2

I have recently started studying steganography and I've come across a problem that I just don't seem to understand. Basically, the image is a png which contains a hidden flag in it.

When you extract the bit planes from the image, you can see that there's an image in the blue and green planes that you can see in the red one. To reveal the flag in clear text, you have to remove those images from the red one by XORing the LSB or something. I am not totally sure.

This is what the image in the red plane looks like if you don't remove the others.

Image of what it does if you don't remove the other images

My question is how do I go about doing this kind of thing? This is the image in question.

Here's a link to the image in question

Reti43
  • 9,656
  • 3
  • 28
  • 44
capcap
  • 33
  • 4
  • Perhaps [this question](https://stackoverflow.com/questions/54398627/xor-ing-and-summing-two-black-and-white-images) will give you a suitable starting point. – import random Oct 02 '19 at 04:44
  • The thing is, I don't know how to remove images from the three least significant bits of an image. I only want the red plane, without the other images in it, but I need to remove them by XORing the LSB I think – capcap Oct 02 '19 at 04:51
  • This [question](https://stackoverflow.com/questions/33181060/faster-method-for-adjusting-pil-pixel-values) shows how to perform operations on individual pixels using numpy – import random Oct 02 '19 at 05:12

1 Answers1

2

Actually the hidden image is in the lowest 3 bit planes. Doing a full bit decomposition makes that clear.

Red plane bit decomposition

Start by loading the image to a numpy array, which will have dimensions MxNx3.

import matplotlib.pyplot as plt
import numpy as np
from PIL import Image

img = Image.open('stego.png')
data = np.array(img)

All you have to do now is XOR each colour plane with another and then keep the 3 least significant bits (lsb).

extracted = (data[...,0] ^ data[...,1] ^ data[...,2]) & 0x07
plt.imshow(extracted)
plt.show()

extracted message

In case it wasn't obvious, the & 0x07 part is an AND operation with the binary number 00000111, just written in hexadecimal for conciseness.

If you don't keep all 3 lsb, then you'll either be missing some letters in the solution, or everything will be there but some edges won't be as smooth. The first of these is critically important.

Reti43
  • 9,656
  • 3
  • 28
  • 44