JPEGsnoop | JPEGsnoop : JPEG decoder and detailed analysis | Computer Vision library
kandi X-RAY | JPEGsnoop Summary
kandi X-RAY | JPEGsnoop Summary
JPEGsnoop is a detailed JPEG image decoder and analysis tool. It reports all image metadata and can even help identify if an image has been edited. Official repository for JPEGsnoop: JPEGsnoop @ GitHub.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of JPEGsnoop
JPEGsnoop Key Features
JPEGsnoop Examples and Code Snippets
Community Discussions
Trending Discussions on JPEGsnoop
QUESTION
ANSWER
Answered 2018-Oct-25 at 16:05The approach used to get this back was more luck than judgement. I think I can explain, though be aware it involves a hex editor...
The Wikipedia page for the syntax of a JPEG file explains that it is made up of a series of segments each started by a two byte marker - 0xFF
and another byte to indicate the type of segment.
The hope was that it was just the Huffman table segment of the file that was wrong - as suggested by the error message. Without needing to understand what a Huffman table is, it was enough to see that the same section on Wikipedia explains it is a 0xFF
0xC4
marker for a Huffman table segment.
Further down the page, it mentions:
The JPEG standard provides general-purpose Huffman tables; encoders may also choose to generate Huffman tables...
Opening up a few other JPEG files found what looks like a standard set of 4 consecutive Huffman table segments - each starting with that 0xFF
0xC4
marker. The sample corrupt.jpg
however just had one Huffman table - from position 0x00c8
to 0x02bc
below.
(Both contain that &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
sequence you mentioned in their Huffman tables. In the corrupt file it appears twice in that single Huffman table, in the 'more conventional' JPEGs it appears in the second and fourth Huffman tables.)
From there, the fixed image is a copy and paste of the standard 4 Huffman tables, in place of that range of bytes in corrupt.jpg
- now from 0x00c8
to 0x0278
in the fixed file.
Because the JPEG format is based around scanning for segments between those 0xff
markers, you can just swap out the Huffman segments - there are no other pointers in the file to worry about. As you said, the rest of the file looked like a plausible JPEG.
Summary of the steps taken:
- Hex search the
corrupt.jpg
forFF C4
and note the offset - Hex search for the next
FF
. If it's anotherFF C4
(so a second Huffman table) keep going - Delete the content from the first
FF C4
(included) up to but not including the nextFF
- Instead replace it with the 'standard 4 Huffman tables'. These are the bytes in the last sample below, or can be copied from
0x00c8
to0x0278
in the fixed file
Corrupt Huffman table:
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install JPEGsnoop
nmake req: ms visual studio(c++) 2005 http://imageshack.com/i/pmym0PEnj
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page