{"id":19482491,"url":"https://github.com/corkami/mitra","last_synced_at":"2025-04-14T22:11:11.236Z","repository":{"id":40046783,"uuid":"297723842","full_name":"corkami/mitra","owner":"corkami","description":"A generator of weird files (binary polyglots, near polyglots, polymocks...)","archived":false,"fork":false,"pushed_at":"2024-12-22T20:29:32.000Z","size":7847,"stargazers_count":1210,"open_issues_count":0,"forks_count":78,"subscribers_count":28,"default_branch":"master","last_synced_at":"2025-04-07T19:06:21.233Z","etag":null,"topics":["binary-polyglots","polyglots"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/corkami.png","metadata":{"files":{"readme":"README.html","changelog":"NEWS.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"corkami","patreon":"corkami","custom":["https://paypal.me/corkami"]}},"created_at":"2020-09-22T17:33:10.000Z","updated_at":"2025-03-31T02:02:36.000Z","dependencies_parsed_at":"2024-11-10T20:10:55.625Z","dependency_job_id":"949accc4-2207-4ff0-9d94-be7d5b5c8ba7","html_url":"https://github.com/corkami/mitra","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corkami%2Fmitra","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corkami%2Fmitra/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corkami%2Fmitra/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corkami%2Fmitra/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corkami","download_url":"https://codeload.github.com/corkami/mitra/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248968914,"owners_count":21191162,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["binary-polyglots","polyglots"],"created_at":"2024-11-10T20:10:42.257Z","updated_at":"2025-04-14T22:11:11.210Z","avatar_url":"https://github.com/corkami.png","language":"Python","funding_links":["https://github.com/sponsors/corkami","https://patreon.com/corkami","https://paypal.me/corkami"],"categories":[],"sub_categories":[],"readme":"\u003c!DOCTYPE html\u003e\n\u003chtml xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"\" xml:lang=\"\"\u003e\n\u003chead\u003e\n  \u003cmeta charset=\"utf-8\" /\u003e\n  \u003cmeta name=\"generator\" content=\"pandoc\" /\u003e\n  \u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1.0, user-scalable=yes\" /\u003e\n  \u003ctitle\u003eREADME\u003c/title\u003e\n  \u003cstyle type=\"text/css\"\u003e\n      code{white-space: pre-wrap;}\n      span.smallcaps{font-variant: small-caps;}\n      span.underline{text-decoration: underline;}\n      div.column{display: inline-block; vertical-align: top; width: 50%;}\n  \u003c/style\u003e\n  \u003c!--[if lt IE 9]\u003e\n    \u003cscript src=\"//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js\"\u003e\u003c/script\u003e\n  \u003c![endif]--\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1 id=\"mitra\"\u003eMitra\u003c/h1\u003e\n\u003cp\u003eA tool to generate binary polyglots (files that are valid with several file formats).\u003c/p\u003e\n\u003cp\u003eLoosely named after \u003ca href=\"https://en.wikipedia.org/wiki/Mithridates_VI_of_Pontus\"\u003eΜιθραδάτης\u003c/a\u003e, a famous polyglot. Pronounced \u003ccode\u003emɪtrə\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"NEWS.md\"\u003eWhat's new\u003c/a\u003e.\u003c/p\u003e\n\u003ch2 id=\"how-to-use\"\u003eHow to use\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003emitra.py file1.png file2.dcm\u003c/code\u003e gives you a working PNG/DICOM polyglot.\u003c/p\u003e\n\u003cp\u003eCheck Corkami \u003ca href=\"https://github.com/corkami/pocs/tree/master/mini\"\u003emini\u003c/a\u003e or \u003ca href=\"https://github.com/corkami/pocs/tree/master/tiny\"\u003etiny\u003c/a\u003e PoCs for input files. and the formats \u003ca href=\"https://github.com/corkami/formats/tree/WIP\"\u003erepository\u003c/a\u003e for some extra technical info.\u003c/p\u003e\n\u003ch1 id=\"features\"\u003eFeatures\u003c/h1\u003e\n\u003cp\u003eIt tries different layouts: Stacks (appended data), Cavities (blank space), Parasites (comments), Zippers (mutual comments).\u003c/p\u003e\n\u003cp\u003eIt stores the offsets where the payloads 'switch sizes' between parenthesis for ambiguous ciphertexts.\u003c/p\u003e\n\u003cp\u003eEx: \u003ccode\u003eZ(80-162-286)-DICOM^TIFF.be3b767b.dcm.tif\u003c/code\u003e is a DICOM/TIFF zipper where the payloads switch side at offsets \u003ccode\u003e0x80\u003c/code\u003e, \u003ccode\u003e0x162\u003c/code\u003e and \u003ccode\u003e0x286\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e-s\u003c/code\u003e option extracts the 2 payloads separately, mixed with pseudo-random bytes (it doesn't fix checksums afterwards).\u003c/p\u003e\n\u003cp\u003eMitra can generate near-polyglots (with overlapping bytes) with the \u003ccode\u003e--overlap\u003c/code\u003e parameter. It stores the overlap data between curly braces of the output file - for example, \u003ccode\u003eO(d-40a){4D5A}.wasm.exe\u003c/code\u003e.\u003c/p\u003e\n\u003ch1 id=\"goals\"\u003eGoals\u003c/h1\u003e\n\u003ch2 id=\"exploration\"\u003eExploration\u003c/h2\u003e\n\u003cp\u003eThe goal of this project was to explore polyglots layouts, formats abuses, and understand which format features enables which kind of abuse.\u003c/p\u003e\n\u003cp\u003eFor example, in a chunk-based format, just find where to \u003ccode\u003ecut\u003c/code\u003e the file, then \u003ccode\u003ewrap\u003c/code\u003e foreign data in a new chunk and insert the chunk. So you just need to teach Mitra how to \u003ccode\u003eidentify\u003c/code\u003e the type, where to \u003ccode\u003ecut\u003c/code\u003e, and how to \u003ccode\u003ewrap\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"demonstration\"\u003eDemonstration\u003c/h2\u003e\n\u003cp\u003eYou can prevent a software launch if you find a security risk, but a bad format design is not considered a risk in itself: it's just the parser's fault, not the designer's !\u003c/p\u003e\n\u003cp\u003eSo if you review a bad file format, then maybe with Mitra you can quickly generate polyglots with many other formats and demonstrate the risks.\u003c/p\u003e\n\u003ch1 id=\"status\"\u003eStatus\u003c/h1\u003e\n\u003cpre\u003e\u003ccode\u003e                          Delayed                 Magic at offset zero,                  No appended\n      Any offset  Cavities start                 tolerated appended data                     data    Footer\n\n        Z 7 A R   P I D T   P M   A B B C C E E F F G G I I I I J J N O P L P P R R T W   B J P P W   I X\n        i Z r A   D S C A   S P   R M Z A P B L L l I Z C C D L P P E G S N E N I T I A   P a C C A   D Z\n        p   j R   F O M R     4     P 2 B I M F V a F   C O 3 D 2 G S G D K   G F F F D   G v A A S   3\n                                          O L     c         v A                 F   F       a P P M   v\n                                                            2                                   N     1\n\nZip     . X X X   X X X X   X X   X X X X X X X X X X X X X X X X X X X X X X X X X X X   X X X X X       41\n7Z      X . X X   X X X X   X X   X X X X X X X X X X X X X X X X X X X X X X X X X X X   X X X X X       41\nArj     X X . X   X X X X   X X   X X X X X X X X X X X X X X X X X X X X X X X X X X X   X X X X X       41\nRAR     X X X .   X X X X   X X   X X X X X X X X X X X X X X X X X X X X X X X X X X X   X X X X X       41\n\nPDF     X X X X   . X X X   X X   X X X X X X X X X X X X X X X X X X X X X X X X X X X   X X X X X       41\nISO     X X X X   X . X X   X X   X X X X X X X X X X X X X X X X X X X X X X X X X X X   X X X X X       41\nDCM     X X X X   X X .     X X   X X X X X X X X X X X   X X X X X X X X   X X X X X X   X X X X X       37\nTAR     X X X X   X X   .   X X   X     X X X   X X   X   X X X X X   X X     X X X X X   X   X X X       30\n\nPS      X X X X   X X X X   .                                                                              8\nMP4     X X X X   X X X X     .                                                                            8\n\nAR      X X X X   X X X X         .                                                                        8\nBMP     X X X X   X X X             .                                                                      7\nBZ2     X X X X   X X X               .                                                                    7\nCAB     X X X X   X X X X               .                                                                  8\nCPIO    X X X X   X X X X                 .                                                                8\nEBML    X X X X   X X X X                   .                                                              8\nELF     X X X X   X X X                       .                                                            7\nFLV     X X X X   X X X X                       .                                                          8\nFlac    X X X X   X X X X                         .                                                        8\nGIF     X X X X   X X X                             .                                                      7\nGZ      X X X X   X X X X                             .                                                    8\nICC     X X X X   X X                                   .                                                  6\nICO     X X X X   X X X X                                 .                                                8\nID3v2   X X X X   X X X X                                   .                                              8\nILDA    X X X X   X X X X                                     .                                            8\nJP2     X X X X   X X X X                                       .                                          8\nJPG     X X X X   X X X X                                         .                                        8\nNES     X X X X   X X X                                             .                                      7\nOGG     X X X X   X X X X                                             .                                    8\nPSD     X X X X   X X X X                                               .                                  8\nLNK     X X X X   X X                                                     .                                6\nPE      X X X X   X X X                                                     .                              7\nPNG     X X X X   X X X X                                                     .                            8\nRIFF    X X X X   X X X X                                                       .                          8\nRTF     X X X X   X X X X                                                         .                        8\nTIFF    X X X X   X X X X                                                           .                      8\nWAD     X X X X   X X X X                                                             .                    8\n\nBPG     X X X X   X X X X                                                                 .                8\nJava    X X X X   X X X                                                                     .              7\nPCAP    X X X X   X X X X                                                                     .            8\nPCAPN   X X X X   X X X X                                                                       .          8\nWASM    X X X X   X X X X                                                                         .        8\n\nID3v1                                                                                                 .    0\nXZ                                                                                                      .  0\n\nFormats combinations: 288\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eNotes that some formats are containers and apply to several file types.\u003c/p\u003e\n\u003ch2 id=\"near-polyglots\"\u003eNear polyglots\u003c/h2\u003e\n\u003cp\u003eWith the \u003ccode\u003e--overlap\u003c/code\u003e option (disabled by default), filetypes starting at the same offsets can be combined.\u003c/p\u003e\n\u003cp\u003eThe overwritten content might be restored via any operation, such as decryption via specific bruteforced parameters (CBC, GCM...), and is stored in the filename between curly brackets. Ex: \u003ccode\u003eO(5-204){424D4E0100}.bmp.jpg\u003c/code\u003e\u003c/p\u003e\n\u003cp\u003eSince it's pure bruteforcing, it's not practical if the filetype requires too many bytes to be restored.\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e                                                               Variable  Unsupported\n                                                                offset     parasite\nMinimal start offset\n         1 2 4 8     9  13    20  23  28  34  40  64  94  132    12  28   \n                      12  16        26  32  36      68  112 226    16     \n\n         P P J F M T F W E G P R I R B C I P C J P E A P I I J    W B O      B G L N\n         S E P l P I L A B Z N I D T M P L S A P C L R C C C a    A P G      Z I N E\n             G a 4 F V D M   G F 3 F P I D D B 2 A F   A O C v    S G G      2 F K S\n               c   F     L     F v     O A       P     P     a    M    \n                                 2               N\n                                                 G\n\n1* PS    . M A ? ? ? ? ? ? ? A ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?    ? ? ?      ? ? ? ?\n2^ PE    M . A A A A A A A A A A A A A A A A A A A ! ! ! ! ! !    M M M      ! ! ! !\n4+ JPG   A A . A A A A A A A A A A A A A A A A A A A A A A A A    A A A      A A A A\n.  .\n.  .     [the table could go on but would take too long to bruteforce]\n\n           X: automated     ?: likely possible\n           M: manual        !: unknown\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e*\u003c/code\u003e: hack that relies on line comments with GhostScript - requires the parasite not to contain any new line, \u003cstrong\u003eafter\u003c/strong\u003e encryption.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e^\u003c/code\u003e: hack relying on overwriting the \u003ccode\u003eDos Header\u003c/code\u003e, therefore restricting the parasite space to offsets \u003ccode\u003e2\u003c/code\u003e-\u003ccode\u003e60\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e+\u003c/code\u003e: Signature, comment declaration and length takes all 2 bytes each, in total:\n\u003cul\u003e\n\u003cli\u003eto set an exact length, \u003ccode\u003e6\u003c/code\u003e bytes are required.\u003c/li\u003e\n\u003cli\u003ethe length is big endian, so you can round up the length and leave the lowest byte uncontrolled, requiring only \u003ccode\u003e5\u003c/code\u003e bytes.\u003c/li\u003e\n\u003cli\u003eIf the entire length is left undefined, and if your payload fits in the resulted encoded length after encryption, then only \u003ccode\u003e4\u003c/code\u003e bytes are required.\u003c/li\u003e\n\u003c/ul\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1 id=\"script-polyglots\"\u003eScript polyglots\u003c/h1\u003e\n\u003cp\u003eSome script language (JavaScript, HTML, PHP, Ruby...) tolerate binary contents and can be combined with binary formats.\u003c/p\u003e\n\u003cp\u003eTypical exploits target browser-supported formats such as images, GZip, Flash, Mp3...\u003c/p\u003e\n\u003cp\u003eMitra can be used to make room in a binary file.\u003c/p\u003e\n\u003cp\u003eThere are different strategies for these polyglots:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eMultiline comments\u003c/em\u003e such as \u003ccode\u003e*/ \u0026lt;JavaScript\u0026gt; /*\u003c/code\u003e in a parasite. In this case, the embedded content shouldn't output an closing comment statement.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://en.wikipedia.org/wiki/Here_document\"\u003eHere document\u003c/a\u003e: In this case, you might want to use the format magic to define a dummy variable with the format magics. For example, \u003ccode\u003eMZ = \u0026lt;\u0026lt; HereMarker\u003c/code\u003e in the \u003ccode\u003eDOS Header\u003c/code\u003e of a Portable Executable.\u003c/li\u003e\n\u003cli\u003eTerminators can also be used to make sure that the rest of the file is ignored.\u003c/li\u003e\n\u003cli\u003eSome formats will enforce some charset even in comments. For example, the current file encoding of the file, or if parenthesis/brackets are balanced.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- csvtable\nLanguage|ML Comments|Here doc.|Terminator\nHTML|`\u003c\\!--` `--\\\u003e`||\nJavaScript|`/*` `*/`||\nPerl|`=pod` `=cut`|`\u003c\u003c`|`__END__`\nPHP|`/*` `*/`|`\u003c\u003c`|\nPostScript|`/{(` `)}`||`stop`\nPowerShell|`\u003c#` `#\u003e`|`@\"`|\nPython||`\"\\\"\"`|\nRuby|`=begin` `=end`|`\u003c\u003c`|`__END__`\nShell||`\u003c\u003c`|\nXML|`\u003c![CDATA[` `]]\u003e`||\n--\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr class=\"header\"\u003e\n\u003cth\u003eLanguage\u003c/th\u003e\n\u003cth\u003eML Comments\u003c/th\u003e\n\u003cth\u003eHere doc.\u003c/th\u003e\n\u003cth\u003eTerminator\u003c/th\u003e\n\u003cth\u003eCharset\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr class=\"odd\"\u003e\n\u003ctd\u003eHTML\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026lt;!--\u003c/code\u003e \u003ccode\u003e--\u0026gt;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e \u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"even\"\u003e\n\u003ctd\u003eJavaScript\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e/*\u003c/code\u003e \u003ccode\u003e*/\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e \u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"odd\"\u003e\n\u003ctd\u003ePerl\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e=pod\u003c/code\u003e \u003ccode\u003e=cut\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026lt;\u0026lt;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e__END__\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"even\"\u003e\n\u003ctd\u003ePHP\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e/*\u003c/code\u003e \u003ccode\u003e*/\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026lt;\u0026lt;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"odd\"\u003e\n\u003ctd\u003ePostScript\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e/{(\u003c/code\u003e \u003ccode\u003e)}\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e \u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003estop\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eBalanced syntax\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"even\"\u003e\n\u003ctd\u003ePowerShell\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026lt;#\u003c/code\u003e \u003ccode\u003e#\u0026gt;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e@\u0026quot;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"odd\"\u003e\n\u003ctd\u003ePython\u003c/td\u003e\n\u003ctd\u003e \u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026quot;\u0026quot;\u0026quot;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003eEncoding\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"even\"\u003e\n\u003ctd\u003eRuby\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e=begin\u003c/code\u003e \u003ccode\u003e=end\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026lt;\u0026lt;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e__END__\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"odd\"\u003e\n\u003ctd\u003eShell\u003c/td\u003e\n\u003ctd\u003e \u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026lt;\u0026lt;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr class=\"even\"\u003e\n\u003ctd\u003eXML\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e\u0026lt;![CDATA[\u003c/code\u003e \u003ccode\u003e]]\u0026gt;\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e \u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003eEncoding\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eYou may want to make room for a specific buffer size to encode a multiline comment via the length declaration of the comment. For example in MP4, where the file starts with the length of the first atom: this length can encode a short comment statement such as \u003ccode\u003e//\u003c/code\u003e or \u003ccode\u003e/*\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eSome combinations may prevent embedding binary files. However, a few binary formats can be exceptionnally turned into ASCII-only files:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePDF, via the official \u003cem\u003eASCIIHex\u003c/em\u003e codec. For \u003ca href=\"https://mupdf.com/docs/manual-mutool-clean.html\"\u003eexample\u003c/a\u003e, via \u003ccode\u003emutool clean -a\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFlash files, via \u003ca href=\"https://github.com/molnarg/ascii-zip\"\u003eASCII-only\u003c/a\u003e deflate compression and clever header+zlib \u003ca href=\"https://github.com/mikispag/rosettaflash\"\u003emanipulation\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1 id=\"mocky\"\u003eMocky\u003c/h1\u003e\n\u003cp\u003eMocky is a script to generate polymocks.\u003c/p\u003e\n\u003cp\u003eIt turns valid files into polymocks by inserting mock signature of other file types at the right offset, if possible. These polymocks might then be detected as something else while retaining their initial validity, depending on the detection engine. If a Tar signature is added, then a proper Tar header checksum is also added.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e--combine\u003c/code\u003e parameters tries to fit as many signatures as accepted by the target file format.\u003c/p\u003e\n\u003ch2 id=\"example\"\u003eExample\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eTake a standard PDF file.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cpre\u003e\u003ccode\u003e$ file pdf.pdf\npdf.pdf: PDF document, version 1.3\n\u003c/code\u003e\u003c/pre\u003e\n\u003col start=\"2\"\u003e\n\u003cli\u003eGenerate a polymock file\u003c/li\u003e\n\u003c/ol\u003e\n\u003cpre\u003e\u003ccode\u003e$ mocky.py --combine input/pdf.pdf\nFiletype: Portable Document Format\nParasite-combined sig(s): SymbOs / netbsd_ktraceS / SoundFX / VirtualBox / ScreamTracker / Plot84 / ezd / dicom / Tar(checksum) / ds / CCP4 / DRDOS / pif / mbr\n\u0026gt; Combined Mock: mA-pdf.pdf\n\u003c/code\u003e\u003c/pre\u003e\n\u003col start=\"3\"\u003e\n\u003cli\u003eCheck the results\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eThe file is still totally valid.\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e$ pdftotext mA-pdf.pdf -\nPDF\n\u003c/code\u003e\u003c/pre\u003e\n\u003cpre\u003e\u003ccode\u003e$ pdfinfo mA-pdf.pdf\nTagged:         no\nUserProperties: no\nSuspects:       no\nForm:           none\nJavaScript:     no\nPages:          1\nEncrypted:      no\nPage size:      612 x 792 pts (letter)\nPage rot:       0\nFile size:      1272 bytes\nOptimized:      no\nPDF version:    1.3\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe detected file type has changed:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e$ file mA-pdf.pdf\nmA-pdf.pdf: tar archive\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eIt actually contains more signatures, and still detected as PDF too:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e$ file --keep-going --raw mA-pdf.pdf\nmA-pdf.pdf: tar archive\n- DR-DOS executable (COM)\n- Windows Program Information File for  R\u0026gt;\u0026gt;\n- DOS/MBR boot sector\n- Nintendo DS ROM image: \u0026quot;%PDF-1.3\u0026quot; (┬╢, Rev.116)\n- Plot84 plotting file DOS/MBR boot sector\n- SymbOS executable v., name: 1 0 obj\n- PDF document, version 1.3\n- Old EZD Electron Density Map\n- Scream Tracker Sample adlib drum mono 8bit\n- SoundFX Module sound file\n- DICOM medical imaging data\n- CCP4 Electron Density Map\n- VirtualBox Disk Image (%PDF-1.3), 5715999566798081280 bytes\n- data\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch1 id=\"notes\"\u003eNotes\u003c/h1\u003e\n\u003ch2 id=\"file-formats\"\u003eFile formats\u003c/h2\u003e\n\u003cp\u003eRemarks and recommendations to design file formats\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEnforcing a magic at offset zero should be standard.\u003c/li\u003e\n\u003cli\u003eStarting at offset zero and not enforcing a magic at zero is still exploitable (PS, MP4).\u003c/li\u003e\n\u003cli\u003eStarting at any offset makes polyglots trivial.\u003c/li\u003e\n\u003cli\u003eEnforcing a footer (like \u003ccode\u003eXZ\u003c/code\u003e, \u003ccode\u003eID3v1\u003c/code\u003e) is a great way to check if a file isn't truncated, and prevents 'naturally' appended data.\u003c/li\u003e\n\u003cli\u003eMost formats have a way to store parasite data, except very simple ones.\u003c/li\u003e\n\u003cli\u003eDon't use a standard container in a non standard way. Use a different magic if you're only going to use similar structures to a limited extend.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"polyglots-detection\"\u003ePolyglots detection\u003c/h2\u003e\n\u003cp\u003eSince these polyglots contain the magic signatures of both formats, \u003ccode\u003efile\u003c/code\u003e may be able to detect them with the \u003ccode\u003e--keep-going\u003c/code\u003e arguments. (it does not \u003cem\u003evalidate\u003c/em\u003e the formats, but at least gives you some information).\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e$ file --keep-going --raw \u0026quot;C(66)-PNG-DICOM.7e22f58e.dcm.png\u0026quot;\nC(66)-PNG-DICOM.7e22f58e.dcm.png: PNG image data, 13 x 7, 1-bit colormap, non-interlaced\n- DICOM medical imaging data\n- data\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch1 id=\"related-documentation\"\u003eRelated documentation\u003c/h1\u003e\n\u003cp\u003ePaper:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://eprint.iacr.org/2020/1456\"\u003eHow to Abuse and Fix Authenticated Encryption Without Key Commitment\u003c/a\u003e, Nov 2020 - Dec 2021. Ange Albertini, \u003ca href=\"https://twitter.com/XorNinja\"\u003eThai Duong\u003c/a\u003e, Shay Gueron, \u003ca href=\"https://twitter.com/kste_\"\u003eStefan Kölbl\u003c/a\u003e, Atul Luykx, \u003ca href=\"https://twitter.com/SchmiegSophie\"\u003eSophie Schmieg\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eTalks:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eTimeCryption - clean now, malicious later\u003c/strong\u003e (DEFCON CH 2021) w/ \u003ca href=\"https://twitter.com/kste_\"\u003eStefan Kölbl\u003c/a\u003e, \u003ca href=\"https://speakerdeck.com/ange/timecryption\"\u003eslides\u003c/a\u003e / \u003ca href=\"https://www.youtube.com/watch?v=liancIA1m9w\"\u003evideo\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eGenerating weird files - an introduction to Mitra\u003c/strong\u003e (Pass the Salt 2021) \u003ca href=\"https://speakerdeck.com/ange/generating-weird-files\"\u003eslides\u003c/a\u003e / \u003ca href=\"https://www.youtube.com/watch?v=96FiTaAiUk8\u0026amp;t=7877s\"\u003evideo\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- pandoc -s -f gfm -t html README.md -o README.html --\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorkami%2Fmitra","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcorkami%2Fmitra","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorkami%2Fmitra/lists"}