代码的执行时间挺长的，好囧！
参考了https://13c5.wordpress.com/2015/04/20/plaidctf-2015-png-uncorrupt/的代码
通过这个题目，也对Png文件格式更深入地理解了！
使用这个代码的前提是将png signature里面的0x0a修改为0x0d0a
1 from itertools import combinations 2 import binascii 3 import os 4 5 6 def find_all(source,aim): 7 start=0 8 while True: 9 start=source.find(aim,start) 10 if start==-1: 11 return 12 yield start 13 start +=len(aim) 14 15 def repair(source,aim,filedes,num,crc): 16 matchlist=list(find_all(source,'x0a')) 17 18 for subnet in combinations(matchlist,num): 19 subnet=sorted(subnet) 20 temp='' 21 if(num==3): 22 temp=source[:subnet[0]]+'x0dx0a'+source[subnet[0]+1:subnet[1]]+'x0dx0a'+source[subnet[1]+1:subnet[2]]+'x0dx0a'+source[subnet[2]+1:] 23 if(num==2): 24 temp=source[:subnet[0]]+'x0dx0a'+source[subnet[0]+1:subnet[1]]+'x0dx0a'+source[subnet[1]+1:] 25 if(num==1): 26 temp=source[:subnet[0]]+'x0dx0a'+source[subnet[0]+1:] 27 if "%08x" % (binascii.crc32(temp)&0xFFFFFFFF)==crc: 28 filedes.write(temp) 29 filedes.write(binascii.a2b_hex(crc)) 30 filedes.flush() 31 print "success" 32 break; 33 print "fail" 34 35 uncfile=open("corrupt_735acee15fa4f3be8ecd0c6bcf294fd4.png","rb") 36 cocfile=open("correct.png","wb") 37 #first write 38 correct=uncfile.read(0x6d) 39 cocfile.write(correct) 40 cocfile.flush() 41 42 correct=uncfile.read(0x4)#length 43 cocfile.write(correct) 44 cocfile.flush() 45 46 uncorrect=uncfile.read(0x20000-0x1+0x4) 47 crc=uncfile.read(0x4) 48 crc=binascii.hexlify(crc) 49 print crc 50 repair(uncorrect,'x0a',cocfile,1,crc)#1 51 #second write 52 correct=uncfile.read(0x4)#length 53 cocfile.write(correct) 54 cocfile.flush() 55 uncorrect=uncfile.read(0x20000-0x3+0x4) 56 crc=uncfile.read(0x4) 57 crc=binascii.hexlify(crc) 58 print crc 59 repair(uncorrect,'x0a',cocfile,3,crc)#2 60 #third write 61 correct=uncfile.read(0x4)#length 62 cocfile.write(correct) 63 cocfile.flush() 64 uncorrect=uncfile.read(0x20000-0x1+0x4) 65 crc=uncfile.read(0x4) 66 crc=binascii.hexlify(crc) 67 print crc 68 repair(uncorrect,'x0a',cocfile,1,crc)#3 69 #fourth write 70 correct=uncfile.read(0x4+0x4+0x20000+0x4) 71 cocfile.write(correct) 72 cocfile.flush() 73 #fifth write 74 correct=uncfile.read(0x4)#length 75 cocfile.write(correct) 76 cocfile.flush() 77 uncorrect=uncfile.read(0x20000-0x3+0x4) 78 crc=uncfile.read(0x4) 79 crc=binascii.hexlify(crc) 80 print crc 81 repair(uncorrect,'x0a',cocfile,3,crc)#4 82 #6th 83 correct=uncfile.read(0x4)#length 84 cocfile.write(correct) 85 cocfile.flush() 86 uncorrect=uncfile.read(0x20000-0x1+0x4) 87 crc=uncfile.read(0x4) 88 crc=binascii.hexlify(crc) 89 print crc 90 repair(uncorrect,'x0a',cocfile,1,crc)#5 91 #7th 92 correct=uncfile.read(0x4) 93 cocfile.write(correct) 94 cocfile.flush() 95 uncorrect=uncfile.read(0x20000-0x2+0x4) 96 crc=uncfile.read(0x4) 97 crc=binascii.hexlify(crc) 98 print crc 99 repair(uncorrect,'x0a',cocfile,2,crc)#6 100 #8th 101 correct=uncfile.read(0x4+0x4+0x20000+0x4) 102 cocfile.write(correct) 103 cocfile.flush() 104 #9th 105 correct=uncfile.read(0x4) 106 cocfile.write(correct) 107 cocfile.flush() 108 uncorrect=uncfile.read(0x20000-0x1+0x4) 109 crc=uncfile.read(0x4) 110 crc=binascii.hexlify(crc) 111 print crc 112 repair(uncorrect,'x0a',cocfile,1,crc)#7 113 #10th 114 correct=uncfile.read(0x4+0x4+0x216f) 115 cocfile.write(correct) 116 cocfile.flush() 117 118 uncfile.close() 119 cocfile.close()
结果：
参考文献：
http://blog.csdn.net/gogor/article/details/5265710
http://www.libpng.org/pub/png/apps/pngcheck.html
http://www.libpng.org/pub/png/book/chapter08.html
http://stackoverflow.com/questions/27238021/png-images-not-loaded
https://13c5.wordpress.com/2015/04/20/plaidctf-2015-png-uncorrupt/