How to read this obfuscated QR code?
XOR
>>1501778what does this mean?
Got to this, decodes to:Z0FBQUFBQm5SMEc1TWhSWllvX0VkMkZFcFlwXzd4SjJILUJIaDQ1LXZSeFpETzhnVmZRLXE0dWlRbGp0NHNiSXMzcjZhRGc5VkxUZ0VkRWRJejNxV2dYZkdHdlFtMmNuQ21aNTBsbVNVTGJmcExCaWlDNldQeW9GWXVIUlozaFB4X3F5Yjk5dS1vV2NRSy11LWl1RkM3cEp1cHltb1N1Y3RBPT0=dunno what to do next
>>1501808Forgot pic
>>1501808Looks like Base64? decoded:gAAAAABnR0G5MhRZYo_Ed2FEpYp_7xJ2H-BHh45-vRxZDO8gVfQ-q4uiQljt4sbIs3r6aDg9VLTgEdEdIz3qWgXfGGvQm2cnCmZ50lmSULbfpLBiiC6WPyoFYuHRZ3hPx_qyb99u-oWcQK-u-iuFC7pJupymoSuctA==
>>1501773Any indication of where you got it from? Any keywords? Metadata? The resulting base64 only translates into more gibberish, meaning we're missing an alphabet or something here.
>>1501810How'd you do it?
>>1501987The red, green, blue and alpha color channels hide obfuscated (through noise) pieces of the QR code. Using the photoshop " " tool, you can adjust the slider and reduce the image to pure black and white. Do that for all four channels and piece them together and you get this. Curiously, the colors are inverted though, but that doesn't stop a QR scanner from reading it right.
>>1502311Meant to say "threshold" tool
>>1502311Thanks. I was on the right track but well I only have Gimp. T_T
>>1501820This could be base64url, replacing - with + and _ with / would convert it to standard base64.Decoding it returns some binary data I don't understand.
>>1502369Post binary?
>>150251400000000: 8000 0000 0067 4741 b932 1459 628f c477 .....gGA.2.Yb..w00000010: 6144 a58a 7fef 1276 1fe0 4787 8e7e bd1c aD.....v..G..~..00000020: 590c ef20 55f4 3eab 8ba2 4258 ede2 c6c8 Y.. U.>...BX....00000030: b37a fa68 383d 54b4 e011 d11d 233d ea5a .z.h8=T.....#=.Z00000040: 05df 186b d09b 6727 0a66 79d2 5992 50b6 ...k..g'.fy.Y.P.00000050: dfa4 b062 882e 963f 2a05 62e1 d167 784f ...b...?*.b..gxO00000060: c7fa b26f df6e fa85 9c40 afae fa2b 850b ...o.n...@...+..00000070: ba49 ba9c a6a1 2b9c b4 .I....+..It's clearer in a monospaced font.You can also decode the base64 yourself gAAAAABnR0G5MhRZYo/Ed2FEpYp/7xJ2H+BHh45+vRxZDO8gVfQ+q4uiQljt4sbIs3r6aDg9VLTgEdEdIz3qWgXfGGvQm2cnCmZ50lmSULbfpLBiiC6WPyoFYuHRZ3hPx/qyb99u+oWcQK+u+iuFC7pJupymoSuctA==
The raw binary might be clearer.10000000 00000000 00000000 00000000 00000000 0110011101000111 01000001 10111001 00110010 00010100 0101100101100010 10001111 11000100 01110111 01100001 0100010010100101 10001010 01111111 11101111 00010010 0111011000011111 11100000 01000111 10000111 10001110 0111111010111101 00011100 01011001 00001100 11101111 0010000001010101 11110100 00111110 10101011 10001011 1010001001000010 01011000 11101101 11100010 11000110 1100100010110011 01111010 11111010 01101000 00111000 0011110101010100 10110100 11100000 00010001 11010001 0001110100100011 00111101 11101010 01011010 00000101 1101111100011000 01101011 11010000 10011011 01100111 0010011100001010 01100110 01111001 11010010 01011001 1001001001010000 10110110 11011111 10100100 10110000 0110001010001000 00101110 10010110 00111111 00101010 0000010101100010 11100001 11010001 01100111 01111000 0100111111000111 11111010 10110010 01101111 11011111 0110111011111010 10000101 10011100 01000000 10101111 1010111011111010 00101011 10000101 00001011 10111010 0100100110111010 10011100 10100110 10100001 00101011 1001110010110100
>>1501773I decoded the QR code to Base91 and got a OpenPGP Secret Key:00 bd d0 2f cb af c1 60 44 11 8d f5 77 05 26 54 6110 b5 3d 34 be 02 18 67 3d bf 4d 32 80 65 bd 56 df20 a8 bb 0d bd af e7 93 a6 a1 d9 95 2c a8 8b bb e230 ac 6a 64 13 46 b4 ed 52 7c 76 3d e4 a5 53 36 7b40 9a 0d c4 c9 b9 58 41 15 be 70 d1 b5 11 a6 f9 db50 bd d1 ed b7 b6 6b b1 e9 99 b0 eb d6 bc ec f0 e560 29 3c 15 60 46 41 f2 87 03 7f b3 44 57 8b f0 ba70 ac af 12 48 7d ae 2c 37 42 c9 c6 8f a2 54 8c fb80 b6 a5 48 3e 42 3b a8 03 73 4b 2b 94 11 c2 f5 e590 2a 6c e9 b8 08 0a 1e 9c 03 2b 25 6c 05 0f 70 29a0 26 cf cf 46 86 92 49 49 98 85 63 5e 75 03 27 4d
>>1502665...how could you tell that was an OpenPGP Secret Key
>>1502348You can also do it on Gimp, retard.
>>1502698Didn't say it was impossible, friend. It was simple in Paint.NET though. Cheers.
>>1502676Apologies, that is the wrong hexdump!00 95 12 0c b0 1c 30 20 d9 3e 0d 5e 98 97 e5 e7 d010 f4 34 6d 38 29 c3 19 36 03 0f e3 a1 26 e2 c8 0220 3a c8 c2 c5 c9 09 17 2b e1 5c e2 a0 3f 53 1e 2a30 03 8d f4 6f 97 8d c4 e0 20 40 f9 7e 60 4c 8f 2840 95 8a 62 84 fd a0 16 d9 c8 a8 d7 8c f8 a2 e1 ac50 e9 54 ca 70 36 7e 88 c6 23 c3 8b 47 b3 14 95 3360 4d 41 d4 08 a0 63 3b 83 42 73 2e 39 9b d2 27 7970 08 4f 8d 58 6c 88 e1 1c b0 1f 9b 40 d3 9a 0b fc80 f9 12 43 a8 5d ec b4 24 19 1e d2 27 e9 44 a2 8990 ec 8c 0e 1a 75 78 34 31 0c 76 64 98 dd 87 5f 76a0 b3 cc 89 18 00 66 a6 20 81 f2 92 5c 96 4e 36 00b0 6d 26
>>1502665>>1502875I think that OpenPGP is invalid. See https://datatracker.ietf.org/doc/html/rfc9580#name-packet-syntaxThe first byte, 0x95 or 10010101, should be an packet header. The second bit is zero, meaning the header is in the legacy format. In the legacy format, the last two bits specify the length-type. Here they are 01, which means the next two bytes specify the length of the packet. The next two bytes are 00010010 00001100, which (in big-endian) is 4620 in decimal, but the file is only 178 bytes, so the packet is incomplete.Did you find out it was a OpenPGP key from file(1)? My version of file(1) identifies a file containing only 0x9500 as an "OpenPGP Secret Key", so I think the 0x95 at the beginning of the file is creating a false positive. See https://github.com/file/file/blob/master/magic/Magdir/pgp-binary-keysWhy do you think it's base91 at all? The equal sign at the end but nowhere else seems like padding, and base91 doesn't use equal signs for padding.
>>1502906Yeah, I'm dismayed all it took was 0x94** to have file label it as such.I chose Base91 because its encoding table includes all the characters in the decoded QR code.
>>1503030Base64 also includes all the characters in the decoded QR code, and uses equal signs for padding.There are 27 characters used in Base91 that Base64 doesn't use, and none of them are in the decoded QR code.
NERDS
>>1502663121 bytes is a weird size
I've been using georgeom_net-StegOnline-image (replace _ with . and - with /) to get the alpha channel, but the website could be useful for other things. One thing I noticed when threshold'ing the channels, is that the red channel is the only one with a noticeable amount of noise. The least noisy I could make it is picrel, and for my previous post I had to color it in. This could maybe mean that plaintext or other interesting information could be hidden in the file hex.
>>1503617When I click Show RGBA Values, they're all either zero or 255, so I think it's a quirk of the program and there's not actually noise in the red channel.
>>1504143>Preview contains up to 10000 values. Download to view full data.There are definitely non-0/255 values past that point.The noise is also visible in other programs, not just on the red channel, but on the green and blue as well.Only the alpha channel is clean.It looks like JPEG compression artifacts to me, which is odd because JPEG does not support alpha channels.Maybe re-saving the RGB channels using a program that can losslessly recompress JPEG DCT blocks could yield something.
>>1504155I don't think the alpha channel is clean (unless I did something wrong), but it's a lot cleaner than the other channels. The alpha channel is mostly ff, but some bytes are d9.
>>1504171Clean, as in free of noise.It's all ff, d9 and nothing else.But yeah, it does need to be leveled to (217, 255) to get pure ff and 00.Unlike the other channels, it doesn't need to be inverted.
The bytes in the blue channel are multimodal with peaks at 00 and e0. The green channel has peaks at 00, 78, and e0. The red channel has peaks at 00, 3d, 78, and e0.
>>1504427It's just crosstalk from the other channels (except alpha).The first three quadrants aren't purely red, green and blue.The person who made the image used alpha blending rather than properly merging the channels.Picrel is what it should have looked like.
>>1504433I also managed to recreate the original image by alpha-blending the red, blue and green quadrants at 50% and adjusting the levels.
>>1504434What about the alpha channel lines? Do these have any significance? They go, every 18px, starting from the white parts:0,0,0,1,0,0,0,1,0,1,1,0,0,0,0,1,1,1,1,1,0,0,0,0
>>1504452It's just part of the green quadrant above it.The cut was off by one pixel.
>>1502663These bytes are mostly uniform, except there aren't many values from 0 to 10 or from 244 to 255. There are four 0s all at the beginning, and four 250s mostly spread out.
It would help to know where the PNG came from. A CTF? Geocache puzzle?? 1337 h4xx0r test???
it's weird that op hasn't said anything
>>1501808I googled Z0FBQUFBQ and found this is some patreon media urlhttps://www.patreon.com/media-u/Z0FBQUFBQm5SMEc1TWhSWllvX0VkMkZFcFlwXzd4SjJILUJIaDQ1LXZSeFpETzhnVmZRLXE0dWlRbGp0NHNiSXMzcjZhRGc5VkxUZ0VkRWRJejNxV2dYZkdHdlFtMmNuQ21aNTBsbVNVTGJmcExCaWlDNldQeW9GWXVIUlozaFB4X3F5Yjk5dS1vV2NRSy11LWl1RkM3cEp1cHltb1N1Y3RBPT0=
>>1505132https://kemono.su/patreon/user/13788548/post/116649648https://www.youtube.com/watch?v=gqaw2hzDNSc
>>1505132Bravo!
>>1505132The url goes to the same image when I replace the last 0 with a 1.
>>1505132good job, but also wtf?
>>1505132This seems too random to be the solution, I mean it could have been any other website with a url like that. And it's not even relevant to the original QR. You think maybe OP stripped the metadata or something? Something's doesn't fit here...>>15055382 and 3 also work
>>1505644I googled "https://www.patreon.com/media-u/" and all the urls started with Z0FBQUFBQm5 and ended with 0=. Changing the last 0 to a 1, 2, or 3 worked for them too.Changing the equals sign also works for most characters (I tested letters, numbers, -, _, and +) but not for some (the * and brackets don't work).
