DEV Community

Cover image for I Made a File That's Also Another File (And Your Mind is About to Break) 🤯
Rolan Lobo
Rolan Lobo

Posted on

I Made a File That's Also Another File (And Your Mind is About to Break) 🤯

#webdev #tutorial #security #opensource

Remember when you were a kid and thought spies were the coolest thing ever? Yeah, me too. Fast forward to present day, and here I am, living my best spy-movie-developer life by building polyglot files into my steganography app.

Wait... Poly-what? 🤔

A polyglot file is basically the Inception of file formats. It's a file that works as two completely different formats at the same time. Like, imagine having a JPG image that you can open normally in any image viewer, BUT if you rename it to .zip and extract it, BAM! There's a secret PDF hidden inside.

Leo DiCaprio would be proud.

"That's Impossible," You Say

That's what I thought too! But then I learned about a beautiful quirk in how ZIP files work:

ZIP files are read from the END, not the beginning.

Let that sink in for a second.

This means you can literally prepend ANY data to the front of a ZIP file, and ZIP programs will happily ignore it and just read the ZIP structure at the end. It's like having a secret trap door in your file format.

The "Aha!" Moment 💡

So here's the genius (if I may say so myself):

  1. Take any carrier file (JPG, PNG, PDF, MP4, literally ANYTHING)
  2. Take the file you want to hide
  3. Create a ZIP containing the hidden file
  4. Concatenate them together: carrier_data + zip_data
  5. Fix the ZIP offsets to account for the prepended carrier data
  6. Profit??? (Actually yes, profit in terms of cool factor!)

The result? A file that:

  • ✅ Opens normally as the carrier format (your image viewer shows the image)
  • ✅ Can be extracted as a ZIP (your hidden file is inside)
  • ✅ Looks completely innocent
  • ✅ Will make your friends question reality

Show Me the Code! 💻

Here's the core magic (simplified Python version):

def create_polyglot(carrier_path, file_to_hide_path, output_path, password=None):
    # Read the carrier file
    with open(carrier_path, 'rb') as f:
        carrier_data = f.read()
    carrier_size = len(carrier_data)

    # Create a ZIP with the hidden file
    with zipfile.ZipFile(temp_zip, 'w', zipfile.ZIP_DEFLATED) as zf:
        zf.write(file_to_hide_path, filename)

    with open(temp_zip, 'rb') as f:
        zip_data = f.read()

    # Combine them! 🎉
    with open(output_path, 'wb') as f:
        f.write(carrier_data)  # Carrier first
        f.write(zip_data)      # ZIP second

    # Fix ZIP offsets (this is the tricky part!)
    fix_zip_offsets(output_path, carrier_size)
Enter fullscreen mode Exit fullscreen mode

The fix_zip_offsets function is where the real magic happens. ZIP files have a "central directory" that stores offsets pointing to where each file is located. Since we prepended carrier data, we need to add carrier_size to all these offsets. It's like updating a map when you've moved all the landmarks.

Real-World Use Cases 🌎

"But when would I actually use this?" you ask.

  1. Digital Dead Drops: Share files publicly without anyone knowing there's anything hidden
  2. Backup Paranoia: Hide your important documents inside family photos
  3. Easter Eggs: Ship an app with hidden goodies for curious users
  4. Security Research: Understanding file formats and bypass techniques
  5. Because You Can: Sometimes that's reason enough!

The Fun Part: It Works with EVERYTHING

The beauty of this approach is it's truly universal:

  • Hide a PDF inside a JPG? ✅
  • Hide a video inside a PNG? ✅
  • Hide a ZIP inside a PDF? ✅ (yo dawg...)
  • Hide an executable inside an MP3? ✅ (please don't use this for evil)
  • Hide your feelings inside memes? ✅ (okay maybe not that one)

Adding Some Spice: Password Protection 🔐

Because regular hiding isn't paranoid enough, I added AES-256 encryption using pyzipper. Now your hidden files are:

  1. Invisible (hidden in another file)
  2. Encrypted (AES-256, military-grade baby!)
  3. Password-protected (good luck, hackers)

It's like putting a safe inside a hidden room behind a bookshelf. Security inception.

The Technical Gotchas 😅

Building this wasn't all sunshine and rainbows. Here are some fun challenges:

Challenge 1: ZIP Offsets Are Evil

The ZIP format stores byte offsets for everything. Add carrier data, and suddenly all your offsets are wrong. Solution? Binary file surgery! I read through the ZIP spec at 2 AM and manually fixed the central directory offsets. Coffee was consumed.

Challenge 2: Different Encryption Standards

Standard ZIP encryption is... not great (it's from the 90s and shows its age). So I used pyzipper for proper AES encryption, but kept backward compatibility with standard ZIPs. Supporting both was like being bilingual but for compression formats.

Challenge 3: File Format Validation

Some programs are VERY picky about file formats. Turns out if you append data to a PNG, some viewers get confused. The trick? Append to formats that are more lenient, or use formats that explicitly allow trailing data (like JPG).

Try It Yourself! 🚀

I built this into InvisioVault - my steganography and polyglot file creation tool. It's got:

  • 🎨 A slick React frontend
  • ⚡ Flask backend doing the heavy lifting
  • 🌙 Dark mode (because I'm not a monster)
  • 🔒 Password protection
  • 🚀 Zero configuration needed

Try the live demo: https://invisio-vault.vercel.app/ 🌐

Check it out on GitHub: InvisioVault

Or just try it yourself with this quick Python snippet:

# The lazy person's polyglot (no offset fixing, may not work with all ZIP readers)
with open('cat.jpg', 'rb') as carrier:
    carrier_data = carrier.read()

with open('secret.zip', 'rb') as secret:
    secret_data = secret.read()

with open('cat_with_secret.jpg', 'wb') as output:
    output.write(carrier_data)
    output.write(secret_data)

# Now 'cat_with_secret.jpg' is both an image AND a ZIP!
Enter fullscreen mode Exit fullscreen mode

The Developer Journey 🎢

Fun fact: InvisioVault was my first ever project. I had NO IDEA what I was doing. Looking back at the original code is like watching a horror movie where you yell "DON'T GO IN THERE!" but the protagonist (me) does it anyway.

After actually learning to code properly, I came back and refactored everything. Separated frontend and backend. Added proper error handling. Made it not crash every 5 minutes. Added this polyglot feature because one way to hide files apparently wasn't enough for my overachieving self.

What I Learned 📚

  1. File formats are weird: Every format has its quirks. Embrace them!
  2. Read the spec: The ZIP specification is surprisingly readable (after the 10th cup of coffee)
  3. Binary data is scary: Until it's not. Then it's just bytes being bytes.
  4. Users will break your app in ways you never imagined: And that's okay!
  5. Documentation is love: Future-you will thank present-you.

The Philosophy 🧘

At its core, this project taught me that technology should be fun. Sure, polyglot files have serious security research applications, but they're also just cool. Sometimes the best reason to build something is "because it's awesome."

Also, it's a great reminder that:

  • File formats are social constructs
  • Specifications are suggestions (please don't quote me on that)
  • With enough determination (and coffee), you can make files do weird things

Try It and Break It! 🔨

I'd love for you to try InvisioVault and see if you can break it! Found a bug? Edge case I didn't consider? File format that doesn't work? Open an issue! I'm always looking to improve it.

Or better yet, if you have ideas for features, fork it and go wild. That's the beauty of open source - it's like a choose-your-own-adventure book, but with more Git commits.

Final Thoughts 💭

Building polyglot file support was one of those projects that seemed impossible at first, then suddenly clicked. It's like solving a puzzle where the pieces are bytes and the solution is "append data in the right order."

If you're a beginner developer reading this: build weird stuff. Don't just follow tutorials - go off script! Want to make files that are also other files? Do it! Want to build a web app that's entirely emoji-based? Why not! The best learning happens when you're slightly in over your head and Googling frantically at 3 AM.

And remember: every expert was once a beginner who refused to give up.

Now if you'll excuse me, I need to go hide my grocery list inside a family photo. For security reasons. Obviously.

Links & Resources

Have you ever worked with polyglot files or steganography? What's the weirdest thing you've ever hidden in a file? Let me know in the comments! 👇

And if you found this helpful (or just entertaining), consider starring the repo and sharing with your fellow developer friends who also enjoy making files do weird things! ⭐

P.S. - If you use this for anything questionable, I don't know you. We've never met. This conversation never happened. 🕵️

Top comments (0)