Author: Marin Radu
Identified and removed non-standard bytes preceding the PNG file signature.
- Understanding of file headers
- Basic file carving
Inspect and modify the file's header bytes. The beginning of the file contains a message that disrupts the file signature. Remove these bytes to restore the header:
- Analyze the file with a hex editor like hexedit.
- Carve out the incorrect bytes preceding the PNG header. For this file, remove the first 38 bytes.
- Save the corrected file and open it to view the message.
Opening the corrected file will display the flag:
Alternative: use the carving tool dd.
Flag:
CSCTF{my_file_has_been_s1gned}