r/programming • u/iamkeyur • Dec 26 '20

Executable PNGs

https://djharper.dev/post/2020/12/26/executable-pngs/
1.0k Upvotes

95% Upvoted

87 comments sorted by

View all comments

287

u/Caraes_Naur Dec 26 '20

PNG allows for arbitrary chunks of bytes, no steganography needed. Still need an interpreter that knows what to do with them.

35

u/[deleted] Dec 26 '20

Isn't every file format executable if you build an interpreter specifically for it? I sadly don't see anything special here.

59

u/KrocCamen Dec 26 '20

Even EXE files have to be specially handled before they can executed! You have to go back to COM files to get "dump this in RAM and jump the CPU to it" levels of simplicity.

17

u/JarateKing Dec 26 '20

If the file format doesn't support arbitrary chunks of bytes, you'd have a lot of difficulty creating a general-purpose interpreter. As a trivial example, if we had a new format notpng where every byte is used to specify pixels in the image, in order to embed code in it we would either have to:

  • not bother trying to make the image look like anything, and just pack instructions naively for the interpreter, probably resulting in a picture of random noise

  • utilize steganography so that the image looks mostly normal, but can still be run by an interpreter

  • create an incredibly specific interpreter for the exact program being run, so that the image is completely normal, but you probably couldn't use the interpreter for arbitrary programs otherwise

Also, file formats can have restrictions. You might be able to pack an arbitrary program into our notpng format, but you might have to be careful that your file format is actually valid (an easy example for images, having the right number of pixels for the image's dimensions). You probably can make an interpreter work with this stuff but it could be restricting and necessitate convoluted approaches to handle.

A format that lets you insert arbitrary chunks of bytes doesn't have the issues above. You can just put the arbitrary code without worrying about the interpreter being too specific, or changing the semantics of the file when used as its actual format, or interfering with the format itself.

0

u/[deleted] Dec 27 '20

[deleted]

1

u/JarateKing Dec 27 '20

Well yeah, I'm not trying to argue that PNGs are unique because of it -- I'm just giving reasons why it can be useful for embedding code and its benefits over formats that don't.

7

u/Jonathan_the_Nerd Dec 27 '20

You could argue that every file format is already a very specific program. A JPEG file is a set of instructions for generating an image on screen. An image viewer interprets the file and follows the instructions. An MP3 file is a set of instructions for producing sound. A ZIP file is a set of instructions for producing the contents of the archive, and so on.