Магический друг (Magic Friend)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: magic_bytes_analysis, file_signature_repair, hex_editing

Summary

Files: - secret.zip contains file secret without extension

Магический друг (Magic Friend) - HackerLab

Description

Кто-то сильно напортачил с файлом. Исправишь это - получишь ценный приз (Someone really messed up the file. Fix it - get a valuable prize)

Files:

• secret.zip contains file secret without extension

Analysis

Step 1: File Identification

 bash read-only • copy allowed Copy
$ file secret
secret: data

The file command doesn't recognize the format - the file is corrupted or has an incorrect signature.

Step 2: Hex Dump Analysis

 bash read-only • copy allowed Copy
$ xxd secret | head -5
00000000: 425a ffe2 0c58 4943 435f 5052 4f46 494c  BZ...XICC_PROFIL
00000010: 4500 0101 0000 0c48 4c69 6e6f 0210 0000  E......HLino....
00000020: 6d6e 7472 5247 4220 5859 5a20 07ce 0002  mntrRGB XYZ ....
00000030: 0009 0006 0031 0000 6163 7370 4d53 4654  .....1..acspMSFT
00000040: 0000 0000 4945 4320 7352 4742 0000 0000  ....IEC sRGB....

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key observations:

• File starts with bytes 42 5A FF E2 (BZ..)
• Contains markers: ICC_PROFILE, RGB, XYZ, sRGB
• This is clearly JPEG file content!

Step 3: Identifying the Problem

JPEG files must start with the signature:

• FF D8 FF - standard JPEG signature

But our file starts with:

• 42 5A FF E2 - first 2 bytes (42 5A = "BZ") are incorrect

The task name "Магический друг" (Magic Friend) is a direct hint to magic bytes - file signatures!

Step 4: Fixing Magic Bytes

Need to replace the first 2 bytes with FF D8: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
$ printf '\xff\xd8' | cat - <(tail -c +3 secret) > fixed.jpg

Or alternatively:

 bash read-only • copy allowed Copy
$ dd if=secret of=fixed.jpg bs=1 skip=2
$ printf '\xff\xd8' | dd of=fixed.jpg bs=1 count=2 conv=notrunc

Step 5: Verification and Viewing

 bash read-only • copy allowed Copy
$ file fixed.jpg
fixed.jpg: JPEG image data, JFIF standard 1.01, ...

Opening the image - it's a "Spider-Man pointing" meme with "HACKER" labels and the flag at the bottom.

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Solution for "Magic Friend" - HackerLab Forensics
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Extract archive
unzip secret.zip

# Analyze file
file secret
xxd secret | head -3

# Fix magic bytes (replace first 2 bytes with FF D8)
printf '\xff\xd8' | cat - <(tail -c +3 secret) > fixed.jpg

# Verify
file fixed.jpg

# Open image
open fixed.jpg  # macOS
# or: xdg-open fixed.jpg  # Linux

Python Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Solution for "Magic Friend" - HackerLab Forensics
Fixing JPEG file magic bytes
"""

# Read corrupted file
with open('secret', 'rb') as f:
    data = f.read()
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Analyze first bytes
print(f"Original magic bytes: {data[:4].hex()}")
print(f"Expected JPEG magic bytes: ff d8 ff")

# Fix magic bytes
# Replace first 2 bytes (42 5A) with (FF D8)
fixed_data = b'\xff\xd8' + data[2:]

# Save fixed file
with open('fixed.jpg', 'wb') as f:
    f.write(fixed_data)

print("File fixed: fixed.jpg")

Magic Bytes Reference

Notes

1. Name as hint: "Магический друг" = Magic Friend = Magic Bytes
2. BZ prefix: First bytes 42 5A = "BZ" - possibly intentional reference to BZip2 to mislead
3. Contextual analysis: Even without correct magic bytes, file content (ICC_PROFILE, RGB, ADBE) clearly indicates JPEG
4. Flag: REDACTED = "modified magic bytes" - confirms the task essence

Useful Commands

 bash read-only • copy allowed Copy
# View magic bytes
xxd file | head -1

# Search for known signatures in file
binwalk file

# Signature reference
# https://en.wikipedia.org/wiki/List_of_file_signatures
# https://www.garykessler.net/library/file_sigs.html

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍