CTF隐写术实战教学：PNG Chunk与音频频域隐写分析<\/h1>

1. 隐写技术概述<\/h2>
本教学文档基于2026年阿里CTF热身赛题目，系统讲解PNG文件格式分析与音频频域隐写技术。该题目展示了从PNG图片中提取隐藏的WAV音频，再从音频中解码出二维码图像的完整流程。<\/p>

2. PNG文件结构分析<\/h2>

2.1 PNG文件基本结构<\/h3>

PNG文件由多个数据块（Chunk）组成，每个Chunk包含以下部分：<\/p>

长度（4字节）：数据域的长度<\/li>
块类型（4字节）：标识块类型的ASCII字符<\/li>
数据域（可变长度）：实际数据<\/li>

CRC（4字节）：循环冗余校验码<\/li> <\/ul>

2.2 非法Chunk检测技术<\/h3>
PNG规范要求块类型应为4个字母字符，但题目中使用了非标准块类型"Fl4G"（包含数字），这是隐写的关键标识。<\/p>

3. PNG Chunk隐写提取<\/h2>

3.1 Chunk解析算法<\/h3>

import<\/span> struct
<\/span><\/span>import<\/span> zlib
<\/span><\/span>
<\/span><\/span>def<\/span> read_chunk<\/span>(f):
<\/span><\/span>    """读取PNG文件中的单个chunk"""<\/span>
<\/span><\/span>    raw_len =<\/span> f.<\/span>read(4<\/span>)
<\/span><\/span>    if<\/span> len(raw_len) !=<\/span> 4<\/span>:
<\/span><\/span>        return<\/span> None<\/span>
<\/span><\/span>    length =<\/span> struct.<\/span>unpack(">I"<\/span>, raw_len)[0<\/span>]
<\/span><\/span>    ctype =<\/span> f.<\/span>read(4<\/span>)
<\/span><\/span>    data =<\/span> f.<\/span>read(length)
<\/span><\/span>    crc =<\/span> f.<\/span>read(4<\/span>)
<\/span><\/span>    if<\/span> len(ctype) !=<\/span> 4<\/span> or<\/span> len(data) !=<\/span> length or<\/span> len(crc) !=<\/span> 4<\/span>:
<\/span><\/span>        return<\/span> None<\/span>
<\/span><\/span>    return<\/span> length, ctype, data, crc
<\/span><\/span>
<\/span><\/span>def<\/span> extract_fl4g_chunk<\/span>(png_path):
<\/span><\/span>    """提取Fl4G chunk中的数据"""<\/span>
<\/span><\/span>    PNG_SIG =<\/span> b<\/span>"<\/span>\x89<\/span>PNG<\/span>\r\n\x1a\n<\/span>"<\/span>
<\/span><\/span>    
<\/span><\/span>    with<\/span> open(png_path, "rb"<\/span>) as<\/span> f:
<\/span><\/span>        sig =<\/span> f.<\/span>read(8<\/span>)
<\/span><\/span>        if<\/span> sig !=<\/span> PNG_SIG:
<\/span><\/span>            raise<\/span> ValueError<\/span>("Not a valid PNG file"<\/span>)
<\/span><\/span>        
<\/span><\/span>        while<\/span> True<\/span>:
<\/span><\/span>            chunk =<\/span> read_chunk(f)
<\/span><\/span>            if<\/span> chunk is<\/span> None<\/span>:
<\/span><\/span>                break<\/span>
<\/span><\/span>            length, ctype, data, crc =<\/span> chunk
<\/span><\/span>            if<\/span> ctype ==<\/span> b<\/span>"Fl4G"<\/span>:
<\/span><\/span>                print(f<\/span>"[+] Found Fl4G chunk: <\/span>{<\/span>length}<\/span> bytes"<\/span>)
<\/span><\/span>                return<\/span> data
<\/span><\/span>    raise<\/span> ValueError<\/span>("Fl4G chunk not found"<\/span>)
<\/span><\/span><\/code><\/pre>3.2 数据解压处理<\/h3>
Fl4G chunk的数据以0x78 0x9c开头，这是zlib压缩流的特征头。解压流程：<\/p>
def<\/span> decompress_fl4g_data<\/span>(compressed_data):
<\/span><\/span>    """解压Fl4G chunk中的zlib压缩数据"""<\/span>
<\/span><\/span>    try<\/span>:
<\/span><\/span>        # 检查zlib头<\/span>
<\/span><\/span>        if<\/span> compressed_data[:2<\/span>] !=<\/span> b<\/span>'<\/span>\x78\x9c<\/span>'<\/span>:
<\/span><\/span>            print("[-] Not a zlib stream"<\/span>)
<\/span><\/span>            return<\/span> None<\/span>
<\/span><\/span>        
<\/span><\/span>        # 解压数据<\/span>
<\/span><\/span>        decompressed_data =<\/span> zlib.<\/span>decompress(compressed_data)
<\/span><\/span>        print(f<\/span>"[+] Decompressed <\/span>{<\/span>len(compressed_data)}<\/span> bytes to <\/span>{<\/span>len(decompressed_data)}<\/span> bytes"<\/span>)
<\/span><\/span>        return<\/span> decompressed_data
<\/span><\/span>    except<\/span> zlib.<\/span>error as<\/span> e:
<\/span><\/span>        print(f<\/span>"[-] Decompression error: <\/span>{<\/span>e}<\/span>"<\/span>)
<\/span><\/span>        return<\/span> None<\/span>
<\/span><\/span><\/code><\/pre>4. 音频频域隐写分析<\/h2>
4.1 WAV音频参数分析<\/h3>
提取出的隐藏音频具有以下特征：<\/p>

声道数：1（单声道）<\/li>
采样位数：16-bit<\/li>
采样率：48000 Hz<\/li>
总帧数：5707200<\/li>
<\/ul>
4.2 频域隐写原理<\/h3>
隐写信息通过在不同频点是否存在强信号来编码二进制数据：<\/p>
编码方案：<\/strong><\/p>

将音频按0.1秒分段，每段4800个采样点<\/li>
使用8个特定频点表示8个比特位：

频点：[100, 200, 400, 800, 1600, 3200, 6400, 12800] Hz<\/li>
比特顺序：低频对应低位（LSB）<\/li>
判断阈值：频点幅值 > 1e6 时认为该bit=1<\/li>
<\/ul>
<\/li>
<\/ul>
4.3 频域解码实现<\/h3>
import<\/span> numpy as<\/span> np
<\/span><\/span>import<\/span> wave
<\/span><\/span>from<\/span> scipy import<\/span> fft
<\/span><\/span>
<\/span><\/span>def<\/span> wav_to_bytes<\/span>(wav_bytes):
<\/span><\/span>    """从WAV音频中提取隐藏数据"""<\/span>
<\/span><\/span>    
<\/span><\/span>    # 读取WAV文件<\/span>
<\/span><\/span>    import<\/span> io
<\/span><\/span>    wf =<\/span> wave.<\/span>open(io.<\/span>BytesIO(wav_bytes), "rb"<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 获取音频参数<\/span>
<\/span><\/span>    n_channels =<\/span> wf.<\/span>getnchannels()
<\/span><\/span>    sampwidth =<\/span> wf.<\/span>getsampwidth()
<\/span><\/span>    framerate =<\/span> wf.<\/span>getframerate()
<\/span><\/span>    n_frames =<\/span> wf.<\/span>getnframes()
<\/span><\/span>    
<\/span><\/span>    print(f<\/span>"Audio info: <\/span>{<\/span>n_channels}<\/span> channel(s), <\/span>{<\/span>sampwidth}<\/span> bytes\/sample, <\/span>{<\/span>framerate}<\/span> Hz, <\/span>{<\/span>n_frames}<\/span> frames"<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 读取所有音频数据<\/span>
<\/span><\/span>    frames =<\/span> wf.<\/span>readframes(n_frames)
<\/span><\/span>    wf.<\/span>close()
<\/span><\/span>    
<\/span><\/span>    # 转换为numpy数组<\/span>
<\/span><\/span>    if<\/span> sampwidth ==<\/span> 2<\/span>:
<\/span><\/span>        dtype =<\/span> np.<\/span>int16
<\/span><\/span>    else<\/span>:
<\/span><\/span>        raise<\/span> ValueError<\/span>(f<\/span>"Unsupported sample width: <\/span>{<\/span>sampwidth}<\/span>"<\/span>)
<\/span><\/span>    
<\/span><\/span>    audio_data =<\/span> np.<\/span>frombuffer(frames, dtype=<\/span>dtype)
<\/span><\/span>    
<\/span><\/span>    # 参数设置<\/span>
<\/span><\/span>    BLOCK =<\/span> 4800<\/span>  # 0.1秒的采样点数<\/span>
<\/span><\/span>    FREQS =<\/span> [100<\/span>, 200<\/span>, 400<\/span>, 800<\/span>, 1600<\/span>, 3200<\/span>, 6400<\/span>, 12800<\/span>]
<\/span><\/span>    THR =<\/span> 1e6<\/span>  # 幅值阈值<\/span>
<\/span><\/span>    
<\/span><\/span>    bytes_list =<\/span> []
<\/span><\/span>    
<\/span><\/span>    # 分段处理<\/span>
<\/span><\/span>    for<\/span> i in<\/span> range(0<\/span>, len(audio_data), BLOCK):
<\/span><\/span>        block =<\/span> audio_data[i:i+<\/span>BLOCK]
<\/span><\/span>        if<\/span> len(block) <<\/span> BLOCK:
<\/span><\/span>            break<\/span>
<\/span><\/span>        
<\/span><\/span>        # 计算FFT<\/span>
<\/span><\/span>        fft_result =<\/span> np.<\/span>fft.<\/span>fft(block)
<\/span><\/span>        freqs =<\/span> np.<\/span>fft.<\/span>fftfreq(len(block), 1<\/span>\/<\/span>framerate)
<\/span><\/span>        
<\/span><\/span>        byte_val =<\/span> 0<\/span>
<\/span><\/span>        for<\/span> bit_idx, target_freq in<\/span> enumerate(FREQS):
<\/span><\/span>            # 找到最接近目标频率的索引<\/span>
<\/span><\/span>            idx =<\/span> np.<\/span>argmin(np.<\/span>abs(freqs[:len(freqs)\/\/<\/span>2<\/span>] -<\/span> target_freq))
<\/span><\/span>            magnitude =<\/span> np.<\/span>abs(fft_result[idx])
<\/span><\/span>            
<\/span><\/span>            if<\/span> magnitude ><\/span> THR:
<\/span><\/span>                byte_val |=<\/span> (1<\/span> <<<\/span> bit_idx)  # 设置对应比特位<\/span>
<\/span><\/span>        
<\/span><\/span>        bytes_list.<\/span>append(byte_val)
<\/span><\/span>    
<\/span><\/span>    return<\/span> bytes(bytes_list)
<\/span><\/span><\/code><\/pre>5. 数据重建与解码<\/h2>
5.1 PNG图像重建<\/h3>
解码出的字节流以PNG文件头（89 50 4E 47）开始，共1189字节，可直接保存为PNG图像文件。<\/p>
5.2 Aztec二维码解码<\/h3>
生成的PNG图像是Aztec格式的二维码，使用专业解码库进行识别：<\/p>
import<\/span> zxingcpp
<\/span><\/span>from<\/span> PIL import<\/span> Image
<\/span><\/span>
<\/span><\/span>def<\/span> decode_aztec_qr<\/span>(image_path):
<\/span><\/span>    """解码Aztec二维码"""<\/span>
<\/span><\/span>    img =<\/span> Image.<\/span>open(image_path).<\/span>convert("RGB"<\/span>)
<\/span><\/span>    result =<\/span> zxingcpp.<\/span>read_barcode(img)
<\/span><\/span>    
<\/span><\/span>    if<\/span> result.<\/span>valid:
<\/span><\/span>        print(f<\/span>"[+] Decoded successfully: <\/span>{<\/span>result.<\/span>text}<\/span>"<\/span>)
<\/span><\/span>        return<\/span> result.<\/span>text
<\/span><\/span>    else<\/span>:
<\/span><\/span>        print("[-] Failed to decode Aztec code"<\/span>)
<\/span><\/span>        return<\/span> None<\/span>
<\/span><\/span><\/code><\/pre>6. 完整攻击链实现<\/h2>
6.1 整体流程<\/h3>

PNG解析<\/strong>：检测并提取非标准Fl4G chunk<\/li>
数据解压<\/strong>：使用zlib解压隐藏的WAV音频<\/li>
频域分析<\/strong>：对音频进行FFT分析，提取频域隐写数据<\/li>
图像重建<\/strong>：将提取的字节流重建为PNG图像<\/li>
二维码解码<\/strong>：识别Aztec二维码获取flag<\/li>
<\/ol>
6.2 完整脚本示例<\/h3>
def<\/span> complete_attack<\/span>(png_path, output_wav=<\/span>"hidden.wav"<\/span>, output_png=<\/span>"decoded.png"<\/span>):
<\/span><\/span>    """完整的攻击流程"""<\/span>
<\/span><\/span>    
<\/span><\/span>    # 步骤1: 提取Fl4G chunk<\/span>
<\/span><\/span>    print("[1\/5] Extracting Fl4G chunk..."<\/span>)
<\/span><\/span>    compressed_data =<\/span> extract_fl4g_chunk(png_path)
<\/span><\/span>    
<\/span><\/span>    # 步骤2: 解压数据<\/span>
<\/span><\/span>    print("[2\/5] Decompressing data..."<\/span>)
<\/span><\/span>    wav_data =<\/span> decompress_fl4g_data(compressed_data)
<\/span><\/span>    
<\/span><\/span>    # 保存WAV文件（可选）<\/span>
<\/span><\/span>    with<\/span> open(output_wav, "wb"<\/span>) as<\/span> f:
<\/span><\/span>        f.<\/span>write(wav_data)
<\/span><\/span>    
<\/span><\/span>    # 步骤3: 从音频提取隐藏数据<\/span>
<\/span><\/span>    print("[3\/5] Extracting hidden data from audio..."<\/span>)
<\/span><\/span>    png_bytes =<\/span> wav_to_bytes(wav_data)
<\/span><\/span>    
<\/span><\/span>    # 步骤4: 保存PNG图像<\/span>
<\/span><\/span>    print("[4\/5] Saving reconstructed PNG..."<\/span>)
<\/span><\/span>    with<\/span> open(output_png, "wb"<\/span>) as<\/span> f:
<\/span><\/span>        f.<\/span>write(png_bytes)
<\/span><\/span>    
<\/span><\/span>    # 步骤5: 解码二维码<\/span>
<\/span><\/span>    print("[5\/5] Decoding Aztec code..."<\/span>)
<\/span><\/span>    flag =<\/span> decode_aztec_qr(output_png)
<\/span><\/span>    
<\/span><\/span>    return<\/span> flag
<\/span><\/span>
<\/span><\/span># 执行攻击<\/span>
<\/span><\/span>if<\/span> __name__ ==<\/span> "__main__"<\/span>:
<\/span><\/span>    flag =<\/span> complete_attack("challenge.png"<\/span>)
<\/span><\/span>    if<\/span> flag:
<\/span><\/span>        print(f<\/span>"FLAG: <\/span>{<\/span>flag}<\/span>"<\/span>)
<\/span><\/span><\/code><\/pre>7. 防御与检测方案<\/h2>
7.1 异常检测方法<\/h3>

PNG Chunk验证<\/strong>：检查所有chunk类型是否符合PNG规范<\/li>
文件熵分析<\/strong>：检测异常高的数据熵值<\/li>
元数据分析<\/strong>：检查文件大小与内容的合理性<\/li>
<\/ol>
7.2 安全建议<\/h3>

对用户上传的图片文件进行严格的格式验证<\/li>
实现chunk类型白名单机制<\/li>
定期更新隐写检测规则库<\/li>
<\/ul>
8. 总结<\/h2>
本教学文档详细讲解了从PNG Chunk隐写到音频频域隐写的完整技术链。关键知识点包括：<\/p>

PNG文件结构<\/strong>的理解和异常chunk检测<\/li>
zlib压缩流<\/strong>的识别和解压技术<\/li>
音频频域分析<\/strong>和FFT变换应用<\/li>
频域隐写编码<\/strong>的原理和解码方法<\/li>
Aztec二维码<\/strong>的识别和解码技术<\/li>
<\/ol>
这种多层隐写技术体现了现代CTF题目对综合技能的高要求，也为数字取证和信息安全领域提供了重要的技术参考。<\/p>

CTF隐写术实战教学：PNG Chunk与音频频域隐写分析<\/h1>

1. 隐写技术概述<\/h2> 本教学文档基于2026年阿里CTF热身赛题目，系统讲解PNG文件格式分析与音频频域隐写技术。该题目展示了从PNG图片中提取隐藏的WAV音频，再从音频中解码出二维码图像的完整流程。<\/p>

2. PNG文件结构分析<\/h2>

2.2 非法Chunk检测技术<\/h3> PNG规范要求块类型应为4个字母字符，但题目中使用了非标准块类型"Fl4G"（包含数字），这是隐写的关键标识。<\/p>

3. PNG Chunk隐写提取<\/h2>

4. 音频频域隐写分析<\/h2>

5. 数据重建与解码<\/h2>

5.1 PNG图像重建<\/h3> 解码出的字节流以PNG文件头（89 50 4E 47）开始，共1189字节，可直接保存为PNG图像文件。<\/p>

6. 完整攻击链实现<\/h2>

7. 防御与检测方案<\/h2>

1. 隐写技术概述<\/h2>
本教学文档基于2026年阿里CTF热身赛题目，系统讲解PNG文件格式分析与音频频域隐写技术。该题目展示了从PNG图片中提取隐藏的WAV音频，再从音频中解码出二维码图像的完整流程。<\/p>

2.2 非法Chunk检测技术<\/h3>
PNG规范要求块类型应为4个字母字符，但题目中使用了非标准块类型"Fl4G"（包含数字），这是隐写的关键标识。<\/p>

5.1 PNG图像重建<\/h3>
解码出的字节流以PNG文件头（89 50 4E 47）开始，共1189字节，可直接保存为PNG图像文件。<\/p>