So i recently completer recover and it came out that the only problem was with the code that was actually told in the recover walkthrough about the checking of jpeg 4 bytes.The code was:

if(block[0] == 0xff && block[1] == 0xd8 && block[2] == 0xff && (block[3] & 0xf0) == 0xe0 It was told that this code will check whether the first 4 bytes are of jpeg file when we store the 512 bytes in the buffer. My part of the code was:

int* block = malloc(sizeof(char) * 512);

int ret = fread(block, 512, 1, cptr);

//loop till it reaches EOF
while (ret != 0)
    //checking whether is it the starting of a JPEG file
    if(block[0] == 0xff &&
       block[1] == 0xd8 &&
       block[2] == 0xff &&
      (block[3] & 0xf0) == 0xe0)

but it never went into the loop and after debugging i found out that the value of block[0] was 0x0effd8ff instead of 0xff. So i wrote if(block[0] == 0x0effd8ff) and it worked! But i have no idea why it happened and why the value of block[0] was not as they said... Is the walkthrough wrong or my way of doing different?


The problem is with the array/pointer type.

You declared it as int[]/int*, with an int on our system being 32 bit, or 4 bytes long. So all the first four bytes are within that first element.

The walkthrough assumes you use unsigned char instead, maybe under an alias byte, or the equivalent type uint8_t.

Oh, and congratulations on finding little-endian (least significant byte comes first), though the number is slightly wrong (the correct value would require an unsigned int or 64-bit long).

  • I did not understand what do you mean by saying the number is wrong? Which number are you talking about?Please explain – TheGeek Feb 15 '19 at 15:47
  • 0x0effd8ff should be 0xe0ffd8ff, with a bitmask of 0xf0ffffff. – Blauelf Feb 15 '19 at 16:02
  • Sorry but I have no clue what is bitmasking of 0xf0ffffff – TheGeek Feb 15 '19 at 16:07
  • For the fourth byte, any number from 0xe0 to 0xef would be valid (though some are much more common), so a valid header would have to use (block[0] & 0xf0ffffff) == 0xe0ffd8ff. The result of block[0] & 0xf0ffffff will have the same bits as block[0], but zeroes where the bitmask has zeroes, erasing the part of the signature that can be variable. – Blauelf Feb 15 '19 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .