News for hackers. Stuff that matters.
Re:Static analysis of an unknown compression format by someone13 on Saturday April 07, 2012 @02:53PM (#3811748)
Something I wrote a while back, using Python and PIL.

    import sys
    import math
    from PIL import Image

    def getSize(len, width):
        h = int(math.ceil(float(len) / width))
        return (width, h)
        
    def getImage(file, width=256):
        d = file.read()
        s = getSize(len(d), width)
        im = Image.new('L', s)
        im.putdata(d)
        return im
        
    def main():
        if len(sys.argv) < 2:
            print 'Usage: file2img.py <file> <output> [width]'
            return
            
        with open(sys.argv[1], 'rb') as f:
            if len(sys.argv) > 3:
                width = int(sys.argv[3])
                img = getImage(f, width)
            else:
                img = getImage(f)
            img.save(sys.argv[2])
        
    if __name__ == "__main__":
        main()
Here's a visualization of user32.dll on Windows. Notice how you can actually make out the images that are embedded in the resources!

http://i.imgur.com/7yEHR.png

There are no comments on this comment yet.