ScanJpeg

Extracts data appended to JPEG files.

This scanner extracts data that is inserted past the JFIF EOI marker.

Source code in strelka/src/python/strelka/scanners/scan_jpeg.py

class ScanJpeg(strelka.Scanner):
    """Extracts data appended to JPEG files.

    This scanner extracts data that is inserted past the JFIF EOI marker.
    """

    def scan(self, data, file, options, expire_at):
        try:
            offset = 0

            # Skip check for length with these markers
            markers_zero_length = [
                b"\xff\xd0",
                b"\xff\xd1",
                b"\xff\xd2",
                b"\xff\xd3",
                b"\xff\xd4",
                b"\xff\xd5",
                b"\xff\xd6",
                b"\xff\xd7",
                b"\xff\xd8",
                b"\xff\x01",
            ]

            # Image must start with SOI
            try:
                if not data[offset:].startswith(b"\xff\xd8"):
                    self.flags.append("corrupt_jpeg_data_no_soi")
                    return
            except IndexError:
                self.flags.append("Error accessing data[offset:]")
                return

            # Skip SOI
            offset += 2
            while True:
                marker = data[offset : offset + 2]

                # Marker must start with 0xff
                if marker[0] != 0xFF:
                    self.flags.append("corrupt_jpeg_data_misaligned_marker")
                    break

                if marker in markers_zero_length:
                    offset += 2
                    continue
                # Start scan data (SOS)
                elif marker == b"\xff\xda":
                    offset += 2
                    while True:
                        # Fast forward until we find a marker that's not FF00
                        if data[offset] == 0xFF and data[offset + 1] != 0x00:
                            break
                        offset += 1
                    continue
                # EOI marker
                elif marker == b"\xff\xd9":
                    offset += 2
                    break
                else:
                    marker_length = struct.unpack(">H", data[offset + 2 : offset + 4])[
                        0
                    ]
                    offset += 2
                    offset += marker_length

            # If the end of the image is reached with no more data, return
            if offset >= len(data):
                self.flags.append("no_trailer")
                return

            if trailer_data := data[offset:]:
                self.event["trailer_index"] = offset

                # Send extracted file back to Strelka
                self.emit_file(trailer_data)
        except Exception:
            self.flags.append("jpeg_general_parsing_error")
            return

Features

The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.

Feature	Support
IOC Support
Emit Files
Extended Docs
Malware Scanner
Image Thumbnails

Tastes

Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.

Source Filetype	Include / Exclude
ScanTranscode
image/jpeg
jpeg_file

Scanner Fields

This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.

Field Name	Field Type
elapsed	str
flags	list
trailer_index	int

Sample Event

Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.

    test_scan_event = {"elapsed": 0.001, "flags": ["no_trailer"]}