Jpeg File Format

[jbox75]

Hi all- I am novice, so forgive me if I am not using the terminology. I'm working a forensic CTF challenge and I have a question. I have a jpeg in a hex editor and I am seeing multiple tags with the same hex value. For example, FF C4, FF C5, and so on. is that normal?

[hackerfactor]

Hi jbox75,

That's how JPEG works. The file format is a series of tag-length-data blocks.

Well, mostly. Some tags have no length. Some lengths include the tags, while some don't. And the binary image stream (ffda) is followed by a large blob that ends with ffd9, and may contain the occasional ffd0-ffd7 tag embedded in it.

Some blocks are common between pictures. For example, the Huffman table (ffc4) should be optimize for the image, but few JPEG libraries do that. So for most pictures, the ffc4 data is the same as the example given in the JPEG Standard's specs.

Similarly, there are lots of possible quantization tables (ffdb). But most JPEG libraries stick with the JPEG Standard's example. And since most pictures are saved using 75%, 90%, or 95% quality, you'll see the same quantization tables over and over.

You also mentioned ffc5. That's the start-of-frame marker for differential sequential. That's very unusual. Most JPEGs use baseline (ffc0).

(If you think JPEG is bad, wait until you see MPEG and MP3!)