Created
May 14, 2025 06:21
-
-
Save TotallyNotAHaxxer/ba9eac724e3efd43f8df583a294c44bf to your computer and use it in GitHub Desktop.
For reverse engineering an application that cache's files without naming them with extensions, further organizing and sorting cache resources going based on header detection. In this case, GIF and PNG were the two focus sources, anything else was 'another' file
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#### @DSTs | |
$pngDir = ".FixedImages" | |
$gifDir = ".FixedGifs" | |
$otherDir = ".Others" | |
#### @Helper->Creates the directory if it does not exist | |
foreach ($dir in @($pngDir, $gifDir, $otherDir)) { | |
if (-not (Test-Path -Path $dir)) { | |
New-Item -Path $dir -ItemType Directory | Out-Null | |
Write-Output "Created directory: $dir" | |
} | |
} | |
#### @Main->View each file in the current dir | |
Get-ChildItem -File | ForEach-Object { | |
$currentFile = $_ | |
$bytes = Get-Content -Path $currentFile.FullName -Encoding Byte -TotalCount 8 -ErrorAction SilentlyContinue | |
$isPng = $false | |
$isGif = $false | |
$status = "-" | |
###### @Validator->PNG | |
if ($bytes -ne $null -and $bytes.Length -ge 8 -and | |
$bytes[0] -eq 0x89 -and $bytes[1] -eq 0x50 -and $bytes[2] -eq 0x4E -and $bytes[3] -eq 0x47 -and | |
$bytes[4] -eq 0x0D -and $bytes[5] -eq 0x0A -and $bytes[6] -eq 0x1A -and $bytes[7] -eq 0x0A) { | |
$isPng = $true | |
$status = "+" | |
} | |
###### @Validator->GIF87a | |
elseif ($bytes -ne $null -and $bytes.Length -ge 6 -and | |
$bytes[0] -eq 0x47 -and $bytes[1] -eq 0x49 -and $bytes[2] -eq 0x46 -and | |
$bytes[3] -eq 0x38 -and $bytes[4] -eq 0x37 -and $bytes[5] -eq 0x61) { | |
$isGif = $true | |
$status = "+" | |
} | |
###### @Validator->GIF89a signature (both showed up) | |
elseif ($bytes -ne $null -and $bytes.Length -ge 6 -and | |
$bytes[0] -eq 0x47 -and $bytes[1] -eq 0x49 -and $bytes[2] -eq 0x46 -and | |
$bytes[3] -eq 0x38 -and $bytes[4] -eq 0x39 -and $bytes[5] -eq 0x61) { | |
$isGif = $true | |
$status = "+" | |
} | |
$Header = if ($bytes -ne $null) { | |
($bytes | ForEach-Object { "0x{0:X2}" -f $_ }) -join " " | |
} else { | |
"Failed to read header" | |
} | |
$hstr = if ($bytes -ne $null) { | |
$charArray = $bytes | ForEach-Object { | |
if ($_ -ge 32 -and $_ -le 126) { [char]$_ } else { "." } | |
} | |
$charArray -join "" | |
} else { | |
"Failed to read header" | |
} | |
Write-Output "[$status] $($currentFile.Name)" | |
Write-Output " [$status] Header Read (Hex) | $Header" | |
Write-Output " [$status] Header Read (String) | $hstr" | |
###### @MainFunctionality-> Sorts based on what it detected, sends to | |
if ($isPng) { | |
Write-Output " [$status] Is a PNG: True" | |
$newName = $currentFile.Name | |
if (-not $newName.EndsWith('.png', [StringComparison]::OrdinalIgnoreCase)) { | |
$newName = "$newName.png" | |
} | |
$destPath = Join-Path -Path $pngDir -ChildPath $newName | |
Move-Item -Path $currentFile.FullName -Destination $destPath | |
Write-Output " [$status] Moved to -> $destPath" | |
} | |
elseif ($isGif) { | |
Write-Output " [$status] Is a GIF: True" | |
$newName = $currentFile.Name | |
if (-not $newName.EndsWith('.gif', [StringComparison]::OrdinalIgnoreCase)) { | |
$newName = "$newName.gif" | |
} | |
$destPath = Join-Path -Path $gifDir -ChildPath $newName | |
Move-Item -Path $currentFile.FullName -Destination $destPath | |
Write-Output " [$status] Moved to -> $destPath" | |
} | |
else { | |
Write-Output " [$status] Is a known image: False" | |
$destPath = Join-Path -Path $otherDir -ChildPath $currentFile.Name | |
Move-Item -Path $currentFile.FullName -Destination $destPath | |
Write-Output " [$status] Moved to -> $destPath" | |
} | |
} | |
Write-Output "[*] PNG files moved to | $pngDir" | |
Write-Output "[*] GIF files moved to | $gifDir" | |
Write-Output "[*] Other files moved to | $otherDir" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment