Unremarable

The brief

The file was recovered without any accompanying notes. Nothing about it was considered significant at the time.

• chall.png, 18.7 MB

In short

A large PNG hid its settings in the row filter types. They described an edge map and two walks across it, and along each walk Hamming matrix embedding on channel parity carried the next layer, ending in a zip with the flag.

A photo with a fake flag on top

The file is a 4725 by 3150 PNG, 14.9 million pixels and no notes. Its chunks are clean and nothing hides after the image. The red low bits of the first row spell a fake flag that says it is not that easy.

Settings hidden in the row filters

Each PNG row starts with a filter type from 0 to 4. Rows 0 to 344 were set by hand, unlike every row after them. Their steps, read as base 5 digits, four to a byte, give 86 bytes that inflate to an 85 byte block of settings.

An edge map and a walk across it

The settings define an edge map, a Sobel gradient on brightness with a threshold of 114. A breadth first walk from pixel 3319, 2198 covers exactly 629,487 edge pixels, the size the block promises.

Colours a JPEG cannot make

The PNG is a decoded JPEG at quality 95. Only 4.26 million colours can come out of that decoder, and just 854 pixels fall outside them. They sit in the fake flag row and two small patches, where the data was written.

Seven pixels carry three bits

Along the walk, each group of 7 pixels carries 3 bits by Hamming matrix embedding on the parity of green and blue. At most one pixel per group changes. The first 1,029 pixels give 55 bytes that describe a second walk.

A weighted walk to a zip file

The second walk is a Dijkstra path where a step costs more across a change in edge strength. Its 5,530 pixels carry 296 bytes on the parity of red and blue, CRC matching. They form a zip, and flag.txt holds the flag.

The insight

Every changed pixel was a colour a quality 95 JPEG decoder cannot make, so 854 odd pixels out of 14.9 million showed exactly where the data was.

The flag

hiCTF{fr0nt13rs_f4d3_but_w31ght3d_p4ths_r3m41n}