> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/forensics/c0rrupt.md). # c0rrupt First, I used the **`file`** command to check what type of file it was, but it only showed **data**, which means the file header was probably corrupted. So I opened the file in a hex editor and checked the first few bytes. I noticed that the **PNG header was corrupted**. A valid PNG file must start with this header: ```id="yfjru0" 89 50 4E 47 0D 0A 1A 0A ``` But the file had incorrect bytes, so I manually fixed the header. However, after fixing the header the image still did not work, which meant there were **more corrupted bytes in the file**. Since I had solved many **picoCTF** challenges before, I already knew how to fix the PNG header because this trick appears in many challenges. But I didn’t know how to find the other corrupted parts. So I sent the hex data to **Claude**, which helped identify the other corrupted bytes and repair the image. These were the corrupted bytes that needed fixing: | Offset | Was | Should Be | Description | | --------- | ----------- | ----------- | -------------------- | | 0x01 | 65 | 50 | PNG magic byte (`P`) | | 0x03 | 34 | 47 | PNG magic byte (`G`) | | 0x06 | B0 | 1A | PNG magic byte | | 0x07 | AA | 0A | PNG magic byte | | 0x0C | 43 | 49 | IHDR chunk type | | 0x0D | 22 | 48 | IHDR chunk type | | 0x53 | AA | 00 | IDAT chunk length | | 0x57–0x5A | 54 44 45 54 | 49 44 41 54 | IDAT chunk type | Another issue was that the **zlib Adler-32 checksum inside the IDAT stream was corrupted**, so it required bypassing the checksum during decompression. After fixing all these corrupted bytes, the **PNG image decoded successfully**, and I was able to view the recovered image and obtain the flag. thanks to claude! --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/forensics/c0rrupt.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.