For the creation of this post I was inspired by this , this and this . If these rarjpegs can be created, then they can also be defined among ordinary "innocent" images. Immediately, .jpg and .png fall under suspicion. But how to distinguish rarzhpeg from the usual picture?

A banal size comparison (if, for example, a picture is larger than 10 MB, then it can be a rarjpeg) does not help - there can be different sizes: a 10Kb picture with a single-line textbook hidden in it or a large photo with a rather large audio file inside. How would you distinguish?

I would do this: calculate the image size ( высота*ширина*глубина_цвета ) and compare it with the actual file size. Not agreed - it means rarzhpeg. But how then to calculate the size of EXIF ​​and compression (jpg), they are also part of the image?

UPDATE Wrote a working (rather smart) algorithm in Java (tested on Android). It works calmly with png + zip / rar, jpg + zip / rar.

 //Определим заголовки файлов String HEADER_RAR = "Rar!"; //Для .rar это будет Rar! String HEADER_ZIP = new String(new BigInteger("504B0304", 16).toByteArray()); //а для .zip будет "PK" и ещё два нечитаемых символа, поэтому мы получим их из HEX-кода //создаём массив строк с путями к нужным изображениям (ArrayList<String> mImages) ArrayList<String> mRarjpegs = new ArrayList<String>(); //массив с путями к раржпегам for (String path : mImages) { //проверяем каждый файл try { BufferedReader br = new BufferedReader(new FileReader(path)); String line; while ((line = br.readLine()) != null) //открываем файл построчно... { if (line.contains(HEADER_RAR) || line.contains(HEADER_ZIP)) // ...если в строке нашёлся заголовок одного из архивов... { mRarjpegs.add(path); // ...то добавим его в список раржпегов break; // ...и выйдем из цикла, чтобы не считывать остальную часть файла } } } catch (Exception ex) { /* что-то своё */ } } //На выходе получим mRarjpegs, наполненный путями
  • An interesting trick, did not know! The definition is simple: to be one of the programs. Search for the header of the RAR archive further than a few bytes from the beginning of the file, or the JPEG ending mark ( 0xFF, 0xD9 ) far to the end of the file. Facebook and VKontakte download pictures resample, so there the RAR part will not work. So, when uploading images, you can pinch them with GD or ImageMagick, so as not to miss too much. - Sergiks
  • Does searching for a header / tag in one file take a long time? And what if you want to check, for example, 100 files for the presence of an archive inside? - Helisia
  • At worst, you need to read the entire file, looking for a sequence of two bytes. There should be no longer than just copying all these files once, say. - Sergiks

1 answer 1

I once wrote for myself like that. It seems to work.

 enum RJClassification { NotJpeg, JustJpeg, JpegWithUnrecognizedTail, JpegWithRarTail } static class RJClassifier { public static RJClassification Classify(byte[] data, out long payloadIndex) { payloadIndex = 0; JpegParser jpp = new JpegParser(data, 0); if (!jpp.HasJpegHeader()) return RJClassification.NotJpeg; var jpegEnd = jpp.SkipJpegHeader(); if (!jpegEnd.HasValue) return RJClassification.NotJpeg; var rrp = new RarParser(data, jpegEnd.Value); var rarStart = rrp.FindRarHeader(); if (!rarStart.HasValue) return RJClassification.JpegWithUnrecognizedTail; payloadIndex = rarStart.Value; return RJClassification.JpegWithRarTail; } } class RarParser { byte[] data; long startIndex; public RarParser(byte[] data, long startIndex) { this.data = data; this.startIndex = startIndex; } byte[] signature = { 0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00 }; public long? FindRarHeader() { // state machine int state = 0; for (long i = startIndex; i < data.LongLength; i++) { if (data[i] == signature[state]) { state++; if (state == signature.Length) return i + 1 - state; } else { if (state > 0) i--; // need to recheck the current byte state = 0; } } return null; } }

JPEG parser is too long, put it here .

For other image formats you need, of course, another image parser. Or you can do without it at all, if you feed RarParser 'y zero as startIndex (but it will be longer and less reliably).

Oops, it seems the code never returns JustJpeg . Another check is needed after var jpegEnd = jpp.SkipJpegHeader(); .

  • A good example, plus. Probably worth writing something too :) - Helisia
  • @SuperCreeper: thanks! - VladD