Extract PNGs from a file using Python

extract_pngs.py

# extract_pngs.py
# Extract PNGs from a file and put them in a pngs/ directory
import sys
with open(sys.argv[1], "rb") as binary_file:
    binary_file.seek(0, 2)  # Seek the end
    num_bytes = binary_file.tell()  # Get the file size

    count = 0
    for i in range(num_bytes):
        binary_file.seek(i)
        eight_bytes = binary_file.read(8)
        if eight_bytes == b"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a":  # PNG signature
            count += 1
            print("Found PNG Signature #" + str(count) + " at " + str(i))
            
            # Next four bytes after signature is the IHDR with the length
            png_size_bytes = binary_file.read(4)
            png_size = int.from_bytes(png_size_bytes, byteorder='little', signed=False)

            # Go back to beginning of image file and extract full thing
            binary_file.seek(i)
            # Read the size of image plus the signature
            png_data = binary_file.read(png_size + 8)
            with open("pngs/" + str(i) + ".png", "wb") as outfile:
                outfile.write(png_data)

import os
import sys
import errno

#Usage in cmd: python hexread.py Test.bin
#              python hexread.py

if len(sys.argv) !=1:
    print("Selecting file..."+sys.argv[1])
else:
    filename=input("Enter Filename or press ENTER to skip:")
    if filename == '':
        sys.exit("No Args or filename, exiting")
    else:
        sys.argv.append(filename)
        print("Selecting file..."+sys.argv[1])

with open(sys.argv[1], "rb") as binary_file:
    print("Opening file:"+sys.argv[1])
    binary_file.seek(0, 2)  # Seek the end
    num_bytes = binary_file.tell()  # Get the file size
    print('File size:'+str(num_bytes)+'B')
    count = 0
    print('Finding PNG signatures')
    for i in range(num_bytes):
        binary_file.seek(i)
        eight_bytes = binary_file.read(8)
        if eight_bytes == b"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a":  # PNG signature
            count += 1
            print("Found PNG Signature #" + str(count) + " at " + str(i))

            # Next four bytes after signature is the IHDR with the length
            png_size_bytes = binary_file.read(4)
            png_size = int.from_bytes(png_size_bytes, byteorder='little', signed=False)

            # Go back to beginning of image file and extract full thing
            binary_file.seek(i)
            # Read the size of image plus the signature
            png_data = binary_file.read(png_size + 8)
            try:
                os.mkdir('pngs')
            except OSError as e:
                if e.errno != errno.EEXIST:
                    raise
            with open("pngs/" + str(i) + ".png", "wb") as outfile:
                outfile.write(png_data)
if count==0:
    print('No png signatures found?')

Byte order in png files is bigendian. And I think the data after the signature is the size of the IHDR, not the whole png.

Here's a working version:

# extract_pngs.py
# Extract PNGs from a file and put them in a pngs/ directory
import sys
import os

try:
    os.mkdir("pngs")
except:
    pass

with open(sys.argv[1], "rb") as binary_file:
    binary_file.seek(0, 2)  # Seek the end
    num_bytes = binary_file.tell()  # Get the file size

    count = 0
    for i in range(num_bytes):
        binary_file.seek(i)
        eight_bytes = binary_file.read(8)
        if eight_bytes == b"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a":  # PNG signature
            count += 1
            print("Found PNG Signature #%d at 0x%08x" % (count,i))
            
            with open("pngs/%08x.png" % i, "wb") as outfile:
                outfile.write(eight_bytes)

                while True:
                    sizeData = binary_file.read(4)
                    size = 4+int.from_bytes(sizeData, byteorder='big', signed=False)
                    chunk = binary_file.read(4)
                    
                    outfile.write(sizeData)
                    outfile.write(chunk)
                    
                    data = binary_file.read(size)
                    outfile.write(data)
                    
                    if chunk == b'IEND':
                        break
                    
                        

Thanks. I’m certain I would have tested this….now I will have to go back and try

The two bugs in the original script kind of canceled out: reading the length as low-endian basically took the length of IHDR and made a very large number out of it, and then it copied a long file that probably would include all of the original png. As a result, you got a usable png but with a lot of junk at the end.