Skip to content

Instantly share code, notes, and snippets.

@Snack-X
Created June 10, 2014 09:14
Show Gist options
  • Save Snack-X/4e0052168ae3cb034ad0 to your computer and use it in GitHub Desktop.
Save Snack-X/4e0052168ae3cb034ad0 to your computer and use it in GitHub Desktop.
Simple polygot POC for PNG and BF
<?php
// 32 ~ 126, 5x7 = 35 pixels
$pixel = gzinflate(base64_decode("lVUJkiMxCPsS/P9zWzMxIAnZk3VVk3abS4CciC9WGsGn+SNHeCfnNH+WvB2z3+d8/H372GW9xec3Y7TnqbNznOgz5nO9j+0DdasA8JayBSGeO5sGbov4SS8L3iu3eEOoin23uqiUjT7jOroJWaBiWlUmbmi6q+3FRutF4ROSPYEmk54iMKttVknGDacL8xSJAKtlmWkzRWHMJND+hk6nAdKP3R6vgp3azduyTLswMjTejuHf2ghZsMqHnyVcXWACaBvvLXtZfDxtbC5yNGxRooNyOtv8Q6VKSbkQmJnRO97O2VJoeHTTyR4pZUji+ZupCLpAQfN2EWNSahVFbmqvVHOdvla3b3284L0XAs2krjwR876Lt7jX4Bu8TX2rMiShiR0zObi6h3RvFxmjfk9DTJ2uMrC2pmw5gSHN/1swHBz7aXIU539C6FyedXxWYLII40R4HuJmYkyATip6XD3DVy7wd+I4o4jAz/hzzbocN9UWH+wt85qF0LLIJZOc7sF67haLiKtLDZDKTQNcbW11RY1zeXuB+UvuqrlpFqAweAWRnm5moQrdL6ICtsbP+rwZjAj7AT6IGTHJTzvP2Tbbp1Uh7Uevfw=="));
$data_text = "Answer to the Ultimate Question of Life, the Universe, and Everything";
$data_hide = "++++++++[>++++[>++>+++>+++>+<<<<-]>+>+>->>+[<]<-]>>.>---.+++++++..+++.>>.<-.<.+++.------.--------.>>+.>++.";
$img_height = 9; // 7 pixel per character + 2 pixel padding
$img_width = strlen($data_text) * 6 + 1; // 5 pixel per character + 1 pixel spacing + 2 pixel padding
// PNG chunk
function chunk($data) {
return pack("Na*N", strlen($data) - 4, $data, crc32($data));
}
// PNG header
$output = "\x89PNG\r\n\x1a\n";
$output .= chunk("IHDR".pack("NNCV", $img_width, $img_height, 8, 6));
// text to pixels
$pixel_data = "";
$dh_pos = 0;
// line 1 = empty white
$pixel_data .= "\0".str_repeat(hex2bin("FFFFFFFF"), $img_width);
// line 2~8 = real data
for($y = 0 ; $y < 7 ; $y++) {
$pixel_data .= "\0";
$pixel_data .= hex2bin("FFFFFFFF");
for($dt_pos = 0 ; $dt_pos < strlen($data_text) ; $dt_pos++) {
$ord = ord($data_text[$dt_pos]);
$pixel_binary = substr($pixel, ($ord-32) * 35 + ($y*5), 5);
for($pb_pos = 0 ; $pb_pos < 5 ; $pb_pos++) {
if($pixel_binary[$pb_pos] === "1") {
$temp = "0000";
if(strlen($data_hide) > $dh_pos) {
$temp .= strtoupper(dechex(ord($data_hide[$dh_pos])));
$dh_pos++;
}
else {
$temp .= "00";
}
$temp .= "FF";
}
else {
$temp = "FFFFFFFF";
}
$pixel_data .= hex2bin($temp);
}
$pixel_data .= hex2bin("FFFFFFFF");
}
}
// line 9 = empty white
$pixel_data .= "\0".str_repeat(hex2bin("FFFFFFFF"), $img_width);
// PNG data
$output .= chunk("IDATx^".gzdeflate($pixel_data, 0));
// PNG footer
$output .= chunk("IEND");
// for($i = 0 ; $i < strlen($output) ; $i++) {
// $ord = ord($output[$i]);
// if($ord >= 32 && $ord <= 126) echo $output[$i];
// }
echo $output;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment