Broken Signals

The brief

Our signals intelligence team intercepted a file during a routine sweep, but it appears corrupted. The file cannot be opened by any standard application. Something is wrong with the file itself. Can you repair it and recover the hidden message?

• broken-signals.zip, 14 KB

In short

A PNG image had the first four bytes of its signature erased, so nothing would open it. All nine chunk checksums were valid, and since checksums never cover the signature, that pointed straight at it. Writing the four bytes back opened the image and its flag.

A file nothing would open

The intercept, broken_signal.dat, is 15,916 bytes and every viewer refused it. Its first bytes read 00 00 00 00 0D 0A 1A 0A, the tail of a PNG signature with the front four bytes erased.

Nine chunks, nine valid checksums

Behind the signature sit nine chunks from IHDR to IEND, each with a valid CRC and nothing trailing. A PNG checksum covers its own chunk but never the signature, so the damage could only be there.

The size was honest too

Another common trick is a faked height. IHDR says 400 by 300 pixels at 16 bit RGBA, so 300 rows of 3,201 bytes, 960,300 in all. The image data inflates to exactly that.

Four bytes written back

The lab wrote 89 50 4E 47 into bytes 0 to 3 and changed nothing else. The image opened, a dark blue card reading SIGNAL INTERCEPTED with the flag beneath it in red.

Read to the pixel

To be sure of every character, the lab drew the card again with the same font and sizes. 0 of 120,000 pixels differed, while each of twelve lookalike readings missed by 36 pixels or more.

The insight

A PNG checksum covers its chunk, never the signature. When all nine checksums pass and the file still will not open, the damage is in the first eight bytes.

The flag

hiCTF{h34d3r_r3p41r_m4st3r}