Stego 1

by **JC5** on Thu May 29, 2008 2:08 pm ([msg=3520]see Re: Stego One[/msg])

Im in the same position as JC5, I am new to this whole stego thing. Can someone just help me and show me how these work. Thanks

dont expect to get spoonfed. thats one of their big ticks. im willing to google but i have no idea what topic to google. ne ideas? i was looking above where someone said hex to text conversions but when i googled that it didnt help me much

by **int3grate** on Thu May 29, 2008 3:33 pm ([msg=3528]see Re: Stego One[/msg])

I've been working on it for a few weeks. I'm not exactly sure what to do with it. I see two groups of two NULL bytes in the data section of the BMP file, but I'm not sure what I need to do with them. I've already tried messing with the color table to see If I could get something to show up, but no luck so far. Am I even heading in the right direction? Thanks,

Int3grate

by **G__** on Fri May 30, 2008 11:39 am ([msg=3738]see Re: Stego One[/msg])

This is really annoying!

I understand how steganography works but I cannot realize how to reverse it.

I cannot find the source of the stegged 1.bmp . So I cannot compare two files
in order to find the different bytes.
I have also downloaded a lot of steganography software but no revealing of the
text is possible.

I would like someone to show me exactly what to do, in order to get the touch of it,
but I guess I will lose the joy of solving for stego 1.

Thanks in advance for any recommendation. A tutorial would also be fine but I cannot
find one in Google. Please give me something.

If your looking to view the source of some file, try a hex editor or similar.

Last edited by G__ on Tue Jul 01, 2008 7:16 am, edited 1 time in total.

I use ultraedit to view the binary of the bmp

What I meant is that 1.bmp is steganographed.
If I had the prototype file I could compare the two files steganographed one and not steganographed one
and I would know where the difference is.

by **sandwich** on Fri May 30, 2008 2:14 pm ([msg=3747]see Re: Stego One[/msg])

ooh this is annoying. The original image is here:
http://www.rootthisbox.net/pages/index/training.jpg
But it's not in greyscale!

I've now opened the thing in PSPad and found the offsets of the null bytes from the front of the file and from each other - am I close or am I just missing the big picture (so to speak)?

I didn't realize there was an original. It's not really needed when you figure out what the hint is implying.

by **sandwich** on Fri May 30, 2008 3:06 pm ([msg=3753]see Re: Stego One[/msg])

Yeh I understand that now. Although am I thinking the right way? Have I got the information I need or should I gather some more? I've tried converting the HEX in between the nulls, the offsets etc. to all sorts of things (DEC, ASCII etc), but to no avail.

by **G__** on Fri May 30, 2008 3:49 pm ([msg=3759]see Re: Stego One[/msg])

What does the tip imply?

by **BhaaL** on Sat May 31, 2008 5:19 am ([msg=3805]see Re: Stego One[/msg])

The tip refers to two null bytes. Always did and always will.
I wonder if they mark some spot...