PICOCTF 2019 • FORENSICS • IMAGE METADATA
So Meta: EXIF & PNG Text Chunk Metadata Carving
By Abdo•Aug 31, 2026
Official Challenge Prompt
“Find the flag in this picture. Look beyond the pixels.”
● Category: Forensics / Image Metadata● Points: 150 PTS● Flag Format:
picoCTF{...}
Target: PNG tEXt Chunk (Artist)
💡 THE INTUITIVE ANALOGY (The Photographer's Stamp)
When a painter finishes a masterpiece, they sign their signature at the bottom corner of the frame. In digital photos, cameras and graphic editors embed metadata “stamps” into the file (such as Camera Model, Timestamp, and Artist Name). The title “So Meta” is a direct hint to check the image's metadata chunks before trying complex pixel steganography!
METHOD A: HANDS-ON CLI FORENSICS
1. Extracting Metadata via ExifTool & Strings
Option 1: ExifTool
$ exiftool pico_img.png
File Name : pico_img.png
File Type : PNG
Software : Adobe ImageReady
Artist : picoCTF{s0_m3ta_74af23ab}Option 2: Strings & Grep
$ strings pico_img.png | grep "picoCTF"
picoCTF{s0_m3ta_74af23ab}METHOD B: AUTOMATED PYTHON PARSER & ONELINER
2. Automated Extraction Script (`solve.py`)
from PIL import Image
# Open the image file using PIL
img = Image.open('pico_img.png')
# Extract PNG metadata text chunks
flag = img.info.get('Artist')
print("🎉 Extracted Artist Tag Flag:", flag)⚡ Terminal One-Liner (PowerShell / Bash):
python -c "from PIL import Image; print(Image.open('pico_img.png').info.get('Artist'))"3. Decoded Flag
Extracted Secret Flag:
picoCTF{s0_m3ta_74af23ab}
4. The Complete Investigation Path & Mental Roadmap
STEP 1
Title & Challenge Clue Triage
Recognized “So Meta” as a direct hint toward metadata structures (EXIF / XMP / PNG text chunks).
STEP 2
Metadata Inspection
Ran exiftool and strings to dump all non-pixel text records embedded in the PNG.
STEP 3
Flag Extraction
Found the flag stored inside the Artist chunk: picoCTF{s0_m3ta_74af23ab}.