{"id":21680697,"url":"https://github.com/cleasbycode/pdvzip","last_synced_at":"2025-04-12T06:23:48.433Z","repository":{"id":60069454,"uuid":"536652479","full_name":"CleasbyCode/pdvzip","owner":"CleasbyCode","description":"Embed a ZIP or JAR file within a PNG image to create a tweetable and \"executable\" PNG-ZIP polyglot image file.  CLI / Web tool.","archived":false,"fork":false,"pushed_at":"2024-12-06T04:12:24.000Z","size":112171,"stargazers_count":21,"open_issues_count":0,"forks_count":2,"subscribers_count":0,"default_branch":"main","last_synced_at":"2024-12-06T22:38:49.690Z","etag":null,"topics":["arbitrary-data","cli-tools","cpp","hacking","infosec","jar","java","linux","png","polyglot","polyglot-files","polyglots","powershell","pwsh","python","tweetable-zip","twitter","x-platform","zip","zipfile"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CleasbyCode.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-14T15:49:13.000Z","updated_at":"2024-12-06T19:38:00.000Z","dependencies_parsed_at":"2024-02-23T00:28:51.693Z","dependency_job_id":"4605d4c1-db7a-4ff3-bde6-7101fec04a83","html_url":"https://github.com/CleasbyCode/pdvzip","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CleasbyCode%2Fpdvzip","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CleasbyCode%2Fpdvzip/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CleasbyCode%2Fpdvzip/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CleasbyCode%2Fpdvzip/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CleasbyCode","download_url":"https://codeload.github.com/CleasbyCode/pdvzip/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248526168,"owners_count":21118834,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arbitrary-data","cli-tools","cpp","hacking","infosec","jar","java","linux","png","polyglot","polyglot-files","polyglots","powershell","pwsh","python","tweetable-zip","twitter","x-platform","zip","zipfile"],"created_at":"2024-11-25T15:20:03.551Z","updated_at":"2025-04-12T06:23:48.420Z","avatar_url":"https://github.com/CleasbyCode.png","language":"C++","readme":"# pdvzip  \n\nEmbed a ***ZIP*** or ***JAR*** file within a ***PNG*** image, to create a ***tweetable*** and \"[***executable***](https://github.com/CleasbyCode/pdvzip#extracting-your-embedded-files)\" ***PNG*** polyglot file.  \nShare the image on ***X/Twitter*** and a few other hosting sites, which will retain the embedded archive.  \n\nWith ***pdvzip***, you can embed a ***ZIP/JAR*** file up to a maximum size of ***2GB** (cover image + archive file).\n\n*Compatible sites, ***listed below***, have their own ***much smaller*** size limits:-\n\n***X/Twitter*** (**5MB**), ***Flickr*** (**200MB**), ***ImgBB*** (**32MB**), ***PostImage*** (**32MB**), ***ImgPile*** (**8MB**).\n  \n![Demo Image](https://github.com/CleasbyCode/pdvzip/blob/main/demo_image/pzip_24334.png)  \n***Image credit:*** [***@obeca***](https://x.com/obeca)\n \nBased on the similar idea by [***David Buchanan***](https://www.da.vidbuchanan.co.uk/), from his original ***Python*** program [***tweetable-polyglot-png***](https://github.com/DavidBuchanan314/tweetable-polyglot-png),  \n***pdvzip*** uses different methods for [***storing***](https://github.com/CleasbyCode/pdvzip#png-image-requirements-for-arbitrary-data-preservation) and [***extracting***](https://github.com/CleasbyCode/pdvzip#extracting-your-embedded-files) embedded files within a ***PNG*** image.  \n\nThe ***Linux/Windows*** extraction script is stored within the ***iCCP*** chunk of the ***PNG*** image. The embedded ***ZIP/JAR*** file is stored within the last ***IDAT*** chunk of the image.  \n\n(*You can try the [***pdvzip Web App, here,***](https://cleasbycode.co.uk/pdvzip/index/) if you don't want to download and compile the CLI source code.*)  \n\n## Usage (Linux)\n\n```console\nuser1@linuxbox:~/Downloads/pdvzip-main/src$ g++ main.cpp -O2 -s -o pdvzip\nuser1@linuxbox:~/Downloads/pdvzip-main/src$ sudo cp pdvzip /usr/bin\n\nuser1@linuxbox:~/Desktop$ pdvzip\n\nUsage: pdvzip \u003ccover_image\u003e \u003czip/jar\u003e\n       pdvzip --info\n\nuser1@linuxbox:~/Desktop$ pdvzip my_cover_image.png document_pdf.zip\n\nCreated PNG-ZIP polyglot image file: pzip_55183.png (4038367 bytes).\n\nComplete!\n\nuser1@linuxbox:~/Desktop$ pdvzip my_cover_image.png hello_world.jar\n\nCreated PNG-JAR polyglot image file: pjar_19662.png (1016336 bytes).\n\nComplete!\n\n``` \n## Extracting Your Embedded File(s)  \n**Important:** When saving images from ***X/Twitter***, click the image in the post to ***fully expand it***, before saving.  \n\nThe following section covers the extraction of embedded ***ZIP*** files. ***JAR*** files are covered later.\n\n***pdvzip*** (for ***Linux***) will attempt to ***automatically set executable permissions*** on newly created polyglot image files.  \n\nYou will need to manually set executable permissions using ***chmod*** on these polyglot images downloaded from hosting sites.\n\nhttps://github.com/user-attachments/assets/b775f8b8-059f-4460-89fa-d3692a245a53\n\n***Linux - using bash (or sh) shell environment.***\n```console\n\nuser1@linuxbox:~/Desktop$ ./pzip_55183.png\n\n```\n**For any other Linux shell environment, you will probably need to invoke bash (or sh) to run the image file.**\n```console\n\nlinuxbox% bash ./pzip_55183.png \n\n``` \nAlternative extraction (***Linux***).  Using ***wget*** to download and run the image directly from the hosting site.  \n***X/Twitter*** ***wget*** example: **Image with embedded ***python*** script**.\n```console\n\nwget -O Fibo.png \"https://pbs.twimg.com/media/GLXTYeCWMAAA6B_.png\";chmod +x Fibo.png;bash ./Fibo.png\n\n```   \n\n**Windows** ***(Rename the image file extension to '.cmd')***\n```console\n\nG:\\demo\u003e ren pzip_55183.png pzip_55183.cmd\nG:\\demo\u003e .\\pzip_55183.cmd\n\n```\nAlternative extraction (***Windows***).  Using ***iwr*** to download and run the image directly from the hosting site.  \n***Flickr*** ***iwr*** example: **Image with embedded mp4 video file.**\n```console\n\niwr -o swing.cmd \"https://live.staticflickr.com/65535/54025688614_2f9d474cba_o_d.png\";.\\swing.cmd\n\n```\n\nOpening the ***.cmd*** file from the desktop, on its first run, ***Windows*** may display a security warning.  \nClear this by clicking '***More info***' then select '***Run anyway***'.  \n\nTo avoid security warnings, run the file from a ***Windows console***, as shown in the above example.  \n\n***The file (or folder) within the ZIP archive that appears first within the ZIP file record, determines what extraction script, based on file type, is used.***\n\nFor common ***video \u0026 audio*** files, ***Linux*** will use the ***vlc*** or ***mpv*** media player. ***Windows*** uses the default media player.  \n\n***PDF*** - ***Linux*** will use ***evince*** or ***firefox***. ***Windows*** uses the default ***PDF*** viewer.  \n***Python*** - ***Linux*** \u0026 ***Windows*** use ***python3*** to run these programs.  \n***PowerShell*** - ***Linux*** uses ***pwsh*** (if installed), ***Windows*** uses either ***powershell.exe*** or ***pwsh.exe*** to run these scripts.\n***Folder*** - ***Linux*** uses ***xdg-open***, ***Windows*** uses ***powershell.exe*** with II (***Invoke-Item***) command, to open zipped folders.\n\nFor any other file type within your ***ZIP*** file, ***Linux*** \u0026 ***Windows*** will rely on the operating system's set default method/application. Obviously, the compressed/embedded file needs to be compatible with the operating system you run it on.\n\nIf the archive file is JAR or the compressed file type within the ZIP archive is ***PowerShell***, ***Python***, ***Shell Script*** or a ***Windows/Linux Executable, pdvzip*** will give you the option to provide command-line arguments for your file, if required.  \n\nMake sure to enclose arguments containing spaces, such as file \u0026 directory names, within \"quotation\" marks. e.g.\n```console\nuser1@linuxbox:~/Desktop$ ./pdvzip my_cover_image.png jdvrif_linux_executable.zip\n\nFor this file type you can provide command-line arguments here, if required.\n\nLinux: -e ../my_cover_image.jpg \"../my document file.pdf\"\n\n```\nAlso, be aware when using arguments for the compressed ZIP file types (not JAR), you are always working from within the subdirectory \"***pdvzip_extracted***\".  \n\nhttps://github.com/user-attachments/assets/9125d4e5-f94b-4d27-987e-fb2d76a90e8f\n\nTo just get access to the file(s) within the ***ZIP*** archive, rename the '***.png***' file extension to '***.zip***'.  \nTreat the ***ZIP*** archive as read-only, do not add or remove files from the ***PNG-ZIP*** polyglot file.  \n\n## Executing Embedded Java Programs\n\n***Linux Option 1:***\n```console\nuser1@linuxbox:~/Desktop$ java -jar pjar_19662.png\nNote: If you use this method to run your embedded Java program, you will have to manually add command-line\n      arguments (if required) to the end of the command, as your embedded arguments will not work with\n      this method. e.g.\n      user1@linuxbox:~/Desktop$ java -jar ./pjar_19662.png -u john_s -a 42 -f \"John Smith\"\n```\n***Linux Option 2a, using bash (or sh) shell environment:***\n```console\nuser1@linuxbox:~/Desktop$ ./pjar_19662.png\nNote: This method will execute the embedded Java program and also use any embedded\n      command-line arguments with the Java program.\n```\n***Linux Option 2b, using any other shell environment, you will need to invoke bash (or sh) to execute the image:***\n```console\nlinuxbox% bash ./pjar_19662.png\n```\n***Windows Option 1:***\n```console\nPS C:\\Users\\Nick\\Desktop\\jar_demo\u003e java -jar .\\pjar_19662.png \nNote: If you use this method to run your embedded Java program, you will have to manually add command-line\n      arguments (if required) to the end of the command, as your embedded arguments will not work with\n      this method. e.g.\n      PS C:\\Users\\Nick\\Desktop\\jar_demo\u003e java -jar .\\pjar_19662.png -u john_s -a 42 -f \"John Smith\"\n```\n***Windows Option 2:***\n```console\nPS C:\\Users\\Nick\\Desktop\\jar_demo\u003e ren .\\pjar_19662.png .\\pjar_19662.cmd\nPS C:\\Users\\Nick\\Desktop\\jar_demo\u003e .\\pjar_19662.cmd\nNote: This method will execute the embedded Java program and also use any\n      embedded command-line arguments with the Java program.\n```\nhttps://github.com/user-attachments/assets/9451ad50-4c7c-4fa3-a1be-3854189bde00\n\n## PNG Image Requirements for Arbitrary Data Preservation\n\n***PNG*** file size (image + archive file) must not exceed the hosting site's size limits.  \nThe site will either refuse to upload your image or it will convert your image to ***jpg***, such as ***X/Twitter***.\n\n***Dimensions:***\n\nThe following dimension size limits are specific to ***pdvzip*** and not necessarily the extact hosting site's size limits.\nThese dimension size limits are for compatibility reasons, allowing it to work with all the above listed platforms.\n\n***PNG-32/24 (Truecolor)***\n\nImage dimensions can be set between a minimum of **68 x 68** and a maximum of **900 x 900**.\n\n*Note: Images that are created \u0026 saved within your image editor as ***PNG-32/24*** that are either\nblack \u0026 white/grayscale, images with 256 colors or less, will be converted by ***X/Twitter*** to\n***PNG-8*** and you will lose the embedded content. If you want to use a simple \"single\" color\n***PNG-32/24*** image, then fill an area with a gradient color instead of a single solid color. \n***X/Twitter*** should then keep the image as ***PNG-32/24***. [***(Example).***](https://twitter.com/CleasbyCode/status/1694992647121965554)*\n    \n***PNG-8 (Indexed-color)***\n\nImage dimensions can be set between a minimum of **68 x 68** and a maximum of **4096 x 4096**.\n        \n***PNG Chunks:***  \n\nWith ***X/Twitter***, for example, you can ***overfill*** the following ***PNG*** chunks with arbitrary data,  \nin which the platform will preserve as long as you keep within the image dimension \u0026 file size limits.  \n\n***bKGD, cHRM, gAMA, hIST,***  \n***iCCP,*** (Limited size chunk. Only **10KB** max. with ***X/Twitter***).  \n***IDAT,*** (Use as last ***IDAT*** chunk, after the final image ***IDAT*** chunk).  \n***PLTE,*** (Use only with ***PNG-32/24*** images).  \n***pHYs, sBIT, sPLT, sRGB,***   \n***tRNS. (Use only with ***PNG-32/24*** images).***  \n\n*Other platforms may differ in what chunks they preserve and which ones you can overfill.*\n  \npdvzip uses the chunks ***iCCP*** (stores extraction script) and ***IDAT*** (stores the ***ZIP/JAR*** file) for your arbitrary data.\n\n## ***ZIP/JAR*** File Size \u0026 Other Important Information\n\nTo work out the maximum ***ZIP/JAR*** file size, start with the size limit, minus the image size, minus ***1500*** bytes (extraction script size).  \n  \n***X/Twitter*** example: (**5MB** limit) **5,242,880** - (**307,200** [image] + **1500** [extraction script]) = **4,934,180 bytes** available for your ***ZIP/JAR*** file.  \n\n* Make sure your ***ZIP/JAR*** file is a standard ***ZIP/JAR*** archive, compatible with ***Linux*** unzip \u0026 ***Windows*** Explorer.\n* Do not include more than one ***.zip*** file within the main ***ZIP*** archive. (***.rar*** files are ok).\n* Do not include other ***pdvzip*** created ***PNG*** image files within the main ***ZIP*** archive, as they are essentially ***.zip*** files.\n* Use file extensions for your file(s) within the ***ZIP*** archive: ***my_doc.pdf***, ***my_video.mp4***, ****my_program.py****, etc.\n  \n  A file without an extension within a ***ZIP*** archive will be considered a ***Linux*** executable.      \n* ***Paint.net*** application is recommended for easily creating compatible ***PNG*** image files.  \n\n## Third-Party Libraries\n\nThis project includes the following third-party library:\n\n- **LodePNG** by Lode Vandevenne\n  - License: zlib/libpng (see [***LICENSE***](https://github.com/lvandeve/lodepng/blob/master/LICENSE) file)\n  - Copyright (c) 2005-2024 Lode Vandevenne\n\n##\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcleasbycode%2Fpdvzip","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcleasbycode%2Fpdvzip","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcleasbycode%2Fpdvzip/lists"}