Skip to content

Instantly share code, notes, and snippets.

@TotallyNotAHaxxer
Created May 14, 2025 06:21
Show Gist options
  • Save TotallyNotAHaxxer/ba9eac724e3efd43f8df583a294c44bf to your computer and use it in GitHub Desktop.
Save TotallyNotAHaxxer/ba9eac724e3efd43f8df583a294c44bf to your computer and use it in GitHub Desktop.
For reverse engineering an application that cache's files without naming them with extensions, further organizing and sorting cache resources going based on header detection. In this case, GIF and PNG were the two focus sources, anything else was 'another' file
#### @DSTs
$pngDir = ".FixedImages"
$gifDir = ".FixedGifs"
$otherDir = ".Others"
#### @Helper->Creates the directory if it does not exist
foreach ($dir in @($pngDir, $gifDir, $otherDir)) {
if (-not (Test-Path -Path $dir)) {
New-Item -Path $dir -ItemType Directory | Out-Null
Write-Output "Created directory: $dir"
}
}
#### @Main->View each file in the current dir
Get-ChildItem -File | ForEach-Object {
$currentFile = $_
$bytes = Get-Content -Path $currentFile.FullName -Encoding Byte -TotalCount 8 -ErrorAction SilentlyContinue
$isPng = $false
$isGif = $false
$status = "-"
###### @Validator->PNG
if ($bytes -ne $null -and $bytes.Length -ge 8 -and
$bytes[0] -eq 0x89 -and $bytes[1] -eq 0x50 -and $bytes[2] -eq 0x4E -and $bytes[3] -eq 0x47 -and
$bytes[4] -eq 0x0D -and $bytes[5] -eq 0x0A -and $bytes[6] -eq 0x1A -and $bytes[7] -eq 0x0A) {
$isPng = $true
$status = "+"
}
###### @Validator->GIF87a
elseif ($bytes -ne $null -and $bytes.Length -ge 6 -and
$bytes[0] -eq 0x47 -and $bytes[1] -eq 0x49 -and $bytes[2] -eq 0x46 -and
$bytes[3] -eq 0x38 -and $bytes[4] -eq 0x37 -and $bytes[5] -eq 0x61) {
$isGif = $true
$status = "+"
}
###### @Validator->GIF89a signature (both showed up)
elseif ($bytes -ne $null -and $bytes.Length -ge 6 -and
$bytes[0] -eq 0x47 -and $bytes[1] -eq 0x49 -and $bytes[2] -eq 0x46 -and
$bytes[3] -eq 0x38 -and $bytes[4] -eq 0x39 -and $bytes[5] -eq 0x61) {
$isGif = $true
$status = "+"
}
$Header = if ($bytes -ne $null) {
($bytes | ForEach-Object { "0x{0:X2}" -f $_ }) -join " "
} else {
"Failed to read header"
}
$hstr = if ($bytes -ne $null) {
$charArray = $bytes | ForEach-Object {
if ($_ -ge 32 -and $_ -le 126) { [char]$_ } else { "." }
}
$charArray -join ""
} else {
"Failed to read header"
}
Write-Output "[$status] $($currentFile.Name)"
Write-Output " [$status] Header Read (Hex) | $Header"
Write-Output " [$status] Header Read (String) | $hstr"
###### @MainFunctionality-> Sorts based on what it detected, sends to
if ($isPng) {
Write-Output " [$status] Is a PNG: True"
$newName = $currentFile.Name
if (-not $newName.EndsWith('.png', [StringComparison]::OrdinalIgnoreCase)) {
$newName = "$newName.png"
}
$destPath = Join-Path -Path $pngDir -ChildPath $newName
Move-Item -Path $currentFile.FullName -Destination $destPath
Write-Output " [$status] Moved to -> $destPath"
}
elseif ($isGif) {
Write-Output " [$status] Is a GIF: True"
$newName = $currentFile.Name
if (-not $newName.EndsWith('.gif', [StringComparison]::OrdinalIgnoreCase)) {
$newName = "$newName.gif"
}
$destPath = Join-Path -Path $gifDir -ChildPath $newName
Move-Item -Path $currentFile.FullName -Destination $destPath
Write-Output " [$status] Moved to -> $destPath"
}
else {
Write-Output " [$status] Is a known image: False"
$destPath = Join-Path -Path $otherDir -ChildPath $currentFile.Name
Move-Item -Path $currentFile.FullName -Destination $destPath
Write-Output " [$status] Moved to -> $destPath"
}
}
Write-Output "[*] PNG files moved to | $pngDir"
Write-Output "[*] GIF files moved to | $gifDir"
Write-Output "[*] Other files moved to | $otherDir"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment