1
#!/usr/bin/env python3
2
import sys
3
import zlib
4

5
PNG_SIG = b'\x89PNG\r\n\x1a\n'
6
MAX_N = 50
7

8
def parse_png_chunks(bs):
9
    pos = 8  # after signature
10
    while pos + 8 <= len(bs):
11
        length = int.from_bytes(bs[pos:pos+4], 'big')
12
        ctype = bs[pos+4:pos+8]
13
        total = 4 + 4 + length + 4
14
        if pos + total > len(bs):
15
            raise ValueError("truncated chunk")
16
        data = bs[pos+8:pos+8+length]
17
        crc_read = int.from_bytes(bs[pos+8+length:pos+8+length+4], 'big')
18
        crc_calc = zlib.crc32(ctype + data) & 0xffffffff
19
        if crc_calc != crc_read:
20
            raise ValueError("CRC mismatch")
21
        pos += total
22
        if ctype == b'IEND':
23
            return True
24
    raise ValueError("no IEND found")
25

26
def check_partial_png(bs):
27
    if not bs.startswith(PNG_SIG):
28
        return False
29
    pos = 8
30
    while True:
31
        if pos + 8 > len(bs):
32
            return True
33
        length = int.from_bytes(bs[pos:pos+4], 'big')
34
        ctype = bs[pos+4:pos+8]
35
        total = 4 + 4 + length + 4
36
        if pos + total > len(bs):
37
            return True
38
        data = bs[pos+8:pos+8+length]
39
        crc_read = int.from_bytes(bs[pos+8+length:pos+8+length+4], 'big')
40
        crc_calc = zlib.crc32(ctype + data) & 0xffffffff
41
        if crc_calc != crc_read:
42
            return False
43
        pos += total
44
        if ctype == b'IEND':
45
            return pos == len(bs)
46

47
def dfs(chunks, used, order, n):
48
    if len(order) == n:
49
        candidate = b''.join(chunks[i] for i in order)
50
        try:
51
            parse_png_chunks(candidate)
52
            return candidate
53
        except:
54
            return None
55

56
    prefix = b''.join(chunks[i] for i in order)
57
    if not check_partial_png(prefix):
58
        return None
59

60
    for i in range(n):
61
        if used[i]:
62
            continue
63
        used[i] = True
64
        order.append(i)
65
        result = dfs(chunks, used, order, n)
66
        if result:
67
            return result
68
        order.pop()
69
        used[i] = False
70
    return None
71

72
def main():
73
    fname = sys.argv[1]
74
    data = open(fname, 'rb').read()
75
    fsize = len(data)
76
    print(f"File size: {fsize} bytes")
77

78
    for n in range(2, MAX_N+1):
79
        if fsize % n != 0:
80
            continue
81
        chunk_size = fsize // n
82
        chunks = [data[i*chunk_size:(i+1)*chunk_size] for i in range(n)]
83
        start_candidates = [i for i, c in enumerate(chunks) if c.startswith(PNG_SIG)]
84
        for start in start_candidates:
85
            used = [False]*n
86
            used[start] = True
87
            order = [start]
88
            print(f"Trying n={n}, start={start}...")
89
            result = dfs(chunks, used, order, n)
90
            if result:
91
                with open("recovered.png", "wb") as f:
92
                    f.write(result)
93
                print("SUCCESS: Reconstructed image saved as recovered.png")
94
                return
95
    print("Failed to reconstruct")
96

97
if __name__ == '__main__':
98
    main()

1
$ python3 recover_png.py document.png.shredded
2
SUCCESS: recovered PNG written to recovered.png

1
bctf{TODO_shr3d_th1s_1MM3D1AT3LY}