10 ms·
A file that’s both an acceptable HTML page and a JPEG (2012)
- tomglynch 8y agoExplanation please?
- saagarjha 8y agoTook a look at the page source, and it's full of binary garbage. It looks to me that it's a JPEG image that has been slightly tweaked to contain just enough HTML to get a (lenient) browser to display it.
- cryptonaut 8y agoIt's a JPEG with the HTML written in the comment field: # exiftool -b -comment <(curl -s http://lcamtuf.coredump.cx/squirrel/) <html><body><style>body { visibility: hidden; } .n { visibility: visible; position: absolute; padding: 0 1ex 0 1ex; margin: 0; top: 0; left: 0; } h1 { margin-top: 0.4ex; margin-bottom: 0.8ex; }</style><div class=n><h1><i>Hello, squirrel fans!</i></h1>This is an embedded landing page for an image. You can link to this URL and get the HTML document you are viewing right now (soon to include essential squirrel facts); or embed the exact same URL as an image on your own squirrel-themed page:<p><xmp><a href="http://lcamtuf.coredump.cx/squirrel/">Click here!</a></xmp><xmp><img src="http://lcamtuf.coredump.cx/squirrel/"></xmp><p>No server-side hacks involved - the magic happens in your browser. Let's try embedding the current page as an image right now (INCEPTION!):<p><img src="#" style="border: 1px solid crimson"><p>Pretty radical, eh? Send money to: lcamtuf@coredump.cx<!--
- mikeryan 8y agoIt also uses an (non terminated - AFAICT) HTML Comment to hide the rest of the JPEG data.
- anonymfus 8y agoYes but it is not necessary because everything except absolutely positioned div is hidden anyway.
- saagarjha 8y ago> non terminated - AFAICT Yes, it shows up as all green in Safari. And: $ { curl -s http://lcamtuf.coredump.cx/squirrel/?1 | grep -- '-->' ; } || echo "Not found" Not found
- saagarjha 8y agoI suspected it was something like that: the "meat" of the HTML and JPEG data being contained in each other's comment fields, since that's how many quines work. I don't quite know enough about the JPEG file format to be confident about it, though.
- MapleWalnut 8y agoHere is the output from the handy `file` BSD utility which gave it away to me (see the comment field). JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "<html><body><style>body { visibility: hidden; } .n { visibility: visible; position: absolute; ", baseline, precision 8, 1000x667, frames 3
- quickthrower2 8y agoBrowsers are <liberal> in what they </accept>
- ramshorns 8y agoIt doesn't even use JavaScript.
- vandot 8y agoThis looks like the original thread: https://news.ycombinator.com/item?id=4209052 https://news.ycombinator.com/item?id=4209052
- jwilk 8y agoAlso discussed in 2016: https://news.ycombinator.com/item?id=12262470 https://news.ycombinator.com/item?id=12262470
- VeXocide 8y agoIt causes a 500 Internal Service Error when passed to the W3C validator: https://validator.w3.org/check?uri=http%3A%2F%2Flcamtuf.coredump.cx%2Fsquirrel%2F&charset=%28detect+automatically%29 https://validator.w3.org/check?uri=http%3A%2F%2Flcamtuf.core...
- byron_fast 8y agoCool, but it's a chipmunk not a squirrel. Just saying!
- oh_sigh 8y agoA chipmunk is a type of squirrel.
- eagsalazar2 8y agohttps://animalsake.com/how-is-chipmunk-different-from-squirrel https://animalsake.com/how-is-chipmunk-different-from-squirr... (TLDR, Chipmunks are not Squirrels)
- oh_sigh 8y agohttps://en.wikipedia.org/wiki/Squirrel https://en.wikipedia.org/wiki/Squirrel > Squirrels are members of the family Sciuridae, a family that includes small or medium-size rodents. The squirrel family includes tree squirrels, ground squirrels, chipmunks, marmots (including woodchucks), flying squirrels, and prairie dogs amongst other rodents. (TLDR, chipmunks are squirrels)
- notadog 8y agoIf you think that this is interesting, you should check out Daeken's Magister: http://demoseen.com/windowpane/magister.png.html http://demoseen.com/windowpane/magister.png.html It's a PNG that's interpreted as HTML and loads itself as compressed JavaScript!
- gammatrigono 8y agohttps://news.ycombinator.com/item?id=4209168 https://news.ycombinator.com/item?id=4209168 So, literally copying previous top comments on old posts is now a popular thing?
- dang 8y agoThat's indeed weird. Please don't do that, GP! It seems to have been a one-off, so we won't ban the account.
- kyo3 8y agoFound the real gold: http://lcamtuf.coredump.cx/prep/ http://lcamtuf.coredump.cx/prep/
- notadog 8y agoEDIT: I realize that the subject of this thread is not a polygot, but I'm leaving this comment up in case it interests someone. :/ If anyone's interested in what these are called, they are called polygots. > In computing, a polyglot is a computer program or script written in a valid form of multiple programming languages, which performs the same operations or output independent of the programming language used to compile or interpret it. [1] https://en.wikipedia.org/wiki/Polyglot_(computing) https://en.wikipedia.org/wiki/Polyglot_(computing)
- colejohnson66 8y agoI wouldn’t call it a polyglot as that has to deal with computer programs, no?
- Kerrick 8y agoIt also doesn't have the same operations/output since one is a squirrel photo and the other is a webpage with English text.
- 13of40 8y agoI always thought it was called a chimera.
- Drup 8y agoSo, if I remember correctly Ange Albertini's nomenclature, chimeras are particular types of polyglots where a single data is disguised as different file formats. For example, consider a file that is both a JPEG of a picture and a PDF which contains the same picture, and the data of the picture is present only once in the file.
- bigiain 8y agoPOC||GTFO issue 2 (from 2013) was a PDF and a bootable OS at the same time: From section 8: "A careful reader may have noticed that a bootable OS image was hidden in the last issue of PoC k GTFO, as one of the files in its dual PDF/ZIP structure (if you haven’t, download and extract it now!). This time, though, let’s hide it in plain sight. You will find by running ‘qemu-system-i386 -fda pocorgtfo02.pdf’ that the PDF file you are reading is also a bootable disk image." https://greatscottgadgets.com/pocorgtfo/pocorgtfo02.pdf https://greatscottgadgets.com/pocorgtfo/pocorgtfo02.pdf And issue 3: "This file, pocorgtfo03.pdf, complies with the PDF, JPEG, and ZIP file formats. When encrypted with AES in CBC mode with an IV of 5B F0 15 E2 04 8C E3 D3 8C 3A 97 E7 8B 79 5B C1 and a key of “Manul Laphroaig!”, it becomes a valid PNG file. Treated as single-channel raw audio, 16-bit signed little-endian integer, at a sample rate of 22,050 Hz, it contains a 2400 baud AFSK transmission."
- turbografx16 8y agoDon't forget the issue that was a PDF, a ZIP, and an NES ROM that would print its own MD5 when run in an emulator
- na85 8y agoAny reading you can link to regarding how to accomplish stuff like this? I.e. valid pdfs that are also valid bootable images?
- qu4z-2 8y agoThey usually document their tricks in the file itself. For example, see Chapter 8 in GP's link.
- EMRZ 8y agoThe last week i found this [1] thread by Notch. He is working in an entry to js13k [2] (a game jam about html5 games restricted to 13 KBs). He bundled the whole source code and binary data used in the game/tech demo to use the in browser image decompression, avoiding to write a custom (de)compression code, saving KBs this way. Then he just eval() the needed parts for each thing. I found this extremely clever, game jam limitations, specially size ones, evolve into clever programming tricks that are interesting both to code and to look at. [1] https://twitter.com/notch/status/1035811278520872960 https://twitter.com/notch/status/1035811278520872960 [2] http://js13kgames.com/ http://js13kgames.com/
- jfries 8y agoWhile definitely cool, I wonder how effective this is. Code/random binary data should have different characteristics than image data.
- onion2k 8y agoIt's very effective, because it means you get a really good compression algorithm for free (because it's already there in the browser). You definitely won't save enough bytes with better input heuristics than the amount of code needed to decompress them if you're only working with 13Kb of data.
- boomlinde 8y ago
- amelius 8y agoBut what does the Unix "file" command say?
- bitofhope 8y agosquirrel: HTML document, ASCII text BSD file(1) on both Linux and NetBSD. Solaris also identifies it as HTML.
- duckerude 8y ago$ curl -s http://lcamtuf.coredump.cx/squirrel/ | file - /dev/stdin: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "<html><body><style>body { visibility: hidden; } .n { visibility: visible; position: absolute; ", baseline, precision 8, 1000x667, frames 3 file(1) version 5.32-2ubuntu0.1.
- londons_explore 8y agofile knows...
- ddalex 8y ago/dev/stdin: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "<html><body><style>body { visibility: hidden; } .n { visibility: visible; position: absolute; ", baseline, precision 8, 1000x667, frames 3 so you get even more details...
- peterburkimsher 8y agoIt's a pity that phones recompress the JPG when doing Save To Camera Roll. I'd like to build a system for distributing mini-apps as images, bypassing the App Store. A JavaScript bookmarklet could be used to provide a basic "bootloader" that provides an "upload image" button. Then a binary representation of the HTML could be loaded from the image data. The problem I had was lossy recompression - colours bleed across edges, so the binary data was corrupt after the first save. I'm still not sure how to work around that problem.
- mping 8y agoSome kind of redundancy?
- dan_hawkins 8y agoTry to use metadata sections and hope they won't be dropped during the re-save?
- opencl 8y agoMy phone left the JPG entirely intact when downloading it. I suppose you're talking about iOS devices?
- bitofhope 8y agoA similar interesting hybrid is K Lange's résumé, which is both a PDF and an ISO image for x86 bootable operating system http://r.dakko.us/ http://r.dakko.us/ Also of note, klange's unofficial résumé in C https://gist.github.com/klange/4042963 https://gist.github.com/klange/4042963
- 3chelon 8y agoThe first thing to cross my mind when I saw this was XSS vulnerabilities. Presumably there's nothing to stop this page running JS?
- kenbellows 8y agoAssuming you can include JS in the file, I imagine it would only run if the file was being parsed as HTML at the moment, not when parsed as a JPEG. That's the main point here: this file can be interpreted in two ways, but the data in it is treated very differently and has different effects depending on the way it's currently interpreted.
- wimagguc 8y agoNice one! So is the trick that: 1. JPEG allows text comments 2. Browsers don't enforce correct HTML (alternatively, is "����JFIF,,��r<html>" correct HTML?) 3. And exif tools mostly work based on header & statistical analysis? Or am I completely wrong here?
- niceoutput 8y agoP01 also uses that technique in 2015. You can see here the technique http://www.p01.org/jsconf_asia_2015/ http://www.p01.org/jsconf_asia_2015/
- blattimwind 8y agoI think the most irritating thing about this is right-clicking on the image and selecting "View image", just to be confronted with the very same page as before, since the browser continues to interpret it as HTML.
- Drup 8y agoOn that topic, I recently wrote a tool to take a PDF file, an OCaml bytecode file (OCaml can compile to both byte or native code) and smash them together to create a file that is both a valid PDF and a valid bytecode. https://github.com/Drup/bytepdf https://github.com/Drup/bytepdf
- jaclaz 8y agoThe best example/explanation of a polyglot I ever found is in this "pocorgtfo" file [2015] (12 MB PDF but not only): https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/pocorgtfo07.pdf https://www.alchemistowl.org/pocorgtfo/pocorgtfo07.pdf 6 Abusing file formats; or, Corkami, the Novella by Ange Albertini And more example/pocs: https://code.google.com/archive/p/corkami/ https://code.google.com/archive/p/corkami/ https://github.com/corkami https://github.com/corkami
- iforgotpassword 8y agoIt should be possible to also make this a zip file since they're read from the end by official spec.