Cat Image

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: decoy_flag_identification, mspaint_canvas_recovery, process_memory_dump, raw_bgra_pixel_reconstruction, registry_recent_files_analysis

Summary

Task: a 4GB Windows memory dump where the suspect was drawing cats in MS Paint. Solution: dump mspaint.exe process memory, reconstruct the unsaved canvas from raw BGRA pixel data to reveal the flag drawn on a cat image.

Cat Image — HackerLab

Description

The suspect likes to draw cats, can you find his latest work?

English summary: given a 4.3GB Windows memory dump (task.mem), find the suspect's latest cat drawing. The drawing was created in MS Paint but never saved to disk, so it must be recovered directly from process memory.

Analysis

1. Identify the OS and running processes

 bash read-only • copy allowed Copy
$ vol -f task.mem windows.info

The dump is from Windows 7 SP1 x86 (32-bit), user account: Hedgehog.

 bash read-only • copy allowed Copy
$ vol -f task.mem windows.pslist

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key processes found:

• mspaint.exe (PID 3600) — MS Paint, the drawing application
• notepad.exe (PID 2864) — Notepad

The mspaint command line was "C:\Windows\system32\mspaint.exe" — launched without a file argument, meaning the suspect was creating a new, unsaved drawing.

2. Check Paint's Recent File List

Registry analysis of Paint's Recent File List showed it was empty — confirming the drawing was never saved to disk. This means the only copy of the image exists in the mspaint.exe process memory as raw pixel data. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Red herring: decoy flag

Running strings on the process memory dump revealed CODEBY{d3skt0p_f1le} — this came from flag.txt.txt on the Desktop. This is a decoy flag, not the real answer. The file listing confirmed:

\Users\Hedgehog\Desktop\flag.txt.txt

Solution

Step 1: Dump mspaint.exe process memory

 bash read-only • copy allowed Copy
$ vol -f task.mem --output-dir output windows.memmap --pid 3600 --dump

This produced pid.3600.dmp (~391MB) — the full virtual address space of the mspaint process. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Reconstruct the canvas from raw pixel data

MS Paint on Windows 7 stores its canvas as a raw DIB (Device Independent Bitmap) in GDI memory. The pixel format is 32-bit BGRA (Blue, Green, Red, Alpha — 4 bytes per pixel). The canvas dimensions correspond to the screen resolution or the image size Paint was working with.

The key challenge is finding the correct width, offset, and orientation (DIBs are stored bottom-up, so the image appears vertically flipped).

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Reconstruct MS Paint canvas from raw process memory dump.
MS Paint on Windows 7 stores canvas as raw BGRA pixels (DIB format).
DIBs are bottom-up, so the image needs to be vertically flipped.
"""
from PIL import Image
import struct
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

DUMP_FILE = "output/pid.3600.dmp"
WIDTH = 1024   # Common canvas width for 1024x768 resolution
HEIGHT = 768

with open(DUMP_FILE, "rb") as f:
    data = f.read()

# Try different offsets to find the canvas data
# The canvas is stored as 32-bit BGRA pixels
stride = WIDTH * 4  # 4 bytes per pixel (BGRA)
needed = stride * HEIGHT

# Search through the dump for the canvas region
# Typically found at a large offset in the GDI heap
for offset in range(0, len(data) - needed, 4096):
    chunk = data[offset:offset + needed]
    # Create image from raw BGRA data
    img = Image.frombytes("RGBX", (WIDTH, HEIGHT), chunk, "raw", "BGRX")
    # Flip vertically (DIB is bottom-up)
    img = img.transpose(Image.FLIP_TOP_BOTTOM)
    img.save(f"canvas_{WIDTH}x{HEIGHT}_off{offset}.png")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Identify the correct reconstruction

After trying various widths (640, 800, 1024, 1280, etc.) and offsets, the correct parameters produced a clear image showing:

• A cat drawing made in MS Paint
• The flag CODEBY{REDACTED} written on the image

The successful reconstruction used:

• Width: 1024 pixels
• Height: 768 pixels
• Pixel format: BGRA (32-bit)
• Vertical flip applied (DIB bottom-up storage) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍