Slide 1

Slide 1 text

Ange Albertini Ange Albertini 1

Slide 2

Slide 2 text

A workshop by LET’s PLAY LET’s PLAY A.K.A. Ange Albertini with files 2022/06/12 233 slides 2

Slide 3

Slide 3 text

Welcome I made this deck to share my knowledge, but also to learn from you. The slides are public and have been improved several times whenever needed. It may not cover all perspectives or answer all questions, so feel free to Reach me at @angealbertini or ✉ [email protected] with questions, one-liners, suggestions... Versions: 2019/07/02 150p (Pass The Salt) 2019/07/24 199p (Google) 2019/08/19 208p (Google) 2019/10/23 222p (Hack.lu) 2019/11/07 225p (Black Alps) 2019/12/03 229p (Google) 2022/06/12 233p This desk's URL is: https://speakerdeck.com/ange/colltris Make sure you have the latest version. Color blind ? LMK if you're having any troubles. 3

Slide 4

Slide 4 text

TL;DR (for experts) Hash collisions existed for more than a decade and are often misunderstood: - exageration: "MD5 is broken, just don't use it!" - understatement: "It always takes hours!" Generating colliding files can be sped up (from hours to instant) via tricks specific to some file formats: which ones, and why? This workshop aims to clarify these topics (and avoid the crypto). 4 THE CURRENT SLIDE IS AN A CORKAMI ORIGINAL PRODUCTION HONEST TALK TRAILER

Slide 5

Slide 5 text

Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid. not Albert Einstein No gatekeeping, no dogma, no cult. Don't show off, share knowledge. It's just better for everyone. Please be considerate. 5

Slide 6

Slide 6 text

☐ Hash collisions attacks: FastColl/UniColl/HashClash/Shattered. ☐ File formats abuses: shuffling, parasites, polyglots. ☐ Hash functions: MD5/SHA1, blocks, length extension. ☐ File formats: magic, header, body, chunks, footer. ☐ Hexadecimal / ASCII / hex viewer / endianness. Knowledge points checklist (✓/✗) 6

Slide 7

Slide 7 text

Contents Introduction Goals Basics Prerequisites Main Coll 1 : FastColl File formats basics Coll 2 : UniColl Exploit 1 : PNG Coll 3 : HashClash* Exploit 2 : PE Coll 4 : Shattered Coll 5 : Shambles Final Wrap up Extras Exploit 3 : GIF There are only 5 existing collisions attacks! *HashClash is actually the name of the whole project. But HashClashCPC is too long :) 7

Slide 8

Slide 8 text

- Reversing since the 80's - Author of Corkami - PoC or GTFO* About the author Professionally - malware analysis - infosec research my license plate is a CPU, my phone case is a PDF doc, my resume is a PDF/SNES/Genesis rom. 8 https://github.com/angea/pocorgtfo/blob/master/README.md

Slide 9

Slide 9 text

Incident Response Black hat White hat DIGItal PREServation User DEVelopment 9 ...and I’m interested in all of them. , My life is about file formats - they're my toys. There are various (with a few things in common) communities around file formats

Slide 10

Slide 10 text

Hash functions (only 5 slides) A gentle introduction to... 10

Slide 11

Slide 11 text

Returns from any content a big fixed-size value, always different. Impossible to guess a content from its hash value. What’s a hash function? MD5, SHA1... → d41d8cd98f00b204e9800998ecf8427e a → 01cc175b9c0f1b6a831c399e269772661 b → 92eb5ffee6ae2fec3ad71c777531578f A → 7fc56270e7a70fa81a5935b72eacbe29 ? ← d41d8cd98f00b204e9800998ecf8427f ? ← d41d8cd98f00b204e9800998ecf8427d also called ‘checksum’ ␣ 11

Slide 12

Slide 12 text

If two contents have the same hash, they are (assumed to be) identical (if the hash is secure) Hashes are used: - to check passwords (compute input hash, compare with stored value) Confidential - do not share → a59250af3300a8050106a67498a930f7 p4ssw0rd → 2a9d119df47ff993b662a8ef36f9ea20 - to validate content integrity - to index files (ex: your pictures in the cloud) 12

Slide 13

Slide 13 text

This example uses the crypt(3) hash. ...unless there is a hash collision: two dif ferent contents with the same hash result. $ python [...] >>> crypt.crypt("5dUD&66", salt="br") 'brokenOz4KxMc' >>> crypt.crypt("O!>',%$", salt="br") 'brokenOz4KxMc' >>> _ 13

Slide 14

Slide 14 text

Hash collision != password cracking Password cracking (HashCat, John the Ripper): finds a string that matches a value, a hash. Hash collision (HashClash, Shattered): Make Content Good and Content Bad with the same hash. 14

Slide 15

Slide 15 text

What’s the extent of a hash collision? It’s impossible to generate a file with predetermined hash with MD5 or SHA1. We can only generate two (or more) different files that have the same hash. With some file types, we can instantly generate files that render the same way (via some tricks). Cf Lessons from the history of attacks on secure hash-functions (Pre-image attack) But Maraca and Snefru were broken. 15

Slide 16

Slide 16 text

Results 1/2 Instant MD5 collisions, with no recomputation 16 https://github.com/corkami/collisions PDF MP4 JPG PNG

Slide 17

Slide 17 text

Results - 2/2 (also DocX, GZIP, 3MF…) GIF PE JP2 17

Slide 18

Slide 18 text

Just new collisions? Instant, reusable and generic collisions: Take any pair of files, run script, get colliding files. Ex: script -> output recording In some cases (PDFs), the colliding files are 100% standard: From a parser perspective, the contents are unmodified: only the files’ structures are. $ time ./png.py yes.png no.png real 0m0.039s user 0m0.025s sys 0m0.017s $ md5sum collision*.png 7af5775114be02b9b2594418a68a4cb8 collision1.png 7af5775114be02b9b2594418a68a4cb8 collision2.png 18

Slide 19

Slide 19 text

Demystifying long-lasting myths Hash collisions are usually perceived to apply only to: 1. a pair of files 2. of the same file type 3. Colliding files are expected to be very different. 19

Slide 20

Slide 20 text

instant & generic PDF/PE/PNG/MP4 collision A multi-type quartet of an executable, image, video, document. https://github.com/angea/pocorgtfo/blob/master/README.md#0x19 A tree of 3 HashClash! 20

Slide 21

Slide 21 text

https://github.com/angea/pocorgtfo/blob/master/README.md#0x14 A 60 page LaTeX-generated PDF... ...showing its MD5... ...showing the same MD5! ...also a NES rom... Tiny change (text), same MD5 609 FastColls in the file! <= alternate cover but same MD5! Mmm, seaf00d... 21

Slide 22

Slide 22 text

Tiny change (background image), same SHA1 https://github.com/angea/pocorgtfo/blob/master/README.md#0x18 Two covers via a "dual-content" JPG and 2 payloads via HTML polyglot A 64 page LaTeX-generated PDF... 22

Slide 23

Slide 23 text

Don't be fooled: shortcuts are necessary Instant & generic collisions rely on attacks and file formats tricks. Some formats have no suitable tricks. -> no generic collisions for ELF, Mach-O, ZIP, TAR, Class… These tricks will be reusable with future collision attacks: the same JPEG trick was reused with 3 hash collisions (MD5, MalSHA1, Sha1) 23

Slide 24

Slide 24 text

24

Slide 25

Slide 25 text

- F ile formats structures and manipulations - Understand hash collisions attacks and their exploits - Create your own exploits Goals of this workshop their impacts and limits, without all the internal details A system that you study indexes f iles with MD5: what can you do? 25

Slide 26

Slide 26 text

"No one uses MD5 anymore!" ? https://citizenlab.ca/2019/07/cant-picture-this-2-an-analysis-of-wechats-realtime-image-filtering-in-chats/ 26

Slide 27

Slide 27 text

the Shattered attack A computation of the attack documented in Stevens13 using a JPG in a PDF exploit crypto attack pwnie best CRYPTO17 paper what this slide deck is about (more details about shattered here) You may have heard of… nominated for Péter Szőr award Official paper Presentations: - Marc (crypto) video - Pierre (computation) video / slides - Elie (high level) video / slides - Ange (file formats) video / slides 27

Slide 28

Slide 28 text

Uses of hashes - check if contents have changed: ✓ do nothing ✗ refresh file [if newer...] - provide randomization: ✓user id ✗ crypto key - match a file to a file/set (white/blacklisting, indexing) ✗ if the set is user-controlled 28

Slide 29

Slide 29 text

*rendering-wise, not structure-wise. Use cases A system uses MD5 to index/check integrity. Is it safe? Collide a normal* file with a malicious one. You can even do it on the fly! To get instant collisions, a few hours of research and computation is usually enough. 29

Slide 30

Slide 30 text

Having troubles to convince? Let f iles do the talking. Threats? theory... Exploits PoCs? reality! Theoretical attacks to put in practice immediate threat 30

Slide 31

Slide 31 text

MD5 collisions: a good hacking chal lenge Hacking a file format == reading + manipulating + abusing parsers Crafting a re-usable collision requires all these skills, and leaves an undeniable proof. A re-usable MD5 collision is a good & impactful exercise: If the collision is instant, the files work and have the same MD5, it sets in stone your knowledge of that file format, and you have a proof (of concept). 31

Slide 32

Slide 32 text

.Don't be scared… Hash Functions Attacks on https://www.cwi.nl/system/files/PhD-Thesis-Marc-Stevens-Attacks-on-Hash-Functions-and-Applications.pdf -Crypto- -Tales- Crypto Tales -from the- from the 32

Slide 33

Slide 33 text

You don’t need to understand crypto graphy or maths... (to be honest, I don’t either) We'l l just use existing attacks: FastColl, UniColl, HashClash, Shattered - yes, that’s al l! 33

Slide 34

Slide 34 text

You don’t have to be an expert in f ile formats. 34

Slide 35

Slide 35 text

header Tail Body (less complex than some lego models) You just need to know their overall structure. Leg 35

Slide 36

Slide 36 text

Even this is too much! ✗ ✗ 36

Slide 37

Slide 37 text

✓ ✓ PNG structure You only need to understand the high level structure (not the whole thing) 37

Slide 38

Slide 38 text

000: 89 .P .N .G \r \n ^Z \n 00 00 00 0D .I .H .D .R 010: 00 00 00 03 00 00 00 01 08 02 00 00 00 94 82 83 020: E3 00 00 00 15 .I .D .A .T 08 1D 01 0A 00 F5 FF 030: 00 FF 00 00 00 FF 00 00 00 FF 0E FB 02 FE E9 32 040: 61 E5 00 00 00 00 .I .E .N .D AE 42 60 82 89 .P .N .G \r \n ^Z \n 00 00 00 0D .I .H .D .R 94 82 83 E3 00 00 00 15 .I .D .A .T E9 32 61 E5 00 00 00 00 .I .E .N .D AE 42 60 82 And we’l l ignore most contents, so we’l l just think in blocks. 38

Slide 39

Slide 39 text

To be honest Exploiting hash collisions feels a bit like... 39

Slide 40

Slide 40 text

COLLT IS COLLT IS COLLT IS Ange Albertini Ange Albertini ...playing a puzzle game! 40

Slide 41

Slide 41 text

You just need to know the rules of each block! 41

Slide 42

Slide 42 text

For a simpler introduction to the topic, check this.slides / video 42

Slide 43

Slide 43 text

43

Slide 44

Slide 44 text

You know hexadecimal? 44

Slide 45

Slide 45 text

You know ASCII? A standard encoding: characters <=> values "A" <=> 0x41 = 65 "Z" <=> 0x5A = 90 "a" <=> 0x61 = 97 45

Slide 46

Slide 46 text

Memory addresses Memory addresses 01 23 -> Big digits f irst <- Little digits f irst → 0x0123 = 291 You know endianness? 01 23 → 0x2301 = 8961 PNG, JPG, MP4, Class TIFF ZIP, BMP, GZip Executables: ARM (default), x86, x64 TIFF Exists in both endianness Formats Reading like many processors. Reading like humans. 46

Slide 47

Slide 47 text

You know hexadecimal viewers? 000: 89 .P .N .G \r \n ^Z \n 00 00 00 0D .I .H .D .R 010: 00 00 00 03 00 00 00 01 08 02 00 00 00 94 82 83 020: E3 00 00 00 15 .I .D .A .T 08 1D 01 0A 00 F5 FF 030: 00 FF 00 00 00 FF 00 00 00 FF 0E FB 02 FE E9 32 040: 61 E5 00 00 00 00 .I .E .N .D AE 42 60 82 Start in the top-left corner +1 +0x10 Offsets Contents Kaitai XXD/Hexedit/Okteta/Bvi/Dhex Hex Fiend HxD/Hiew Web Linux Mac Win Recommended hex tools Note: for this workshop, wrapping at 0x10 / 16 bytes is important. 47

Slide 48

Slide 48 text

What are hash collisions in practice? A computation that generates two distinct contents with the same hash. We can set the start of these contents - we'll see why. A hash collision generates a lot of randomness! -> the final hash is not known in advance. 48

Slide 49

Slide 49 text

Prerequisites- 49

Slide 50

Slide 50 text

https://github.com/cr-marcstevens/hashclash Cuda is not required HashClash download source and compile, or download release binaries HashClash, not HashCat. May require psmisc and autoconf-archive Prerequisites 1/2 ~/git/hashclash/bin$ ls md5* md5_birthdaysearch md5_diffpathconnect md5_diffpathhelper md5_diffpathbackward md5_diffpathforward md5_fastcoll Check that the executables are there! src/sha1attackgenerator/collfind.cpp:1266:64: warning: [-Wshift-overflow=] if (((Q20bu+(m15add<<20))&Q20mask)==Q20val && (((Q21b A few warnings will happen but it's OK!: 50 To run your own computations:

Slide 51

Slide 51 text

Can’t compile? Computation too slow? Compiling and computing can be troublesome. In case, all the computed examples of the slides are available: https://github.com/corkami/collisions/tree/master/workshop/prefixes So you can skip that step and focus on file manipulation (if you prefer). OTOH you may want to at least try to run FastColl: it’s instant and never fails. Even works with Wine w/ Windows binaries: 51 corkami:~$ wine ~/fastcoll_v1.0.0.5.exe MD5 collision generator v1.5 by Marc Stevens (http://www.win.tue.nl/hashclash/) Allowed options: -h [ --help ] Show options. -q [ --quiet ] Be less verbose. -i [ --ihv ] arg Use specified initial value. Default is MD5 initial value. -p [ --prefixfile ] arg Calculate initial value using given prefixfile. Also copies data to output files. -o [ --out ] arg Set output filenames. This must be the last option and exactly 2 filenames must be specified. cf5600ab

Slide 52

Slide 52 text

Hex editor, assembly, scripting… Whatever rocks your boat and you’re familiar with. A f ile format manipulation environment A copy of Corkami/collisions (contains materials for this workshop) https://github.com/corkami/collisions Prerequisites 2/2 Kaitai XXD/Hexedit/Okteta/Bvi/Dhex Hex Fiend HxD/Hiew Web Linux Mac Win Recommended hex tools 52 A copy of these slides (for readability if needed) https://speakerdeck.com/ange/colltris

Slide 53

Slide 53 text

Kaitai 101 If you’re not familiar with hex viewing: 53 A pretty awesome tool with a great online viewer (no modif ications of the f iles are allowed) https://ide.kaitai.io

Slide 54

Slide 54 text

Kaitai in a nutshell - Uses YAML-based parsers. Many formats are already supported. - Drop your file on the IDE, select the file format. - if you modify the YAML source (for ex: to remove unneeded details), the modified version is saved locally and reusable/downloadable. Drawback: instantly fails on invalid files (but you can fix that directly in the GUI). 54

Slide 55

Slide 55 text

55

Slide 56

Slide 56 text

hex viewer YAML editor parsed output available formats Demo samples Your f iles 56

Slide 57

Slide 57 text

If you're not familiar with format manipulations - Skim through some specs. Get an idea of the high level structure. - Look for possible shortcuts that a parser might take, such as: - Secondary structures might be absent or corrupted -> parasitizing - Structures order might not be enforced -> shuffling - Check standard open-source implementations. All the referenced scripts are on the Corkami GitHub: https://github.com/corkami/collisions 57

Slide 58

Slide 58 text

01-fastcoll-1.bin . 0000 0000: 37 75 C1 F1 C4 A7 5A E7 9C E0 DE 7A 5B 10 80 26 7u....Z. ...z[..& . 0000 0010: 02 AB D9 39 C9 6C 5F 02 12 C2 7F DA CD 0D A3 B0 ...9.l_. ........ . 0000 0020: 8C ED FA F3 E1 A3 FD B4 EF 09 E7 FB B1 C3 99 1D ........ ........ . 0000 0030: CD 91 C8 45 E6 6E FD 3D C7 BB 61 52 3E F4 E0 38 ...E.n.= ..aR>..8 . 0000 0040: 49 11 85 69 EB CC 17 9C 93 4F 40 EB 33 02 AD 20 I..i.... [email protected]... . 0000 0050: A4 09 2D FB 15 FA 20 1D D1 DB 17 CD DD 29 59 1E ..-... . .....)Y. . 0000 0060: 39 89 9E F6 79 46 9F E6 8B 85 C5 EF DE 42 4F 46 9...yF.. .....BOF . 0000 0070: C2 78 75 9D 8B 65 F4 50 EA 21 C5 59 18 62 FF 7B .xu..e.P .!.Y.b.{ . 01-fastcoll-2.bin .. 0000 0000: 37 75 C1 F1 C4 A7 5A E7 9C E0 DE 7A 5B 10 80 26 7u....Z. ...z[..& . 0000 0010: 02 AB D9 B9 C9 6C 5F 02 12 C2 7F DA CD 0D A3 B0 .....l_. ........ . 0000 0020: 8C ED FA F3 E1 A3 FD B4 EF 09 E7 FB B1 43 9A 1D ........ .....C.. . 0000 0030: CD 91 C8 45 E6 6E FD 3D C7 BB 61 D2 3E F4 E0 38 ...E.n.= ..a.>..8 . 0000 0040: 49 11 85 69 EB CC 17 9C 93 4F 40 EB 33 02 AD 20 I..i.... [email protected]... . 0000 0050: A4 09 2D 7B 15 FA 20 1D D1 DB 17 CD DD 29 59 1E ..-{.. . .....)Y. . 0000 0060: 39 89 9E F6 79 46 9F E6 8B 85 C5 EF DE C2 4E 46 9...yF.. ......NF . 0000 0070: C2 78 75 9D 8B 65 F4 50 EA 21 C5 D9 18 62 FF 7B .xu..e.P .!...b.{ . …..────────────────────┐ │Arrow keys move F find RET next difference ESC quit T move top │ │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ └─────────────────────────────────────────────────────────────── ───────┘ Efficient diffing 58 VBinDiff $ diff <(xxd 01-fastcoll-1.bin) <(xxd 01-fastcoll-2.bin) 2,4c2,4 < 00000010: 02ab d939 c96c 5f02 12c2 7fda cd0d a3b0 ...9.l_......... < 00000020: 8ced faf3 e1a3 fdb4 ef09 e7fb b1c3 991d ................ < 00000030: cd91 c845 e66e fd3d c7bb 6152 3ef4 e038 ...E.n.=..aR>..8 --- > 00000010: 02ab d9b9 c96c 5f02 12c2 7fda cd0d a3b0 .....l_......... > 00000020: 8ced faf3 e1a3 fdb4 ef09 e7fb b143 9a1d .............C.. > 00000030: cd91 c845 e66e fd3d c7bb 61d2 3ef4 e038 ...E.n.=..a.>..8 6,8c6,8 < 00000050: a409 2dfb 15fa 201d d1db 17cd dd29 591e ..-... ......)Y. < 00000060: 3989 9ef6 7946 9fe6 8b85 c5ef de42 4f46 9...yF.......BOF < 00000070: c278 759d 8b65 f450 ea21 c559 1862 ff7b .xu..e.P.!.Y.b.{ --- > 00000050: a409 2d7b 15fa 201d d1db 17cd dd29 591e ..-{.. ......)Y. > 00000060: 3989 9ef6 7946 9fe6 8b85 c5ef dec2 4e46 9...yF........NF > 00000070: c278 759d 8b65 f450 ea21 c5d9 1862 ff7b .xu..e.P.!...b.{

Slide 59

Slide 59 text

Radiff (from Radare) ~/git/corkami/collisions/workshop/prefixes$ radiff2 -x 10* offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF 0x00000000! 6e6f0000000000000000000000000000 no.............. 79657300000000000000000000000000 yes............. 0x00000010 00000000000000000000000000000000 ................ 00000000000000000000000000000000 ................ 0x00000020 00000000000000000000000000000000 ................ 00000000000000000000000000000000 ................ 0x00000030! 00000000000000001971e7f70972fb06 .........q...r.. 0000000000000000b74638098a46f17b .........F8..F.{ 0x00000040 f34526136660c801b92a75255a6723a6 .E&.f`...*u%Zg#. f34526136660c801b92a75255a6723a6 .E&.f`...*u%Zg#. 0x00000050 923deb8db0b757f1459f2295bec04375 .=....W.E."...Cu 923deb8db0b757f1459f2295bec04375 .=....W.E."...Cu 0x00000060! 9198a2d3e0fd59edd1c5fa0b79659751 ......Y.....ye.Q 9198a2d3e0fd59edd1c5fa0b7965974d ......Y.....ye.M 0x00000070 b3b3e40c110c9032de4ba14bb81b5ec8 .......2.K.K..^. b3b3e40c110c9032de4ba14bb81b5ec8 .......2.K.K..^. 0x00000080 25d38f19cd104307d9bbff8cb75a23f9 %.....C......Z#. 25d38f19cd104307d9bbff8cb75a23f9 %.....C......Z#. ... 0x000000a0! ba784000c37e93b231a36e2d34724ac9 .x@..~..1.n-4rJ. ba784000c37e93b231a36e2d346a4ac9 .x@..~..1.n-4jJ. 0x000000b0 534ec045361ec86a5698e6f0571d6198 SN.E6..jV...W.a. 534ec045361ec86a5698e6f0571d6198 SN.E6..jV...W.a. 0x000000c0 13fcffcd4d83a2d2bbb8dc042be2b883 ....M.......+... 13fcffcd4d83a2d2bbb8dc042be2b883 ....M.......+... ... 0x000000e0! 7d86e4351eb833eeea15d181fa9662ec }..5..3.......b. 7d86e4351eb833eeea15d181ba9662ec }..5..3.......b. 0x000000f0 7531fbda4fae246f67d6af109629fbc7 u1..O.$og....).. 7531fbda4fae246f67d6af109629fbc7 u1..O.$og....).. 0x00000100 a332bba9ead5e4ae1fc2fb234122b2e0 .2.........#A".. a332bba9ead5e4ae1fc2fb234122b2e0 .2.........#A".. ... 0x00000120! 8bc95c93a5efa4227d9a66516eedaf70 ..\...."}.fQn..p 8bc95c93a5efa4227d9a66516eedad70 ..\...."}.fQn..p 0x00000130 3290d4bd6792389bdc150dbfdc717227 2...g.8......qr' 3290d4bd6792389bdc150dbfdc717227 2...g.8......qr' 0x00000140 e05b43fa4459e860f7637ff0730ad4be .[C.DY.`.c..s... e05b43fa4459e860f7637ff0730ad4be .[C.DY.`.c..s... ... 0x00000160! e860db910013c91d7a619b9a5d60bd71 .`......za..]`.q e860db910013c91d7a619b9a5d5ebd71 .`......za..]^.q 0x00000170 231ad2bda6e038660b8cf599567963d6 #.....8f....Vyc. 231ad2bda6e038660b8cf599567963d6 #.....8f....Vyc. 0x00000180 6e5ed77ec34e9d5f6523c038c9555aa1 n^.~.N._e#.8.UZ. 6e5ed77ec34e9d5f6523c038c9555aa1 n^.~.N._e#.8.UZ. ... ... 0x00000220! e6186ee3f052e435836142357297cd8d ..n..R.5.aB5r... e6186ee3f052e435836142357297c58d ..n..R.5.aB5r... 0x00000230 4ff793685a705f5a043ad542c1fa0fe2 O..hZp_Z.:.B.... 4ff793685a705f5a043ad542c1fa0fe2 O..hZp_Z.:.B.... 0x00000240 ae57dbaff151b8b73818ef2eb8a6a92c .W...Q..8......, ae57dbaff151b8b73818ef2eb8a6a92c .W...Q..8......, ... 0x00000260! 4f9cfa623d4246596732ec99da897a08 O..b=BFYg2....z. 4f9cfa623d4246596732ec99da897a88 O..b=BFYg2....z. 0x00000270 e7ade321ed3c4bc04d9f833cdc7fb70a ...!.

Slide 60

Slide 60 text

60 60

Slide 61

Slide 61 text

The f irst block in our game: An Identical Pref ix Collision - FastColl 61

Slide 62

Slide 62 text

Collision computing is a very random process Many possible problems across the different attacks: - variable computing time - different results from each execution. - final result might just not collide. - computation might be stalled. -> restart/backtracking might be required. Warning https://www.cwi.nl/system/files/PhD-Thesis-Marc-Stevens-Attacks-on-Hash-Functions-and-Applications.pdf#page=110 https://github.com/cr-marcstevens/hashclash/blob/master/src/md5fastcoll/main.cpp#L106 seed32_1 = uint32(time(NULL)); Ex: with FastCo ll from 0.3 to 13s on the same machine! 62

Slide 63

Slide 63 text

63

Slide 64

Slide 64 text

From nothing, generate 2 f iles with the same md5. Create an empty f ile, run FastColl on it (recording). bin$ md5_fastcoll -p empty MD5 collision generator v1.5 by Marc Stevens (http://www.win.tue.nl/hashclash/) Using output filenames: 'msg1.bin' and 'msg2.bin' Using prefixfile: 'empty' Using initial value: 0123456789abcdeffedcba9876543210 Generating first block: . Generating second block: W..... Running time: 0.343 s bin$ _ Mission Example bin$ touch empty bin$ du -b empty 0 empty bin$ _ 64

Slide 65

Slide 65 text

00: 37 75 C1 F1-C4 A7 5A E7-9C E0 DE 7A-5B 10 80 26 7u┴±─ºZτ£α▐z[►Ç& 10: 02 AB D9 B9-C9 6C 5F 02-12 C2 7F DA-CD 0D A3 B0 ☻½┘╣╔l_☻↕┬⌂┌═♪ú░ 20: 8C ED FA F3-E1 A3 FD B4-EF 09 E7 FB-B1 43 9A 1D îφ·≤ßú²┤∩○τ√▒CÜ↔ 30: CD 91 C8 45-E6 6E FD 3D-C7 BB 61 D2-3E F4 E0 38 ═æ╚Eµn²=╟╗a╥>⌠α8 40: 49 11 85 69-EB CC 17 9C-93 4F 40 EB-33 02 AD 20 I◄àiδ╠↨£ôO@δ3☻¡ 50: A4 09 2D 7B-15 FA 20 1D-D1 DB 17 CD-DD 29 59 1E ñ○-{§· ↔╤█↨═▌)Y▲ 60: 39 89 9E F6-79 46 9F E6-8B 85 C5 EF-DE C2 4E 46 9ë₧÷yFƒµïà┼∩▐┬NF 70: C2 78 75 9D-8B 65 F4 50-EA 21 C5 D9-18 62 FF 7B ┬xu¥ïe⌠PΩ!┼┘↑b { Our f irst hash collision 00: 37 75 C1 F1-C4 A7 5A E7-9C E0 DE 7A-5B 10 80 26 7u┴±─ºZτ£α▐z[►Ç& 10: 02 AB D9 39-C9 6C 5F 02-12 C2 7F DA-CD 0D A3 B0 ☻½┘9╔l_☻↕┬⌂┌═♪ú░ 20: 8C ED FA F3-E1 A3 FD B4-EF 09 E7 FB-B1 C3 99 1D îφ·≤ßú²┤∩○τ√▒├Ö↔ 30: CD 91 C8 45-E6 6E FD 3D-C7 BB 61 52-3E F4 E0 38 ═æ╚Eµn²=╟╗aR>⌠α8 40: 49 11 85 69-EB CC 17 9C-93 4F 40 EB-33 02 AD 20 I◄àiδ╠↨£ôO@δ3☻¡ 50: A4 09 2D FB-15 FA 20 1D-D1 DB 17 CD-DD 29 59 1E ñ○-√§· ↔╤█↨═▌)Y▲ 60: 39 89 9E F6-79 46 9F E6-8B 85 C5 EF-DE 42 4F 46 9ë₧÷yFƒµïà┼∩▐BOF 70: C2 78 75 9D-8B 65 F4 50-EA 21 C5 59-18 62 FF 7B ┬xu¥ïe⌠PΩ!┼Y↑b { - two blocks of 64 bytes - totally random - a few tiny differences (Your results will be different) 65

Slide 66

Slide 66 text

Try again in the same conditions -> different computation time. bin$ md5_fastcoll -p empty MD5 collision generator v1.5 by Marc Stevens (http://www.win.tue.nl/hashclash/) Using output filenames: 'msg1.bin' and 'msg2.bin' Using prefixfile: 'empty' Using initial value: 0123456789abcdeffedcba9876543210 Generating first block: ........................ Generating second block: S10............... Running time: 13.35 s bin$ _ Mission 66

Slide 67

Slide 67 text

00: 1D 92 56 C9-34 F6 C6 F2-C9 0C 97 90-AA 16 55 2A ↔ÆV╔4÷╞≥╔♀ùɬ▬U* 10: 68 00 E7 C4-8C 56 39 E8-47 A6 80 A6-4D B0 2B F2 h τ─îV9ΦGªÇªM░+≥ 20: F6 12 D2 E6-D0 AC 13 2D-EF FF F0 DC-13 90 DD 72 ÷↕╥µ╨¼‼-∩ ≡▄‼É▌r 30: 32 99 B0 BB-C7 65 A6 66-73 10 56 7C-9C 5F 45 8B 2Ö░╗╟eªfs►V|£_Eï 40: 61 76 C9 56-3E DF 7E 28-DB AB DC 64-B4 9A 44 00 av╔V>▀~(█½▄d┤ÜD 50: D3 4D BC 9E-80 1C B2 38-C9 B3 40 67-1A 60 A8 C6 ╙M╝₧Ç∟▓8╔│@g→`¿╞ 60: D3 BB 48 08-AF 04 30 16-B8 01 10 5B-92 94 F9 1C ╙╗H◘»♦0▬╕☺►[Æö∙∟ 70: 3D 3C C6 AC-FF 2C FD AD-DB 2C 2C CF-C1 06 9B 50 =<╞¼ ,²¡█,,╧┴♠¢P 00: 1D 92 56 C9-34 F6 C6 F2-C9 0C 97 90-AA 16 55 2A ↔ÆV╔4÷╞≥╔♀ùɬ▬U* 10: 68 00 E7 44-8C 56 39 E8-47 A6 80 A6-4D B0 2B F2 h τDîV9ΦGªÇªM░+≥ 20: F6 12 D2 E6-D0 AC 13 2D-EF FF F0 DC-13 10 DE 72 ÷↕╥µ╨¼‼-∩ ≡▄‼►▐r 30: 32 99 B0 BB-C7 65 A6 66-73 10 56 FC-9C 5F 45 8B 2Ö░╗╟eªfs►Vⁿ£_Eï 40: 61 76 C9 56-3E DF 7E 28-DB AB DC 64-B4 9A 44 00 av╔V>▀~(█½▄d┤ÜD 50: D3 4D BC 1E-80 1C B2 38-C9 B3 40 67-1A 60 A8 C6 ╙M╝▲Ç∟▓8╔│@g→`¿╞ 60: D3 BB 48 08-AF 04 30 16-B8 01 10 5B-92 14 F9 1C ╙╗H◘»♦0▬╕☺►[ƶ∙∟ 70: 3D 3C C6 AC-FF 2C FD AD-DB 2C 2C 4F-C1 06 9B 50 =<╞¼ ,²¡█,,O┴♠¢P Our second colliding pair - completely different - still random-looking -> let’s ignore the ASCII! - differences at the same offsets (that’s how it works) 67

Slide 68

Slide 68 text

…a big pile of…- computed randomness- …with tiny differences.- A hash collision is...- (in the case of these MD5/SHA1 attacks)- Reminder: the final hash is not known in advance.- 68

Slide 69

Slide 69 text

1D 92 56 C9-34 F6 C6 F2-C9 0C 97 90-AA 16 55 2A 68 00 E7 44-8C 56 39 E8-47 A6 80 A6-4D B0 2B F2 F6 12 D2 E6-D0 AC 13 2D-EF FF F0 DC-13 10 DE 72 32 99 B0 BB-C7 65 A6 66-73 10 56 FC-9C 5F 45 8B 61 76 C9 56-3E DF 7E 28-DB AB DC 64-B4 9A 44 00 D3 4D BC 1E-80 1C B2 38-C9 B3 40 67-1A 60 A8 C6 D3 BB 48 08-AF 04 30 16-B8 01 10 5B-92 14 F9 1C 3D 3C C6 AC-FF 2C FD AD-DB 2C 2C 4F-C1 06 9B 50 1D 92 56 C9-34 F6 C6 F2-C9 0C 97 90-AA 16 55 2A 68 00 E7 C4-8C 56 39 E8-47 A6 80 A6-4D B0 2B F2 F6 12 D2 E6-D0 AC 13 2D-EF FF F0 DC-13 90 DD 72 32 99 B0 BB-C7 65 A6 66-73 10 56 7C-9C 5F 45 8B 61 76 C9 56-3E DF 7E 28-DB AB DC 64-B4 9A 44 00 D3 4D BC 9E-80 1C B2 38-C9 B3 40 67-1A 60 A8 C6 D3 BB 48 08-AF 04 30 16-B8 01 10 5B-92 94 F9 1C 3D 3C C6 AC-FF 2C FD AD-DB 2C 2C CF-C1 06 9B 50 37 75 C1 F1-C4 A7 5A E7-9C E0 DE 7A-5B 10 80 26 02 AB D9 39-C9 6C 5F 02-12 C2 7F DA-CD 0D A3 B0 8C ED FA F3-E1 A3 FD B4-EF 09 E7 FB-B1 C3 99 1D CD 91 C8 45-E6 6E FD 3D-C7 BB 61 52-3E F4 E0 38 49 11 85 69-EB CC 17 9C-93 4F 40 EB-33 02 AD 20 A4 09 2D FB-15 FA 20 1D-D1 DB 17 CD-DD 29 59 1E 39 89 9E F6-79 46 9F E6-8B 85 C5 EF-DE 42 4F 46 C2 78 75 9D-8B 65 F4 50-EA 21 C5 59-18 62 FF 7B 37 75 C1 F1-C4 A7 5A E7-9C E0 DE 7A-5B 10 80 26 02 AB D9 B9-C9 6C 5F 02-12 C2 7F DA-CD 0D A3 B0 8C ED FA F3-E1 A3 FD B4-EF 09 E7 FB-B1 43 9A 1D CD 91 C8 45-E6 6E FD 3D-C7 BB 61 D2-3E F4 E0 38 49 11 85 69-EB CC 17 9C-93 4F 40 EB-33 02 AD 20 A4 09 2D 7B-15 FA 20 1D-D1 DB 17 CD-DD 29 59 1E 39 89 9E F6-79 46 9F E6-8B 85 C5 EF-DE C2 4E 46 C2 78 75 9D-8B 65 F4 50-EA 21 C5 D9-18 62 FF 7B ...and these differences are always at the same offsets Chosen specifically because of weaknesses in the hash function.. For more details, check https://www.youtube.com/watch?v=iKE7DJd-PwU The last ones are sometimes missing! 69

Slide 70

Slide 70 text

Now let’s add an input - our pref ix. The content and length of the prefix is not important here (example recording). bin$ md5_fastcoll -p prefix MD5 collision generator v1.5 by Marc Stevens (http://www.win.tue.nl/hashclash/) Using output filenames: 'msg1.bin' and 'msg2.bin' Using prefixfile: 'prefix' Using initial value: 05ca8309f7b553d58845a18ab918a64c Generating first block: .... Generating second block: S10......... Running time: 2.653 s bin$ _ bin$ cat prefix Here is a file with a few bytes bin$ du -b prefix 31 prefix bin$ _ File 70

Slide 71

Slide 71 text

File Padding Mission - padded to 64 bytes - collision blocks appended - differences at the same relative offsets Similar blocks - added after padding to 64 bytes 00: .H .e .r .e . .i .s . .a . .f .i .l .e . .w 10: .i .t .h . .a . .f .e .w . .b .y .t .e .s 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40: CE 84 07 61 4B BA 7A 3D 3A EA 8A AA F8 EE 1D E5 50: 44 17 9B 70 0A E0 D2 64 21 E2 38 E1 94 18 0A F6 60: 93 D2 B5 E4 FC 2F 3A 32 4F 50 46 01 F1 CB BE 02 70: 23 EE EF BF 92 B5 7C 29 D9 C5 66 88 31 5E 7A 1D 80: 2F 5A 9C 5C 12 8E DF F2 85 17 5B DD 67 25 05 78 90: 13 F2 BF 56 64 59 F2 C8 8B C3 00 6F 8B 5F 88 C6 A0: CB 3D 80 E4 9F 48 91 5E 34 06 D0 3A 8B 83 FB E0 B0: ED 18 67 0F C8 3A C9 A1 E7 48 F6 AA D2 5C 30 C0 00: .H .e .r .e . .i .s . .a . .f .i .l .e . .w 10: .i .t .h . .a . .f .e .w . .b .y .t .e .s 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40: CE 84 07 61 4B BA 7A 3D 3A EA 8A AA F8 EE 1D E5 50: 44 17 9B F0 0A E0 D2 64 21 E2 38 E1 94 18 0A F6 60: 93 D2 B5 E4 FC 2F 3A 32 4F 50 46 01 F1 4B BF 02 70: 23 EE EF BF 92 B5 7C 29 D9 C5 66 08 31 5E 7A 1D 80: 2F 5A 9C 5C 12 8E DF F2 85 17 5B DD 67 25 05 78 90: 13 F2 BF D6 64 59 F2 C8 8B C3 00 6F 8B 5F 88 C6 A0: CB 3D 80 E4 9F 48 91 5E 34 06 D0 3A 8B 03 FB E0 B0: ED 18 67 0F C8 3A C9 A1 E7 48 F6 2A D2 5C 30 C0 71

Slide 72

Slide 72 text

MD5, SHA1 work by processing 64 bytes block, from start to end. -> Appending the same thing to two files with the same hash will give files with the same hash. Padded to 64 bytes? Merkle–Damgård Construction https://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_construction ✓ ✓ ✓ ✓ at block boundaries Length extension attack https://en.wikipedia.org/wiki/Length_extension_attack 72

Slide 73

Slide 73 text

All current hash collisions attacks work with such alignment: padding, then adding (at block boundaries) a number of blocks. -> Via these attacks: 1. Every pair with the same hash will have the same length. 2. The end of the files is either identical (suffix), Or high entropy, very similar and aligned to 64 bytes (no suffix, just collision blocks). Similarities of all current collision attacks 73

Slide 74

Slide 74 text

We always work with 64 bytes blocks. It's really a block game! Double-check your hex viewer wrapping! (some viewers adjust their wrapping when you resize the window) From now on... 74

Slide 75

Slide 75 text

Hash collision Computed your first FastColl Certificate (easy) Ange Albertini INSTRUCTOR COLLT IS 75

Slide 76

Slide 76 text

76 76

Slide 77

Slide 77 text

Step 1/4 : the pref ix (optional) PREFIX Padding 77 We define the start of the file. The collision computation will depend on it. The prefix can be empty. Its content and size make no difference at all.

Slide 78

Slide 78 text

Step 2/4 : the padding (if needed) PREFIX Padding 78 We add some data to the prefix to get a rounded size (a multiple of 64). Its content doesn’t matter, only its length: it just aligns things.

Slide 79

Slide 79 text

Step 3/4 : the collision blocks We compute a pair of blocks full of randomness with tiny differences. Despite the differences, the hash of both files is the same. These collision blocks only work for that exact prefix. PREFIX Padding PREFIX Padding Differences 79

Slide 80

Slide 80 text

Step 4/4 : the suffix You can add anything to both sides (not required). The hash value will remain the same. PREFIX Padding PREFIX Padding SUFFIX SUFFIX 80

Slide 81

Slide 81 text

- takes a single input - prefix and suffix will be identical: -> files almost identical -> exploitation depends only on collision differences -> two contents coexist in the same file. An Identical Pref ix hash Collision These properties are common to FastColl, Unicoll and Shattered. 81

Slide 82

Slide 82 text

00: .H .e .r .e . .i .s . .a . .f .i .l .e . .w 10: .i .t .h . .a . .f .e .w . .b .y .t .e .s 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40: CE 84 07 61 4B BA 7A 3D 3A EA 8A AA F8 EE 1D E5 50: 44 17 9B F0 0A E0 D2 64 21 E2 38 E1 94 18 0A F6 60: 93 D2 B5 E4 FC 2F 3A 32 4F 50 46 01 F1 4B BF 02 70: 23 EE EF BF 92 B5 7C 29 D9 C5 66 08 31 5E 7A 1D 80: 2F 5A 9C 5C 12 8E DF F2 85 17 5B DD 67 25 05 78 90: 13 F2 BF D6 64 59 F2 C8 8B C3 00 6F 8B 5F 88 C6 A0: CB 3D 80 E4 9F 48 91 5E 34 06 D0 3A 8B 03 FB E0 B0: ED 18 67 0F C8 3A C9 A1 E7 48 F6 2A D2 5C 30 C0 00: .H .e .r .e . .i .s . .a . .f .i .l .e . .w 10: .i .t .h . .a . .f .e .w . .b .y .t .e .s 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40: CE 84 07 61 4B BA 7A 3D 3A EA 8A AA F8 EE 1D E5 50: 44 17 9B 70 0A E0 D2 64 21 E2 38 E1 94 18 0A F6 60: 93 D2 B5 E4 FC 2F 3A 32 4F 50 46 01 F1 CB BE 02 70: 23 EE EF BF 92 B5 7C 29 D9 C5 66 88 31 5E 7A 1D 80: 2F 5A 9C 5C 12 8E DF F2 85 17 5B DD 67 25 05 78 90: 13 F2 BF 56 64 59 F2 C8 8B C3 00 6F 8B 5F 88 C6 A0: CB 3D 80 E4 9F 48 91 5E 34 06 D0 3A 8B 83 FB E0 B0: ED 18 67 0F C8 3A C9 A1 E7 48 F6 AA D2 5C 30 C0 ⇤ ⇥ #&%!@ …‽… …🛑? What can we do with this? We can put whatever we want before and after the collision. We need the following from the target file format: Padding , for alignments collision blocks’ randomness needs to be ignored Differences needs to be taken into account Several contents can co-exist (usually appended data) 82

Slide 83

Slide 83 text

- start and end aligned to 64 bytes (via padding if needed) - totally random - tiny differences at fixed offsets We can’t change these offsets. (they depend on the hash function). Hash collision blocks These properties are common to all the attacks on MD5 or SHA1. 83

Slide 84

Slide 84 text

📏 ⌛ ‽ -> hard to exploit! The fastest, but the most limiting. FastColl FastColl 00: 37 75 C1 F1-C4 A7 5A E7-9C E0 DE 7A-5B 10 80 26 10: 02 AB D9 B9-C9 6C 5F 02-12 C2 7F DA-CD 0D A3 B0 20: 8C ED FA F3-E1 A3 FD B4-EF 09 E7 FB-B1 43 9A 1D 30: CD 91 C8 45-E6 6E FD 3D-C7 BB 61 D2-3E F4 E0 38 40: 49 11 85 69-EB CC 17 9C-93 4F 40 EB-33 02 AD 20 50: A4 09 2D 7B-15 FA 20 1D-D1 DB 17 CD-DD 29 59 1E 60: 39 89 9E F6-79 46 9F E6-8B 85 C5 EF-DE C2 4E 46 70: C2 78 75 9D-8B 65 F4 50-EA 21 C5 D9-18 62 FF 7B 00: 37 75 C1 F1-C4 A7 5A E7-9C E0 DE 7A-5B 10 80 26 10: 02 AB D9 39-C9 6C 5F 02-12 C2 7F DA-CD 0D A3 B0 20: 8C ED FA F3-E1 A3 FD B4-EF 09 E7 FB-B1 C3 99 1D 30: CD 91 C8 45-E6 6E FD 3D-C7 BB 61 52-3E F4 E0 38 40: 49 11 85 69-EB CC 17 9C-93 4F 40 EB-33 02 AD 20 50: A4 09 2D FB-15 FA 20 1D-D1 DB 17 CD-DD 29 59 1E 60: 39 89 9E F6-79 46 9F E6-8B 85 C5 EF-DE 42 4F 46 70: C2 78 75 9D-8B 65 F4 50-EA 21 C5 59-18 62 FF 7B two blocks a few seconds in the middle (away from start or end) 84

Slide 85

Slide 85 text

What makes exploiting Fastcoll so difficult? Every collision differences is surrounded by random data: -> it’s usually impossible to declare a structure and its length in a single byte. (such as a variable-length comment). "Cheating" workaround: some code (executable, javascript) checks the difference in the collision block. 85

Slide 86

Slide 86 text

Extra constraint can be added manually inside FastColl source. Cf PoCorGTFO 14:11 Thankfully, there is UniColl and its unique powers. Workaround: bruteforcing (bruteforcing the collision block output, not the hash value) 99 // change q17 until conditions are met on q18, q 100 unsigned counter = 0; 101 while (counter < (1 << 7)) 102 { 103 const uint32 q16 = Q[Qoff + 16]; 104 uint32 q17 = ((xrng64() & 0x3ffd7ff7) | (q16& 105 ++counter; 106 107 uint32 q18 = GG(q17, q16, Q[Qoff + 15]) + tt1 108 q18 = RL(q18, 9); q18 += q17; 109 if (0x00020000 != ((q18^q17)&0xa0020000)) 110 continue; 111 112 uint32 q19 = GG(q18, q17, q16) + tt19; 113 q19 = RL(q19, 14); q19 += q18; 114 if (0x80000000 != (q19 & 0x80020000)) 115 continue; 116 117 uint32 q20 = GG(q19, q18, q17) + tt20; 118 q20 = RL(q20, 20); q20 += q19; 119 if (0x00040000 != ((q20^q19) & 0x80040000)) 120 continue; 121 122 block[1] = q17-q16; block[1] = RR(block[1], 5 123 uint32 q2 = block[1] + tt1; q2 = RL(q2, 12); 124 block[5] = tt5 - q2; 125 126 Q[Qoff + 2] = q2; 127 Q[Qoff + 17] = q17; 128 Q[Qoff + 18] = q18; 129 Q[Qoff + 19] = q19; 130 Q[Qoff + 20] = q20; 131 MD5_REVERSE_STEP(2, 0x242070db, 17); https://github.com/cr-marcstevens/hashclash/blob/master/src/md5fastcoll/block0.cpp#L101 https://github.com/angea/pocorgtfo#0x14 86

Slide 87

Slide 87 text

Instant computation doesn’t give any instant exploitation. -> Instant exploitation relies on pre-computed collisions and file format tricks. Recap 87

Slide 88

Slide 88 text

Basics of f ile formats (most) 88

Slide 89

Slide 89 text

Typical structure header : required at the start of the file. It defines the file type, versions, metadata... body comes after the header . It's made of several chunks that may be moved around. footer follows the body . It indicates that the file is complete. Parsers ignore any following data. 89

Slide 90

Slide 90 text

The “comment” block Most format accept a comment block of some kind. It usually can contain anything - not just text. -> perfect to skip collision blocks or extra data. They can be inserted several times - they’re just entirely skipped. -> perfect for padding, collision blocks and extra data. They are usually length-defined: -> give them a variable length via collision blocks differences. 90

Slide 91

Slide 91 text

clues Most files have all body chunks in a perfect and optimal arrangement, but parsers must be robust against weird structures or incomplete implementations. -> In practice, they just parse chunks and collect data on the way. And when a footer [or EOF ] is reached, they check if they have enough data to render something. If not the file is considered invalid. Robust parsers are 'detectives' Even if most files are perfectly structured, robust parsers behave more like detectives. 91

Slide 92

Slide 92 text

Die Kunst aufräumen - Ursus Wehrli A standard file (allegory) 92 Most f iles are perfectly structured They were generated by one of the standard libraries, in normal conditions, and with typical requirements. Corner cases

Slide 93

Slide 93 text

Abusing 'detective'parsers A detective looks for specific clues. Since parsers behave like detectives, we can move pieces of a file around, split them, hide them among rubbles. For most parsers, the presence/completeness/order of the files structures may not matter. 93

Slide 94

Slide 94 text

HHHH HHBB BBBB FFF HHHH HHCB CBBB CCCC CCCC BCBF FF?? ?? HHHH HHCB BBBB BFFF HHHH HHCC CCCC CCBB BBBB FFF? These f iles are equivalent (from a parser perspective). Same content, different structure. Turning one into another is usually (very) easy. Header Comment Body (chunks) Footer ? Appended data 94

Slide 95

Slide 95 text

Take two f iles… (of the same file type) 95

Slide 96

Slide 96 text

Plan a special common header. Same images dimensions? Color space? Remove some features. Flatten content. etc... 96

Slide 97

Slide 97 text

Compute the collision for this header. Padding and randomness with tiny differences. These differences follow some patterns that will be abused. Margin errors have to be mitigated. 97

Slide 98

Slide 98 text

Create a super f ile combining both f iles’ data. Both files’ Body and Footer are unmodified. The header has to be a common ground. The collision blocks differences will act like a switch to toggle between each content. 98

Slide 99

Slide 99 text

= ‽ = Collision Pref ix Suffix It’s an IPC, so their hash value is the same. 99

Slide 100

Slide 100 text

It's like a ski slope with 2 special jump ramps. Collision blocks Landing A Landing B 100

Slide 101

Slide 101 text

Each colliding f ile will render as one of the original pair. 101

Slide 102

Slide 102 text

102 102

Slide 103

Slide 103 text

Now let’s look at something different. 103

Slide 104

Slide 104 text

Poetry...? 104

Slide 105

Slide 105 text

Now we hash md5, no enemy cares! Only we gave the shards. ... A cryptico poem https://github.com/Jurph/word-decrementer 105

Slide 106

Slide 106 text

Now we hath md5, no enemy dares! Only we have the shares. ... Increment the 10th letter of each sentence. (leading spaces are tolerated) 106

Slide 107

Slide 107 text

Our second block - another Identical Pref ix Collision: UniColl. 107

Slide 108

Slide 108 text

Run its script on a pref ix scripts$ ./poc_no.sh prefix MD5 differential path toolbox Copyright (C) 2009 Marc Stevens http://homepages.cwi.nl/~stevens/ delta_m[2] = [!8!] In-block prefix words: 5 Parsed path: Q-3:|01100111 01000101 00100011 00000001| [...] Found collision! 2b3663b299b72c6b40d13ccd6c905a7d collision1.bin 2b3663b299b72c6b40d13ccd6c905a7d collision2.bin [...] scripts$ _ Mission scripts$ cat prefix Here is my prefix!!\n scripts$ du -b prefix 20 prefix scripts$ _ words of 32 bits https://github.com/cr-marcstevens/hashclash/releases https://github.com/cr-marcstevens/hashclash/blob/master/scripts/poc_no.sh ⚠ Use exactly this prefix for your first try! 108

Slide 109

Slide 109 text

Sometimes, unicoll just... fails! Just re-run it then! [...] 262144 9 370611 16 524288 19 Block 1: ./data/coll1_4205915269 53 75 43 d7 3b 33 9a fe e7 b7 ed bd ae a8 07 b9 f4 49 fa 94 34 01 54 db be 87 3c 39 af cd a1 82 c4 ea 3a f8 9b 7c ba d3 ac af 3d 47 a1 03 0d 34 7f ff 0c 58 92 bc 2b 8a a4 31 53 ee 2f 9b c1 f2 Block 2: ./data/coll2_4205915269 53 75 43 d7 3b 33 9a fe e7 b8 ed bd ae a8 07 b9 f4 49 fa 94 34 01 54 db be 87 3c 39 af cd a1 82 c4 ea 3a f8 9b 7c ba d3 ac af 3d 47 a1 03 0d 34 7f ff 0c 58 92 bc 2b 8a a4 31 53 ee 2f 9b c1 f2 Found collision! 2b3663b299b72c6b40d13ccd6c905a7d collision1.bin 2b3663b299b72c6b40d13ccd6c905a7d collision2.bin [...] t=12: 0% 10 20 30 40 50 60 70 80 90 |----|----|----|----|----|----|----|----|----|- *********************************************** Best path: totcompl=-1000 tottunnel=0, totcond=104857 Verified: 17780 bad out of 17780 Runtime: 88.9094 MD5 differential path toolbox Copyright (C) 2009 Marc Stevens http://homepages.cwi.nl/~stevens/ delta_m[2] = [!8!] Error: could not load path(s) in 'data/bestpath.bin.g cat: 'data/coll1_*': No such file or directory cat: 'data/coll2_*': No such file or directory 738994fa06fb97feec6de48887d6452d collision1.bin 3170e138bd0606df43c72d8051ba6184 collision2.bin Happy end Dead ends [...] 65536 4 126153 8 131072 8 Block 1: ./data/coll1_2664753446 ed 3f f0 88 4c 9a fe 58 f7 68 48 1f 22 28 22 62 20 27 15 9e 1b da cf d4 df b7 7d e3 b4 a1 6c 33 26 2a 58 3e 50 ca c9 3f 84 37 52 65 37 b6 ac fb 9a f9 93 73 49 f9 df b7 48 84 29 c8 cb db 68 dc Block 2: ./data/coll2_2664753446 ed 3f f0 88 4c 9a fe 58 f7 69 48 1f 22 28 22 62 20 27 15 9e 1b da cf d4 df b7 7d e3 b4 a1 6c 33 26 2a 58 3e 50 ca c9 3f 84 37 52 65 37 b6 ac fb 9a f9 93 73 49 f9 df b7 48 84 29 c8 cb db 68 dc Found collision! 0b37822e3e06d0e69e2b12d5f742f6d6 collision1.bin b7c77655f8a1d9b85c4ba7358939c9e4 collision2.bin 109

Slide 110

Slide 110 text

Output of a UniColl computation Characteristics: - Two blocks - A few minutes to compute Important difference with FastColl: - prefix as a part of the collision blocks (!!) -> no padding - differences: 10th char of prefix += 1 (!!) 10th char of 2nd block -= 1 00: .H .e .r .e . .i .s . .m .z . .p .r .e .f .i 10: .x .! .! \n 85 33 77 E3 4E 2D B4 F7 33 52 CD 17 20: 63 F0 24 11 8E 42 EE 0D 6D 73 1D 18 FA BA 3F 2D 30: 53 C6 C3 9E 17 F6 86 5F 44 EB 71 C4 24 FB 67 10 40: 53 75 43 D7 3B 33 9A FE E7 B7 ED BD AE A8 07 B9 50: F4 49 FA 94 34 01 54 DB BE 87 3C 39 AF CD A1 82 60: C4 EA 3A F8 9B 7C BA D3 AC AF 3D 47 A1 03 0D 34 70: 7F FF 0C 58 92 BC 2B 8A A4 31 53 EE 2F 9B C1 F2 00: .H .e .r .e . .i .s . .m .y . .p .r .e .f .i 10: .x .! .! \n 85 33 77 E3 4E 2D B4 F7 33 52 CD 17 20: 63 F0 24 11 8E 42 EE 0D 6D 73 1D 18 FA BA 3F 2D 30: 53 C6 C3 9E 17 F6 86 5F 44 EB 71 C4 24 FB 67 10 40: 53 75 43 D7 3B 33 9A FE E7 B8 ED BD AE A8 07 B9 50: F4 49 FA 94 34 01 54 DB BE 87 3C 39 AF CD A1 82 60: C4 EA 3A F8 9B 7C BA D3 AC AF 3D 47 A1 03 0D 34 70: 7F FF 0C 58 92 BC 2B 8A A4 31 53 EE 2F 9B C1 F2 110

Slide 111

Slide 111 text

A hybrid IPC where: - you can define the data around the first difference. - you can set the first difference: your text and your text +1 No other collision does that. A true Unicorn of a collision 111

Slide 112

Slide 112 text

Why +1 on the 10th character? Because crypto (due to specific MD5 properties) No, you can't change it as you like. The other working cases are not as easy to exploit. Other working cases: https://www.cwi.nl/system/files/PhD-Thesis-Marc-Stevens-Attacks-on-Hash-Functions-and-Applications.pdf#page=200 112

Slide 113

Slide 113 text

0000: .U .n .i .C .o .l .l . .2 . .p .r .e .f .i .x 0010: . .2 .0 .b 24 FA 3F 50 2F 7A B1 A7 04 DC 2F 39 0020: 07 E7 6F 33 B4 64 97 DD B1 95 8E F3 CB 60 18 B1 0030: 9F E9 DC B3 D8 03 FC 7C 52 40 8E 36 AF 0C 86 C7 0040: 8C 41 62 73 C9 B9 A7 EB 03 10 68 F0 5B 82 49 EE 0050: B6 77 D5 50 E2 B8 D7 A2 61 16 78 B0 35 24 1B 2F 0060: 5A 83 E2 E0 49 4F B7 0D 7D 7C E7 3F CC B7 F3 72 0070: 8A 55 71 A0 B2 34 6C 0E 45 EE 04 60 ED 33 62 BC 0000: .U .n .i C3 .o .l .l . .2 . .p .r .e .f .i .x 0010: . .2 .0 .b 24 FA 3F 50 2F 7A B1 27 04 DC 2F 39 0020: 07 E7 6F 33 B4 64 97 DD B1 95 8E F3 CB 60 18 B1 0030: 9F E9 DC B3 D8 03 FC 84 52 40 8E 36 AF 0C 86 C7 0040: 8C 41 62 F3 C9 B9 A7 EB 03 10 68 F0 5B 82 49 EE 0050: B6 77 D5 50 E2 B8 D7 A2 61 16 78 30 35 24 1B 2F 0060: 5A 83 E2 E0 49 4F B7 0D 7D 7C E7 3F CC B7 F3 72 0070: 8A 55 71 A0 B2 34 6C 06 45 EE 04 60 ED 33 62 BC 0000: .U .n .i .C .o .l .l . .3 . .p .r .e .f .i .x 0010: . .2 .0 .b EC D2 0C 56 2F 03 F6 66 D1 76 8F 87 0020: FF E4 7B EC F3 31 0A 65 66 B5 BD 6D F5 2B FD 1E 0030: 4D 2D 99 37 0C B6 1B D5 63 94 DC 2E DB 97 F2 10 0040: 22 BA 25 C4 F6 F7 EC C6 D7 0E DB 5D 18 DF 90 F9 0050: 6A C5 2A 0A CC 88 3C 7F 6C AE 24 71 F9 BF 76 17 0060: BE 60 AA DE 6F 0B 11 D0 52 E2 0E 85 BB 0B 8B 76 0070: A1 18 87 03 D2 9D 39 80 79 10 50 3F BC 17 65 01 0000: .U .n .i .C .o .l .l . .3 . .p .r .e .f .i .x 0010: . .2 .0 .b EC D2 0C 56 2F 04 F6 66 D1 76 8F 87 0020: FF E4 7B EC F3 31 0A E5 66 B5 BD 6D F5 2B FD 1E 0030: 4D 2D 99 37 0C B6 1B D5 63 94 DC 2E DB 97 F2 90 0040: 22 BA 25 C4 F6 F7 EC C6 D7 0E DB 5D 18 DF 90 F9 0050: 6A C5 2A 0A CC 88 3C 7F 6C AD 24 71 F9 BF 76 17 0060: BE 60 AA DE 6F 0B 11 50 52 E2 0E 85 BB 0B 8B 76 0070: A1 18 87 03 D2 9D 39 80 79 10 50 3F BC 17 65 81 With N=2: - less predictable difference + 16 f ixed bytes after the f irst difference With N=3: Difference on the last byte Other implemented variants: cf https://github.com/cr-marcstevens/hashclash/blob/master/scripts/poc_no.sh#L29-L44 N=1: "--diffm2 9" [by default] N=2: "--diffm13 28 --diffm0 32 --diffm6 32" N=3: "--diffm6 9 --diffm9 32 --diffm15 32" 113

Slide 114

Slide 114 text

The pref ix can be any size. Only its last block is integrated in the collision. (remember: no padding) 00: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20: 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30: 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40: .h .e .r .e . .i .s . .m .y . .p .r .e .f .i 50: .x .! .! 0a . 00: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20: 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30: 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40: .h .e .r .e . .i .s . .m .y . .p .r .e .f .i 50: .x .! .! 0a a4 8e d8 3f ae 42 a5 6b 47 e1 b4 72 60: 7a 86 27 96 60 3a e6 9a 8a 37 7d 2f 8e ac a6 ad 70: fd 56 ff d8 23 59 1c 81 da 57 1c 84 ee f5 17 07 80: 39 f9 b5 e5 d8 a6 c4 02 89 df e2 c0 82 1e f8 fa 90: 1e c3 c4 3e 77 17 12 98 d6 78 ed 80 dc 4f 83 86 a0: 21 68 77 44 e2 dc 81 c8 69 33 eb 95 3a 60 08 a0 b0: 05 37 f7 cc 0b b1 ee 94 76 0c af da 18 8b c2 57 00: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20: 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30: 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40: .h .e .r .e . .i .s . .m .z . .p .r .e .f .i 50: .x .! .! 0a a4 8e d8 3f ae 42 a5 6b 47 e1 b4 72 60: 7a 86 27 96 60 3a e6 9a 8a 37 7d 2f 8e ac a6 ad 70: fd 56 ff d8 23 59 1c 81 da 57 1c 84 ee f5 17 07 80: 39 f9 b5 e5 d8 a6 c4 02 89 de e2 c0 82 1e f8 fa 90: 1e c3 c4 3e 77 17 12 98 d6 78 ed 80 dc 4f 83 86 a0: 21 68 77 44 e2 dc 81 c8 69 33 eb 95 3a 60 08 a0 b0: 05 37 f7 cc 0b b1 ee 94 76 0c af da 18 8b c2 57 Pref ix collision blocks 114

Slide 115

Slide 115 text

Length multiple of 4 (otherwise it won't work as intended) 2nd rule of UniColl's last pref ix block $ md5sum collision* 43a22967d7d6343da5c50da277f63f62 collision1.bin 43a22967d7d6343da5c50da277f63f62 collision2.bin $ xxd prefix 00000000: 70 p $ xxd collision1.bin | head -1 00000000: c830 2859 684c dc50 cbba 8f0f 8fa7 48ef .0(YhL.P......H. $ md5sum collision* 47bc2a72c2885bcc624342fe8d3756fd collision1.bin 478ccf32058daf9d1fa44fd78959ed50 collision2.bin $ xxd prefix 00000000: 7070 7070 pppp $ xxd collision1.bin | head -1 00000000: 7070 7070 2c65 975b e9de 9dd9 98dc 7cd4 pppp,e.[......|. If not, the collision block doesn't start with the prefix' content. If its length is a multiple of 4, the end of the prefix’s last block is in the collision block. 115

Slide 116

Slide 116 text

If that part is longer than 20 bytes, it may never collide. -> increase delays in the script. 3rd rule of UniColl's last pref ix block $ diff poc_no.sh long_poc_no.sh 11c11 < data=200000 --- > data=1000000 56c56 < sleep 10 --- > sleep 120 116

Slide 117

Slide 117 text

000: .H .e .r .e . .i .s . .m .y . .l .o .n .g . 010: .p .r .e .f .i .x .! \n 17 ef 03 3a 3b 0b d8 ba 020: 11 0c 27 fe 71 8c ec 39 ab 48 97 fb 81 8e 7a 50 030: 4c 5d 44 73 05 08 f7 ff 16 06 44 db ea 1c 8b 50 040: 70 f4 66 04 c8 23 16 b0 83 99 e5 76 09 92 13 f0 050: 3e 3e d2 bb d9 fb 3e 00 78 64 b4 89 af 98 fb bd 060: aa e1 03 6b 77 61 46 3b 84 d4 25 a7 3b 00 09 1a 070: 23 b9 e2 26 fd 35 6c d0 e4 56 a0 b5 fe 3d 28 47 000: .H .e .r .e . .i .s . .m .z . .l .o .n .g . 010: .p .r .e .f .i .x .! \n 17 ef 03 3a 3b 0b d8 ba 020: 11 0c 27 fe 71 8c ec 39 ab 48 97 fb 81 8e 7a 50 030: 4c 5d 44 73 05 08 f7 ff 16 06 44 db ea 1c 8b 50 040: 70 f4 66 04 c8 23 16 b0 83 98 e5 76 09 92 13 f0 050: 3e 3e d2 bb d9 fb 3e 00 78 64 b4 89 af 98 fb bd 060: aa e1 03 6b 77 61 46 3b 84 d4 25 a7 3b 00 09 1a 070: 23 b9 e2 26 fd 35 6c d0 e4 56 a0 b5 fe 3d 28 47 24 bytes: real 2m21.203s user 33m3.508s sys 0m55.864s Standard version Slower version 000: .H .e .r .e . .i .s . .m .y . .l .o .n .g . 010: .p .r .e .f .i .x .! .0 .1 .2 .3 0a a5 4d 0a a2 020: 4a 9e 0e b1 20 bc df 89 bf ed d3 eb bb e2 e9 6f 030: e9 fa 24 39 02 42 4f 8b 77 77 8c 50 0f ff a7 86 040: b4 7a e4 de 00 27 f8 c7 ad ef b1 2d 25 35 f7 9f 050: fa 01 64 3c 06 8a 5b 66 ad 46 fa 5f 11 ea 91 c6 060: d3 70 11 45 57 dd 8a 0f b8 af 4d 0d d2 d2 40 43 070: 48 c0 22 4d 67 b9 b2 5b 0a 98 ff e0 7f d3 7b 6d 000: .H .e .r .e . .i .s . .m .z . .l .o .n .g . 010: .p .r .e .f .i .x .! .0 .1 .2 .3 0a a5 4d 0a a2 020: 4a 9e 0e b1 20 bc df 89 bf ed d3 eb bb e2 e9 6f 030: e9 fa 24 39 02 42 4f 8b 77 77 8c 50 0f ff a7 86 040: b4 7a e4 de 00 27 f8 c7 ad ee b1 2d 25 35 f7 9f 050: fa 01 64 3c 06 8a 5b 66 ad 46 fa 5f 11 ea 91 c6 060: d3 70 11 45 57 dd 8a 0f b8 af 4d 0d d2 d2 40 43 070: 48 c0 22 4d 67 b9 b2 5b 0a 98 ff e0 7f d3 7b 6d 28 bytes: real 13m21.452s user 227m35.496s sys 3m27.896s 117

Slide 118

Slide 118 text

📏 ⌛ ‽ Slightly slower, but easy to exploit. UniColl UniColl two blocks A few minutes In pref ix 00: .H .e .r .e . .i .s . .m .z . .p .r .e .f .i 10: .x .! .! \n 85 33 77 E3 4E 2D B4 F7 33 52 CD 17 20: 63 F0 24 11 8E 42 EE 0D 6D 73 1D 18 FA BA 3F 2D 30: 53 C6 C3 9E 17 F6 86 5F 44 EB 71 C4 24 FB 67 10 40: 53 75 43 D7 3B 33 9A FE E7 B7 ED BD AE A8 07 B9 50: F4 49 FA 94 34 01 54 DB BE 87 3C 39 AF CD A1 82 60: C4 EA 3A F8 9B 7C BA D3 AC AF 3D 47 A1 03 0D 34 70: 7F FF 0C 58 92 BC 2B 8A A4 31 53 EE 2F 9B C1 F2 00: .H .e .r .e . .i .s . .m .y . .p .r .e .f .i 10: .x .! .! \n 85 33 77 E3 4E 2D B4 F7 33 52 CD 17 20: 63 F0 24 11 8E 42 EE 0D 6D 73 1D 18 FA BA 3F 2D 30: 53 C6 C3 9E 17 F6 86 5F 44 EB 71 C4 24 FB 67 10 40: 53 75 43 D7 3B 33 9A FE E7 B8 ED BD AE A8 07 B9 50: F4 49 FA 94 34 01 54 DB BE 87 3C 39 AF CD A1 82 60: C4 EA 3A F8 9B 7C BA D3 AC AF 3D 47 A1 03 0D 34 70: 7F FF 0C 58 92 BC 2B 8A A4 31 53 EE 2F 9B C1 F2 118

Slide 119

Slide 119 text

119

Slide 120

Slide 120 text

Your f irst hash collision exploit 120

Slide 121

Slide 121 text

Prepare 1. Study format specs, look for features that you need. 2. Choose attack: FastColl, UniColl [tree]... 3. Plan your file structure (pen & specs). Craft 4. Craft mockup files: check compatibility, CRCs… 5. Ignore collision ranges to simulate colliding files. Compute 6. Extract prefixes from mockups. 7. Run computation(s). Plan your exploit ⇤ ⇥ #&%!@ …‽… …🛑? A mockup f ile before computation 121 Padding, for alignments Collision blocks’ randomness needs to be ignored Differences need to be taken into account Two contents need to co-exist.

Slide 122

Slide 122 text

What makes exploiting UniColl so easy? The first difference is surrounded by chosen text: no restrictions to declare a length before or after a type. The difference is +1, which makes it trivial to plan the impact. I.E. one chunk will be exactly 0x100 longer than the other, which is bigger than the collision block but doesn’t grow uncontrollably. FastColl: UniColl: 61 52 3E ⇔ 61 D2 3E 00 71 .c .O .L .L ⇔ 01 71 .c .O .L .L 122

Slide 123

Slide 123 text

1. A fixed-length comment for padding. 2. A variable length comment at the start of collision blocks. 3. Using collision blocks to grow this comment over a first file’s data, followed by a second’s file data. Layout of a classic collision+format exploitation Collision Alignment Suffix Pref ix 123 Signature Padding Collision Chunk A Chunk B Comment Comment

Slide 124

Slide 124 text

Case A (short comment) Case B (long comment) 124

Slide 125

Slide 125 text

Plan your generic exploit Getting an exploit PoC (pair) is great to convince/test! Making a script to instantly generate any PoC is even better! Explore the format landscape, standard implementations. Understand compatibility in depth. 125

Slide 126

Slide 126 text

Making it generic The size of {Chunk A } is unknown in advance. -> one extra comment to jump over these chunks with its declaration toggled by the variable comment Collision Alignment Suf f ix Pref ix 126

Slide 127

Slide 127 text

Short collision comment Long collision comment A chain of three comments Collision Collision ‽ = = 127

Slide 128

Slide 128 text

Generic exploitation is sometimes hard. Identify required structures of the format. Check structure sizes: constant? if not, what are the margins? Explore tools and options: Merging (PDF pages, GIF frames) then selectively hiding is a quick way to normalize 2 contents. Some minor tools’ output might be optimal for manipulation. 128

Slide 129

Slide 129 text

Exploiting PNG with UniColl 129

Slide 130

Slide 130 text

The most regular of the common formats: a signature then a sequence of chunks. The Portable Network Graphics format /ˌpiːɛnˈdʒiː/ PEE-en-JEE /pɪŋ/ PING Signature Chunk 130

Slide 131

Slide 131 text

The PNG signature - enforced at offet 0 - fixed, always the same 8 bytes: 89 50 4E 47 0D 0A 1A 0A (Trivia) it's made of special characters to detect various errors: \x89 P N G \r \n ^Z \n End Of File non ASCII Line feed Line feed Carriage return 131

Slide 132

Slide 132 text

The PNG format at chunk level - the length , big endian on 4 bytes. - the type , on 4 letters. - the data , of the given length . - the CRC of type and data . - they are usually ignored 132

Slide 133

Slide 133 text

Lower case-typed chunks are ignored first letter: - uppercase == critical: Standard: IHDR Header / PLTE Palette / IDAT Data /IEND end Non-standard: CgBI Apple custom PNG - lowercase == secondary: In the specs: ignored if not in the specs: aLIG / cOLL / sKIP http://www.libpng.org/pub/png/spec/1.2/PNG-Structure.html#Chunk-naming-conventions bKGD cHRM gAMA hIST iCCP pHYs tIME tRNS sBIT sPLT sRGB tEXt iTXt zTXt 133

Slide 134

Slide 134 text

134 00000430: 8C F5 51 C6-58 1F 65 8C-F5 51 C6 58-1F 65 8C F5 î⌡Q╞X eî⌡Q╞X eî⌡ 00000440: 51 C6 58 1F-65 8C F5 51-C6 58 1F 65-8C D5 51 C6 Q╞X eî⌡Q╞X eî╒Q╞ 00000450: 58 13 65 8C-05 51 C6 58-10 65 8C F5-51 C6 58 1F X eî Q╞X eî⌡Q╞X 00000460: 65 8C F5 51-C6 58 1F 65-8C F5 51 C6-58 1F 65 8C eî⌡Q╞X eî⌡Q╞X eî 00000470: F5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ⌡Q╞X eî⌡Q╞X eî⌡Q 00000480: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 00000490: 1F 65 8C F5-51 C6 58 1F-65 8C E5 51-76 CE 18 65 eî⌡Q╞X eîσQv╬ e 000004A0: 7D 8C 51 F6-D3 62 8C 32-C6 28 13 63-94 31 46 19 }îQ÷╙bî2╞( cö1F 000004B0: 63 94 89 31-CA 18 A3 EC-3B C7 18 65-8C 51 26 C6 cöë1╩ ú∞;╟ eîQ&╞ 000004C0: 28 63 8C 32-C6 28 13 63-94 31 46 D9-F7 8E 31 CA (cî2╞( cö1F┘≈Ä1╩ 000004D0: 18 A3 4C 8C-51 C6 18 65-8C 51 26 C6-28 63 8C 32 úLîQ╞ eîQ&╞(cî2 000004E0: 31 46 19 63-94 31 46 99-18 A3 8C 31-CA 18 A3 4C 1F cö1FÖ úî1╩ úL 000004F0: 8C 51 C6 18-65 62 8C 32-C6 28 63 8C-32 31 46 19 îQ╞ ebî2╞(cî21F 00000500: 63 94 31 46-99 18 A3 8C-31 CA C4 18-65 8C 51 C6 cö1FÖ úî1╩─ eîQ╞ 00000510: 18 65 62 8C-32 C6 28 63-8C 32 31 46-19 63 94 89 ebî2╞(cî21F cöë 00000520: 31 CA 18 A3-8C 31 CA C4-18 65 8C 51-C6 98 28 63 1╩ úî1╩─ eîQ╞ÿ(c 00000530: 8C 32 C6 28-13 63 94 31-46 19 63 94-89 31 CA 18 î2╞( cö1F cöë1╩ 00000540: A3 8C 31 51-C6 18 65 8C-51 C6 98 28-63 8C 32 C6 úî1Q╞ eîQ╞ÿ(cî2╞ 00000550: 28 13 63 94-31 46 19 63-A2 8C 31 CA-18 A3 8C 31 ( cö1F cóî1╩ úî1 00000560: 51 C6 18 65-8C 89 32 C6-28 63 8C 32-C6 44 19 63 Q╞ eîë2╞(cî2╞D c 00000570: 94 31 46 19-63 A2 8C 31-CA 18 13 65-8C 51 C6 18 ö1F cóî1╩ eîQ╞ 00000580: 65 8C 89 32-C6 28 63 8C-32 C6 44 19-63 94 31 26 eîë2╞(cî2╞D cö1& 00000590: CA 18 A3 8C-31 CA 18 13-65 8C 51 C6-18 65 8C 89 ╩ úî1╩ eîQ╞ eîë 000005A0: 32 C6 28 63-4C 94 31 46-19 63 94 31-26 CA 18 A3 2╞(cLö1F cö1&╩ ú 000005B0: 8C 31 BD 54-19 63 A2 8C-31 CA 18 D3-C5 E5 2F 34 î1╜T cóî1╩ ╙┼σ/4 000005C0: 76 FE EF FB-24 3B 99 18-A3 8C 31 CA-E4 9F 4C 8C v■∩√$;Ö úî1╩ΣƒLî 000005D0: 51 C6 18 65-62 8C 32 C6-28 63 8C 32-31 46 19 63 Q╞ ebî2╞(cî21F c 000005E0: 94 89 31 CA-18 A3 8C 31-CA C4 18 65-8C 51 C6 18 öë1╩ úî1╩─ eîQ╞ 000005F0: 65 62 8C 32-C6 28 13 63-94 31 46 19-63 94 89 31 ebî2╞( cö1F cöë1 00000600: CA 18 A3 8C-31 CA C4 18-65 8C 51 26-C6 28 63 8C ╩ úî1╩─ eîQ&╞(cî 00000610: 32 C6 28 13-63 94 31 46-19 63 94 89-31 CA 18 A3 2╞( cö1F cöë1╩ ú 00000620: 4C 8C 51 C6-18 65 8C 51-26 C6 28 63-8C 32 C6 44 LîQ╞ eîQ&╞(cî2╞D 00000630: 19 63 94 31-46 99 18 A3-8C 31 CA 18-A3 4C 8C 51 cö1FÖ úî1╩ úLîQ 00000640: C6 18 65 8C-89 32 C6 28-63 8C 32 C6-44 19 63 94 ╞ eîë2╞(cî2╞D cö 00000650: 31 46 99 18-A3 8C 31 CA-18 13 65 8C-51 C6 18 65 1FÖ úî1╩ eîQ╞ e 00000660: 8C 89 32 C6-28 63 4C 94-31 46 19 63-94 31 26 CA îë2╞(cLö1F cö1&╩ 00000670: 18 A3 8C 31-CA 18 13 65-8C 51 C6 98-28 63 8C 32 úî1╩ eîQ╞ÿ(cî2 00000680: C6 28 63 4C-94 31 46 19-63 94 31 26-CA 18 A3 8C ╞(cLö1F cö1&╩ úî 00000690: 31 51 C6 18-65 8C 51 C6-98 28 63 8C-32 C6 28 63 1Q╞ eîQ╞ÿ(cî2╞(c 000006A0: 4C 94 31 46-19 63 A2 8C-31 CA 18 A3-8C 31 51 C6 Lö1F cóî1╩ úî1Q╞ 000006B0: 18 65 DF D4-98 28 63 8C-32 C6 44 19-63 94 31 46 e▀╘ÿ(cî2╞D cö1F 000006C0: 19 63 A2 8C-31 CA BE BF-31 51 C6 18-65 8C 89 32 cóî1╩╛┐1Q╞ eîë2 000006D0: C6 28 63 8C-32 C6 44 19-63 94 31 A6-1F A7 8C B1 ╞(cî2╞D cö1ª ºî▒ 000006E0: 73 CA 18 8B-3B 38 3C A0-8C B1 7A 1A-94 D5 31 46 s╩ ï;8<áî▒z ö╒1F 000006F0: 59 1F 63 94-F5 31 46 59-1F 63 94 F5-31 46 59 1F Y cö⌡1FY cö⌡1FY 00000700: 63 94 F5 31-46 59 1F 63-94 F5 31 46-59 1F 63 94 cö⌡1FY cö⌡1FY cö 00000710: F5 31 46 59-1F 63 94 F5-31 46 59 1F-63 94 F5 31 ⌡1FY cö⌡1FY cö⌡1 00000720: 46 59 1F 63-94 F5 31 46-59 1F 63 94-F5 31 46 59 FY cö⌡1FY cö⌡1FY 00000730: 1F 63 94 F5-31 46 59 1F-63 94 D5 31-46 59 1D 63 cö⌡1FY cö╒1FY c 00000740: 94 D5 31 46-59 1D 63 94-D5 31 46 59-1D 63 94 D5 ö╒1FY cö╒1FY cö╒ 00000750: 31 46 59 1D-63 94 D5 31-46 59 1D 63-94 D5 31 46 1FY cö╒1FY cö╒1F 00000760: 59 1D 63 94-D5 31 46 59-1D 63 94 D5-31 46 59 1D Y cö╒1FY cö╒1FY 00000770: 63 94 D5 31-46 59 1D 63-94 D5 31 46-59 1D 63 94 cö╒1FY cö╒1FY cö 00000780: D5 31 46 59-6E 8C 31 CA-62 65 8C DD-45 D9 EB 63 ╒1FYnî1╩beî▌E┘δc 00000790: 2C 8C 32 C6-6A 63 94 DD-C5 58 1C 65-8C F5 51 C6 ,î2╞jcö▌┼X eî⌡Q╞ 000007A0: 58 1F 65 8C-F5 51 C6 58-1F 65 8C F5-51 C6 58 1F X eî⌡Q╞X eî⌡Q╞X 000007B0: 65 8C F5 51-C6 58 1F 65-8C F5 51 C6-58 1F 65 8C eî⌡Q╞X eî⌡Q╞X eî 000007C0: F5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ⌡Q╞X eî⌡Q╞X eî⌡Q 000007D0: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 000007E0: 1F 65 8C F5-51 C6 58 1D-65 8C D5 51-C6 58 1D 65 eî⌡Q╞X eî╒Q╞X e 000007F0: 8C D5 51 C6-58 1D 65 8C-D5 51 C6 58-1D 65 8C D5 î╒Q╞X eî╒Q╞X eî╒ 00000800: 51 C6 58 1D-65 8C D5 51-C6 58 1D 65-8C D5 51 C6 Q╞X eî╒Q╞X eî╒Q╞ 00000810: 58 1D 65 8C-D5 51 C6 58-1D 65 8C D5-51 C6 58 1D X eî╒Q╞X eî╒Q╞X 00000820: 65 8C D5 51-C6 58 1D 65-8C D5 51 C6-58 1E 65 A7 eî╒Q╞X eî╒Q╞X eº 00000830: 8C D5 51 F6-9F 31 CA D2-4E AE B9 A5-83 01 00 00 î╒Q÷ƒ1╩╥N«╣Ñâ 00000840: 00 06 42 F3-A7 DE F3 1C-8A A1 01 CB-A0 63 2D A3 B≤º▐≤ èí ╦ác-ú 00000850: 8E B5 0C 3D-06 2C 03 8E-B5 4C 39 C6-2D 03 8E B5 Ä╡ = , Ä╡L9╞- Ä╡ 00000860: CC 3C 06 2C-03 8E B5 CC-3C 06 2C 03-8E B5 CC 3C ╠< , Ä╡╠< , Ä╡╠< 00000870: 06 2C 03 8E-B5 CC 3C 06-2C 03 8E B5-CC 3C 06 2C , Ä╡╠< , Ä╡╠< , 00000880: 03 8E B5 CC-3C 06 2C 03-8E B5 CC 3C-06 2C 03 8E Ä╡╠< , Ä╡╠< , Ä 00000890: B5 CC 3C 06-2C 03 8E B5-CC 3C 06 2C-03 8E B5 4C ╡╠< , Ä╡╠< , Ä╡L 000008A0: 3A 06 2C 03-8E 01 CB C4-63 2D 03 8E-01 CB C4 63 : , Ä ╦─c- Ä ╦─c 000008B0: 2D 03 8E 01-CB C4 63 2D-03 8E 01 CB-A4 63 C0 B2 - Ä ╦─c- Ä ╦ñc└▓ 000008C0: 8E 41 CB A4-63 C0 B2 8E-41 CB A4 63-C0 B2 8E 41 ÄA╦ñc└▓ÄA╦ñc└▓ÄA 000008D0: CB A4 63 C0-B2 8E BD 5D-3A B4 61 20-08 A2 28 B6 ╦ñc└▓Ä╜]:┤a ó(╢ 000008E0: 20 FD D7 1C-38 FC 23 EB-F4 5C 83 F7-65 1D 6B D9 ²╫ 8ⁿ#δ⌠\â≈e k┘ 000008F0: 7E 6C 5B D6-B1 96 ED C7-6E 59 C7 5A-B6 1F DB 97 ~l[╓▒ûφ╟nY╟Z╢ █ù 00000900: 75 AC 65 FB-B1 7D 59 C7-5A 76 C7 F6-65 1D 6B D9 u¼e√▒}Y╟Zv╟÷e k┘ 00000910: 7E 6C 5F D6-B1 96 ED C7-6E 59 C7 5A-B6 1F DB 97 ~l_╓▒ûφ╟nY╟Z╢ █ù 00000920: 75 AC 65 DB-B1 61 59 C7-5A 36 1C 1B-96 75 AC 65 u¼e█▒aY╟Z6 ûu¼e 00000930: FB B1 5B D6-B1 96 0D C7-86 65 1D 6B-D9 70 6C 58 √▒[╓▒û ╟åe k┘plX 00000940: D6 B1 96 0D-C7 86 65 1D-6B D9 70 6C-58 D6 B1 96 ╓▒û ╟åe k┘plX╓▒û 00000950: DD 31 60 19-70 AC 65 F2-B1 5B D6 B1-96 0D C7 86 ▌1` p¼e≥▒[╓▒û ╟å 00000960: 65 1D 6B D9-70 6C 58 D6-B1 96 DD 31-60 19 72 AC e k┘plX╓▒û▌1` r¼ 00000970: 65 FE B1 5B-D6 B1 96 DD-31 60 19 74-AC 65 FE B1 e■▒[╓▒û▌1` t¼e■▒ 00000980: 5B D6 B1 96-DD 31 60 19-75 AC 65 FE-B1 5B D6 B1 [╓▒û▌1` u¼e■▒[╓▒ 00000990: 96 DD 31 60-19 75 AC 65-FE B1 5B 46-1D 6B 99 75 û▌1` u¼e■▒[F kÖu 000009A0: CC 5F E6 1F-6B D9 1D F3-97 F9 C7 5A-36 1C F3 97 ╠_µ k┘ ≤ù∙╟Z6 ≤ù 000009B0: F9 C7 5A 76-C7 FC 65 FE-B1 96 0D C7-FC 65 FE B1 ∙╟Zv╟ⁿe■▒û ╟ⁿe■▒ 000009C0: 96 FD DE 03-96 F1 C7 5A-E6 1F BB 65-D4 B1 96 01 û²▐ û±╟Zµ ╗e╘▒û 000009D0: C7 DC 65 FE-B1 96 DD 31-65 99 7F AC-65 FE B1 5B ╟▄e■▒û▌1eÖ¼e■▒[ 000009E0: 46 1D 6B 19-70 4C 5C E6-1F 6B D9 1D-B3 96 F9 C7 F k pL\µ k┘ │û∙╟ 000009F0: 5A E6 1F BB-65 D4 B1 96-01 C7 C8 65-FE B1 96 DD Zµ ╗e╘▒û ╟╚e■▒û▌ 00000A00: 31 6A 99 7F-AC 65 FE B1-5B 46 1D 6B-19 70 4C 59 1jÖ¼e■▒[F k pLY 00000A10: E6 1F 6B D9-1D 73 97 F9-C7 5A E6 1F-BB 65 D4 B1 µ k┘ sù∙╟Zµ ╗e╘▒ 00000A20: 96 01 C7 80-65 FC B1 96-DD 31 77 99-7F AC 65 FB û ╟Çeⁿ▒û▌1wÖ¼e√ 00000A30: 31 7F 99 7F-AC 65 77 4C-5F E6 1F 6B-D9 7E CC 5F 1Ö¼ewL_µ k┘~╠_ 00000A40: E6 1F 6B D9-1D F3 97 F9-C7 5A E6 1F-BB 65 F6 B1 µ k┘ ≤ù∙╟Zµ ╗e÷▒ 00000A50: 96 ED C7 FC-65 FE B1 96-F9 C7 6E 99-7D AC 65 FB ûφ╟ⁿe■▒û∙╟nÖ}¼e√ 00000A60: 31 7F 99 7F-AC 65 FE B1-5B 66 1F 6B-D9 7E CC 5F 1Ö¼e■▒[f k┘~╠_ 00000A70: E6 1F 6B 99-7F EC 96 D9-C7 5A B6 1F-F3 97 F9 C7 µ kÖ∞û┘╟Z╢ ≤ù∙╟ 00000A80: 5A E6 1F BB-65 F6 B1 96-ED C7 FC 65-FE B1 96 F9 Zµ ╗e÷▒ûφ╟ⁿe■▒û∙ 00000A90: C7 6E 19 75-AC 65 D3 31-7F 19 75 AC-65 D3 31 7F ╟n u¼e╙1 u¼e╙1 00000AA0: 19 75 AC 65-D3 31 7F 19-75 AC 65 D3-31 7F 19 75 u¼e╙1 u¼e╙1 u 00000AB0: AC 65 D3 31-7F 19 75 AC-65 D3 31 7F-19 75 AC 65 ¼e╙1 u¼e╙1 u¼e 00000AC0: D3 31 7F 19-75 AC 65 D3-31 7F 19 75-AC 65 D3 31 ╙1 u¼e╙1 u¼e╙1 00000AD0: 7F 19 75 AC-65 D3 31 7F-19 75 AC 65-D3 31 7F 19  u¼e╙1 u¼e╙1 00000AE0: 75 AC 65 D3-31 7F 19 75-AC 65 D3 31-7F 19 75 AC u¼e╙1 u¼e╙1 u¼ 00000AF0: 65 D3 31 7F-19 75 AC 65-D3 31 7F 19-75 AC 65 D3 e╙1 u¼e╙1 u¼e╙ 00000B00: 31 7F 19 75-AC 65 D3 31-7F 19 75 AC-65 D3 31 7F 1 u¼e╙1 u¼e╙1 00000B10: 19 75 AC 65-FC B1 7D 59-C7 A8 65 FB-31 78 59 C7 u¼eⁿ▒}Y╟¿e√1xY╟ 00000B20: A8 65 FB 31-78 59 C7 A8-65 5F 3A 96-FC 01 2A EE ¿e√1xY╟¿e_:ûⁿ *ε 00000B30: B0 6C 0B 6E-B3 BA 00 00-00 00 49 45-4E 44 AE 42 ░l n│║ IEND«B 00000B40: 60 82 - - - `é 00000000: 89 50 4E 47-0D 0A 1A 0A-00 00 00 0D-49 48 44 52 ëPNG IHDR 00000010: 00 00 02 64-00 00 02 64-08 03 00 00-00 88 CF CD d d ê╧═ 00000020: 8E 00 00 00-24 50 4C 54-45 FF FF FF-FF 7D 7D FF Ä $PLTE }} 00000030: 6F 6F FF FE-FE FF 7E 7E-FF 00 00 FF-80 80 FF 6D oo ■■ ~~ ÇÇ m 00000040: 6D FF 6E 6E-FF 30 30 FF-FD FD FF 2F-2F A6 F0 78 m nn 00 ²² //ª≡x 00000050: 4E 00 00 0A-D9 49 44 41-54 78 DA EC-D2 D1 09 5A N ┘IDATx┌∞╥╤ Z 00000060: 01 14 86 31-B5 DE EE 3F-72 1F CF 00-3F 94 20 5F å1╡▐ε?r ╧ ?ö _ 00000070: 66 C8 EB BF-79 7F 5E 8C-FC F9 7C 5F-BF E7 FD 3C f╚δ┐y^îⁿ∙|_┐τ²< 00000080: 2D 83 8E 3D-CF F7 17 8F-B5 8C 3A E6-2E 1B 8E 51 -âÄ=╧≈ Å╡î:µ. ÄQ 00000090: CB 3A 36 2C-73 8F 51 CB-3A 36 2C 73-8F 51 CB 3A ╦:6,sÅQ╦:6,sÅQ╦: 000000A0: 36 2C 73 8F-51 CB 3A 36-2C 73 8F 51-CB 3A 36 2C 6,sÅQ╦:6,sÅQ╦:6, 000000B0: 73 8F 51 CB-3A E6 2E 1B-8E 51 CB 3A-E6 2E 1B 8E sÅQ╦:µ. ÄQ╦:µ. Ä 000000C0: 51 CB 3A E6-2E 1B 8E 51-CB 3A E6 2E-1B 8E 51 CB Q╦:µ. ÄQ╦:µ. ÄQ╦ 000000D0: 3A E6 2E 1B-8E 51 CB 3A-E6 2E 1B 8E-51 CB 3A E6 :µ. ÄQ╦:µ. ÄQ╦:µ 000000E0: 2E 1B 8E 51-CB 3A E6 2E-1B 8E 59 CB-3A E6 2F 1B . ÄQ╦:µ. ÄY╦:µ/ 000000F0: 8E F9 CB 3A-26 2F 1B 8E-B5 8C 3A 26-2F 1B 8E B5 Ä∙╦:&/ Ä╡î:&/ Ä╡ 00000100: 8C 3A 26 2F-1B 8E B5 8C-3A 26 2F 1B-8E B5 8C 3A î:&/ Ä╡î:&/ Ä╡î: 00000110: 26 2F 1B 8E-B5 8C 3A 26-2F 1B 8E B5-8C 3A E6 2F &/ Ä╡î:&/ Ä╡î:µ/ 00000120: BB 63 2D F3-8F F9 CB F6-63 2D 33 8F-F9 CB EE 58 ╗c-≤Å∙╦÷c-3Å∙╦εX 00000130: CB FC 63 FE-B2 FD 58 CB-CC 63 B7 CC-3F D6 32 FF ╦ⁿc■▓²X╦╠c╖╠?╓2 00000140: 98 BF 6C 3F-D6 32 F3 D8-2D F3 8F B5-CC 3F E6 2F ÿ┐l?╓2≤╪-≤Å╡╠?µ/ 00000150: DB 8F B5 CC-3C 76 CB FC-63 2D F3 8F-F9 CB F6 63 █Å╡╠µ/ 00000180: BB 63 D4 B2-8E 01 CB 80-63 F8 B2 8E-DD 32 F9 98 ╗c╘▓Ä ╦Çc°▓Ä▌2∙ÿ 00000190: BF AC 63 FE-B2 3B 46 2D-EB 18 B0 CC-38 E6 2F EB ┐¼c■▓;F-δ ░╠8µ/δ 000001A0: D8 2D 33 8F-F9 CB 3A E6-2F BB 63 D4-B2 8E 01 CB ╪-3Å∙╦:µ/╗c╘▓Ä ╦ 000001B0: A4 63 FE B2-8E DD 32 ED-98 BF AC 63-FE B2 3B 46 ñc■▓Ä▌2φÿ┐¼c■▓;F 000001C0: 2D EB 18 B0-CC 3B E6 2F-EB D8 2D 73-8E F9 CB 3A -δ ░╠;µ/δ╪-sÄ∙╦: 000001D0: E6 2F BB 63-D4 B2 8E 01-CB D4 63 FE-B2 8E DD 32 µ/╗c╘▓Ä ╦╘c■▓Ä▌2 000001E0: F9 98 BF AC-63 C3 32 FF-98 BF AC 63-E7 2F 70 0C ∙ÿ┐¼c├2 ÿ┐¼cτ/p 000001F0: 5F D6 31 7F-D9 1D A3 96-75 0C 58 E6-1F F3 97 75 _╓1┘ úûu Xµ ≤ùu 00000200: EC 96 01 C7-D8 65 1D F3-97 DD 31 6A-59 C7 98 65 ∞û ╟╪e ≤ù▌1jY╟ÿe 00000210: FE 31 7F 59-C7 6E 19 70-0C 5C D6 31-7F D9 1D 6B ■1Y╟n p \╓1┘ k 00000220: 59 C7 6E 19-70 8C 59 D6-31 7F D9 1D-6B 59 C7 6E Y╟n pîY╓1┘ kY╟n 00000230: 19 70 0C 5A-D6 31 7F D9-1D 6B 59 C7-6E 19 70 8C p Z╓1┘ kY╟n pî 00000240: 5A D6 31 7F-D9 1D 6B 59-C7 6E 19 70-CC 59 D6 31 Z╓1┘ kY╟n p╠Y╓1 00000250: 7F D9 1D 6B-59 C7 C6 65-FE B1 96 DD-31 7F D9 7E ┘ kY╟╞e■▒û▌1┘~ 00000260: AC 65 1D DB-97 DD B1 96-75 6C 5B 36-1C 6B 59 C7 ¼e █ù▌▒ûul[6 kY╟ 00000270: F6 65 77 AC-65 1D 9B 96-0D C7 5A D6-B1 5B B6 1F ÷ew¼e ¢û ╟Z╓▒[╢ 00000280: 6B 59 C7 A6-65 C3 B1 96-75 EC 96 4D-C7 5A D6 B1 kY╟ªe├▒ûu∞ûM╟Z╓▒ 00000290: 61 D9 70 AC-65 1D BB 65-D3 B1 96 75-6C 5F B6 1F a┘p¼e ╗e╙▒ûul_╢ 000002A0: FB C7 8E 5D-1D 84 01 45-51 10 4C 70-E9 BF 5E 1C √╟Ä] ä EQ LpΘ┐^ 000002B0: CE 27 BA E8-6C 0B 77 9E-52 C6 D8 94-35 C6 28 63 ╬'║Φl w₧R╞╪ö5╞(c 000002C0: 6C CA 02 63-94 31 36 65-B1 31 CA 18-9B B2 CA 18 l╩ cö16e▒1╩ ¢▓╩ 000002D0: 65 8C 4D 59-65 8C 32 C6-A6 AC 32 46-19 63 53 56 eîMYeî2╞ª¼2F cSV 000002E0: 19 A3 8C B1-29 AB 8C 51-C6 D8 94 55-C6 28 63 6C úî▒)½îQ╞╪öU╞(cl 000002F0: CA 2A 63 94-31 36 65 95-31 CA 18 9B-B2 CA 18 65 ╩*cö16eò1╩ ¢▓╩ e 00000300: 8C 4D 59 65-8C 32 C6 A6-AC 32 46 19-63 53 56 19 îMYeî2╞ª¼2F cSV 00000310: A3 8C B1 29-AB 8C 51 C6-D8 94 55 C6-28 63 6C CA úî▒)½îQ╞╪öU╞(cl╩ 00000320: 2A 63 94 31-36 65 33 46-19 63 A5 B2-19 A3 8C B1 *cö16e3F cÑ▓ úî▒ 00000330: 46 59 63 8C-32 C6 A6 AC-31 46 19 63-53 16 18 A3 FYcî2╞ª¼1F cS ú 00000340: 8C B1 29 8B-8D 51 C6 D8-9D B2 D3 63-CA 18 8B A7 î▒)ïìQ╞╪¥▓╙c╩ ïº 00000350: 71 78 46 59-1B 63 94 F5-31 46 59 1F-63 94 F5 31 qxFY cö⌡1FY cö⌡1 00000360: 46 59 1F 63-94 F5 31 46-59 1F 63 94-F5 31 46 59 FY cö⌡1FY cö⌡1FY 00000370: 1F 63 94 F5-31 46 59 1F-63 94 F5 31-46 59 1F 63 cö⌡1FY cö⌡1FY c 00000380: 94 F5 31 46-59 1F 63 94-F5 31 46 59-1F 63 94 F5 ö⌡1FY cö⌡1FY cö⌡ 00000390: 31 46 59 1F-63 94 F5 31-46 59 1F 63-94 F5 31 46 1FY cö⌡1FY cö⌡1F 000003A0: 59 1D 63 94-D5 31 46 59-1D 63 94 D5-31 46 59 1D Y cö╒1FY cö╒1FY 000003B0: 63 94 D5 31-46 59 1D 63-94 D5 31 46-59 1D 63 94 cö╒1FY cö╒1FY cö 000003C0: D5 31 46 59-1D 63 94 D5-31 46 59 1D-63 94 D5 31 ╒1FY cö╒1FY cö╒1 000003D0: 46 59 1D 63-94 D5 31 46-59 1D 63 94-D5 31 46 59 FY cö╒1FY cö╒1FY 000003E0: 1D 63 94 C5-31 46 59 6F-8C 31 CA D2-18 EB 95 51 cö┼1FYoî1╩╥ δòQ 000003F0: C6 D8 5D 94-85 31 F6 DA-28 EB 8D 31-46 D9 5D 8C ╞╪]öà1÷┌(δì1F┘]î 00000400: C5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ┼Q╞X eî⌡Q╞X eî⌡Q 00000410: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 00000420: 1F 65 8C F5-51 C6 58 1F-65 8C F5 51-C6 58 1F 65 eî⌡Q╞X eî⌡Q╞X e Let's walk through a simple PNG f ile... no.png

Slide 135

Slide 135 text

00000430: 8C F5 51 C6-58 1F 65 8C-F5 51 C6 58-1F 65 8C F5 î⌡Q╞X eî⌡Q╞X eî⌡ 00000440: 51 C6 58 1F-65 8C F5 51-C6 58 1F 65-8C D5 51 C6 Q╞X eî⌡Q╞X eî╒Q╞ 00000450: 58 13 65 8C-05 51 C6 58-10 65 8C F5-51 C6 58 1F X eî Q╞X eî⌡Q╞X 00000460: 65 8C F5 51-C6 58 1F 65-8C F5 51 C6-58 1F 65 8C eî⌡Q╞X eî⌡Q╞X eî 00000470: F5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ⌡Q╞X eî⌡Q╞X eî⌡Q 00000480: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 00000490: 1F 65 8C F5-51 C6 58 1F-65 8C E5 51-76 CE 18 65 eî⌡Q╞X eîσQv╬ e 000004A0: 7D 8C 51 F6-D3 62 8C 32-C6 28 13 63-94 31 46 19 }îQ÷╙bî2╞( cö1F 000004B0: 63 94 89 31-CA 18 A3 EC-3B C7 18 65-8C 51 26 C6 cöë1╩ ú∞;╟ eîQ&╞ 000004C0: 28 63 8C 32-C6 28 13 63-94 31 46 D9-F7 8E 31 CA (cî2╞( cö1F┘≈Ä1╩ 000004D0: 18 A3 4C 8C-51 C6 18 65-8C 51 26 C6-28 63 8C 32 úLîQ╞ eîQ&╞(cî2 000004E0: 31 46 19 63-94 31 46 99-18 A3 8C 31-CA 18 A3 4C 1F cö1FÖ úî1╩ úL 000004F0: 8C 51 C6 18-65 62 8C 32-C6 28 63 8C-32 31 46 19 îQ╞ ebî2╞(cî21F 00000500: 63 94 31 46-99 18 A3 8C-31 CA C4 18-65 8C 51 C6 cö1FÖ úî1╩─ eîQ╞ 00000510: 18 65 62 8C-32 C6 28 63-8C 32 31 46-19 63 94 89 ebî2╞(cî21F cöë 00000520: 31 CA 18 A3-8C 31 CA C4-18 65 8C 51-C6 98 28 63 1╩ úî1╩─ eîQ╞ÿ(c 00000530: 8C 32 C6 28-13 63 94 31-46 19 63 94-89 31 CA 18 î2╞( cö1F cöë1╩ 00000540: A3 8C 31 51-C6 18 65 8C-51 C6 98 28-63 8C 32 C6 úî1Q╞ eîQ╞ÿ(cî2╞ 00000550: 28 13 63 94-31 46 19 63-A2 8C 31 CA-18 A3 8C 31 ( cö1F cóî1╩ úî1 00000560: 51 C6 18 65-8C 89 32 C6-28 63 8C 32-C6 44 19 63 Q╞ eîë2╞(cî2╞D c 00000570: 94 31 46 19-63 A2 8C 31-CA 18 13 65-8C 51 C6 18 ö1F cóî1╩ eîQ╞ 00000580: 65 8C 89 32-C6 28 63 8C-32 C6 44 19-63 94 31 26 eîë2╞(cî2╞D cö1& 00000590: CA 18 A3 8C-31 CA 18 13-65 8C 51 C6-18 65 8C 89 ╩ úî1╩ eîQ╞ eîë 000005A0: 32 C6 28 63-4C 94 31 46-19 63 94 31-26 CA 18 A3 2╞(cLö1F cö1&╩ ú 000005B0: 8C 31 BD 54-19 63 A2 8C-31 CA 18 D3-C5 E5 2F 34 î1╜T cóî1╩ ╙┼σ/4 000005C0: 76 FE EF FB-24 3B 99 18-A3 8C 31 CA-E4 9F 4C 8C v■∩√$;Ö úî1╩ΣƒLî 000005D0: 51 C6 18 65-62 8C 32 C6-28 63 8C 32-31 46 19 63 Q╞ ebî2╞(cî21F c 000005E0: 94 89 31 CA-18 A3 8C 31-CA C4 18 65-8C 51 C6 18 öë1╩ úî1╩─ eîQ╞ 000005F0: 65 62 8C 32-C6 28 13 63-94 31 46 19-63 94 89 31 ebî2╞( cö1F cöë1 00000600: CA 18 A3 8C-31 CA C4 18-65 8C 51 26-C6 28 63 8C ╩ úî1╩─ eîQ&╞(cî 00000610: 32 C6 28 13-63 94 31 46-19 63 94 89-31 CA 18 A3 2╞( cö1F cöë1╩ ú 00000620: 4C 8C 51 C6-18 65 8C 51-26 C6 28 63-8C 32 C6 44 LîQ╞ eîQ&╞(cî2╞D 00000630: 19 63 94 31-46 99 18 A3-8C 31 CA 18-A3 4C 8C 51 cö1FÖ úî1╩ úLîQ 00000640: C6 18 65 8C-89 32 C6 28-63 8C 32 C6-44 19 63 94 ╞ eîë2╞(cî2╞D cö 00000650: 31 46 99 18-A3 8C 31 CA-18 13 65 8C-51 C6 18 65 1FÖ úî1╩ eîQ╞ e 00000660: 8C 89 32 C6-28 63 4C 94-31 46 19 63-94 31 26 CA îë2╞(cLö1F cö1&╩ 00000670: 18 A3 8C 31-CA 18 13 65-8C 51 C6 98-28 63 8C 32 úî1╩ eîQ╞ÿ(cî2 00000680: C6 28 63 4C-94 31 46 19-63 94 31 26-CA 18 A3 8C ╞(cLö1F cö1&╩ úî 00000690: 31 51 C6 18-65 8C 51 C6-98 28 63 8C-32 C6 28 63 1Q╞ eîQ╞ÿ(cî2╞(c 000006A0: 4C 94 31 46-19 63 A2 8C-31 CA 18 A3-8C 31 51 C6 Lö1F cóî1╩ úî1Q╞ 000006B0: 18 65 DF D4-98 28 63 8C-32 C6 44 19-63 94 31 46 e▀╘ÿ(cî2╞D cö1F 000006C0: 19 63 A2 8C-31 CA BE BF-31 51 C6 18-65 8C 89 32 cóî1╩╛┐1Q╞ eîë2 000006D0: C6 28 63 8C-32 C6 44 19-63 94 31 A6-1F A7 8C B1 ╞(cî2╞D cö1ª ºî▒ 000006E0: 73 CA 18 8B-3B 38 3C A0-8C B1 7A 1A-94 D5 31 46 s╩ ï;8<áî▒z ö╒1F 000006F0: 59 1F 63 94-F5 31 46 59-1F 63 94 F5-31 46 59 1F Y cö⌡1FY cö⌡1FY 00000700: 63 94 F5 31-46 59 1F 63-94 F5 31 46-59 1F 63 94 cö⌡1FY cö⌡1FY cö 00000710: F5 31 46 59-1F 63 94 F5-31 46 59 1F-63 94 F5 31 ⌡1FY cö⌡1FY cö⌡1 00000720: 46 59 1F 63-94 F5 31 46-59 1F 63 94-F5 31 46 59 FY cö⌡1FY cö⌡1FY 00000730: 1F 63 94 F5-31 46 59 1F-63 94 D5 31-46 59 1D 63 cö⌡1FY cö╒1FY c 00000740: 94 D5 31 46-59 1D 63 94-D5 31 46 59-1D 63 94 D5 ö╒1FY cö╒1FY cö╒ 00000750: 31 46 59 1D-63 94 D5 31-46 59 1D 63-94 D5 31 46 1FY cö╒1FY cö╒1F 00000760: 59 1D 63 94-D5 31 46 59-1D 63 94 D5-31 46 59 1D Y cö╒1FY cö╒1FY 00000770: 63 94 D5 31-46 59 1D 63-94 D5 31 46-59 1D 63 94 cö╒1FY cö╒1FY cö 00000780: D5 31 46 59-6E 8C 31 CA-62 65 8C DD-45 D9 EB 63 ╒1FYnî1╩beî▌E┘δc 00000790: 2C 8C 32 C6-6A 63 94 DD-C5 58 1C 65-8C F5 51 C6 ,î2╞jcö▌┼X eî⌡Q╞ 000007A0: 58 1F 65 8C-F5 51 C6 58-1F 65 8C F5-51 C6 58 1F X eî⌡Q╞X eî⌡Q╞X 000007B0: 65 8C F5 51-C6 58 1F 65-8C F5 51 C6-58 1F 65 8C eî⌡Q╞X eî⌡Q╞X eî 000007C0: F5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ⌡Q╞X eî⌡Q╞X eî⌡Q 000007D0: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 000007E0: 1F 65 8C F5-51 C6 58 1D-65 8C D5 51-C6 58 1D 65 eî⌡Q╞X eî╒Q╞X e 000007F0: 8C D5 51 C6-58 1D 65 8C-D5 51 C6 58-1D 65 8C D5 î╒Q╞X eî╒Q╞X eî╒ 00000800: 51 C6 58 1D-65 8C D5 51-C6 58 1D 65-8C D5 51 C6 Q╞X eî╒Q╞X eî╒Q╞ 00000810: 58 1D 65 8C-D5 51 C6 58-1D 65 8C D5-51 C6 58 1D X eî╒Q╞X eî╒Q╞X 00000820: 65 8C D5 51-C6 58 1D 65-8C D5 51 C6-58 1E 65 A7 eî╒Q╞X eî╒Q╞X eº 00000830: 8C D5 51 F6-9F 31 CA D2-4E AE B9 A5-83 01 00 00 î╒Q÷ƒ1╩╥N«╣Ñâ 00000840: 00 06 42 F3-A7 DE F3 1C-8A A1 01 CB-A0 63 2D A3 B≤º▐≤ èí ╦ác-ú 00000850: 8E B5 0C 3D-06 2C 03 8E-B5 4C 39 C6-2D 03 8E B5 Ä╡ = , Ä╡L9╞- Ä╡ 00000860: CC 3C 06 2C-03 8E B5 CC-3C 06 2C 03-8E B5 CC 3C ╠< , Ä╡╠< , Ä╡╠< 00000870: 06 2C 03 8E-B5 CC 3C 06-2C 03 8E B5-CC 3C 06 2C , Ä╡╠< , Ä╡╠< , 00000880: 03 8E B5 CC-3C 06 2C 03-8E B5 CC 3C-06 2C 03 8E Ä╡╠< , Ä╡╠< , Ä 00000890: B5 CC 3C 06-2C 03 8E B5-CC 3C 06 2C-03 8E B5 4C ╡╠< , Ä╡╠< , Ä╡L 000008A0: 3A 06 2C 03-8E 01 CB C4-63 2D 03 8E-01 CB C4 63 : , Ä ╦─c- Ä ╦─c 000008B0: 2D 03 8E 01-CB C4 63 2D-03 8E 01 CB-A4 63 C0 B2 - Ä ╦─c- Ä ╦ñc└▓ 000008C0: 8E 41 CB A4-63 C0 B2 8E-41 CB A4 63-C0 B2 8E 41 ÄA╦ñc└▓ÄA╦ñc└▓ÄA 000008D0: CB A4 63 C0-B2 8E BD 5D-3A B4 61 20-08 A2 28 B6 ╦ñc└▓Ä╜]:┤a ó(╢ 000008E0: 20 FD D7 1C-38 FC 23 EB-F4 5C 83 F7-65 1D 6B D9 ²╫ 8ⁿ#δ⌠\â≈e k┘ 000008F0: 7E 6C 5B D6-B1 96 ED C7-6E 59 C7 5A-B6 1F DB 97 ~l[╓▒ûφ╟nY╟Z╢ █ù 00000900: 75 AC 65 FB-B1 7D 59 C7-5A 76 C7 F6-65 1D 6B D9 u¼e√▒}Y╟Zv╟÷e k┘ 00000910: 7E 6C 5F D6-B1 96 ED C7-6E 59 C7 5A-B6 1F DB 97 ~l_╓▒ûφ╟nY╟Z╢ █ù 00000920: 75 AC 65 DB-B1 61 59 C7-5A 36 1C 1B-96 75 AC 65 u¼e█▒aY╟Z6 ûu¼e 00000930: FB B1 5B D6-B1 96 0D C7-86 65 1D 6B-D9 70 6C 58 √▒[╓▒û ╟åe k┘plX 00000940: D6 B1 96 0D-C7 86 65 1D-6B D9 70 6C-58 D6 B1 96 ╓▒û ╟åe k┘plX╓▒û 00000950: DD 31 60 19-70 AC 65 F2-B1 5B D6 B1-96 0D C7 86 ▌1` p¼e≥▒[╓▒û ╟å 00000960: 65 1D 6B D9-70 6C 58 D6-B1 96 DD 31-60 19 72 AC e k┘plX╓▒û▌1` r¼ 00000970: 65 FE B1 5B-D6 B1 96 DD-31 60 19 74-AC 65 FE B1 e■▒[╓▒û▌1` t¼e■▒ 00000980: 5B D6 B1 96-DD 31 60 19-75 AC 65 FE-B1 5B D6 B1 [╓▒û▌1` u¼e■▒[╓▒ 00000990: 96 DD 31 60-19 75 AC 65-FE B1 5B 46-1D 6B 99 75 û▌1` u¼e■▒[F kÖu 000009A0: CC 5F E6 1F-6B D9 1D F3-97 F9 C7 5A-36 1C F3 97 ╠_µ k┘ ≤ù∙╟Z6 ≤ù 000009B0: F9 C7 5A 76-C7 FC 65 FE-B1 96 0D C7-FC 65 FE B1 ∙╟Zv╟ⁿe■▒û ╟ⁿe■▒ 000009C0: 96 FD DE 03-96 F1 C7 5A-E6 1F BB 65-D4 B1 96 01 û²▐ û±╟Zµ ╗e╘▒û 000009D0: C7 DC 65 FE-B1 96 DD 31-65 99 7F AC-65 FE B1 5B ╟▄e■▒û▌1eÖ¼e■▒[ 000009E0: 46 1D 6B 19-70 4C 5C E6-1F 6B D9 1D-B3 96 F9 C7 F k pL\µ k┘ │û∙╟ 000009F0: 5A E6 1F BB-65 D4 B1 96-01 C7 C8 65-FE B1 96 DD Zµ ╗e╘▒û ╟╚e■▒û▌ 00000A00: 31 6A 99 7F-AC 65 FE B1-5B 46 1D 6B-19 70 4C 59 1jÖ¼e■▒[F k pLY 00000A10: E6 1F 6B D9-1D 73 97 F9-C7 5A E6 1F-BB 65 D4 B1 µ k┘ sù∙╟Zµ ╗e╘▒ 00000A20: 96 01 C7 80-65 FC B1 96-DD 31 77 99-7F AC 65 FB û ╟Çeⁿ▒û▌1wÖ¼e√ 00000A30: 31 7F 99 7F-AC 65 77 4C-5F E6 1F 6B-D9 7E CC 5F 1Ö¼ewL_µ k┘~╠_ 00000A40: E6 1F 6B D9-1D F3 97 F9-C7 5A E6 1F-BB 65 F6 B1 µ k┘ ≤ù∙╟Zµ ╗e÷▒ 00000A50: 96 ED C7 FC-65 FE B1 96-F9 C7 6E 99-7D AC 65 FB ûφ╟ⁿe■▒û∙╟nÖ}¼e√ 00000A60: 31 7F 99 7F-AC 65 FE B1-5B 66 1F 6B-D9 7E CC 5F 1Ö¼e■▒[f k┘~╠_ 00000A70: E6 1F 6B 99-7F EC 96 D9-C7 5A B6 1F-F3 97 F9 C7 µ kÖ∞û┘╟Z╢ ≤ù∙╟ 00000A80: 5A E6 1F BB-65 F6 B1 96-ED C7 FC 65-FE B1 96 F9 Zµ ╗e÷▒ûφ╟ⁿe■▒û∙ 00000A90: C7 6E 19 75-AC 65 D3 31-7F 19 75 AC-65 D3 31 7F ╟n u¼e╙1 u¼e╙1 00000AA0: 19 75 AC 65-D3 31 7F 19-75 AC 65 D3-31 7F 19 75 u¼e╙1 u¼e╙1 u 00000AB0: AC 65 D3 31-7F 19 75 AC-65 D3 31 7F-19 75 AC 65 ¼e╙1 u¼e╙1 u¼e 00000AC0: D3 31 7F 19-75 AC 65 D3-31 7F 19 75-AC 65 D3 31 ╙1 u¼e╙1 u¼e╙1 00000AD0: 7F 19 75 AC-65 D3 31 7F-19 75 AC 65-D3 31 7F 19  u¼e╙1 u¼e╙1 00000AE0: 75 AC 65 D3-31 7F 19 75-AC 65 D3 31-7F 19 75 AC u¼e╙1 u¼e╙1 u¼ 00000AF0: 65 D3 31 7F-19 75 AC 65-D3 31 7F 19-75 AC 65 D3 e╙1 u¼e╙1 u¼e╙ 00000B00: 31 7F 19 75-AC 65 D3 31-7F 19 75 AC-65 D3 31 7F 1 u¼e╙1 u¼e╙1 00000B10: 19 75 AC 65-FC B1 7D 59-C7 A8 65 FB-31 78 59 C7 u¼eⁿ▒}Y╟¿e√1xY╟ 00000B20: A8 65 FB 31-78 59 C7 A8-65 5F 3A 96-FC 01 2A EE ¿e√1xY╟¿e_:ûⁿ *ε 00000B30: B0 6C 0B 6E-B3 BA 00 00-00 00 49 45-4E 44 AE 42 ░l n│║ IEND«B 00000B40: 60 82 - - - `é 00000000: 89 50 4E 47-0D 0A 1A 0A-00 00 00 0D-49 48 44 52 ëPNG IHDR 00000010: 00 00 02 64-00 00 02 64-08 03 00 00-00 88 CF CD d d ê╧═ 00000020: 8E 00 00 00-24 50 4C 54-45 FF FF FF-FF 7D 7D FF Ä $PLTE }} 00000030: 6F 6F FF FE-FE FF 7E 7E-FF 00 00 FF-80 80 FF 6D oo ■■ ~~ ÇÇ m 00000040: 6D FF 6E 6E-FF 30 30 FF-FD FD FF 2F-2F A6 F0 78 m nn 00 ²² //ª≡x 00000050: 4E 00 00 0A-D9 49 44 41-54 78 DA EC-D2 D1 09 5A N ┘IDATx┌∞╥╤ Z 00000060: 01 14 86 31-B5 DE EE 3F-72 1F CF 00-3F 94 20 5F å1╡▐ε?r ╧ ?ö _ 00000070: 66 C8 EB BF-79 7F 5E 8C-FC F9 7C 5F-BF E7 FD 3C f╚δ┐y^îⁿ∙|_┐τ²< 00000080: 2D 83 8E 3D-CF F7 17 8F-B5 8C 3A E6-2E 1B 8E 51 -âÄ=╧≈ Å╡î:µ. ÄQ 00000090: CB 3A 36 2C-73 8F 51 CB-3A 36 2C 73-8F 51 CB 3A ╦:6,sÅQ╦:6,sÅQ╦: 000000A0: 36 2C 73 8F-51 CB 3A 36-2C 73 8F 51-CB 3A 36 2C 6,sÅQ╦:6,sÅQ╦:6, 000000B0: 73 8F 51 CB-3A E6 2E 1B-8E 51 CB 3A-E6 2E 1B 8E sÅQ╦:µ. ÄQ╦:µ. Ä 000000C0: 51 CB 3A E6-2E 1B 8E 51-CB 3A E6 2E-1B 8E 51 CB Q╦:µ. ÄQ╦:µ. ÄQ╦ 000000D0: 3A E6 2E 1B-8E 51 CB 3A-E6 2E 1B 8E-51 CB 3A E6 :µ. ÄQ╦:µ. ÄQ╦:µ 000000E0: 2E 1B 8E 51-CB 3A E6 2E-1B 8E 59 CB-3A E6 2F 1B . ÄQ╦:µ. ÄY╦:µ/ 000000F0: 8E F9 CB 3A-26 2F 1B 8E-B5 8C 3A 26-2F 1B 8E B5 Ä∙╦:&/ Ä╡î:&/ Ä╡ 00000100: 8C 3A 26 2F-1B 8E B5 8C-3A 26 2F 1B-8E B5 8C 3A î:&/ Ä╡î:&/ Ä╡î: 00000110: 26 2F 1B 8E-B5 8C 3A 26-2F 1B 8E B5-8C 3A E6 2F &/ Ä╡î:&/ Ä╡î:µ/ 00000120: BB 63 2D F3-8F F9 CB F6-63 2D 33 8F-F9 CB EE 58 ╗c-≤Å∙╦÷c-3Å∙╦εX 00000130: CB FC 63 FE-B2 FD 58 CB-CC 63 B7 CC-3F D6 32 FF ╦ⁿc■▓²X╦╠c╖╠?╓2 00000140: 98 BF 6C 3F-D6 32 F3 D8-2D F3 8F B5-CC 3F E6 2F ÿ┐l?╓2≤╪-≤Å╡╠?µ/ 00000150: DB 8F B5 CC-3C 76 CB FC-63 2D F3 8F-F9 CB F6 63 █Å╡╠µ/ 00000180: BB 63 D4 B2-8E 01 CB 80-63 F8 B2 8E-DD 32 F9 98 ╗c╘▓Ä ╦Çc°▓Ä▌2∙ÿ 00000190: BF AC 63 FE-B2 3B 46 2D-EB 18 B0 CC-38 E6 2F EB ┐¼c■▓;F-δ ░╠8µ/δ 000001A0: D8 2D 33 8F-F9 CB 3A E6-2F BB 63 D4-B2 8E 01 CB ╪-3Å∙╦:µ/╗c╘▓Ä ╦ 000001B0: A4 63 FE B2-8E DD 32 ED-98 BF AC 63-FE B2 3B 46 ñc■▓Ä▌2φÿ┐¼c■▓;F 000001C0: 2D EB 18 B0-CC 3B E6 2F-EB D8 2D 73-8E F9 CB 3A -δ ░╠;µ/δ╪-sÄ∙╦: 000001D0: E6 2F BB 63-D4 B2 8E 01-CB D4 63 FE-B2 8E DD 32 µ/╗c╘▓Ä ╦╘c■▓Ä▌2 000001E0: F9 98 BF AC-63 C3 32 FF-98 BF AC 63-E7 2F 70 0C ∙ÿ┐¼c├2 ÿ┐¼cτ/p 000001F0: 5F D6 31 7F-D9 1D A3 96-75 0C 58 E6-1F F3 97 75 _╓1┘ úûu Xµ ≤ùu 00000200: EC 96 01 C7-D8 65 1D F3-97 DD 31 6A-59 C7 98 65 ∞û ╟╪e ≤ù▌1jY╟ÿe 00000210: FE 31 7F 59-C7 6E 19 70-0C 5C D6 31-7F D9 1D 6B ■1Y╟n p \╓1┘ k 00000220: 59 C7 6E 19-70 8C 59 D6-31 7F D9 1D-6B 59 C7 6E Y╟n pîY╓1┘ kY╟n 00000230: 19 70 0C 5A-D6 31 7F D9-1D 6B 59 C7-6E 19 70 8C p Z╓1┘ kY╟n pî 00000240: 5A D6 31 7F-D9 1D 6B 59-C7 6E 19 70-CC 59 D6 31 Z╓1┘ kY╟n p╠Y╓1 00000250: 7F D9 1D 6B-59 C7 C6 65-FE B1 96 DD-31 7F D9 7E ┘ kY╟╞e■▒û▌1┘~ 00000260: AC 65 1D DB-97 DD B1 96-75 6C 5B 36-1C 6B 59 C7 ¼e █ù▌▒ûul[6 kY╟ 00000270: F6 65 77 AC-65 1D 9B 96-0D C7 5A D6-B1 5B B6 1F ÷ew¼e ¢û ╟Z╓▒[╢ 00000280: 6B 59 C7 A6-65 C3 B1 96-75 EC 96 4D-C7 5A D6 B1 kY╟ªe├▒ûu∞ûM╟Z╓▒ 00000290: 61 D9 70 AC-65 1D BB 65-D3 B1 96 75-6C 5F B6 1F a┘p¼e ╗e╙▒ûul_╢ 000002A0: FB C7 8E 5D-1D 84 01 45-51 10 4C 70-E9 BF 5E 1C √╟Ä] ä EQ LpΘ┐^ 000002B0: CE 27 BA E8-6C 0B 77 9E-52 C6 D8 94-35 C6 28 63 ╬'║Φl w₧R╞╪ö5╞(c 000002C0: 6C CA 02 63-94 31 36 65-B1 31 CA 18-9B B2 CA 18 l╩ cö16e▒1╩ ¢▓╩ 000002D0: 65 8C 4D 59-65 8C 32 C6-A6 AC 32 46-19 63 53 56 eîMYeî2╞ª¼2F cSV 000002E0: 19 A3 8C B1-29 AB 8C 51-C6 D8 94 55-C6 28 63 6C úî▒)½îQ╞╪öU╞(cl 000002F0: CA 2A 63 94-31 36 65 95-31 CA 18 9B-B2 CA 18 65 ╩*cö16eò1╩ ¢▓╩ e 00000300: 8C 4D 59 65-8C 32 C6 A6-AC 32 46 19-63 53 56 19 îMYeî2╞ª¼2F cSV 00000310: A3 8C B1 29-AB 8C 51 C6-D8 94 55 C6-28 63 6C CA úî▒)½îQ╞╪öU╞(cl╩ 00000320: 2A 63 94 31-36 65 33 46-19 63 A5 B2-19 A3 8C B1 *cö16e3F cÑ▓ úî▒ 00000330: 46 59 63 8C-32 C6 A6 AC-31 46 19 63-53 16 18 A3 FYcî2╞ª¼1F cS ú 00000340: 8C B1 29 8B-8D 51 C6 D8-9D B2 D3 63-CA 18 8B A7 î▒)ïìQ╞╪¥▓╙c╩ ïº 00000350: 71 78 46 59-1B 63 94 F5-31 46 59 1F-63 94 F5 31 qxFY cö⌡1FY cö⌡1 00000360: 46 59 1F 63-94 F5 31 46-59 1F 63 94-F5 31 46 59 FY cö⌡1FY cö⌡1FY 00000370: 1F 63 94 F5-31 46 59 1F-63 94 F5 31-46 59 1F 63 cö⌡1FY cö⌡1FY c 00000380: 94 F5 31 46-59 1F 63 94-F5 31 46 59-1F 63 94 F5 ö⌡1FY cö⌡1FY cö⌡ 00000390: 31 46 59 1F-63 94 F5 31-46 59 1F 63-94 F5 31 46 1FY cö⌡1FY cö⌡1F 000003A0: 59 1D 63 94-D5 31 46 59-1D 63 94 D5-31 46 59 1D Y cö╒1FY cö╒1FY 000003B0: 63 94 D5 31-46 59 1D 63-94 D5 31 46-59 1D 63 94 cö╒1FY cö╒1FY cö 000003C0: D5 31 46 59-1D 63 94 D5-31 46 59 1D-63 94 D5 31 ╒1FY cö╒1FY cö╒1 000003D0: 46 59 1D 63-94 D5 31 46-59 1D 63 94-D5 31 46 59 FY cö╒1FY cö╒1FY 000003E0: 1D 63 94 C5-31 46 59 6F-8C 31 CA D2-18 EB 95 51 cö┼1FYoî1╩╥ δòQ 000003F0: C6 D8 5D 94-85 31 F6 DA-28 EB 8D 31-46 D9 5D 8C ╞╪]öà1÷┌(δì1F┘]î 00000400: C5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ┼Q╞X eî⌡Q╞X eî⌡Q 00000410: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 00000420: 1F 65 8C F5-51 C6 58 1F-65 8C F5 51-C6 58 1F 65 eî⌡Q╞X eî⌡Q╞X e Reminder A PNG f ile is a signature , then a sequence of Chunks: starts with a length then a type , and ends with a CRC . no.png 135

Slide 136

Slide 136 text

136 00000430: 8C F5 51 C6-58 1F 65 8C-F5 51 C6 58-1F 65 8C F5 î⌡Q╞X eî⌡Q╞X eî⌡ 00000440: 51 C6 58 1F-65 8C F5 51-C6 58 1F 65-8C D5 51 C6 Q╞X eî⌡Q╞X eî╒Q╞ 00000450: 58 13 65 8C-05 51 C6 58-10 65 8C F5-51 C6 58 1F X eî Q╞X eî⌡Q╞X 00000460: 65 8C F5 51-C6 58 1F 65-8C F5 51 C6-58 1F 65 8C eî⌡Q╞X eî⌡Q╞X eî 00000470: F5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ⌡Q╞X eî⌡Q╞X eî⌡Q 00000480: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 00000490: 1F 65 8C F5-51 C6 58 1F-65 8C E5 51-76 CE 18 65 eî⌡Q╞X eîσQv╬ e 000004A0: 7D 8C 51 F6-D3 62 8C 32-C6 28 13 63-94 31 46 19 }îQ÷╙bî2╞( cö1F 000004B0: 63 94 89 31-CA 18 A3 EC-3B C7 18 65-8C 51 26 C6 cöë1╩ ú∞;╟ eîQ&╞ 000004C0: 28 63 8C 32-C6 28 13 63-94 31 46 D9-F7 8E 31 CA (cî2╞( cö1F┘≈Ä1╩ 000004D0: 18 A3 4C 8C-51 C6 18 65-8C 51 26 C6-28 63 8C 32 úLîQ╞ eîQ&╞(cî2 000004E0: 31 46 19 63-94 31 46 99-18 A3 8C 31-CA 18 A3 4C 1F cö1FÖ úî1╩ úL 000004F0: 8C 51 C6 18-65 62 8C 32-C6 28 63 8C-32 31 46 19 îQ╞ ebî2╞(cî21F 00000500: 63 94 31 46-99 18 A3 8C-31 CA C4 18-65 8C 51 C6 cö1FÖ úî1╩─ eîQ╞ 00000510: 18 65 62 8C-32 C6 28 63-8C 32 31 46-19 63 94 89 ebî2╞(cî21F cöë 00000520: 31 CA 18 A3-8C 31 CA C4-18 65 8C 51-C6 98 28 63 1╩ úî1╩─ eîQ╞ÿ(c 00000530: 8C 32 C6 28-13 63 94 31-46 19 63 94-89 31 CA 18 î2╞( cö1F cöë1╩ 00000540: A3 8C 31 51-C6 18 65 8C-51 C6 98 28-63 8C 32 C6 úî1Q╞ eîQ╞ÿ(cî2╞ 00000550: 28 13 63 94-31 46 19 63-A2 8C 31 CA-18 A3 8C 31 ( cö1F cóî1╩ úî1 00000560: 51 C6 18 65-8C 89 32 C6-28 63 8C 32-C6 44 19 63 Q╞ eîë2╞(cî2╞D c 00000570: 94 31 46 19-63 A2 8C 31-CA 18 13 65-8C 51 C6 18 ö1F cóî1╩ eîQ╞ 00000580: 65 8C 89 32-C6 28 63 8C-32 C6 44 19-63 94 31 26 eîë2╞(cî2╞D cö1& 00000590: CA 18 A3 8C-31 CA 18 13-65 8C 51 C6-18 65 8C 89 ╩ úî1╩ eîQ╞ eîë 000005A0: 32 C6 28 63-4C 94 31 46-19 63 94 31-26 CA 18 A3 2╞(cLö1F cö1&╩ ú 000005B0: 8C 31 BD 54-19 63 A2 8C-31 CA 18 D3-C5 E5 2F 34 î1╜T cóî1╩ ╙┼σ/4 000005C0: 76 FE EF FB-24 3B 99 18-A3 8C 31 CA-E4 9F 4C 8C v■∩√$;Ö úî1╩ΣƒLî 000005D0: 51 C6 18 65-62 8C 32 C6-28 63 8C 32-31 46 19 63 Q╞ ebî2╞(cî21F c 000005E0: 94 89 31 CA-18 A3 8C 31-CA C4 18 65-8C 51 C6 18 öë1╩ úî1╩─ eîQ╞ 000005F0: 65 62 8C 32-C6 28 13 63-94 31 46 19-63 94 89 31 ebî2╞( cö1F cöë1 00000600: CA 18 A3 8C-31 CA C4 18-65 8C 51 26-C6 28 63 8C ╩ úî1╩─ eîQ&╞(cî 00000610: 32 C6 28 13-63 94 31 46-19 63 94 89-31 CA 18 A3 2╞( cö1F cöë1╩ ú 00000620: 4C 8C 51 C6-18 65 8C 51-26 C6 28 63-8C 32 C6 44 LîQ╞ eîQ&╞(cî2╞D 00000630: 19 63 94 31-46 99 18 A3-8C 31 CA 18-A3 4C 8C 51 cö1FÖ úî1╩ úLîQ 00000640: C6 18 65 8C-89 32 C6 28-63 8C 32 C6-44 19 63 94 ╞ eîë2╞(cî2╞D cö 00000650: 31 46 99 18-A3 8C 31 CA-18 13 65 8C-51 C6 18 65 1FÖ úî1╩ eîQ╞ e 00000660: 8C 89 32 C6-28 63 4C 94-31 46 19 63-94 31 26 CA îë2╞(cLö1F cö1&╩ 00000670: 18 A3 8C 31-CA 18 13 65-8C 51 C6 98-28 63 8C 32 úî1╩ eîQ╞ÿ(cî2 00000680: C6 28 63 4C-94 31 46 19-63 94 31 26-CA 18 A3 8C ╞(cLö1F cö1&╩ úî 00000690: 31 51 C6 18-65 8C 51 C6-98 28 63 8C-32 C6 28 63 1Q╞ eîQ╞ÿ(cî2╞(c 000006A0: 4C 94 31 46-19 63 A2 8C-31 CA 18 A3-8C 31 51 C6 Lö1F cóî1╩ úî1Q╞ 000006B0: 18 65 DF D4-98 28 63 8C-32 C6 44 19-63 94 31 46 e▀╘ÿ(cî2╞D cö1F 000006C0: 19 63 A2 8C-31 CA BE BF-31 51 C6 18-65 8C 89 32 cóî1╩╛┐1Q╞ eîë2 000006D0: C6 28 63 8C-32 C6 44 19-63 94 31 A6-1F A7 8C B1 ╞(cî2╞D cö1ª ºî▒ 000006E0: 73 CA 18 8B-3B 38 3C A0-8C B1 7A 1A-94 D5 31 46 s╩ ï;8<áî▒z ö╒1F 000006F0: 59 1F 63 94-F5 31 46 59-1F 63 94 F5-31 46 59 1F Y cö⌡1FY cö⌡1FY 00000700: 63 94 F5 31-46 59 1F 63-94 F5 31 46-59 1F 63 94 cö⌡1FY cö⌡1FY cö 00000710: F5 31 46 59-1F 63 94 F5-31 46 59 1F-63 94 F5 31 ⌡1FY cö⌡1FY cö⌡1 00000720: 46 59 1F 63-94 F5 31 46-59 1F 63 94-F5 31 46 59 FY cö⌡1FY cö⌡1FY 00000730: 1F 63 94 F5-31 46 59 1F-63 94 D5 31-46 59 1D 63 cö⌡1FY cö╒1FY c 00000740: 94 D5 31 46-59 1D 63 94-D5 31 46 59-1D 63 94 D5 ö╒1FY cö╒1FY cö╒ 00000750: 31 46 59 1D-63 94 D5 31-46 59 1D 63-94 D5 31 46 1FY cö╒1FY cö╒1F 00000760: 59 1D 63 94-D5 31 46 59-1D 63 94 D5-31 46 59 1D Y cö╒1FY cö╒1FY 00000770: 63 94 D5 31-46 59 1D 63-94 D5 31 46-59 1D 63 94 cö╒1FY cö╒1FY cö 00000780: D5 31 46 59-6E 8C 31 CA-62 65 8C DD-45 D9 EB 63 ╒1FYnî1╩beî▌E┘δc 00000790: 2C 8C 32 C6-6A 63 94 DD-C5 58 1C 65-8C F5 51 C6 ,î2╞jcö▌┼X eî⌡Q╞ 000007A0: 58 1F 65 8C-F5 51 C6 58-1F 65 8C F5-51 C6 58 1F X eî⌡Q╞X eî⌡Q╞X 000007B0: 65 8C F5 51-C6 58 1F 65-8C F5 51 C6-58 1F 65 8C eî⌡Q╞X eî⌡Q╞X eî 000007C0: F5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ⌡Q╞X eî⌡Q╞X eî⌡Q 000007D0: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 000007E0: 1F 65 8C F5-51 C6 58 1D-65 8C D5 51-C6 58 1D 65 eî⌡Q╞X eî╒Q╞X e 000007F0: 8C D5 51 C6-58 1D 65 8C-D5 51 C6 58-1D 65 8C D5 î╒Q╞X eî╒Q╞X eî╒ 00000800: 51 C6 58 1D-65 8C D5 51-C6 58 1D 65-8C D5 51 C6 Q╞X eî╒Q╞X eî╒Q╞ 00000810: 58 1D 65 8C-D5 51 C6 58-1D 65 8C D5-51 C6 58 1D X eî╒Q╞X eî╒Q╞X 00000820: 65 8C D5 51-C6 58 1D 65-8C D5 51 C6-58 1E 65 A7 eî╒Q╞X eî╒Q╞X eº 00000830: 8C D5 51 F6-9F 31 CA D2-4E AE B9 A5-83 01 00 00 î╒Q÷ƒ1╩╥N«╣Ñâ 00000840: 00 06 42 F3-A7 DE F3 1C-8A A1 01 CB-A0 63 2D A3 B≤º▐≤ èí ╦ác-ú 00000850: 8E B5 0C 3D-06 2C 03 8E-B5 4C 39 C6-2D 03 8E B5 Ä╡ = , Ä╡L9╞- Ä╡ 00000860: CC 3C 06 2C-03 8E B5 CC-3C 06 2C 03-8E B5 CC 3C ╠< , Ä╡╠< , Ä╡╠< 00000870: 06 2C 03 8E-B5 CC 3C 06-2C 03 8E B5-CC 3C 06 2C , Ä╡╠< , Ä╡╠< , 00000880: 03 8E B5 CC-3C 06 2C 03-8E B5 CC 3C-06 2C 03 8E Ä╡╠< , Ä╡╠< , Ä 00000890: B5 CC 3C 06-2C 03 8E B5-CC 3C 06 2C-03 8E B5 4C ╡╠< , Ä╡╠< , Ä╡L 000008A0: 3A 06 2C 03-8E 01 CB C4-63 2D 03 8E-01 CB C4 63 : , Ä ╦─c- Ä ╦─c 000008B0: 2D 03 8E 01-CB C4 63 2D-03 8E 01 CB-A4 63 C0 B2 - Ä ╦─c- Ä ╦ñc└▓ 000008C0: 8E 41 CB A4-63 C0 B2 8E-41 CB A4 63-C0 B2 8E 41 ÄA╦ñc└▓ÄA╦ñc└▓ÄA 000008D0: CB A4 63 C0-B2 8E BD 5D-3A B4 61 20-08 A2 28 B6 ╦ñc└▓Ä╜]:┤a ó(╢ 000008E0: 20 FD D7 1C-38 FC 23 EB-F4 5C 83 F7-65 1D 6B D9 ²╫ 8ⁿ#δ⌠\â≈e k┘ 000008F0: 7E 6C 5B D6-B1 96 ED C7-6E 59 C7 5A-B6 1F DB 97 ~l[╓▒ûφ╟nY╟Z╢ █ù 00000900: 75 AC 65 FB-B1 7D 59 C7-5A 76 C7 F6-65 1D 6B D9 u¼e√▒}Y╟Zv╟÷e k┘ 00000910: 7E 6C 5F D6-B1 96 ED C7-6E 59 C7 5A-B6 1F DB 97 ~l_╓▒ûφ╟nY╟Z╢ █ù 00000920: 75 AC 65 DB-B1 61 59 C7-5A 36 1C 1B-96 75 AC 65 u¼e█▒aY╟Z6 ûu¼e 00000930: FB B1 5B D6-B1 96 0D C7-86 65 1D 6B-D9 70 6C 58 √▒[╓▒û ╟åe k┘plX 00000940: D6 B1 96 0D-C7 86 65 1D-6B D9 70 6C-58 D6 B1 96 ╓▒û ╟åe k┘plX╓▒û 00000950: DD 31 60 19-70 AC 65 F2-B1 5B D6 B1-96 0D C7 86 ▌1` p¼e≥▒[╓▒û ╟å 00000960: 65 1D 6B D9-70 6C 58 D6-B1 96 DD 31-60 19 72 AC e k┘plX╓▒û▌1` r¼ 00000970: 65 FE B1 5B-D6 B1 96 DD-31 60 19 74-AC 65 FE B1 e■▒[╓▒û▌1` t¼e■▒ 00000980: 5B D6 B1 96-DD 31 60 19-75 AC 65 FE-B1 5B D6 B1 [╓▒û▌1` u¼e■▒[╓▒ 00000990: 96 DD 31 60-19 75 AC 65-FE B1 5B 46-1D 6B 99 75 û▌1` u¼e■▒[F kÖu 000009A0: CC 5F E6 1F-6B D9 1D F3-97 F9 C7 5A-36 1C F3 97 ╠_µ k┘ ≤ù∙╟Z6 ≤ù 000009B0: F9 C7 5A 76-C7 FC 65 FE-B1 96 0D C7-FC 65 FE B1 ∙╟Zv╟ⁿe■▒û ╟ⁿe■▒ 000009C0: 96 FD DE 03-96 F1 C7 5A-E6 1F BB 65-D4 B1 96 01 û²▐ û±╟Zµ ╗e╘▒û 000009D0: C7 DC 65 FE-B1 96 DD 31-65 99 7F AC-65 FE B1 5B ╟▄e■▒û▌1eÖ¼e■▒[ 000009E0: 46 1D 6B 19-70 4C 5C E6-1F 6B D9 1D-B3 96 F9 C7 F k pL\µ k┘ │û∙╟ 000009F0: 5A E6 1F BB-65 D4 B1 96-01 C7 C8 65-FE B1 96 DD Zµ ╗e╘▒û ╟╚e■▒û▌ 00000A00: 31 6A 99 7F-AC 65 FE B1-5B 46 1D 6B-19 70 4C 59 1jÖ¼e■▒[F k pLY 00000A10: E6 1F 6B D9-1D 73 97 F9-C7 5A E6 1F-BB 65 D4 B1 µ k┘ sù∙╟Zµ ╗e╘▒ 00000A20: 96 01 C7 80-65 FC B1 96-DD 31 77 99-7F AC 65 FB û ╟Çeⁿ▒û▌1wÖ¼e√ 00000A30: 31 7F 99 7F-AC 65 77 4C-5F E6 1F 6B-D9 7E CC 5F 1Ö¼ewL_µ k┘~╠_ 00000A40: E6 1F 6B D9-1D F3 97 F9-C7 5A E6 1F-BB 65 F6 B1 µ k┘ ≤ù∙╟Zµ ╗e÷▒ 00000A50: 96 ED C7 FC-65 FE B1 96-F9 C7 6E 99-7D AC 65 FB ûφ╟ⁿe■▒û∙╟nÖ}¼e√ 00000A60: 31 7F 99 7F-AC 65 FE B1-5B 66 1F 6B-D9 7E CC 5F 1Ö¼e■▒[f k┘~╠_ 00000A70: E6 1F 6B 99-7F EC 96 D9-C7 5A B6 1F-F3 97 F9 C7 µ kÖ∞û┘╟Z╢ ≤ù∙╟ 00000A80: 5A E6 1F BB-65 F6 B1 96-ED C7 FC 65-FE B1 96 F9 Zµ ╗e÷▒ûφ╟ⁿe■▒û∙ 00000A90: C7 6E 19 75-AC 65 D3 31-7F 19 75 AC-65 D3 31 7F ╟n u¼e╙1 u¼e╙1 00000AA0: 19 75 AC 65-D3 31 7F 19-75 AC 65 D3-31 7F 19 75 u¼e╙1 u¼e╙1 u 00000AB0: AC 65 D3 31-7F 19 75 AC-65 D3 31 7F-19 75 AC 65 ¼e╙1 u¼e╙1 u¼e 00000AC0: D3 31 7F 19-75 AC 65 D3-31 7F 19 75-AC 65 D3 31 ╙1 u¼e╙1 u¼e╙1 00000AD0: 7F 19 75 AC-65 D3 31 7F-19 75 AC 65-D3 31 7F 19  u¼e╙1 u¼e╙1 00000AE0: 75 AC 65 D3-31 7F 19 75-AC 65 D3 31-7F 19 75 AC u¼e╙1 u¼e╙1 u¼ 00000AF0: 65 D3 31 7F-19 75 AC 65-D3 31 7F 19-75 AC 65 D3 e╙1 u¼e╙1 u¼e╙ 00000B00: 31 7F 19 75-AC 65 D3 31-7F 19 75 AC-65 D3 31 7F 1 u¼e╙1 u¼e╙1 00000B10: 19 75 AC 65-FC B1 7D 59-C7 A8 65 FB-31 78 59 C7 u¼eⁿ▒}Y╟¿e√1xY╟ 00000B20: A8 65 FB 31-78 59 C7 A8-65 5F 3A 96-FC 01 2A EE ¿e√1xY╟¿e_:ûⁿ *ε 00000B30: B0 6C 0B 6E-B3 BA 00 00-00 00 49 45-4E 44 AE 42 ░l n│║ IEND«B 00000B40: 60 82 - - - `é 00000000: 89 50 4E 47-0D 0A 1A 0A-00 00 00 0D-49 48 44 52 ëPNG IHDR 00000010: 00 00 02 64-00 00 02 64-08 03 00 00-00 88 CF CD d d ê╧═ 00000020: 8E 00 00 00-24 50 4C 54-45 FF FF FF-FF 7D 7D FF Ä $PLTE }} 00000030: 6F 6F FF FE-FE FF 7E 7E-FF 00 00 FF-80 80 FF 6D oo ■■ ~~ ÇÇ m 00000040: 6D FF 6E 6E-FF 30 30 FF-FD FD FF 2F-2F A6 F0 78 m nn 00 ²² //ª≡x 00000050: 4E 00 00 0A-D9 49 44 41-54 78 DA EC-D2 D1 09 5A N ┘IDATx┌∞╥╤ Z 00000060: 01 14 86 31-B5 DE EE 3F-72 1F CF 00-3F 94 20 5F å1╡▐ε?r ╧ ?ö _ 00000070: 66 C8 EB BF-79 7F 5E 8C-FC F9 7C 5F-BF E7 FD 3C f╚δ┐y^îⁿ∙|_┐τ²< 00000080: 2D 83 8E 3D-CF F7 17 8F-B5 8C 3A E6-2E 1B 8E 51 -âÄ=╧≈ Å╡î:µ. ÄQ 00000090: CB 3A 36 2C-73 8F 51 CB-3A 36 2C 73-8F 51 CB 3A ╦:6,sÅQ╦:6,sÅQ╦: 000000A0: 36 2C 73 8F-51 CB 3A 36-2C 73 8F 51-CB 3A 36 2C 6,sÅQ╦:6,sÅQ╦:6, 000000B0: 73 8F 51 CB-3A E6 2E 1B-8E 51 CB 3A-E6 2E 1B 8E sÅQ╦:µ. ÄQ╦:µ. Ä 000000C0: 51 CB 3A E6-2E 1B 8E 51-CB 3A E6 2E-1B 8E 51 CB Q╦:µ. ÄQ╦:µ. ÄQ╦ 000000D0: 3A E6 2E 1B-8E 51 CB 3A-E6 2E 1B 8E-51 CB 3A E6 :µ. ÄQ╦:µ. ÄQ╦:µ 000000E0: 2E 1B 8E 51-CB 3A E6 2E-1B 8E 59 CB-3A E6 2F 1B . ÄQ╦:µ. ÄY╦:µ/ 000000F0: 8E F9 CB 3A-26 2F 1B 8E-B5 8C 3A 26-2F 1B 8E B5 Ä∙╦:&/ Ä╡î:&/ Ä╡ 00000100: 8C 3A 26 2F-1B 8E B5 8C-3A 26 2F 1B-8E B5 8C 3A î:&/ Ä╡î:&/ Ä╡î: 00000110: 26 2F 1B 8E-B5 8C 3A 26-2F 1B 8E B5-8C 3A E6 2F &/ Ä╡î:&/ Ä╡î:µ/ 00000120: BB 63 2D F3-8F F9 CB F6-63 2D 33 8F-F9 CB EE 58 ╗c-≤Å∙╦÷c-3Å∙╦εX 00000130: CB FC 63 FE-B2 FD 58 CB-CC 63 B7 CC-3F D6 32 FF ╦ⁿc■▓²X╦╠c╖╠?╓2 00000140: 98 BF 6C 3F-D6 32 F3 D8-2D F3 8F B5-CC 3F E6 2F ÿ┐l?╓2≤╪-≤Å╡╠?µ/ 00000150: DB 8F B5 CC-3C 76 CB FC-63 2D F3 8F-F9 CB F6 63 █Å╡╠µ/ 00000180: BB 63 D4 B2-8E 01 CB 80-63 F8 B2 8E-DD 32 F9 98 ╗c╘▓Ä ╦Çc°▓Ä▌2∙ÿ 00000190: BF AC 63 FE-B2 3B 46 2D-EB 18 B0 CC-38 E6 2F EB ┐¼c■▓;F-δ ░╠8µ/δ 000001A0: D8 2D 33 8F-F9 CB 3A E6-2F BB 63 D4-B2 8E 01 CB ╪-3Å∙╦:µ/╗c╘▓Ä ╦ 000001B0: A4 63 FE B2-8E DD 32 ED-98 BF AC 63-FE B2 3B 46 ñc■▓Ä▌2φÿ┐¼c■▓;F 000001C0: 2D EB 18 B0-CC 3B E6 2F-EB D8 2D 73-8E F9 CB 3A -δ ░╠;µ/δ╪-sÄ∙╦: 000001D0: E6 2F BB 63-D4 B2 8E 01-CB D4 63 FE-B2 8E DD 32 µ/╗c╘▓Ä ╦╘c■▓Ä▌2 000001E0: F9 98 BF AC-63 C3 32 FF-98 BF AC 63-E7 2F 70 0C ∙ÿ┐¼c├2 ÿ┐¼cτ/p 000001F0: 5F D6 31 7F-D9 1D A3 96-75 0C 58 E6-1F F3 97 75 _╓1┘ úûu Xµ ≤ùu 00000200: EC 96 01 C7-D8 65 1D F3-97 DD 31 6A-59 C7 98 65 ∞û ╟╪e ≤ù▌1jY╟ÿe 00000210: FE 31 7F 59-C7 6E 19 70-0C 5C D6 31-7F D9 1D 6B ■1Y╟n p \╓1┘ k 00000220: 59 C7 6E 19-70 8C 59 D6-31 7F D9 1D-6B 59 C7 6E Y╟n pîY╓1┘ kY╟n 00000230: 19 70 0C 5A-D6 31 7F D9-1D 6B 59 C7-6E 19 70 8C p Z╓1┘ kY╟n pî 00000240: 5A D6 31 7F-D9 1D 6B 59-C7 6E 19 70-CC 59 D6 31 Z╓1┘ kY╟n p╠Y╓1 00000250: 7F D9 1D 6B-59 C7 C6 65-FE B1 96 DD-31 7F D9 7E ┘ kY╟╞e■▒û▌1┘~ 00000260: AC 65 1D DB-97 DD B1 96-75 6C 5B 36-1C 6B 59 C7 ¼e █ù▌▒ûul[6 kY╟ 00000270: F6 65 77 AC-65 1D 9B 96-0D C7 5A D6-B1 5B B6 1F ÷ew¼e ¢û ╟Z╓▒[╢ 00000280: 6B 59 C7 A6-65 C3 B1 96-75 EC 96 4D-C7 5A D6 B1 kY╟ªe├▒ûu∞ûM╟Z╓▒ 00000290: 61 D9 70 AC-65 1D BB 65-D3 B1 96 75-6C 5F B6 1F a┘p¼e ╗e╙▒ûul_╢ 000002A0: FB C7 8E 5D-1D 84 01 45-51 10 4C 70-E9 BF 5E 1C √╟Ä] ä EQ LpΘ┐^ 000002B0: CE 27 BA E8-6C 0B 77 9E-52 C6 D8 94-35 C6 28 63 ╬'║Φl w₧R╞╪ö5╞(c 000002C0: 6C CA 02 63-94 31 36 65-B1 31 CA 18-9B B2 CA 18 l╩ cö16e▒1╩ ¢▓╩ 000002D0: 65 8C 4D 59-65 8C 32 C6-A6 AC 32 46-19 63 53 56 eîMYeî2╞ª¼2F cSV 000002E0: 19 A3 8C B1-29 AB 8C 51-C6 D8 94 55-C6 28 63 6C úî▒)½îQ╞╪öU╞(cl 000002F0: CA 2A 63 94-31 36 65 95-31 CA 18 9B-B2 CA 18 65 ╩*cö16eò1╩ ¢▓╩ e 00000300: 8C 4D 59 65-8C 32 C6 A6-AC 32 46 19-63 53 56 19 îMYeî2╞ª¼2F cSV 00000310: A3 8C B1 29-AB 8C 51 C6-D8 94 55 C6-28 63 6C CA úî▒)½îQ╞╪öU╞(cl╩ 00000320: 2A 63 94 31-36 65 33 46-19 63 A5 B2-19 A3 8C B1 *cö16e3F cÑ▓ úî▒ 00000330: 46 59 63 8C-32 C6 A6 AC-31 46 19 63-53 16 18 A3 FYcî2╞ª¼1F cS ú 00000340: 8C B1 29 8B-8D 51 C6 D8-9D B2 D3 63-CA 18 8B A7 î▒)ïìQ╞╪¥▓╙c╩ ïº 00000350: 71 78 46 59-1B 63 94 F5-31 46 59 1F-63 94 F5 31 qxFY cö⌡1FY cö⌡1 00000360: 46 59 1F 63-94 F5 31 46-59 1F 63 94-F5 31 46 59 FY cö⌡1FY cö⌡1FY 00000370: 1F 63 94 F5-31 46 59 1F-63 94 F5 31-46 59 1F 63 cö⌡1FY cö⌡1FY c 00000380: 94 F5 31 46-59 1F 63 94-F5 31 46 59-1F 63 94 F5 ö⌡1FY cö⌡1FY cö⌡ 00000390: 31 46 59 1F-63 94 F5 31-46 59 1F 63-94 F5 31 46 1FY cö⌡1FY cö⌡1F 000003A0: 59 1D 63 94-D5 31 46 59-1D 63 94 D5-31 46 59 1D Y cö╒1FY cö╒1FY 000003B0: 63 94 D5 31-46 59 1D 63-94 D5 31 46-59 1D 63 94 cö╒1FY cö╒1FY cö 000003C0: D5 31 46 59-1D 63 94 D5-31 46 59 1D-63 94 D5 31 ╒1FY cö╒1FY cö╒1 000003D0: 46 59 1D 63-94 D5 31 46-59 1D 63 94-D5 31 46 59 FY cö╒1FY cö╒1FY 000003E0: 1D 63 94 C5-31 46 59 6F-8C 31 CA D2-18 EB 95 51 cö┼1FYoî1╩╥ δòQ 000003F0: C6 D8 5D 94-85 31 F6 DA-28 EB 8D 31-46 D9 5D 8C ╞╪]öà1÷┌(δì1F┘]î 00000400: C5 51 C6 58-1F 65 8C F5-51 C6 58 1F-65 8C F5 51 ┼Q╞X eî⌡Q╞X eî⌡Q 00000410: C6 58 1F 65-8C F5 51 C6-58 1F 65 8C-F5 51 C6 58 ╞X eî⌡Q╞X eî⌡Q╞X 00000420: 1F 65 8C F5-51 C6 58 1F-65 8C F5 51-C6 58 1F 65 eî⌡Q╞X eî⌡Q╞X e To walk through a PNG check the signature , followed by a chunk start (typically IHDR) then look for sequences like: XX XX XX XX LL LL LL LL AA AA AA AA 4 random-looking bytes Ex: 88 CF CD 8E a big-endian length Ex: 00 00 00 24 a 4-bytes alpha string Ex: PLTE - Note the chunk type. - Skip L bytes (Repeat until chunk IEND). no.png

Slide 137

Slide 137 text

The same f ile, displayed with HexII and skipping data ranges 0000: 89 .P .N .G \r \n ^Z \n 00 00 00 0D .I .H .D .R 0010: 00 00 02 64 00 00 02 64 08 03 00 00 00 88 CF CD 0020: 8E 00 00 00 24 .P .L .T .E FF FF FF FF 7D 7D FF 0030: 6F 6F FF FE FE FF 7E 7E FF 00 00 FF 80 80 FF 6D 0040: 6D FF 6E 6E FF 30 30 FF FD FD FF 2F 2F A6 F0 78 0050: 4E 00 00 0A D9 .I .D .A .T 78 DA EC D2 D1 09 5A 0060: 01 14 86 31 B5 DE EE 3F 72 1F CF 00 3F 94 20 5F .... 0B20: A8 65 FB 31 78 59 C7 A8 65 5F 3A 96 FC 01 2A EE 0B30: B0 6C 0B 6E B3 BA 00 00 00 00 .I .E .N .D AE 42 0B40: 60 82 no.png 137

Slide 138

Slide 138 text

The f ile's chunk map 0000: 89 .P .N .G \r \n ^Z \n 00 00 00 0D .I .H .D .R 0010: 00 00 02 64 00 00 02 64 08 03 00 00 00 88 CF CD 0020: 8E 00 00 00 24 .P .L .T .E FF FF FF FF 7D 7D FF 0030: 6F 6F FF FE FE FF 7E 7E FF 00 00 FF 80 80 FF 6D 0040: 6D FF 6E 6E FF 30 30 FF FD FD FF 2F 2F A6 F0 78 0050: 4E 00 00 0A D9 .I .D .A .T 78 DA EC D2 D1 09 5A 0060: 01 14 86 31 B5 DE EE 3F 72 1F CF 00 3F 94 20 5F 0B20: A8 65 FB 31 78 59 C7 A8 65 5F 3A 96 FC 01 2A EE 0B30: B0 6C 0B 6E B3 BA 00 00 00 00 .I .E .N .D AE 42 0B40: 60 82 0000-0007: Signature 89 .P .N .G \r \n ^Z \n 0008-0020: Image Header 00 00 00 0D .I .H .D .R…88 CF CD 8E 0021-0050: Palette 00 00 00 24 .P .L .T .E…A6 F0 78 4E 0051-0B34: Data 00 00 0A D9 .I .D .A .T…0B 6E B3 BA 0B35-0B41: End 00 00 00 00 .I .E .N .D AE 42 60 82 no.png PALETTE HEADER DATA END 138

Slide 139

Slide 139 text

The PNG format is really easy to parse or manipulate at chunk level. import struct import binascii _MAGIC = b"\x89PNG\x0d\x0a\x1a\x0a" _crc32 = lambda d:(binascii.crc32(d) % 0x100000000) def parse(f): assert f.read(8) == _MAGIC chunks = [] while (True): l, = struct.unpack(">I", f.read(4)) t = f.read(4) d = f.read(l) assert _crc32(t + d) == struct.unpack(">I", f.read(4))[0] chunks += [[t, d]] if t == b"IEND": return chunks raise(BaseException("Invalid image")) def make(chunks): s = [_MAGIC] for t, d in chunks: s += [ struct.pack(">I", len(d)), t, d, struct.pack(">I", _crc32(t + d)) ] return "".join(s) Cf minipng.py 139

Slide 140

Slide 140 text

- lower-case chunk are ignored. aLIG/cOLL/sKIP/wHAT/eVER/… - 3 chunks to add: 1. alignment 2. collision:aligned with UniColl’s 10th character to jump over collision blocks with variable length. 3. skip: one to land successfully, and jump over the first image. - we can copy the whole images’ contents after their signature: they’re made of sequence of chunks, no need to parse them. Recap: exploit strategy 140

Slide 141

Slide 141 text

Inserting chunks still keeps a PNG f ile valid. 0000: 89 .P .N .G \r \n ^Z \n 00 00 00 33 .a .L .I .G 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0040: 00 00 00 57 93 27 27 00 00 00 71 .c .O .L .L 00 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00C0: 32 B8 1F CE 00 00 00 0D .I .H .D .R 00 00 02 64 00D0: 00 00 02 64 08 03 00 00 00 88 CF CD 8E 00 00 00 00E0: 24 .P .L .T .E FF FF FF FF 7D 7D FF 6F 6F FF FE 0BE0: A8 65 FB 31 78 59 C7 A8 65 5F 3A 96 FC 01 2A EE 0BF0: B0 6C 0B 6E B3 BA 00 00 00 00 .I .E .N .D AE 42 0C00: 60 82 0000-0007: Signature 0008-0046: Alignment 00 00 00 33 .a .L .I .G…57 93 27 27 0047-00C3: UniColl 00 00 00 71 .c .O .L .L…32 B8 1F CE 00C4-00DC: Image Header 00 00 00 0D .I .H .D .R…88 CF CD 8E 00DD-010C: Palette 00 00 00 24 .P .L .T .E…A6 F0 78 4E 010D-0BF1: Data 00 00 0A D9 .I .D .A .T…0B 6E B3 BA 0BF2-0BFD: End 00 00 00 00 .I .E .N .D AE 42 60 82 UNICOLL ALIGNMENT Source example: chunks = [ ["aLIG", 0x33*"\0"], ["cOLL", 0x71*"\0"], ] + read(fNo) 141

Slide 142

Slide 142 text

Length . Type . CRC32 . Mission 0000: 89 .P .N .G \r \n ^Z \n 00 00 00 33 .a .L .I .G 0010: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0020: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0030: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0040: ?? ?? ?? ?? ?? ?? ?? 00-00 00 71 .c .O .L .L ?? 0050: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0060: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0070: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0080: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0090: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00A0: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00B0: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00C0: ?? ?? ?? ?? XX XX XX XX .s .K .I .P ?? ?? ?? ?? [...] 01C0: ?? ?? ?? ?? ?? ?? ?? ?? .I .H .D .R ?? ?? ?? ?? 01D0: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? [...] ????: ?? ?? 00 00 00 00 .I .E .N .D AE 42 60 82 ?? ?? ????: ?? ?? 00 00 20 00 .I .H .D .R ?? ?? ?? ?? ?? ?? [...] ????: ?? ?? ?? 00 00 00 00 .I .E .N .D AE 42 60 82 142 3 dummy chunks: alignment, collision and jump over (the f irst image) data

Slide 143

Slide 143 text

0000: 89 .P .N .G \r \n ^Z \n 00 00 00 33 .a .L .I .G 0010: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0020: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0030: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0040: ?? ?? ?? ?? ?? ?? ?? 00-00 00 71 .c .O .L .L ?? 0050: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0060: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0070: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0080: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0090: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00A0: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00B0: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00C0: ?? ?? ?? ?? XX XX XX XX .s .K .I .P ?? ?? ?? ?? [...] 01C0: ?? ?? ?? ?? ?? ?? ?? ?? .I .H .D .R ?? ?? ?? ?? 01D0: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? [...] ????: ?? ?? 00 00 00 00 .I .E .N .D AE 42 60 82 ?? ?? ????: ?? ?? 00 00 20 00 .I .H .D .R ?? ?? ?? ?? ?? ?? [...] ????: ?? ?? ?? 00 00 00 00 .I .E .N .D AE 42 60 82 Alignment chunk Chunks A Chunks B UniColl chunk Here's a working script for reference. 143

Slide 144

Slide 144 text

Need to explore by yourself? 144 Open Kaitai IDE with the lightweight PoCs https://ide.kaitai.io/ + https://github.com/corkami/collisions/blob/master/examples/free/README.md

Slide 145

Slide 145 text

Kaitai tricks Only the high level structure is useful: -> simpler grammar can be better. Looser logic can be required: Ex: IHDR chunk not in the first slot. ICYDK You can directly edit the grammar in the IDE! (the modified copy will be automatically saved in your local storage) meta: id: png file-extension: png endian: be seq: - id: magic contents: [137, 80, 78, 71, 13, 10, 26, 10] - id: chunks type: chunk repeat: until repeat-until: _.type == "IEND" or _io.eof types: chunk: seq: - id: len type: u4 - id: type type: str size: 4 encoding: UTF-8 - id: body size: len - id: crc size: 4 Simplif ied PNG grammar png_simple.ksy 145

Slide 146

Slide 146 text

# Standard PNG image. 0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data Know the format landscape All PNG viewers seem to ignore CRCs. Most PNG viewers tolerate starting w/ a dummy chunk. -> generic collisions for any PNG pair OS X (Safari, Preview) enforce an IHDR chunk first: and dimensions and colorspace are in the common prefix -> Study the landscape to understand the scope of your exploit. https://github.com/file/file/blob/master/magic/Magdir/images#L440-L441 They support the undocumented CgBI chunk, But they enforce the specs more than anyone else! 146

Slide 147

Slide 147 text

Collision exploit Reusable PNG via UniColl Certificate (medium) Ange Albertini INSTRUCTOR COLLT IS 147

Slide 148

Slide 148 text

Correct CRCs in UniColliding-PNG ? - CRCs are ignored - the collision blocks have different contents + the collision blocks also change the length of the chunk -> 2 different CRCs for different lengths of the collision chunk -> correct CRCs are possible 148

Slide 149

Slide 149 text

149

Slide 150

Slide 150 text

The two Identical Pref ix Collisions against MD5 📏 ⌛ ‽ two blocks a few minutes in pref ix 📏 ⌛ ‽ two blocks a few seconds in the middle (away from start or end) FastColl UniColl 150

Slide 151

Slide 151 text

IPCs limitations Some formats have hardcoded offsets, or don’t tolerate early comments Same prefix -> same file type Same header -> same metadata Enforced checksums prevent validity. Only the length of a current structure level can be manipulated. 151

Slide 152

Slide 152 text

Chosen-Pref ix Collisions The ultimate attack HashClashCPC 152

Slide 153

Slide 153 text

Our third block: a Chosen Pref ix hash Collision 153

Slide 154

Slide 154 text

Hashclash Master of backtracking Takes 72h.core hours to compute - if you’re lucky: Often requires backtracking, but it's now automated.. The fewer the collision blocks, the longer to compute. EXAMPLE OF A COMPUTATION LOG: Corkami collisions:examples/cpc.txt A word of warning on CPC 154

Slide 155

Slide 155 text

Trivial: run scripts/cpc.sh prefix1 prefix2 No monitoring required (unlike previous versions) Launching a hashclash computation ... [*] Timeout reached. Killing process with pid 5760 Killed [*] Step 5 failed. Backtracking to step 4 [*] Number of backtracks until now: 1 [*] Time before backtrack: 2400 s [*] Starting step 4 ... 155

Slide 156

Slide 156 text

A 9-block CPC of yes and no. (differences are irrelevant) Collision blocks Random buffer (partial birthday attack bits) Padding 0000: .n .o 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0010: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0020: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0030: 00 00 00 00-00 00 00 00-19 71 E7 F7-09 72 FB 06 0040: F3 45 26 13-66 60 C8 01-B9 2A 75 25-5A 67 23 A6 0050: 92 3D EB 8D-B0 B7 57 F1-45 9F 22 95-BE C0 43 75 0060: 91 98 A2 D3-E0 FD 59 ED-D1 C5 FA 0B-79 65 97 51 0070: B3 B3 E4 0C-11 0C 90 32-DE 4B A1 4B-B8 1B 5E C8 0080: 25 D3 8F 19-CD 10 43 07-D9 BB FF 8C-B7 5A 23 F9 0090: 4D D8 13 14-58 A3 35 97-C5 D1 D4 A9-9A E2 FD 1F 00A0: BA 78 40 00-C3 7E 93 B2-31 A3 6E 2D-34 72 4A C9 00B0: 53 4E C0 45-36 1E C8 6A-56 98 E6 F0-57 1D 61 98 00C0: 13 FC FF CD-4D 83 A2 D2-BB B8 DC 04-2B E2 B8 83 00D0: DB 53 80 D7-3D E9 97 D3-23 5A 27 F9-98 9A E7 56 00E0: 7D 86 E4 35-1E B8 33 EE-EA 15 D1 81-FA 96 62 EC 00F0: 75 31 FB DA-4F AE 24 6F-67 D6 AF 10-96 29 FB C7 0100: A3 32 BB A9-EA D5 E4 AE-1F C2 FB 23-41 22 B2 E0 0110: 69 1E 29 20-6F 5B 20 1E-5E 3D 11 2F-3E 4D 9F 39 0120: 8B C9 5C 93-A5 EF A4 22-7D 9A 66 51-6E ED AF 70 0130: 32 90 D4 BD-67 92 38 9B-DC 15 0D BF-DC 71 72 27 0140: E0 5B 43 FA-44 59 E8 60-F7 63 7F F0-73 0A D4 BE 0150: 33 28 AA 99-2C 90 2D D0-01 58 E3 8F-58 50 30 99 0160: E8 60 DB 91-00 13 C9 1D-7A 61 9B 9A-5D 60 BD 71 0170: 23 1A D2 BD-A6 E0 38 66-0B 8C F5 99-56 79 63 D6 0180: 6E 5E D7 7E-C3 4E 9D 5F-65 23 C0 38-C9 55 5A A1 0190: E2 3C CA 78-58 4D B5 3B-04 45 C3 B4-44 C8 87 26 01A0: 02 60 F6 62-91 34 70 FE-C3 34 54 6D-76 07 FF 1A 01B0: 73 53 E6 0B-08 FB 82 80-AD 5F 22 15-18 69 B5 6E 01C0: BB 06 C3 A7-FF 39 15 52-BE FE D4 5C-D2 55 5A 71 01D0: EC E9 BC 1A-B7 BB 08 61-C5 3E E7 89-7C 93 03 FC 01E0: 1F 8A 9A D8-42 BF 6C 01-6A 39 26 84-6C 58 E2 E4 01F0: 00 D4 67 7B-27 BD 93 6D-DF F0 10 4A-2B 00 7E 68 0200: 1D DE D5 8A-67 89 EA 52-0C 32 BD 30-A2 8C BE D0 0210: A7 35 BA C6-BB 7D 07 80-49 22 EF E5-10 B2 83 6D 0220: E6 18 6E E3-F0 52 E4 35-83 61 42 35-72 97 CD 8D 0230: 4F F7 93 68-5A 70 5F 5A-04 3A D5 42-C1 FA 0F E2 0240: AE 57 DB AF-F1 51 B8 B7-38 18 EF 2E-B8 A6 A9 2C 0250: 81 87 FA FE-B2 C4 DC 45-A3 64 91 6D-B8 6E F5 D1 0260: 4F 9C FA 62-3D 42 46 59-67 32 EC 99-DA 89 7A 08 0270: E7 AD E3 21-ED 3C 4B C0-4D 9F 83 3C-DC 7F B7 0A 0000: .y .e .s 00-00 00 00 00-00 00 00 00-00 00 00 00 0010: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0020: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0030: 00 00 00 00-00 00 00 00-B7 46 38 09-8A 46 F1 7B 0040: F3 45 26 13-66 60 C8 01-B9 2A 75 25-5A 67 23 A6 0050: 92 3D EB 8D-B0 B7 57 F1-45 9F 22 95-BE C0 43 75 0060: 91 98 A2 D3-E0 FD 59 ED-D1 C5 FA 0B-79 65 97 4D 0070: B3 B3 E4 0C-11 0C 90 32-DE 4B A1 4B-B8 1B 5E C8 0080: 25 D3 8F 19-CD 10 43 07-D9 BB FF 8C-B7 5A 23 F9 0090: 4D D8 13 14-58 A3 35 97-C5 D1 D4 A9-9A E2 FD 1F 00A0: BA 78 40 00-C3 7E 93 B2-31 A3 6E 2D-34 6A 4A C9 00B0: 53 4E C0 45-36 1E C8 6A-56 98 E6 F0-57 1D 61 98 00C0: 13 FC FF CD-4D 83 A2 D2-BB B8 DC 04-2B E2 B8 83 00D0: DB 53 80 D7-3D E9 97 D3-23 5A 27 F9-98 9A E7 56 00E0: 7D 86 E4 35-1E B8 33 EE-EA 15 D1 81-BA 96 62 EC 00F0: 75 31 FB DA-4F AE 24 6F-67 D6 AF 10-96 29 FB C7 0100: A3 32 BB A9-EA D5 E4 AE-1F C2 FB 23-41 22 B2 E0 0110: 69 1E 29 20-6F 5B 20 1E-5E 3D 11 2F-3E 4D 9F 39 0120: 8B C9 5C 93-A5 EF A4 22-7D 9A 66 51-6E ED AD 70 0130: 32 90 D4 BD-67 92 38 9B-DC 15 0D BF-DC 71 72 27 0140: E0 5B 43 FA-44 59 E8 60-F7 63 7F F0-73 0A D4 BE 0150: 33 28 AA 99-2C 90 2D D0-01 58 E3 8F-58 50 30 99 0160: E8 60 DB 91-00 13 C9 1D-7A 61 9B 9A-5D 5E BD 71 0170: 23 1A D2 BD-A6 E0 38 66-0B 8C F5 99-56 79 63 D6 0180: 6E 5E D7 7E-C3 4E 9D 5F-65 23 C0 38-C9 55 5A A1 0190: E2 3C CA 78-58 4D B5 3B-04 45 C3 B4-44 C8 87 26 01A0: 02 60 F6 62-91 34 70 FE-C3 34 54 6D-76 07 7F 1A 01B0: 73 53 E6 0B-08 FB 82 80-AD 5F 22 15-18 69 B5 6E 01C0: BB 06 C3 A7-FF 39 15 52-BE FE D4 5C-D2 55 5A 71 01D0: EC E9 BC 1A-B7 BB 08 61-C5 3E E7 89-7C 93 03 FC 01E0: 1F 8A 9A D8-42 BF 6C 01-6A 39 26 84-74 58 E2 E4 01F0: 00 D4 67 7B-27 BD 93 6D-DF F0 10 4A-2B 00 7E 68 0200: 1D DE D5 8A-67 89 EA 52-0C 32 BD 30-A2 8C BE D0 0210: A7 35 BA C6-BB 7D 07 80-49 22 EF E5-10 B2 83 6D 0220: E6 18 6E E3-F0 52 E4 35-83 61 42 35-72 97 C5 8D 0230: 4F F7 93 68-5A 70 5F 5A-04 3A D5 42-C1 FA 0F E2 0240: AE 57 DB AF-F1 51 B8 B7-38 18 EF 2E-B8 A6 A9 2C 0250: 81 87 FA FE-B2 C4 DC 45-A3 64 91 6D-B8 6E F5 D1 0260: 4F 9C FA 62-3D 42 46 59-67 32 EC 99-DA 89 7A 88 0270: E7 AD E3 21-ED 3C 4B C0-4D 9F 83 3C-DC 7F B7 0A 156

Slide 157

Slide 157 text

So, we have two f iles. Any pair of f iles. We can see them as pref ixes. 157

Slide 158

Slide 158 text

Padding, as usual Pad both files to the same length, to a block boundary minus 12 (0xC) bytes. Padding content doesn't matter. 158

Slide 159

Slide 159 text

Computation We compute a collision, that appends different blocks to both files. It makes sense only if both formats tolerate appended data. (or cover it by a comment). Block differences are irrelevant in this case. (we entirely control both prefixes). 159

Slide 160

Slide 160 text

📏 ⌛ ‽ Almighty, but slower HashClash HashClash 7-9 blocks A few hours Irrelevant 160

Slide 161

Slide 161 text

Input: two arbitrary pref ixes Their content and length don’t matter. Shorter prefixes don’t make anything faster. Both are padded to the same size. The last 12 bytes before the collision blocks are used for the attack. They're always different. After, blocks of collision are appended (by default, 9 of them) . --maxblocks 9 161

Slide 162

Slide 162 text

The 2 steps of a CPC First, a single Birthday Search, then near-collision computation for each block. (which may require backtracking) Only the Birthday Search benefits from GPU. The B.S. doesn't require any backtracking. 162

Slide 163

Slide 163 text

The fewer the blocks, the more complex the B.S. - 400kH for a single block CPC. - 7-9 blocks is a good trade-off for desktop computation. 9 239 2009 3 249 2009 2 246 2019 1 253 2009 # Blocks Complexity Attack publication 163

Slide 164

Slide 164 text

Impact of a CPC If two files formats tolerate appended data: Compute collision. Done. + Straightforward - Only works for a single pair 164

Slide 165

Slide 165 text

Identical Pref ix vs Chosen Pref ix Recap 165

Slide 166

Slide 166 text

IPC: both contents in each file. (You might leak your payload) From a content perspective 166 CPC: Only one content per file. (evil payload not in the good file)

Slide 167

Slide 167 text

IPC: Deeply modified file structures. Weird header, 2 payloads, possibly split. From a f ile perspective 167 CPC: Each file starts exactly like before. It's just appended data.

Slide 168

Slide 168 text

IPC: Can reuse precomputed collision so instant generation can be possible. From a computing perspective 168 CPC: No re-usability: same computation every time. -> no optimization, no shortcut.

Slide 169

Slide 169 text

⨉ Combining CPC flexibility with IPC re-usability Level-up: IPC(CPC) = 169

Slide 170

Slide 170 text

Using CPC as a pref ix like an IPC More computing than IPC, but less restrictive. Do a CPC with headers rather than whole files. Append body/footer of 2 files. Enables mixing file types: - valid/invalid files - polyglot collisions 170

Slide 171

Slide 171 text

PE collisions via a CPC used like an IPC 171

Slide 172

Slide 172 text

0000: 4D 5A 90 00-03 00 00 00-04 00 00 00-FF FF 00 00 MZÉ ♥ ♦ 0010: B8 00 00 00-00 00 00 00-40 00 00 00-00 00 00 00 ╕ @ 0020: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0030: 00 00 00 00-00 00 00 00-00 00 00 00-E8 00 00 00 Φ 0040: 0E 1F BA 0E-00 B4 09 CD-21 B8 01 4C-CD 21 54 68 ♫▼║♫ ┤○═!╕☺L═!Th 0050: 69 73 20 70-72 6F 67 72-61 6D 20 63-61 6E 6E 6F is program canno 0060: 74 20 62 65-20 72 75 6E-20 69 6E 20-44 4F 53 20 t be run in DOS 0070: 6D 6F 64 65-2E 0D 0D 0A-24 00 00 00-00 00 00 00 mode.♪♪◙$ 0080: 59 09 56 C8-1D 68 38 9B-1D 68 38 9B-1D 68 38 9B Y○V╚↔h8¢↔h8¢↔h8¢ 0090: 0E 60 51 9B-1F 68 38 9B-18 64 37 9B-07 68 38 9B ♫`Q¢▼h8¢↑d7¢•h8¢ 00A0: 18 64 58 9B-3C 68 38 9B-18 64 67 9B-8F 68 38 9B ↑dX¢ address) Anatomy of a typical PE f ile PE Header (critical) Dos Header: declares Executable, points to PE Header. Dos Stub (old 16b code) Rich Header (MS linker information) Points to 172

Slide 173

Slide 173 text

0000: 4D 5A 90 00-03 00 00 00-04 00 00 00-FF FF 00 00 MZÉ ♥ ♦ 0010: B8 00 00 00-00 00 00 00-40 00 00 00-00 00 00 00 ╕ @ 0020: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0030: 00 00 00 00-00 00 00 00-00 00 00 00-E8 00 00 00 Φ 0040: 0E 1F BA 0E-00 B4 09 CD-21 B8 01 4C-CD 21 54 68 ♫▼║♫┤○═!╕☺L═!Th 0050: 69 73 20 70-72 6F 67 72-61 6D 20 63-61 6E 6E 6F is program canno 0060: 74 20 62 65-20 72 75 6E-20 69 6E 20-44 4F 53 20 t be run in DOS 0070: 6D 6F 64 65-2E 0D 0D 0A-24 00 00 00-00 00 00 00 mode.♪♪◙$ 0080: 59 09 56 C8-1D 68 38 9B-1D 68 38 9B-1D 68 38 9B Y○V╚↔h8¢↔h8¢↔h8¢ 0090: 0E 60 51 9B-1F 68 38 9B-18 64 37 9B-07 68 38 9B ♫`Q¢▼h8¢↑d7¢•h8¢ 00A0: 18 64 58 9B-3C 68 38 9B-18 64 67 9B-8F 68 38 9B ↑dX¢

Slide 174

Slide 174 text

- DOS header is generic Pointers to 2 headers, over collision blocks. - Dos Stub and Rich header are discarded to make place for collision blocks - Two PE Headers that follow each other - both sections sets have adjusted offsets. -> Reusable and instant PE collision Windows PE collisions 0000: 4D 5A 90 00-03 00 00 00-04 00 00 00-FF FF 00 00 MZÉ ♥ ♦ 0010: B8 00 00 00-00 00 00 00-40 00 00 00-00 00 00 00 ╕ @ 0020: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 0030: 00 00 00 00-00 00 00 00-00 00 00 00--80 04 00 00 Ç♦ 00040: 2F 3D 2D 3D-2D 3D 2D 3D-2D 3D 2D 3D-2D 3D 2D 5C /=-=-=-=-=-=-=-\ 00050: 7C 50 45 20-43 50 43 20-48 65 61 64-65 72 00 7C |PE CPC Header | 00060: 5C 2D 3D 2D-3D 2D 3D 2D-3D 2D 3D 2D-3D 2D 3D 2F \-=-=-=-=-=-=-=/ 00070: 41 6E 67 65-00 00 00 00-50 9F 71 32-3D 49 75 DD Ange Pƒq2=Iu▌ 00080: E3 45 20 DB-90 D9 F9 1A-1E 32 55 D1-4D C9 14 F6 πE █É┘∙→▲2U╤M╔¶÷ 00090: AD D9 79 C8-3E D7 22 3D-EF AB 83 E8-DD CB 87 F0 ¡┘y╚>╫"=∩½âΦ▌╦ç≡ ... 002B0: F2 C8 C5 E0-7D 7C 29 D8-91 36 41 37-D0 8D 04 E5 ≥╚┼α}|)╪æ6A7╨ì♦σ 002C0: 50 45 00 00-4C 01 04 00-4A 24 52 44-00 00 00 00 PE L☺♦ J$RD 002D0: 00 00 00 00-E0 00 0F 01-0B 01 07 0A-00 10 03 00 α ☼☺♂☺•◙ ►♥ 002E0: 00 E0 00 00-00 00 00 00-6F 9C 01 00-00 10 00 00 α o£☺ ► 002F0: 00 20 03 00-00 00 40 00-00 10 00 00-00 10 00 00 ♥ @ ► ► 00300: 04 00 00 00-01 00 00 00-04 00 00 00-00 00 00 00 ♦ ☺ ♦ 00470: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 00480: 50 45 00 00-4C 01 04 00-E7 81 0C 54-00 00 00 00 PE L☺♦ τü♀T 00490: 00 00 00 00-E0 00 03 01-0B 01 09 00-00 9E 03 00 α ♥☺♂☺○ ₧♥ 004A0: 00 A2 01 00-00 00 00 00-CC 91 02 00-00 10 00 00 ó☺ ╠æ☻ ► 004B0: 00 B0 03 00-00 00 40 00-00 10 00 00-00 02 00 00 ░♥ @ ► ☻ ... 007E0: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 007F0: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 00800: 8B 44 24 0C-8B 4C 24 10-57 8B 7C 24-0C 8D 57 01 ïD$♀ïL$►Wï|$♀ìW☺ 00810: C7 00 00 00-00 00 52 C7-01 00 00 00-00 E8 09 6A ╟ R╟☺ Φ○j 00820: 02 00 83 C4-04 85 C0 75-02 5F C3 56-33 C9 33 F6 ☻ â─♦à└u☻_├V3╔3÷ ... 54FF0: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 55000: 6A FF 68 98-02 43 00 64-A1 00 00 00-00 50 64 89 j hÿ☻C dí Pdë 55010: 25 00 00 00-00 51 56 8B-F1 89 74 24-04 E8 F0 7C % QVï±ët$♦Φ≡| 55020: 01 00 33 C0-89 44 24 10-8D 4E 0C C7-06 F0 21 43 ☺ 3└ëD$►ìN♀╟♠≡!C 55030: 00 6A FF 89-41 14 C7 41-18 0F 00 00-00 50 88 41 j ëA¶╟A↑☼ PêA ... 91FF0: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00 C0 02 00 00 Dos Header (prefix w/ 2 values) Alignments and collision blocks PE Header 1 PE Header 2 Sections set 1 Sections set 2 points to points to maps maps 174

Slide 175

Slide 175 text

Recap: CPC-IPC exploitation for PE f iles 1. Craft 2 DOS headers with enough difference: - 1 block of alignment, 9 blocks of collision + 1 PE header 2. Compute CPC (a few hours) 3. Copy PE headers. Append sections. Adjust Sections offsets. -> instant collision of any pair of PE files (with no code modification) 175

Slide 176

Slide 176 text

Chaining collisions 176

Slide 177

Slide 177 text

Chaining collisions A collision makes two different contents have the same hash. -> they can be chained like a tree. Top nodes can be an IPC, others CPCs or UniColl -> colliding more than 2 files N collisions makes N+1 contents collide 177

Slide 178

Slide 178 text

Collisions trees PoeMD5: 8 UniColls displayed on the page. https://github.com/corkami/collisions#pdf A pile-up of 3 HashClashes to collide 4 file types. Nostradamus (2007): 11 HashClashes for 12 PDFs https://www.win.tue.nl/hashclash/Nostradamus/ 178

Slide 179

Slide 179 text

All the known (implemented) collisions attacks on SHA1 179 📏 ⌛ ‽ 2 blocks 11K USD Start & end Shattered 📏 ⌛ ‽ 9 blocks 45K USD Irrelevant Shambles

Slide 180

Slide 180 text

Shattered a SHA-1 IPC 180

Slide 181

Slide 181 text

Shattered - an IPC for Sha1 - Computed only once (?) - Differences at start and end -> “easy” to exploit Official PoCs: JPGs in PDFs (PDFs embed JPGs natively) 📏 ⌛ ‽ 2 blocks 6K years Start & end 181

Slide 182

Slide 182 text

Shattered f iles layout: different length => skip f irst image data 182

Slide 183

Slide 183 text

Most formats declare Lengths before Type (LTV): -> not good for hash collisions (type declaration is in random bytes) JPG & MP4* are TLV & big endian -> exploitable w/ Shattered Declare comment (FF FE for JPG, free for MP4) then abuse length with collision difference. Length / Type / Value <-> Type / Length / Value *with 64b lengths 183

Slide 184

Slide 184 text

For more details about Shattered exploitation: https://speakerdeck.com/ange/exploiting-hash-collisions (2017) 184

Slide 185

Slide 185 text

Shambles a SHA-1 CPC 185

Slide 186

Slide 186 text

186 0 1 2 3 4 5 6 7 01234567 0 1 2 3 4 5 6 7 01234567 99040d047fe81780 ........ 99030d047fe81780 ........ 012000ff4b657920 . ..Key 011800ff50726163 ....Prac 6973207061727420 is part 746963616c205348 tical SH 6f66206120636f6c of a col 412d312063686f73 A-1 chos 6c6973696f6e2120 lision! 656e2d7072656669 en-prefi 4974277320612074 It's a t 7820636f6c6c6973 x collis 7261702179c61af0 rap!y... 696f6e211d276c6b ion!.'lk afcc054515d9274e ...E..'N a661e1040e1f7d76 .a....}v 7307624b1dc7fb23 s.bK...# 7f076249ddc7fb33 ..bI...3 988bb8de8b575dba .....W]. 2c8bb8c2b7575dbe ,....W]. 7b9eab31c1674b6d {..1.gKm c79eab2be1674b7d ...+.gK} ... 05a404fbdb12fc45 .......E 05a404f76312fc55 ....c..U 4d41fdd95cf24596 MA..\.E. 4141fddb9cf24586 AA....E. 64a2ad032d1da60a d...-... d0a2ad1f111da60e ........ 73264075d7f1e0d6 s&@u.... cf26406ff7f1e0c6 .&@o.... c1403ae7a0d861df .@:...a. e5403afb4cd861cb .@:.L.a. 3fe5707188dd5e07 ?.pq..^. 33e5707348dd5e17 3.psH.^. d1589b9f8b663055 .X...f0U 65589b83a7663051 eX...f0Q 3f8fc352b3e0c27d ?..R...} 838fc34a03e0c26d ...J...m a80bddba4c64020d ....Ld.. a80bddb6f464021d .....d.. Birthday bits Identical Dif ferences Pref ixes offset 0x0000 0x0008 0x0010 0x0018 0x0020 0x0028 0x0030 0x0038 0x0040 0x0048 0x0050 ... 0x0238 0x0240 0x0248 0x0250 0x0258 0x0260 0x0268 0x0270 0x0278

Slide 187

Slide 187 text

Shambles - a CPC for Sha1 - Same layout as HashClash: 9 blocks, 12 birthday bits Official PoCs: PGP 📏 ⌛ ‽ 9 blocks 45K USD Irrelevant Shambles 187

Slide 188

Slide 188 text

188

Slide 189

Slide 189 text

All the known (implemented) collisions attacks on MD5 📏 ⌛ ‽ two blocks a few minutes in pref ix 📏 ⌛ ‽ two blocks a few seconds in the middle (away from start or end) FastColl UniColl 📏 ⌛ ‽ HashClash 189 7-9 blocks a few hours irrelevant

Slide 190

Slide 190 text

They all appends random-looking blocks with tiny differences. No, there's no other kind of attacks! Nothing like: - ascii-only - incomplete blocks - modify in the middle Common points of all these attacks 190

Slide 191

Slide 191 text

In 2008, a CPC Attack used to create a rogue SSL certificate. (200 PS3, signing at an exact second, 4 attempts, 2 days of computation each…) -> MD5 was considered dead for good. -> no incentive for any further research. Only 3 attacks? https://medium.com/@sleevi_/a-history-of-hard-choices-c1e1cc9bb089 191

Slide 192

Slide 192 text

Exploitations patterns File (prefix) Comment (padding) Header Body (chunks) Footer Identical Prefix Chosen Prefix Reusable IPC Reusable CPC CPC 192

Slide 193

Slide 193 text

Layout of a re-usable collision exploit Alignment Suffix Pref ix 193

Slide 194

Slide 194 text

a cryptographic hash a toy function MD5 is ...have fun! 194

Slide 195

Slide 195 text

2964F721 7EEEF375 983F0420 725976C2 60101938 18BDD53D 332E8131 25244205 04D9B9CE 80FF0958 EB01DAD4 9A4DAA18 AD894BEB A3A824B2 C94DB974 378499C2 478D436C 255C79F3 A7B2A523 CBA811FB D7D0C870 1F1C6B5F 6EEBDFDF 4BA0AD41 31D8B06A 020B9399 B897DB50 499C7713 879C2E0B DB0267DD FE27A567 DDA5487C 2964F721 7EEEF375 983F0420 725976C2 601019B8 18BDD53D 332E8131 25244205 04D9B9CE 80FF0958 EB01DAD4 9ACDAA18 AD894BEB A3A824B2 C94DB9F4 378499C2 478D436C 255C79F3 A7B2A523 CBA811FB D7D0C8F0 1F1C6B5F 6EEBDFDF 4BA0AD41 31D8B06A 020B9399 B897DB50 491C7713 879C2E0B DB0267DD FE27A5E7 DDA5487C 4CFB0E37 5E7078A2 31260B95 4550524A $ file selfmd5-release.zip selfmd5-release.zip: Sega Mega Drive / Genesis ROM image: "TOY MD5 COLLIDER" (GM 00000000-00, (C) MAKO 2017 ) $ Mako's “Toy MD5 Collider” for the MegaDrive dd49d7eb... 195

Slide 196

Slide 196 text

It takes 2 hours 1988: Sega Mega Drive/Genesis - 1992: MD5 196

Slide 197

Slide 197 text

197

Slide 198

Slide 198 text

Other UniColl-based exploits for other formats For more, see https://github.com/corkami/collisions 198

Slide 199

Slide 199 text

PDF Merge both documents, split /Kids in 2 part showing pages sets separately. Declare a /Catalog objects that has its /Pages as object 2. 0040: .. .. ./ .P .a .g .e .s . .2 . .0 . .R \n .% The other file will have its pages referenced as object 3. 0040: .. .. ./ .P .a .g .e .s . .3 . .0 . .R \n .% More details @ https://github.com/corkami/collisions#pdf 199

Slide 200

Slide 200 text

JPEG f ile structure Comment segment in JPG: FF FE Scans can be bigger than 64 kb -> split them via saving as progressive 200

Slide 201

Slide 201 text

201 JPG Use a FF FE COMment segments for alignement, then a comment of length 0x77 0000: FF D8 FF FE-00 03 .. FF FE 00 77 .. .. .. .. .. The other file will have a longer segment of 0x177. 0000: FF D8 FF FE-00 03 .. FF FE 01 77 .. .. .. .. .. CF https://github.com/corkami/collisions#jpg In JPG specifications, Chunks are called segments

Slide 202

Slide 202 text

202 MP4 (+JP2, HEIF…) Use FREE atoms, for alignement then of length 0x79 0040: .. .. .. .. .. .. .. 00 00 00 79 .F .R .E .E .. The other file will have a longer chunk of 0x179. 0040: .. .. .. .. .. .. .. 00 00 01 79 .F .R .E .E .. Adjusting absolute (!) offsets in sample tables is required. More details @ https://github.com/corkami/collisions#mp4-and-others In MP4 specifications, Chunks are called Atom/Boxes

Slide 203

Slide 203 text

File format Comment bit length Generic collision FastColl UniColl Shattered HashClash GZIP 16 ✓ ✓* ✓* ✓ PDF 32 ✓ ✓* ✓ JPG 16 ✓ ✓* ✓* ✓ PNG 32 ✓ ✓* ✓ MP4 32/64 ✓ ✓* ✓* ✓ PE N/A ✓ ✓ GIF 8 ✗ ✓ ✓ ZIP-based (DOCX, 3MF) 16 ✓ ✓ ELF/TAR Mach-O/Class ✗ ✓ * restrictions 203

Slide 204

Slide 204 text

Exploiting FastColl It seems hard, but not necessarily impossible. It's a matter of finding the right file format. (AKA aligning planets) Extra 204

Slide 205

Slide 205 text

00: .H .e .r .e . .i .s . .a . .f .i .l .e . .w 10: .i .t .h . .a . .f .e .w . .b .y .t .e .s 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40: CE 84 07 61 4B BA 7A 3D 3A EA 8A AA F8 EE 1D E5 50: 44 17 9B 70 0A E0 D2 64 21 E2 38 E1 94 18 0A F6 60: 93 D2 B5 E4 FC 2F 3A 32 4F 50 46 01 F1 CB BE 02 70: 23 EE EF BF 92 B5 7C 29 D9 C5 66 88 31 5E 7A 1D 80: 2F 5A 9C 5C 12 8E DF F2 85 17 5B DD 67 25 05 78 90: 13 F2 BF 56 64 59 F2 C8 8B C3 00 6F 8B 5F 88 C6 A0: CB 3D 80 E4 9F 48 91 5E 34 06 D0 3A 8B 83 FB E0 B0: ED 18 67 0F C8 3A C9 A1 E7 48 F6 AA D2 5C 30 C0 00: .H .e .r .e . .i .s . .a . .f .i .l .e . .w 10: .i .t .h . .a . .f .e .w . .b .y .t .e .s 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40: CE 84 07 61 4B BA 7A 3D 3A EA 8A AA F8 EE 1D E5 50: 44 17 9B F0 0A E0 D2 64 21 E2 38 E1 94 18 0A F6 60: 93 D2 B5 E4 FC 2F 3A 32 4F 50 46 01 F1 4B BF 02 70: 23 EE EF BF 92 B5 7C 29 D9 C5 66 08 31 5E 7A 1D 80: 2F 5A 9C 5C 12 8E DF F2 85 17 5B DD 67 25 05 78 90: 13 F2 BF D6 64 59 F2 C8 8B C3 00 6F 8B 5F 88 C6 A0: CB 3D 80 E4 9F 48 91 5E 34 06 D0 3A 8B 03 FB E0 B0: ED 18 67 0F C8 3A C9 A1 E7 48 F6 2A D2 5C 30 C0 Recap on FastColl It’s just a matter of getting a format to comply with the single byte differences. Padding, for alignments collision blocks’ randomness needs to be ignored Differences need to be taken into account Two contents need to coexist ⇤ ⇥ #&%!@ …‽… …🛑? 205

Slide 206

Slide 206 text

The Graphics Interchange Format - FastColl based exploit: instant computation - same dimensions and palettes, single frame. - First image displayed for 10 minutes (each image is a different frame). 5c827c0eba9cfaa647c1a489bea77c60 *collision1.gif 5c827c0eba9cfaa647c1a489bea77c60 *collision2.gif /dʒɪf/ JIF /ɡɪf/ GHIF Specif ications from 1989 206

Slide 207

Slide 207 text

Overview of the Graphics Interchange Format 207 - Punctuation delimited: ! , ; - a frame can be made of several images - header contains file palette & dimensions… - Comments can only be later in the file, in extensions -> no generic collisions for all GIFs

Slide 208

Slide 208 text

More details 208 - A header, with dimensions and optional global palette - Sequence of optional extensions and image data. - comments are extensions. - ImageData and Extension use the same SubBlocks structure . - Global (file-wise) and local (image-wise) palettes can be too big.

Slide 209

Slide 209 text

Structure lengths 7 bytes file-wide palette (optional) 3-768 bytes Examples of extension: - Graphical Control defines delay between frames - Comment - Application Defines looping Image-wide palette (optional) 3-768 bytes SubBlocks-based 10 bytes Variable-sized (3-768 bytes) Fixed size 209

Slide 210

Slide 210 text

Specific structure for comments and image data in GIF: Cut in chunks of 255 bytes max, starting with their length, until 00: Examples of 2 equivalent comments: 07 .c .o .m .m .e .n .t 00 01 .c 04 .o .m .m .e 02 .n .t 00 GIF SubBlocks structures 210

Slide 211

Slide 211 text

GIF SubBlocks impact - can’t jump over anything longer than 255 bytes. -> very restrictive + turns any non-null byte into a forward jump: good for FastColl 211

Slide 212

Slide 212 text

GIF data sled Subblocks are common to image data and extensions (like comments): - > extend comment to image data (turn pixels into comment) Reliable w/ minor overhead. 212

Slide 213

Slide 213 text

10 minutes delay Graphical Control Extension: Max delay between images Long comment Short comment Common schema 213

Slide 214

Slide 214 text

0330: .. .. .. ..-.. .. .. ..-.. .. .. ..-.. 21 FE 7B 0340: 7B 07 80 42-FF 65 E4 4E-1F 99 A0 E8-4D BC 59 EB 0350: E8 DA 58 CC-35 CF 2C 78-53 1E 79 D1-28 34 08 DA 0360: B5 DB FF C6-80 0F 3A 46-EF 0F FB 1C-F9 F1 E0 83 0370: CC FB ED 70-D9 21 A5 7D-0A A1 10 B6-A7 C5 6D E0 0380: 71 82 1F FA-AC 77 A9 12-DD 8E F2 14-9D 64 5B F8 0390: 3D 66 C5 AE-D3 97 8F 2B-6E B9 AB 4B-4B 1D A7 C1 03A0: A8 34 B5 2D-96 46 8A DE-A9 9C EF 18-6B 8C F8 08 03B0: 12 54 43 53-AD 8A 72 BA-19 83 66 B3-2F CF 85 FD .... ... 7B 07 80 42-FF 65 E4 4E-1F 99 A0 E8-4D BC 59 EB E8 DA 58 4C-35 CF 2C 78-53 1E 79 D1-28 34 08 DA B5 DB FF C6-80 0F 3A 46-EF 0F FB 1C-F9 71 E0 83 CC FB ED 70-D9 21 A5 7D-0A A1 10 36-A7 C5 6D E0 71 82 1F FA-AC 77 A9 12-DD 8E F2 14-9D 64 5B F8 3D 66 C5 2E-D3 97 8F 2B-6E B9 AB 4B-4B 1D A7 C1 A8 34 B5 2D-96 46 8A DE-A9 9C EF 18-6B 0C F9 08 12 54 43 53-AD 8A 72 BA-19 83 66 33-2F CF 85 FD Gif comment manipulation via FastColl Chunk length: 0x33/0xB3 Def ines a comment Chunk length: 0x7B 214

Slide 215

Slide 215 text

GIF Special chunk structure -> single byte = “jump” Same structure used for data -> can use it to jump over image A. Just put a delay for image A to display long enough. 5c827c0eba9cfaa647c1a489bea77c60 *collision1.gif 5c827c0eba9cfaa647c1a489bea77c60 *collision2.gif After 10 minutes, the images are identical. 215

Slide 216

Slide 216 text

Common headers? Headers include palette, dimensions: -> use 2 images of same dimensions -> normalize palette Shortcut: merge them as 2 frames of the same animation, with a comment, no looping, and maximum delay. 216

Slide 217

Slide 217 text

GIF FastColl exploit - combine 2 frames in a single animation with a comment. - extend comment to align to 64 bytes with a jump of 0x7B (points to the last difference in the collision blocks) - compute FastColl - append images suffix - adjust comments to: finish before first image: .! F9 slide into first image data : 08 FE 217

Slide 218

Slide 218 text

Actual example 218

Slide 219

Slide 219 text

Alignment 6 00000300: [header palette ending...............] .! FE 2F 00000310: [comment for alignment......................... ... 00000330: ............................................ 7B 00000340: [collision block with its last difference...... 00000350: at relative offset of 7B....................... ... 000003B0: ...............................] EA [.......... 000003C0: [space to land to the shortest comment......... 000003D0: its length will vary, but...................... 000003E0: the longest comment will always be 0x80 longer. ... 00000420: ................] 80 [.......................... ... 000004A0: ................] 14 00 .! F9 04 00 FF FF FF 00 000004B0: 2C 00 00 00 00 F4 01 F4 01 00 08 FE 00 59 09 BC SubBlocks Image Collision blocks Comment declaration CF working script for reference 219

Slide 220

Slide 220 text

Recap on GIF exploitation via FastColl + Comments are made of SubBlocks: declaration are separated from lengths. -> compatible with FastColl (!) - lengths are stored on a single byte -> can’t skip more than 255 bytes + image data is stored in SubBlocks too: -> extend comment to image data* + use max delay (10 min) to the 1st frame to hide the 2nd one. 220 *A great idea from Marc Stevens

Slide 221

Slide 221 text

Collision exploit Instant GIF collision via FastColl Certificate (hard) Ange Albertini INSTRUCTOR COLLT IS 221

Slide 222

Slide 222 text

FAQ (FGA) 222

Slide 223

Slide 223 text

Git doesn't use SHA-1 on files, but on objects. https://git-scm.com/book/en/v2/Git-Internals-Git-Objects SubVersion servers were unexpectedly broken. Bittorrent indexes blocks with SHA-1. -> Marc created a SHA-1 collision detection library https://github.com/cr-marcstevens/sha1collisiondetection What did SHA-1 break? 223

Slide 224

Slide 224 text

What about SHA-2? May 2019: - MD5/SHA-1: "trivial". - SHA-2: "clearly infeasible". https://twitter.com/realhashbreaker/status/1128275424574832640 224

Slide 225

Slide 225 text

Only f iles? Protocols can also be attacked: SLOT - CVE-2015-7575 Security Losses from Obsolete and Truncated Transcript Hashes https://www.mitls.org/pages/attacks/SLOTH Paper: Transcript Collision Attacks: Breaking Authentication in TLS, IKE, and SSH 225

Slide 226

Slide 226 text

References 226

Slide 227

Slide 227 text

227 2004: Dan Kaminsky: MD5 To Be Considered Harmful Someday https://eprint.iacr.org/2004/357.pdf https://dankaminsky.com/2004/12/06/46/ 2004: Ondredj Mikle: Practical Attacks on Digital Signatures Using MD5 Message Digest https://eprint.iacr.org/2004/356.pdf IPC exploits papers ● 2005 Max Gebhardt, Georg Illies, Werner Schindler A Note on the Practical Value of Single Hash Collisions for Special File Formats ● 2014 MalSHA1 Malicious Hashing: Eve’s Variant of SHA-1 Ange Albertini, Jean-Philippe Aumasson, Maria Eichlseder, Florian Mendel, Martin Schläffer ● 2017 Shattered The first collision for full SHA-1 Marc Stevens, Elie Bursztein, Pierre Karpman, Ange Albertini, Yarik Markov Slides a6cb4934... Paper ac7a05b4... Jean-Philippeʼs Slides aba7833e... Paper 5c763e29... Paper a3396362... Marcʼs Crypto17 video Elieʼs BlackHat slides video 1a17c315... Pierre's RWC video slides 08e83064... file format collaborator instigator

Slide 228

Slide 228 text

Current hash collision complexity SHA1 MD5 IPC 265 2017 Stevens (Shattered) The first collision for full SHA-1 CPC 277 2013 Stevens New collision attacks on SHA-1 267 2019 Leurent From Collisions to Chosen-Prefix Collisions IPC 216 2009 Stevens (FastColl) Short chosen-prefix collisions for MD5 CPC 239: 9 blocks 2009 Stevens (HashClash) Short chosen-prefix collisions for MD5 253: 1 block … … 246: 2 blocks 2019 Leurent From Collisions to Chosen-Prefix Collisions 228

Slide 229

Slide 229 text

Hash collisions in CTF 229

Slide 230

Slide 230 text

MD5 collision on certificates by Enzo. 500 pts, 0 solves :( HrefIn 230

Slide 231

Slide 231 text

Looking Glass MD5 collision on ProtoBuf by mlen. 330 pts, 11 solves. 231

Slide 232

Slide 232 text

Acknowledgments Research: Marc Stevens Workshop: Barbie Auglend, Christophe Brocas, Philippe Teuwen. Improvments: Jean-Philippe Aumasson, Nicolas Grégoire, Enzo Puig, Mateusz Lenik, Enrico Bacis. 232

Slide 233

Slide 233 text

233 Thank you for making it this far! Any feedback is welcome! @angealbertini or ✉ [email protected] 233 LET’s PLAY LET’s PLAY