Echoes of a Forgotten Canvas

The brief

A seemingly ordinary file has surfaced with traces of something unusual. It may look complete at first glance, but appearances can be deceiving. Explore the artifact carefully and uncover what was left behind.

• echoes-of-a-forgotten-canvas.zip, 8.8 MB

In short

A PNG declared 4000 rows but its image data held 4500, and the hidden rows carried half the flag in the alpha channel. An encrypted archive after the image led through a poem to a JPEG that hid the other half the same way.

A picture that lies about its size

The file is a PNG that says it is 4000 by 4000 pixels. Its header checksum is broken on purpose, so ordinary viewers refuse to open it. The lab walked its chunks by hand instead.

500 rows below the bottom

The pixel data inflates to 72,004,500 bytes. 4000 rows of 16,001 bytes would be 64,004,000, so 4500 rows are really there. In the 500 hidden rows only the alpha channel is set, and a 213 by 22 patch spells the first half of the flag.

An archive after the end

The PNG ends at byte 5,518,406, yet 3,359,095 more bytes follow. They are a ZIP with one encrypted file, carrier.jpg. A common password list opened it in 15 seconds with dreamcatcher.

The poem holds the passphrase

carrier.jpg shows a poem called Wilder Echoes. The lab turned its words into 646 candidate passphrases for a steghide payload. The word profound opened it and released a second JPEG of 113,614 bytes.

The same trick, one layer deeper

The new JPEG says 495 by 647 pixels, yet its scan decodes 1,456 blocks of 16 by 16, enough for 752 rows. The lab patched the height field from 647 to 752, and 105 hidden rows showed the second half.

Every lookalike glyph checked

The halves join in the order they were found. Lookalike glyphs were settled pixel by pixel. A narrow ring at cap height is a zero, a square ring at x height is the letter o, and a stem with no foot is an l.

The insight

Both images held more rows than they declared, a PNG of 4000 with 4500 inside and a JPEG of 647 with 752. Comparing size with data found both halves.

The flag

hiCTF{mu1t!14y3r3d_st3g0o_ju5t_l0v333}