Нулевой байт (Null Byte)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Byte pair swapping (endianness fix), Hex dump analysis for pattern detection, JPEG header analysis and repair

Summary

Task: Corrupted JPEG file identified as 'data' with swapped byte pairs. Solution: Byte pair swapping to fix endianness - each pair of bytes was reversed, restoring the correct JPEG header.

Нулевой байт (Null Byte) — HackerLab

Description

Они стали как зомби. Их сущность перевернулась с ног до головы.

(They became like zombies. Their essence was turned upside down.)

File: task.zip → flag_dd.jpg

Analysis

After extracting the archive, we get the file flag_dd.jpg, but the file command identifies it as "data" instead of JPEG:

 bash read-only • copy allowed Copy
file flag_dd.jpg
# flag_dd.jpg: data

This indicates a corrupted file header. Let's check the hex dump:

 bash read-only • copy allowed Copy
xxd flag_dd.jpg | head -1
# 00000000: d8ff e0ff 1000 464a 4649 0100 0001 0100  ......JFIF......

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

A standard JPEG header should start with ff d8 ff e0, but we see d8 ff e0 ff — bytes are swapped in pairs!

The hint in the description "turned upside down" directly points to this transformation — each pair of bytes is swapped (byte swap / endianness swap).

Solution

Step 1: Analyzing the corruption

 bash read-only • copy allowed Copy
# Check the first bytes
xxd flag_dd.jpg | head -3
# 00000000: d8ff e0ff 1000 464a 4649 0100 0001 0100  ......JFIF......
# 00000010: 0100 db00 4300 0806 0607 0806 0505 0607  ....C...........
# 00000020: 0907 0707 0909 0c09 140d 0c0b 0b0c 1912  ................

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

We see the pattern: d8ff instead of ffd8, e0ff instead of ffe0 — every 2 bytes are swapped.

Step 2: Restoring the file

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Null Byte - Byte pair swapping fix
"""

# Read the corrupted file
data = open('flag_dd.jpg', 'rb').read()

# Swap each pair of bytes
result = bytearray()
for i in range(0, len(data), 2):
    if i + 1 < len(data):
        # Swap bytes in pair
        result.append(data[i + 1])
        result.append(data[i])
    else:
        # Odd number of bytes - keep the last one as is
        result.append(data[i])
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Save the fixed file
open('fixed.jpg', 'wb').write(result)
print("Fixed file saved as fixed.jpg")

Step 3: Verifying the result

 bash read-only • copy allowed Copy
file fixed.jpg
# fixed.jpg: JPEG image data, JFIF standard 1.01

xxd fixed.jpg | head -1
# 00000000: ffd8 ffe0 0010 4a46 4946 0001 0100 0001  ......JFIF......

Now the header is correct: ff d8 ff e0 — standard JPEG signature.

Step 4: Viewing the image

Open fixed.jpg — the flag is visible in the image.

Full solution script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Null Byte - Byte pair swapping fix
HackerLab CTF
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Description: "Their essence was turned upside down"
Solution: Each pair of bytes is swapped (endianness swap)
"""

import sys

def swap_byte_pairs(input_file, output_file):
    """Swap each pair of bytes in the file"""
    with open(input_file, 'rb') as f:
        data = f.read()
    
    result = bytearray()
    for i in range(0, len(data), 2):
        if i + 1 < len(data):
            result.append(data[i + 1])
            result.append(data[i])
        else:
            result.append(data[i])
    
    with open(output_file, 'wb') as f:
        f.write(result)
    
    print(f"[+] Fixed file saved: {output_file}")
    print(f"[+] Original size: {len(data)} bytes")
    print(f"[+] Fixed size: {len(result)} bytes")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == '__main__':
    input_file = sys.argv[1] if len(sys.argv) > 1 else 'flag_dd.jpg'
    output_file = sys.argv[2] if len(sys.argv) > 2 else 'fixed.jpg'
    
    swap_byte_pairs(input_file, output_file)

Theory: Byte Swapping

Byte swapping is often related to endianness issues:

• Big-endian: most significant byte first (0x1234 → 12 34)
• Little-endian: least significant byte first (0x1234 → 34 12)

In this task, pairwise byte swapping is applied — every 2 bytes are swapped: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Original:  ff d8 ff e0 00 10 4a 46
Corrupted: d8 ff e0 ff 10 00 46 4a

Standard file signatures

When analyzing corrupted files, compare the first bytes with known signatures. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍