unforum

grumpyboy · Unfettered Joined: 04 Feb 2003 Posts: 660

Agents month and place of travel

**Posted:** Fri Sep 12, 2003 6:52 am

JimmyImpossible · Veteran Joined: 27 Apr 2003 Posts: 104 Location: Ottawa

Well, that answers why I was unable to open the txt file in paint or photoshop. Glad to know it's a file problem and not just me. Laughing

**Posted:** Fri Sep 12, 2003 7:28 am

_________________
I'm not crazy, I'm fun!

AnthraX101 · Entrenched Joined: 18 Mar 2003 Posts: 797

Ok, I had a hack at it. It's not the same technique as before. The character distribution is all out of whack. They have removed almost all characters above 0xAF. It has the headers and footers of a GIF file, however. There appears to be a large block of characters towards the top, mostly printable, before what appears to be the color table. More analysis to follow. Smile

AnthraX101

**Posted:** Mon Sep 15, 2003 1:49 pm

Caterpillar

I worked a good part of today on trying to figure out if I could do anything with this...all that I found out was I can't. Crying or Very sad

I tried, I really did.

From what I can understand there's a lot of data that gets lost in the conversion. Which begs the question, would they really give this as a puzzle? Isn't it next to impossible to find the image in this file? I know Anthrax did it once before but ....I think it's tougher this time, and everyone I've spoken to agrees that it would be extremely difficult to get this to "make something".

(But I'm still trying:)

**Posted:** Mon Sep 15, 2003 9:51 pm

Guest · Guest

The last one would have been almost imposible for me to reconstruct if I didn't have the first image there.

It only had one value changed. This one appears to have 100+.

I think that we are missing something though. The character disrobution is nowhere near as smooth as it should be. '?''s form almost 4% of the file. 0x00's are the thirteenth most common character, whereas the 5 or so randomly selected gif's I have on my computer all have that as the most common. I don't know, the thing is still biased towards the printable section of ASCII. I can't help but think we are missing something...

AnthraX101

**Posted:** Mon Sep 15, 2003 10:06 pm

grumpyboy · Unfettered Joined: 04 Feb 2003 Posts: 660

New post on the yahoo message board:

**Posted:** Tue Sep 16, 2003 1:38 am

grumpyboy · Unfettered Joined: 04 Feb 2003 Posts: 660

from what I've been able to piece together, I can make out that the passport IS kanewoods' as mentioned in the messaging log:

**Posted:** Tue Sep 16, 2003 3:13 am

JimmyImpossible · Veteran Joined: 27 Apr 2003 Posts: 104 Location: Ottawa

We probably need to use the portion of the gif they've given us to fix the whole thing...how's that coming, AnthraX? Laughing

Wishing I could help more on this particular one...but not tech-y... Embarassed

**Posted:** Tue Sep 16, 2003 7:46 am

_________________
I'm not crazy, I'm fun!

AnthraX101 · Entrenched Joined: 18 Mar 2003 Posts: 797

By comparing the two files, it looks like the old one went through some sort of complex filter. This new one probably is missing the 0x0B and 0x0D characters. 0x0A has a distrobution of exactly 2%, about twice as common as the other "most common" characters. Chances are those two indexes got changed to 0x0A's. I have to work now, but I hope to look at it some more later.

AnthraX101

**Posted:** Tue Sep 16, 2003 9:23 am

JimmyImpossible · Veteran Joined: 27 Apr 2003 Posts: 104 Location: Ottawa

Thanks AnthraX! You're my hero! Cool

**Posted:** Tue Sep 16, 2003 10:13 am

_________________
I'm not crazy, I'm fun!

AnthraX101 · Entrenched Joined: 18 Mar 2003 Posts: 797

Woo. Crazy. One block done. Several hundred to go. I hope to at least get the upper bar of the photo done by hand, that is only 11 suspect characters. This single block contained 2 of them affecting the picture. One was unchanged (0x0A) one was 0x0D.

AnthraX101

EDIT: Ok, changed the upload to be the completed title bar. That's three 254 byte blocks done. The last one probably isn't fully completed yet, because it has most of the replacements at the end, leaving little visable change.

**Posted:** Tue Sep 16, 2003 1:53 pm

Caterpillar

Wow...you're good. Any chance you can point me to a tutorial? (I worked a long time on trying to understand this....didn't get far.)

**Posted:** Tue Sep 16, 2003 2:22 pm

Varin

**Posted:** Tue Sep 16, 2003 3:17 pm

_________________
"I still miss him to this day and probably always will." - Todd Keeler, Chasing the Wish

"meta meta meta, I made you out of play..." ~ j5

AnthraX101 · Entrenched Joined: 18 Mar 2003 Posts: 797

Well, I kind of just taught myself. Smile

All I am using is a couple of gifs I have on my computer, Hex Workshop, and a copy of the <a href="http://astronomy.swin.edu.au/~pbourke/dataformats/gif/">GIF Specifications</a>.

Every 255 bytes, starting with the first instance of 0xFE is a "block". I was editing those one at a time by hand. I have given up on that now. it wasn't too hard for the first two blocks, because those contained text that was easily visible from the rest of the background. The next few blocks are solid color, or with a little bit of speckling. There are 11 suspect characters. That simply means a character with the value 0x0A in hex. That should either be 0x0A, 0x0B, or 0x0D in hexadecimal. I don't yet know of the "real" way it should be changed, I have noticed that if the value is lower then it should be it shifts to the left, and if it is higher the image shifts to the right. This is just pure speculation though, I haven't completed reading the specs.

Before I was changing a character and doing the old 'better or worse?' eye doctor test. Smile

That won't work any more. I did find what appears to be a text block in the gif though. It contains the proper text headers, and a length that points to a null at the end (proper format). I'm not sure if it is meaningful yet, I have to convert it to 7-bit ASCII.

AnthraX101

EDIT: Note to self, begin edits at 0x3801. Still hitting the transparent layer.

grumpyboy · Unfettered Joined: 04 Feb 2003 Posts: 660

thanks for all the hard work on this Anthrax. I hope you can get the rest of it because I was only able to recover what you have so far, except I did it by saving the gif file as a bmp (for some reason you get more viewable, less garbled stuff that way) then physically manipulating pixels in a pic editor...

[weird this board doesnt allow me to attach bmp files]

EDIT: file converted BACK to gif so I can attach...

**Posted:** Tue Sep 16, 2003 9:10 pm