The offset for the hidden PNG data could be calculated by comparing the reported "Packed Size" from the 7z -slt l command with the actual file structure.
The first file contained the start of the PNG, while the last file ( part2_375.7z ) contained the . Parade_Buster-Final.7z
The PNG file was striped and hidden in the trailing bytes of the 7z archives, just before the footer. The offset for the hidden PNG data could
: Standard extraction and concatenation of the junk files failed to yield a valid binary. : Standard extraction and concatenation of the junk
: To solve this, a script was used to loop through all 376 files, extract a specific block of bytes (typically 0x11 bytes) from each, and concatenate them. Final Result
The file Parade_Buster-Final.7z was the concluding challenge in the series from TastelessCTF 2020 . This write-up details the process of identifying a hidden PNG file embedded across hundreds of separate archives. Challenge Overview
: Opening the first archive ( part2_0.7z ) in a hex editor revealed a PNG header ( 89 50 4E 47 ) and an IHDR chunk buried within the file structure itself, rather than in the extracted contents. The Pattern :