5

This might be a bit of a narrow question but I think it is interesting. HP Photo Creations has made a thumbnail file that seems to contain an obfuscated JPEG inside it. I'm not sure why they would bother to obfuscate it but each byte seems to be modified based off its offset:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  FF D9 FD E3 04 15 4C 41 41 4F 0A 0A 0D 0D 0E 0E  ÿÙýã..LAAO......
00000010  10 10 12 13 EB F4 16 23 5D 61 73 7D 1C 1D 53 52  ....ëô.#]as}..SR
00000020  20 0B 22 23 24 2D 26 26 AF 40 2A 2F 2C 2D 2E 2E   ."#$-&&¯@*/,-..
00000030  30 31 32 29 34 35 36 37 38 38 9E 3A 3C 3E 3E 3F  012)456788ž:<>>?
00000040  40 40 42 42 44 45 46 47 48 49 B5 A8 4C 77 03 2A  @@BBDEFGHIµ¨Lw.*
00000050  24 30 52 53 19 18 56 7D 58 59 5A 53 5C 5E 9D 3A  $0RS..V}XYZS\^.:

Where I would expect the first line to be something closer to:

00000000  FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01  ÿØÿà..JFIF......

Any ideas on what is going on here?

Thanks in advance!

Luke Quinane
  • 291
  • 1
  • 8

1 Answers1

3

I thought about this after work and realised that it was just going to be the data XOR-ed with the low bits off the offset. Based off that I got out a valid JPEG:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01  ÿØÿà..JFIF......
00000010  00 01 00 00 FF E1 00 34 45 78 69 66 00 00 4D 4D  ....ÿá.4Exif..MM
00000020  00 2A 00 00 00 08 00 01 87 69 00 04 00 00 00 01  .*......‡i......
00000030  00 00 00 1A 00 00 00 00 00 01 A4 01 00 03 00 00  ..........¤.....
00000040  00 01 00 01 00 00 00 00 00 00 FF E3 00 3A 4D 65  ..........ÿã.:Me
00000050  74 61 00 00 4D 4D 00 2A 00 00 00 08 00 03 C3 65  ta..MM.*......Ãe
Luke Quinane
  • 291
  • 1
  • 8