hop in !!

PICOCTF 2019 • REVERSE ENGINEERING • FILE OVERLAY CARVING

By Abdo•Aug 31, 2026

Official Challenge Prompt

“We have recovered a binary and an image. See if you can figure out what it did to hide the flag.”

● Category: Forensics / Reverse Engineering● Points: 300 PTS● Flag Format: picoCTF{...}

Provided Files (Download & Practice)

mystery (ELF 64-bit)mystery.png

Dissector: Ghidra + HxD

Forensic Analysis: Trailing Overlay Injection

Standard image parsers terminate processing once the IEND trailer chunk (49 45 4E 44 AE 42 60 82) is reached, ignoring any data appended past that marker. The compiled mystery binary reads flag.txt, applies an arithmetic shift (+5) to byte indices 6 through 15, and appends the transformed stream to the end of mystery.png as an unparsed trailing overlay.

DECOMPILATION ANALYSIS

Opening the ELF binary in Ghidra reveals that it reads a 26-byte flag from flag.txt and writes it directly to mystery.png using append mode ("a"):

int main(void) {
    FILE *flag_file = fopen("flag.txt", "r");
    FILE *png_file  = fopen("mystery.png", "a"); // "a" = Append to end of file!

    char flag[26];
    fread(flag, 26, 1, flag_file);

    // 1. First 6 characters written as-is: "picoCT"
    for (int i = 0; i < 6; i++) {
        fputc(flag[i], png_file);
    }

    // 2. Characters 6 to 14 have 5 added to their ASCII values
    for (int i = 6; i <= 14; i++) {
        fputc(flag[i] + 5, png_file);
    }

    // 3. Character 15 has 3 subtracted from its ASCII value
    fputc(flag[15] - 3, png_file);

    // 4. Remaining characters (indices 16..25) written as-is
    for (int i = 16; i <= 25; i++) {
        fputc(flag[i], png_file);
    }

    fclose(png_file);
    fclose(flag_file);
    return 0;
}

METHOD A: STEP-BY-STEP MANUAL CARVING

Open mystery.png in HxD or HexEd.it, scroll past the IEND marker (49 45 4E 44 AE 42 60 82), and inspect the 26 trailing bytes:

70 69 63 6F 43 54 4B 80 6B 35 7A 73 69 64 36 71 5F 33 35 66 36 39 64 61 62 7D

Character-by-Character Reverse Mathematics:

Index	Encoded Byte	ASCII Decimal	Operation	Decoded Decimal	Decoded Char
0	70 ('p')	112	Unchanged	112	p
1	69 ('i')	105	Unchanged	105	i
2	63 ('c')	99	Unchanged	99	c
3	6F ('o')	111	Unchanged	111	o
4	43 ('C')	67	Unchanged	67	C
5	54 ('T')	84	Unchanged	84	T
6	4B ('K')	75	- 5	70	F
7	80	128	- 5	123	{
8	6B ('k')	107	- 5	102	f
9	35 ('5')	53	- 5	48	0
10	7A ('z')	122	- 5	117	u
11	73 ('s')	115	- 5	110	n
12	69 ('i')	105	- 5	100	d
13	64 ('d')	100	- 5	95	_
14	36 ('6')	54	- 5	49	1
15	71 ('q')	113	+ 3	116	t
16..25	_35f69dab}	—	Unchanged	—	_35f69dab}

METHOD B: AUTOMATED PYTHON PARSER & ONELINER

# Open mystery.png and read the raw trailing bytes
with open('mystery.png', 'rb') as f:
    data = f.read()

# Grab last 26 bytes appended past the PNG IEND marker
encoded = data[-26:]

# Reconstruct flag using inverse mathematics
flag = (
    ''.join(chr(encoded[i]) for i in range(6)) +          # Unchanged: "picoCT"
    ''.join(chr(encoded[i] - 5) for i in range(6, 15)) +   # Subtract 5
    chr(encoded[15] + 3) +                                 # Add 3
    ''.join(chr(encoded[i]) for i in range(16, 26))        # Unchanged: "_35f69dab}"
)

print("[+] Decoded Flag:", flag)

Terminal One-Liner (PowerShell / Bash):

python -c "d=open('mystery.png','rb').read()[-26:]; print(''.join(chr(d[i]) for i in range(6)) + ''.join(chr(d[i]-5) for i in range(6,15)) + chr(d[15]+3) + ''.join(chr(d[i]) for i in range(16,26)))"

Extracted Secret Flag:

picoCTF{f0und_1t_35f69dab}

Concept	Indicator	Reversing Strategy
Append Mode ("a")	fopen(..., "a")	Check for bytes after PNG IEND terminator (49 45 4E 44 AE 42 60 82).
Shift Encoding	flag[i] + 5	Apply exact inverse mathematical operation (subtract 5).

Here is the step-by-step mental roadmap from binary decompilation to flag recovery:

STEP 1

Decompiling the Binary

Loaded mystery in Ghidra. Located main() and identified fopen(..., "a") writing 26 bytes to the end of mystery.png.

STEP 2

Carving Trailing Bytes

Opened mystery.png in HxD, navigated past the IEND marker, and extracted the raw 26 bytes.

STEP 3

Applying Inverse Arithmetic

Subtracted 5 from characters 6..14, added 3 to character 15, and preserved the remaining characters unchanged.

STEP 4

Flag Capture

Constructed and verified the final flag: picoCTF{f0und_1t_35f69dab}.

Forensic Analysis: Trailing Overlay Injection

1. Inspecting the `mystery` Binary

2. Manual Hex Extraction & Arithmetic Table

Character-by-Character Reverse Mathematics:

3. Automated Extraction Script (`solve.py`)

4. Decoded Flag

5. Forensic Key Takeaways

6. The Complete Investigation Path & Mental Roadmap