29.md

Writeup for jpeglitch

@koki310dm

# -*- coding: utf-8 -*-

def mode(arr):
    count = {}
    for a in arr:
        if count.has_key(a):
            count[a] += 1
        else:
            count[a] = 1
    return max(count.items(), key=lambda x:x[1])[0]

array = []
for i in range(10):
    filename = "%s.jpg" % i
    with open(filename, 'rb') as f:
        j = 0
        while True:
            value = f.read(1)
            if value == '': break
            if i == 0: array.append([])
            array[j].append(value)
            j += 1

mode_array = []
for i in range(len(array)):
    mode_array.append(mode(array[i]))
with open('flag.jpg', 'wb') as f:
    f.write(''.join(mode_array))

@mpyw

```
<?php

file_put_contents('answer.jpg', array_map(
    function (...$args) {
        $dist = array_count_values($args);
        arsort($dist);
        return key($dist);
    },
    ...array_map('str_split', array_map('file_get_contents',
        glob(__DIR__ . '/glitch/*.jpg')
    ))
));
```

@myon___

#include <fstream>
#include <iostream>
#include <vector>

auto main() -> int {
  std::fstream img1("0.jpg", std::ios::binary | std::ios::in);
  std::fstream img2("1.jpg", std::ios::binary | std::ios::in);
  std::fstream img3("flag.jpg", std::ios::binary | std::ios::out);

  std::vector<char> v1;
  std::vector<char> v2;
  std::copy(std::istreambuf_iterator<char>(img1), std::istreambuf_iterator<char>(),
            std::back_inserter(v1));
  std::copy(std::istreambuf_iterator<char>(img2), std::istreambuf_iterator<char>(),
            std::back_inserter(v2));

  if (v1.size() != v2.size()) return -1;

  for (std::size_t i = 0; i < v1.size(); ++i) {
    if (v1[i] == 'a' && v2[i] == 'x') {
      v1[i] = 'x';
    }
  }

  std::copy(v1.begin(), v1.end(), std::ostreambuf_iterator<char>(img3));
}

@u3g3

#!/usr/bin/ruby

a = File.open("0.jpg").read
b = File.open("1.jpg").read

a.length.times do |i|
  if a[i] == "\x61" && b[i] == "\x78"
    a[i] = "\x78"
  end
end

File.write("ans.jpg", a)

@ctf_shiho

#!/usr/bin/python

def comp_and_fix_value(a, b, c):
  if a == b == c:
    return a
  s = set()
  for x in [a, b, c]:
    if x in s:
      return x
    s.add(x)
  return None


l = 33596
a = open("0.jpg")
b = open("1.jpg")
c = open("2.jpg")

out = ""

for x in xrange(l):
  l = a.read(1)
  m = b.read(1)
  n = c.read(1)
  out += comp_and_fix_value(l, m, n)
open("out.jpg", "w").write(out)

@bata_24

import sys
f0 = open(sys.argv[1],"rb").read()
f1 = open(sys.argv[2],"rb").read()
f = open(sys.argv[3],"wb")
for i in xrange(len(f0)):
  if f0[i] == f1[i]:
    f.write(f0[i])
  elif f0[i] == '\x61':
    f.write(f1[i])
  elif f1[i] == '\x61':
    f.write(f0[i])
  else:
    print "error"
    exit()

@shift_crops

import sys

argvs = sys.argv

def diff(arr):
    init = arr[0]
    for i in arr:
        if i!=init:
            return True
    return False

def mode(arr):
    base = ord(min(arr))
    r = [0] * (ord(max(arr)) - base + 1)
    for a in arr:
        r[ord(a)-base] += 1
    return chr(base+r.index(max(r)))


indata=[]
for i in range(10):
    infile = open(str(i)+".jpg","rb")
    indata += [infile.read()]
    infile.close()

outdata=""
for i in range(len(indata[0])):
    arr=[]
    for j in range(len(indata)):
        arr+=indata[j][i]

    outdata += mode(arr) if diff(arr) else arr[0]

outfile = open(argv[1] if len(argvs)>1 else "out.jpg","wb")
outfile.write(outdata)    
outfile.close()