 7uffy.png    File: 7uffy.png (27352 bytes)      chunk IHDR at offset 0x0000c, length 13        1113 x 885 image, 32-bit RGB+alpha, non-interlaced      chunk bKGD at offset 0x00025, length 6        red = 0x0000, green = 0x0000, blue = 0x0000      chunk pHYs at offset 0x00037, length 9: 2835x2835 pixels/meter (72 dpi)      chunk tIME at offset 0x0004c, length 7:bbe Mar 2020 00:45:09 UTC      chunk iTXt at offset 0x0005f, length 29, keyword: Comment        uncompressed, no language tag        no translated keyword, 18 bytes of UTF-8 text      chunk EASY at offset 0x00088, length 8192:  illegal (unless recently approved) unknown, public chunk    ERRORS DETECTED in 7uffy_1.png
EASY. That's not in the specification. Looking at the output of the previous command, there are no IDAT chunks in there. Perhaps this chunk is supposed to be IDAT. Not mentally ready for a hex editor yet :). Let's see if we can get around it. I wish sed worked on binary files. Short google search reveals there's a tool called bbe doing just that. Dead end, could not get it to work. But I'm on a quest, so I'm not giving up:
    asd007@host:/mnt/e/ctf$ echo -n "EASY" | xxd -ps    45415359    asd007@host:/mnt/e/ctf$ echo -n "IDAT" | xxd -ps    49444154    //let's get creative and take a risk    asd007@host:/mnt/e/ctf$ hexdump -ve '1/1 "%.2X"' 7uffy.png | sed 's/45415359/49444154/g' | xxd -r -p > 7uffy_1.png    asd007@host:/mnt/e/ctf$ diff 7uffy.png 7uffy_1.png    Binary files 7uffy_1.png and 7uffy_2.png differ
Ah! The things I do to get out of using hex editors. Aaaaanyway - Wohoo! Let's take a breather. (chug beer)     asd007@host:/mnt/e/ctf$ pngcheck -v 7uffy_1.png    File: 7uffy_1.png (27352 bytes)      chunk IHDR at offset 0x0000c, length 13        1113 x 885 image, 32-bit RGB+alpha, non-interlaced      chunk bKGD at offset 0x00025, length 6        red = 0x0000, green = 0x0000, blue = 0x0000      chunk pHYs at offset 0x00037, length 9: 2835x2835 pixels/meter (72 dpi)      chunk tIME at offset 0x0004c, length 7: 26 Mar 2020 00:45:09 UTC      chunk iTXt at offset 0x0005f, length 29, keyword: Comment        uncompressed, no language tag        no translated keyword, 18 bytes of UTF-8 text      chunk IDAT at offset 0x00088, length 8192        zlib: deflated, 32K window, maximum compression      chunk IDAT at offset 0x02094, length 8192      chunk IDAT at offset 0x040a0, length 8192      chunk IDAT at offset 0x060ac, length 2584      chunk IEND at offset 0x06ad0, length 0    No errors detected in 7uffy_2.png (10 chunks, 99.3% compression). Fingers crossed! It Worked!
# Flag
![](https://raw.githubusercontent.com/asd007/CTF_WRITEUPS/master/SharkyCTF-2020/Images/7uffy_1.png)
