> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/forensics/invisible-words.md).

# Invisible Words

### 🧠 Idea of the Challenge

* You are given a `.bmp` image.
* It looks normal, but **data is hidden inside it (steganography)**.
* The goal is to find the hidden **flag**.

### 🔍 Step 1: Check the file in hex

Run:

```bash
xxd -g 1 -l 250 output.bmp
```

👉 While looking at hex, we see:

```
50 4b
```

This is important because:

* `50 4b` = **"PK"**
* This is the signature of a **ZIP file**

### 🤔 Problem

Normally ZIP starts with:

```
50 4b 03 04
```

But here we see:

```
50 4b 95 52 03 04
```

👉 That means:

* ZIP signature is **broken/split**
* So the file is **intentionally corrupted**

### 🔎 Step 2: Find all "PK"

Run:

```bash
binwalk -R "\x50\x4b" output.bmp
```

👉 You will see multiple locations, but none form a proper ZIP.

So:

* Data is there
* But it's **scrambled**

***

### 💡 Step 3: Understand the trick

Looking closely:

* Bytes are **interleaved (mixed)**
* Real data is hidden by inserting junk bytes

👉 Solution: We must **remove extra bytes**

### ⚙️ Step 4: Convert file to hex bytes

```bash
xxd -p -c 1 output.bmp > hex
```

Now file looks like:

```
42
4d
8a
a4
...
```

### 🧑‍💻 Step 5: Fix the data (Python script)

```python
bytes = []

fileObj = open("hex", "r")
bytes = fileObj.read().split()
fileObj.close()

p1 = bytes[0::4]
p2 = bytes[1::4]

zipstring = ""

for f, b in zip(p1, p2):
    zipstring += f
    zipstring += b

print(zipstring)
```

👉 What this does:

* Takes every **real byte**
* Skips fake ones
* Rebuilds original file

***

### 🔁 Step 6: Convert back to binary

```bash
python3 truncate_hex.py | xxd -r -p > hex_trunc
```

***

### 🔍 Step 7: Check fixed file

```bash
xxd hex_trunc
```

Now you should see:

```
50 4b 03 04
```

👉 ZIP is now **correct**

***

### 📦 Step 8: Extract hidden ZIP

```bash
binwalk -e hex_trunc
```

👉 It extracts:

```
ZnJhbmtlbnN0ZWluLXRlc3QudHh0
```

***

### 📖 Step 9: Read file

```bash
cat ZnJhbmtlbnN0ZWluLXRlc3QudHh0
```

👉 It contains text from **Frankenstein**

***

### 🚩 Step 10: Find the flag

```bash
grep picoCTF ZnJhbm..................
```

👉 Output:

```
picoCTF{REDACTED}
```

### 🔑 Simple Summary

* BMP had **hidden ZIP**
* ZIP was **broken by mixing bytes**
* You:
  1. Found `PK`
  2. Fixed byte order
  3. Rebuilt ZIP
  4. Extracted file
  5. Found flag


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/forensics/invisible-words.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.