Normally, if you change a file’s extension in Windows, it doesn’t do anything positive. It just makes the file open in the wrong programs that can’t decode what’s inside. However, [PortalRunner] has crafted a file that can behave as six different filetypes, simply by swapping out the extension at the end of the filename.
The basic concept is simple enough. [PortalRunner] simply found a bunch of different file formats that could feasibly be crammed in together into a single file without corrupting each other or confusing software that loads these files.
It all comes down to how file formats work. File extensions are mostly meaningless to the content of a file—they’re just a shorthand guide so an operating system can figure out which program should load them. In fact, most files have headers inside that indicate to software what they are and how their content is formatted. For this reason, you can often rename a .PNG file to .JPEG and it will still load—because the operating system will still fire up an image viewer app, and that app will use headers to understand that it’s actually a PNG and not a JPEG at heart, and process it in the proper way.
[PortalRunner] found a way to merge the headers of various formats, creating a file that could be many different types. The single file contains data for a PNG image, an MP4 video, a PDF document, a ZIP archive, a Powerpoint presentation, and an HTML webpage. The data chunks for each format are lumped into one big file, with the combined headers at the very top. The hijinx required to pull this off put some limitations on what the file can contain, and the files won’t work with all software… but it’s still one file that has six formats inside.
This doesn’t work for every format. You can’t really combine GIF or PNG for example, as each format requires a different initial set of characters that have to be at the very beginning of the file. Other formats aren’t so persnickety, though, and you can combine their headers in a way that mostly works if you do it just right.
If you love diving into the binary specifics of how file formats work, this is a great project to dive into. We’ve seen similarly mind-bending antics from [PortalRunner] before, like when they turned Portal 2 into a webserver. Video after the break.
Ange Albertini has a long series of articles on making polyglot files in PoC||GTFO – https://github.com/angea/pocorgtfo is his mirror of the issues but there are plenty of others.
Really interesting watch, enjoyed it!
Even though there is no use case for this (afaik?), nice hack.
The question arises if it would be possible to make one file that combines support for Windows computers and Macs. Kind of like the multi-platform disks in the 80s that would work on Atari 8-bit and C64 computers. That would be the only feasible use for something like this, IMO: cross compatibility for two or more computer formats with only one file to download.
If pictures and documents could be hidden in a movie file… yeah, I like this
Hidden or mutually intelligible?
There is Steganography. Also many media formats support “comment” or arbitrary data chunks. MKV for example even supports attachments
I was thinking that you could hide a doc/spreadsheet in a video file, so that if you open the file with the defauly program then you see the video. If you were to rename the file from film.mpg to film.pdf then a reader would open it.
Oh yeah this would be COOL.
Sounds like a good way to hide a macro inside of a file that pulls up malicious data through the web link.
Hey G-man (nice name though; is it s pun for G-?). If you are talking about hiding text (later implement for anything which can be converted to bits – that’s anything and everything digital) checkout https://github.com/kalikaruto/steganography
For now it hides text messages into jpeg only. Hope you will like it.
This sounds really familiar. I believe something similar was contrived for the “multimedia” craze of the 90’s. Images, video, audio, HTML and text all crammed into one file.
Of course, they figured out that things load faster when each element gets done in its own time. They also learned, way back when, that the ability to edit a forum post is a GOOD thing! Come on, it’s the future, people!
Interesting article, not let’s please not start calling programs “apps” here.
Applications are Macintosh programs because Apple didn’t want to use standard terminology, and doubled down on that with the “app” nomenclature when the iphone came out because they thought they were clever. We’re talking about Windows here, so it’s a program.
And yes, one of my biggest annoyance with Windows is how it now calls everything an “app.” Very tone-deaf way to market to Apple users.
Indeed. I would even take it down another level and call it a “process”. But you are correct. “Newspeak”!
A process is a running program, so they’re not really the same thing.
I too find it grating to hear desktop computer programs referred to as apps – to me “app” has come to imply a program for a smartphone or a similar locked down and sandboxed environment, and Apple is surely responsible for the term’s popularity. But taken literally as an abbreviation for “application”, I’d have to say that the programs mentioned are, indeed, applications…
Apple may have preferred to use the term, and of course popularized the shorthand, but they didn’t invent it.
The usage of “application program” and subsequently “application” to refer to end-user facing programs predates Apple by at least a few decades.
I don’t remember “app” until the 90’s, but to start with I mostly remember it used in the context of everyone wanting a “killer app”. That didn’t mean they were developing it for Macintosh.
Who. The. Hell. Cares? Such a stupid hill to die on.
Precisely.
Mac-Bashers need’a get a life.
Your whinge is definitively boring, and nobody cares.
I disagree with this assertion.
“App” is short for Application Program, a widely familiar term to anyone who used an AT, XT, or similar box in its day.
The first Application Programs I was taught were WordStar 4, followed by DBase III+ and Lotus 123
Application Program was the common term-in-use on both platforms, to be clear.
Microsoft chose to shorten it to “program”, Apple later decided to use the diminutive “app”
Windows calling some programs “apps” is not “a tone-def way to market to Apple users”. That’s nonsense. It’s simply the terminology employed by most of their customer base. Instead of dictating what their customers should be calling things, Microsoft is just going along with their customers.
Like “mac+cheese”.
I worked on a game called Portal Runner for the PlayStation 2 around 2000. It was so bad that I had my name taken off it.
So it’s surprising to see anybody would choose that as a handle…
Thanks for that, even if you don’t want to be associated with it me and my brothers played it a lot. Piercing arrows cost us at least one controller that I can remember.
I would absolutely agree with you that it was bad though
Different Portal. PortalRunner’s Youtube channel is full of Valve Portal gameplay videos.
What? No Lord of the Rings joke?
One format to rule them all,
One format to find them.
One format to bring them all,
And in the darkness bind them.
Speaking of darkness, I wonder how antivirus heuristics would handle this. All sorts of nefarious uses are possible if such a file can pass through without triggering alerts.
Exactly where my brain went too.
Great, leaving lots of options open for hackers
Cool, good video. I was playing around with this a while back, and got 8 (sort of 9) different files. They all seem to work OK on Windows. Polyglot image is also tweetable.
.PNG
.PDF (use with Web browsers).
.MP3 (use VLC or Windows legacy player.)
.RAR (use WinRar)
.HTML
.ZIP (Use Windows Explorer)
.JAR (script will open windows Calculator. )
.PS1 (*PowerShell script extracts and plays an MP4 video file embedded in the image. Use command: powershell.exe -ExecutionPolicy Bypass -File .\image.ps1).
When you learn DOCX and XLSX files are actually ZIPs containing multiple files.
I checked how it would function on Linux and here are the results:
mimetype detection: application/pdf
qpdfview: Can view it as a PDF!
Xarchiver: Not recognized as an archive. :(
unzip: Will extract it!
LibreOffice: Could not open it. :(
Firefox: Can kinda view it (shows garbage text and a picture!) when the extension is forced to .html but it’s a huge file and parses slooowly.
Might serve musicians/producers. Sheet music/lead sheet. Phonogram/video. Metadata/lyrics/splits.
That so many sites use the wrong extensions really annoys me, they put up .webp files and call them .jpg or put up .mp4’s and call them .gif et cetera.
And sometimes you think “they updated their format but were too damn lazy to change the HTML”, but yet other times it seems that can’t be the case and they do it seemingly to be annoying..
And if the public then start to talk about gif files meaning mp4 it gets REALLY annoying, and it shows why you should not use the wrong extension, because you see: people gravitate towards stupid.
And here I was assuming it was going to be all the secretly-a-zip formats. Like a Jar that’s also an epub and an android apk.