How to hide RAR files inside images?

A quick look on how files may hide others and how to create a C program for finding them

Changes

It is possible to hide some RAR files inside images. These file can also in turn contain other files. Be careful next time: a JPEG file can contain more than a single image. On this tutorial, we will see how to find images containing RAR files inside them and how to create such files.

What I need

  • A .rar file containing contents to hide
  • A .jpeg file with any image
  • An application to uncompress .rar files
  • Basic command line knowledge (Windows or Linux)

Hiding files inside a JPEG file

For Windows:

  • Open the console (Start menu > Execute > cmd)
  • Go to the folder where your files are (cd c:\path\to\the\folder)
  • Run the following command
copy /b image.jpg + secret.rar newimage.jpg

For Linux:

  • Open Bash or equivalent
  • Go to the folder where your files are (cd /path/to/the/folder)
  • Run the following command
cat image.jpg secret.rar > newimage.jpg

In either case, you should see a "newimage.jpg" file, which contains the image with the hidden RAR file. The trick here is simple: we're appending the RAR contents to the end of the image file.

Accessing the hidden files

When oppening the file in an image viewer, it should be displayed correctly. However, to access the archive files, you should use WinRAR. The contents should be displayed in the application.

The choose of RAR and JPEG formats is not random: the JPEG file contains an header on the start of the file telling how many bytes the image contains. This allows to display the image in image viewers and ignore the contents after it. On the other hand, the WinRAR is smart enough to ignore the start of the file (containing an image) and display successfully the contents of the RAR file. In fact, WinRAR looks for "Rar!" sequence in the image file, knowing that from that point onwards is the data corresponding to the archive.

Archive extractor from images

As a contribution, where goes a small C application I created to detect and extract RAR files inside an image. It searches for the "Rar!" sequence inside the file and extracts the archive to the same directory:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char** argv)
{
    if (argc != 2) {
        printf("Usage: %s filename.jpg\n", *argv);
        return EXIT_FAILURE;
    }

    FILE* jpeg = fopen(*++argv, "r");
    if (jpeg == NULL) {
        perror("Cannot open file");
        return EXIT_FAILURE;
    }

    // looking for Rar!
    int seq[] = {
        0x52 , 0x61 , 0x72 , 0x21 , 0x1A , 0x07 , 0x00
    };
    int seqSize = 7;
    int seqPos = 0;
    int fpos = 0;
    int found = 0;
    int c;

    while ((c = fgetc(jpeg) ) != EOF) {
        fpos++;

        if (c == seq[seqPos])
            seqPos++;
        else
            seqPos = 0;

        if (seqPos >= seqSize) {
            found = 1;
            fpos -= seqPos;
            break;
        }
    }

    if (found == 0) {
        printf("Nothing found...\n");

    } else {
        printf("Found Rar! at %X\nExtracting... ", fpos);
        char rarname[255];
        strcpy(rarname, *argv);
        strcat(rarname, ".rar");
        FILE* rar = fopen(rarname, "w");

        if (rar == NULL) {
            perror("Unable to extract file");
            fclose(jpeg);
            return EXIT_FAILURE;
        }

        fseek(jpeg, fpos, 0);

        int c;
        while ((c = fgetc(jpeg)) != EOF)
            fputc(c, rar);

        fclose(rar);
        printf("Done!\n");
    }

    fclose(jpeg);

    return EXIT_SUCCESS;
}

First, you need to compile the application with GCC:

gcc fatjpeg.c -o fatjpeg

And then you can use it:

./fatjpeg newimage.jpg

Is the RAR file is inside the image, it will be extracted with the same name of the image, followed by the .rar extension.

Article revisions

Explanation about why RAR and JPEG formats are being used