Detective Scripts of STEGA（Version0.0）

来源：互联网发布：神州网络兼职平台是真的吗编辑：程序博客网时间：2024/06/05 04:10

作为一个little noob写了两个小脚本给STEGA入门的同学。

第一个用来检测一下文件大致的信息，检查文件头尾，检测可疑文件头出现次数，查看文件的md5，sha1，crc32

from hashlib import md5,sha1from zlib import crc32from binascii import hexlify as himport osimport sysimport subprocess#read bin filedef judgefilehead(filename):    with open(filename, 'rb') as f:        s=h(f.read())        head=s[:16]        res=head        return resdef judgefiletail(filename):    with open(filename, 'rb') as f:        s=h(f.read())        tail=s[-16:]        res=tail        return res#get suspect datadef judgefilecontent(filename):    jpghead = 'ffd8ff'    #jpgtail = 'ffd9'    pnghead = '89504e47'    #pngtail = 'ae426082'    gifhead = '474946'    giftail = '003b'    with open(filename, 'rb') as f:        s=f.read()        s=h(s)    if s.find(jpghead)==0 :        print 'potential jpeg'        print 'jpg head:',s.count(jpghead)    if s.find(pnghead)==0 :        print 'potential whole png'        print 'png head:',s.count(pnghead)    if s.find(gifhead)==0 :        print 'potential whole gif'        print 'gifsplit plz:'        os.system('gifsplitter2.0.exe')#use your own splitter's path    print 'content first search of images end'    f.close()#get secret numberdef getCrc32(filename):    with open(filename, 'rb') as f:        return (crc32(f.read()))&0xffffffffdef getMd5(filename):    mid=md5()    with open(filename, 'rb') as f:        mid.update(f.read())        return mid.hexdigest()def getsha1(filename):    mid=sha1()    with open(filename, 'rb') as f:        mid.update(f.read())        return mid.hexdigest()if len(sys.argv)<2:    print 'ENTER file plz!\n'    os._exit(0)elif len(sys.argv)>2:    print 'ONLY ONE file to be examined!\n'    os._exit(0)filename=sys.argv[1]print '{:8} {}'.format('md5:',getMd5(filename))print '{:8} {}'.format('sha1:',getsha1(filename))print '{:8}{:x}'.format('crc32:',getCrc32(filename))print 'head:',judgefilehead(filename)print 'tail:',judgefiletail(filename)judgefilecontent(filename)print '\nplz start manual operation\n'os.system('HWork32')#use your own hex-editor's path

上面这个脚本只列出了几个文件头，小伙伴们可以自己改一改

（记得要事先修改一下gifsplitter和hexeditor路径啊！！！否则出现找不到指定路径的情况）

接下来是浏览exif信息的脚本（日常查图片exif）

import exifreadimport sysimport osdef exif(filename):    f=open(filename,'rb')    tags=exifread.process_file(f)    return tagsif len(sys.argv)<2:    print 'ENTER file plz!\n'    os._exit(0)elif len(sys.argv)>2:    print 'ONLY ONE file to be examined!\n'    os._exit(0)filename=sys.argv[1]print 'exif is: ',exif(filename)

（脚本写的很丑，希望各位老哥不要嫌弃）

（希望以后能直接写个010出来）（手动滑稽）

阅读全文

0 0