abeluck / stegdetect

UNMAINTAINED. USE AT OWN RISK. Stegdetect is an automated tool for detecting steganographic content in images.

stegdetect

Note: This repo is a code mirror of the original source which is now dead. Here is a working archive of the page.

Stegdetect and Stegbreak have been developed by Niels Provos.

Copyright 2002 Niels Provos [email protected]

This repo is not maintained. Use at your own risk (there are known issues)

---

Stegdetect is an automated tool for detecting steganographic content in images.

This repo has been updated to compile cleanly on Ubuntu since the original project appears to be abandoned and no longer accepts pull requests.

Tested on Ubuntu 16.04 and 18.04 only(17.x likely works though)

Building on 64-bit Systemgs

    $ linux32 ./configure
    $ linux32 make

You can now run stegdetect from the local directory: ./stegdetect

Build for Android

This Android build is sort of fragile, there are many compile warnings.

You must set the environment variable NDK_BASE to the root location of your Android NDK.

    $ make clean
    $ make -f Makefile.android

Usage

Stegdetect does two types of F5 detection, simple and "slow". Simple merely looks for a comment in the header, which any savy coder has removed. This method is enabled with the "-tf" option.

The "slow" F5 detection is enabled with "-tF"

To run detection on a directory of JPEGs use:

    for img in `find /path/to/images/ -iname "*jpg"`; do
        ./stegdetect -tF $img;
    done

Android

    $ adb push stegdetect /data/local/tmp
    $ adb shell
        for img in `ls /sdcard/PixelKnot/*jpg`; do
            /data/local/tmp/stegdetect -tF $img
        done

stegdetect's Issues

Problem with aclocal

i've some problems here,
i never have any experience with building such thing with make before,
when i try to build stegdetect with linux32 (FYI, my system is x64 Ubuntu 14.04)

$ linux32 ./configure
$ linux32 make

Makefile.am: error: Assembler source seen but 'CCAS' is undefined
Makefile.am:   The usual way to define 'CCAS' is to add 'AM_PROG_AS'
Makefile.am:   to 'configure.in' and run 'aclocal' and 'autoconf' again.
Makefile.am: error: Assembler source seen but 'CCASFLAGS' is undefined
Makefile.am:   The usual way to define 'CCASFLAGS' is to add 'AM_PROG_AS'
Makefile.am:   to 'configure.in' and run 'aclocal' and 'autoconf' again.
make: *** [Makefile.in] Error 1

'''
and after looking for some troubleshootings, it says that the aclocal is a part of make or automake
i don't have any idea how to build it,
and also, i've add debian repository to my sources.list
but afer updating my Ubuntu's package database, it still says that stegadetect package is not found, any idea?

bellow is "footprints" of my build session.

linux32 make
cd . && /bin/bash /home/vickydasta/dev/stegdetect/missing automake-1.14 --foreign Makefile
automake-1.14: warning: autoconf input should be named 'configure.ac', not 'configure.in'
configure.in:6: warning: AM_INIT_AUTOMAKE: two- and three-arguments forms are deprecated.  For more info, see:
configure.in:6: http://www.gnu.org/software/automake/manual/automake.html#Modernize-AM_005fINIT_005fAUTOMAKE-invocation
Makefile.am:30: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
automake-1.14: warning: autoconf input should be named 'configure.ac', not 'configure.in'
Makefile.am: error: Assembler source seen but 'CCAS' is undefined
Makefile.am:   The usual way to define 'CCAS' is to add 'AM_PROG_AS'
Makefile.am:   to 'configure.in' and run 'aclocal' and 'autoconf' again.
Makefile.am: error: Assembler source seen but 'CCASFLAGS' is undefined
Makefile.am:   The usual way to define 'CCASFLAGS' is to add 'AM_PROG_AS'
Makefile.am:   to 'configure.in' and run 'aclocal' and 'autoconf' again.
make: *** [Makefile.in] Error 1
vickydasta@vickydasta:~/dev/stegdetect$ aclocal
aclocal: warning: autoconf input should be named 'configure.ac', not 'configure.in'
vickydasta@vickydasta:~/dev/stegdetect$ touch configure.ac && cat congigure.in >> configure.ac
cat: congigure.in: No such file or directory
vickydasta@vickydasta:~/dev/stegdetect$ touch configure.ac && cat configure.in >> configure.ac
vickydasta@vickydasta:~/dev/stegdetect$ aclocal
aclocal: warning: autoconf input should be named 'configure.ac', not 'configure.in'
aclocal: warning: 'configure.ac' and 'configure.in' both present.
aclocal: proceeding with 'configure.ac'
vickydasta@vickydasta:~/dev/stegdetect$ rm configure.in
vickydasta@vickydasta:~/dev/stegdetect$ aclocal
vickydasta@vickydasta:~/dev/stegdetect$ linux32 make
make: *** No rule to make target `configure.in', needed by `Makefile.in'.  Stop.
vickydasta@vickydasta:~/dev/stegdetect$ linux32 ./configure
checking build system type... i686-pc-linux-gnu
checking host system type... i686-pc-linux-gnu
checking target system type... i686-pc-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for g++... g++
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking for style of include used by make... GNU
checking dependency style of g++... none
checking for gcc... gcc
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... none
checking for inline... inline
checking blowfish object... bf_enc.o
checking for gtk-config... no
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for size_t... yes
checking for u_int32_t... yes
checking for u_int16_t... yes
checking for u_int8_t... yes
checking for strlcat... no
checking for strlcpy... no
checking for dirname... yes
checking for working dirname... no
checking for strerror... yes
checking for MD5Update... no
checking for warnx... yes
checking for timeradd in sys/time.h... yes
checking whether byte ordering is bigendian... no
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: WARNING:  'Makefile.in' seems to ignore the --datarootdir setting
config.status: creating config.h
config.status: config.h is unchanged
config.status: executing depfiles commands
=== configuring in jpeg-6b (/home/vickydasta/dev/stegdetect/jpeg-6b)
configure: running /bin/bash ./configure --disable-option-checking '--prefix=/usr/local'  --cache-file=/dev/null --srcdir=.
checking for gcc... gcc
checking whether the C compiler (gcc  ) works... yes
checking whether the C compiler (gcc  ) is a cross-compiler... no
checking whether we are using GNU C... yes
checking how to run the C preprocessor... gcc -E
checking for function prototypes... yes
checking for stddef.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for size_t... yes
checking for type unsigned char... yes
checking for type unsigned short... yes
checking for type void... yes
checking for working const... yes
checking for inline... __inline__
checking for broken incomplete types... ok
checking for short external names... ok
checking to see if char is signed... yes
checking to see if right shift is signed... yes
checking to see if fopen accepts b spec... yes
checking for a BSD compatible install... /usr/bin/install -c
checking for ranlib... ranlib
checking libjpeg version number... 62
creating ./config.status
creating Makefile
creating jconfig.h
jconfig.h is unchanged
=== configuring in file (/home/vickydasta/dev/stegdetect/file)
configure: running /bin/bash ./configure --disable-option-checking '--prefix=/usr/local'  --cache-file=/dev/null --srcdir=.
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for builtin ELF support... NO
checking for ELF core file support... yes
checking for file formats in man section 5... no
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of gcc... none
checking whether ln -s works... yes
checking for ranlib... ranlib
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking whether sys/types.h defines makedev... yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking for unistd.h... (cached) yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking sys/mman.h usability... yes
checking sys/mman.h presence... yes
checking for sys/mman.h... yes
checking for an ANSI C-conforming const... yes
checking for off_t... yes
checking for size_t... yes
checking for struct stat.st_rdev... yes
checking whether struct tm is in sys/time.h or time.h... time.h
checking for tm_zone in struct tm... yes
checking for tzname... yes
checking for tm_isdst in struct tm... yes
checking for daylight... yes
checking for uint8_t... yes
checking for uint16_t... yes
checking for uint32_t... yes
checking for long long... yes
checking for uint64_t... no
checking size of uint8_t... 0
checking size of uint16_t... 0
checking size of uint32_t... 0
checking size of uint64_t... 8
checking for mmap... yes
checking for strerror... yes
checking for strtoul... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating config.h
config.status: config.h is unchanged
config.status: executing depfiles commands
vickydasta@vickydasta:~/dev/stegdetect$ linux32 make
make: *** No rule to make target `configure.in', needed by `Makefile.in'.  Stop

Out-of-bound write

sirius@lambda:~/Desktop/stegdetect-master$ valgrind ./stegdetect -tF ../crashes/id:000001,sig:11,src:000000,op:flip1,pos:297
==91335== Memcheck, a memory error detector
==91335== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==91335== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==91335== Command: ./stegdetect -tF ../crashes/id:000001,sig:11,src:000000,op:flip1,pos:297
==91335==
==91335== Invalid write of size 4
==91335== at 0x40ACF5: f5_compress (f5.c:126)
==91335== by 0x40BE79: detect_f5 (f5.c:505)
==91335== by 0x4067C7: detect (stegdetect.c:1213)
==91335== by 0x402087: main (stegdetect.c:1568)
==91335== Address 0x80 is not stack'd, malloc'd or (recently) free'd
==91335==
==91335==
==91335== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==91335== Access not within mapped region at address 0x80
==91335== at 0x40ACF5: f5_compress (f5.c:126)
==91335== by 0x40BE79: detect_f5 (f5.c:505)
==91335== by 0x4067C7: detect (stegdetect.c:1213)
==91335== by 0x402087: main (stegdetect.c:1568)
==91335== If you believe this happened as a result of a stack
==91335== overflow in your program's main thread (unlikely but
==91335== possible), you can try to increase the size of the
==91335== main thread stack using the --main-stacksize= flag.
==91335== The main thread stack size used in this run was 8388608.
==91335==
==91335== HEAP SUMMARY:
==91335== in use at exit: 143,896 bytes in 79 blocks
==91335== total heap usage: 83 allocs, 4 frees, 150,144 bytes allocated
==91335==
==91335== LEAK SUMMARY:
==91335== definitely lost: 108,664 bytes in 3 blocks
==91335== indirectly lost: 0 bytes in 0 blocks
==91335== possibly lost: 0 bytes in 0 blocks
==91335== still reachable: 35,232 bytes in 76 blocks
==91335== suppressed: 0 bytes in 0 blocks
==91335== Rerun with --leak-check=full to see details of leaked memory
==91335==
==91335== For counts of detected and suppressed errors, rerun with: -v
==91335== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault

the poc

Compiling failed on Debian Jessie

Making all in file
make[2]: Entering directory '/srv/test/steg/file'
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c file.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c apprentice.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c fsmagic.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c softmagic.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c ascmagic.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c compress.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c is_tar.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c readelf.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -DMAGIC='"/usr/local/share/magic"' -g -O2 -c print.c
make[2]: *** No rule to make target 'Magdir/varied.out', needed by 'magic'. Schluss.
make[2]: Leaving directory '/srv/test/steg/file'
Makefile:330: recipe for target 'all-recursive' failed
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory '/srv/test/steg'
Makefile:476: recipe for target 'all-recursive-am' failed
make: *** [all-recursive-am] Error 2

Out-of-bounds Read

sirius@lambda:~/Desktop/stegdetect-master$ valgrind ./stegdetect -tF ../crashes/id:000000,sig:11,src:000000,op:flip1,pos:295
==91225== Memcheck, a memory error detector
==91225== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==91225== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==91225== Command: ./stegdetect -tF ../crashes/id:000000,sig:11,src:000000,op:flip1,pos:295
==91225==
Corrupt JPEG data: bad Huffman code
==91225== Invalid read of size 2
==91225== at 0x40A1DC: dequant_block (jutil.c:117)
==91225== by 0x40AFAC: f5_luminanceimage (f5.c:195)
==91225== by 0x40BE4C: detect_f5 (f5.c:500)
==91225== by 0x4067C7: detect (stegdetect.c:1213)
==91225== by 0x402087: main (stegdetect.c:1568)
==91225== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==91225==
==91225==
==91225== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==91225== Access not within mapped region at address 0x0
==91225== at 0x40A1DC: dequant_block (jutil.c:117)
==91225== by 0x40AFAC: f5_luminanceimage (f5.c:195)
==91225== by 0x40BE4C: detect_f5 (f5.c:500)
==91225== by 0x4067C7: detect (stegdetect.c:1213)
==91225== by 0x402087: main (stegdetect.c:1568)
==91225== If you believe this happened as a result of a stack
==91225== overflow in your program's main thread (unlikely but
==91225== possible), you can try to increase the size of the
==91225== main thread stack using the --main-stacksize= flag.
==91225== The main thread stack size used in this run was 8388608.
==91225==
==91225== HEAP SUMMARY:
==91225== in use at exit: 138,104 bytes in 39 blocks
==91225== total heap usage: 41 allocs, 2 frees, 142,752 bytes allocated
==91225==
==91225== LEAK SUMMARY:
==91225== definitely lost: 108,032 bytes in 2 blocks
==91225== indirectly lost: 0 bytes in 0 blocks
==91225== possibly lost: 0 bytes in 0 blocks
==91225== still reachable: 30,072 bytes in 37 blocks
==91225== suppressed: 0 bytes in 0 blocks
==91225== Rerun with --leak-check=full to see details of leaked memory
==91225==
==91225== For counts of detected and suppressed errors, rerun with: -v
==91225== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault

the poc

Integer divide by zero

sirius@lambda:~/Desktop/stegdetect-master$ valgrind ./stegdetect -tF ../crashes/id:000004,sig:08,src:000000,op:flip4,pos:27
==91481== Memcheck, a memory error detector
==91481== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==91481== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==91481== Command: ./stegdetect -tF ../crashes/id:000004,sig:08,src:000000,op:flip4,pos:27
==91481==
==91481==
==91481== Process terminating with default action of signal 8 (SIGFPE): dumping core
==91481== Integer divide by zero at address 0x802DDAE53
==91481== at 0x4166F8: forward_DCT (in /home/sirius/Desktop/stegdetect-master/stegdetect)
==91481== by 0x41193D: compress_data (in /home/sirius/Desktop/stegdetect-master/stegdetect)
==91481== by 0x4108A6: process_data_simple_main (in /home/sirius/Desktop/stegdetect-master/stegdetect)
==91481== by 0x40D603: jpeg_write_scanlines (in /home/sirius/Desktop/stegdetect-master/stegdetect)
==91481== by 0x40AD47: f5_compress (f5.c:136)
==91481== by 0x40BE79: detect_f5 (f5.c:505)
==91481== by 0x4067C7: detect (stegdetect.c:1213)
==91481== by 0x402087: main (stegdetect.c:1568)
==91481==
==91481== HEAP SUMMARY:
==91481== in use at exit: 165,584 bytes in 83 blocks
==91481== total heap usage: 87 allocs, 4 frees, 171,832 bytes allocated
==91481==
==91481== LEAK SUMMARY:
==91481== definitely lost: 108,032 bytes in 2 blocks
==91481== indirectly lost: 0 bytes in 0 blocks
==91481== possibly lost: 0 bytes in 0 blocks
==91481== still reachable: 57,552 bytes in 81 blocks
==91481== suppressed: 0 bytes in 0 blocks
==91481== Rerun with --leak-check=full to see details of leaked memory
==91481==
==91481== For counts of detected and suppressed errors, rerun with: -v
==91481== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Floating point exception

the poc

unable to build on ubuntu14.04

while making
"make[2]: *** No rule to make target Magdir/varied.out', needed bymagic'. Stop."
what happened?

about f5 check

When I used this tool for steganographic testing, I found that there are two cases of f5 detection.
./img/test.jpg : f5[1.5974](***)
./img/test2.jpg : f5(***)
What is the difference between these two situations?
What does the number in [] mean?

Thanks～

URL down

Timeout on http://www.outguess.org/detection.php

Unable to build on mint 17

linux32 ./configure

works just fine, but

linux32 make
cd .
&& CONFIG_FILES= CONFIG_HEADERS=config.h
/bin/sh ./config.status
config.status: creating config.h
config.status: config.h is unchanged
/bin/sh: 1: Syntax error: ")" unexpected (expecting "then")
make: *** [)].in]

What is the source of problem? Am I missing some dependency?

Tried compiling in both ubuntu 16.04 and arch and failed with the same error

from linux32 make I get:

cd . && /home/lontra/repos/stegdetect/missing aclocal-1.4
WARNING: `aclocal-1.4' is needed, and you do not seem to have it handy on your
         system.  You might have modified some files without having the
         proper tools for further handling them.  Check the `README' file,
         it often tells you about the needed prerequirements for installing
         this package.  You may also peek at any GNU archive site, in case
         some other package would contain this missing `aclocal-1.4' program.
Makefile:183 : la recette pour la cible « aclocal.m4 » a échouée
make: *** [aclocal.m4] Erreur 1

I have the automake package installed

Tried this fix I found:

That's GitHub screwing with the timestamps. This link helped
hyperrealm/libconfig#22

The following should work :
make AUTOCONF=: AUTOHEADER=: AUTOMAKE=: ACLOCAL=:
make install AUTOCONF=: AUTOHEADER=: AUTOMAKE=: ACLOCAL=:

I used the linux32 prefix and from linux32 make AUTOCONF=: AUTOHEADER=: AUTOMAKE=: ACLOCAL=:

I got this

gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c apprentice.c
gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c fsmagic.c
fsmagic.c: In function ‘fsmagic’:
fsmagic.c:211:5: warning: implicit declaration of function ‘process’ [-Wimplicit-function-declaration]
     process(buf, strlen(buf));
     ^
gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c softmagic.c
gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c ascmagic.c
gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c compress.c
compress.c: In function ‘uncompress’:
compress.c:148:3: warning: ignoring return value of ‘dup’, declared with attribute warn_unused_result [-Wunused-result]
   (void) dup(fdin[0]);
   ^
compress.c:153:3: warning: ignoring return value of ‘dup’, declared with attribute warn_unused_result [-Wunused-result]
   (void) dup(fdout[1]);
   ^
gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c is_tar.c
gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c readelf.c
gcc -DHAVE_CONFIG_H -I. -I. -I.   -DMAGIC='"/usr/local/share/magic"'  -g -O2 -c print.c
make[2]: ***  Aucune règle pour fabriquer la cible « Magdir/varied.out », nécessaire pour « magic ». Arrêt.
make[2] : on quitte le répertoire « /home/lontra/repos/stegdetect/file »
Makefile:330 : la recette pour la cible « all-recursive » a échouée
make[1]: *** [all-recursive] Erreur 1
make[1] : on quitte le répertoire « /home/lontra/repos/stegdetect »
Makefile:476 : la recette pour la cible « all-recursive-am » a échouée
make: *** [all-recursive-am] Erreur 2