CTF_Writeups
Childhood Photo
2026/KICTF/Forensics/Childhood-Photo/Writeup.md
Childhood Photo
When I first looked at the challenge, there was only one file:
gepj.lanif
The filename immediately felt suspicious. If you reverse it, it becomes final.jpeg. That was the first hint that something wasn’t normal.
Initial Inspection
I checked what kind of file it actually was:
file gepj.lanif
xxd -l 16 gepj.lanifSurprisingly:
filereported it as genericdata- The header started with
FF D9
That’s strange because:
FF D8→ JPEG start markerFF D9→ JPEG end marker
Seeing an end marker at the beginning strongly suggests the file is byte-reversed.
Reversing the File
Since the file appeared to be fully reversed, I reversed it byte-by-byte:
perl -0777 -ne 'print scalar reverse $_' gepj.lanif > final.jpeg
file final.jpegNow the file was recognized as a valid JPEG image.
This is the image
That confirmed the suspicion — the challenge intentionally reversed the entire file to break the signature.
Looking Deeper
In CTF challenges, if something works perfectly, it usually means there’s more hidden underneath.
So I searched for multiple JPEG end markers:
grep -oba $'\xff\xd9' final.jpeg
wc -c final.jpegNormally, a JPEG should have only one FFD9 marker at the very end.
But here, there was an earlier occurrence before the file actually ended.
That means:
- The first JPEG ends earlier
- Extra data is appended after it
Carving the Hidden Payload
I extracted everything after the first FFD9 marker:
dd if=final.jpeg of=trailing.bin bs=1 skip=138898 status=none
file trailing.binIt turned out to be another JPEG.
So I renamed it:
mv trailing.bin childhood.jpgThe Hidden Image
Opening childhood.jpg revealed the real content of the challenge.
And there it was — the flag written directly on the image.
Flag
KJCTF{r3v3r53d_jp3g_h34d3r_fix3d}
Final Thoughts
This challenge used two simple but clever tricks:
- The entire file was byte-reversed to break the JPEG signature.
- A second JPEG image was appended after the first JPEG’s end marker.
No heavy steganography. No encryption. Just understanding file structure and thinking logically.
Sometimes the cleanest tricks are the most satisfying to solve.