Rolan Lobo

Posted on Oct 24

🧙‍♂️ When I Tried to Make a PNG + EXE Polyglot (And Accidentally Summoned Chaos)

#beginners #python #programming #security

You ever wake up one fine morning and think —

“Hey, what if I could make one file that’s both a picture and an executable?”

Yeah… me too.

And that, my friend, was the beginning of my descent into the binary abyss —
aka The Great PNG + EXE Polyglot Experiment. 🌀

🧩 The Wild Idea

The dream was simple:

“What if I could merge a .png image and a .exe file so the file behaves like a normal picture and runs as a program?”

Sounds magical, right? Like a hacker-magician pulling hidden code out of an innocent photo. ✨
Except… it turned into chaos pretty fast.

⚔️ Enter the Binary Battlefield

First thing I learned: file formats are divas.
They have their own rules, their own structure, and they do not like sharing space.

A .png starts with this signature (magic bytes):

89 50 4E 47 0D 0A 1A 0A

While an .exe begins like this:

4D 5A

Both want to be at the very start of the file — and neither likes to compromise.

When you try to mash them together, it’s like forcing two kings to share the same throne 👑
— and the OS just says,

“Nope. Corrupted. Get this monstrosity out of here.”

🧠 The Deep Dive (a.k.a. My Brain Melted)

So I dove into the binary structure of both file types.

PNG:

Has chunks like IHDR, IDAT, and IEND.
It can technically ignore extra data after the IEND chunk.
That’s why it’s often used in steganography — you can hide stuff at the end!

EXE (PE Format):

Needs a DOS Header (MZ), a pointer to the PE Header, and properly aligned sections.
Mess any of that up and it won’t run.

So yeah, PNG says “just toss it after IEND, it’s fine,”
while EXE says “everything must be exactly where I said, or I’m done.” 😤

💻 Code Snippet: The Naive Attempt

Here’s one of my first “why not?” tries in Python:

with open("image.png", "rb") as img, open("program.exe", "rb") as exe:
    polyglot = img.read() + exe.read()

with open("polyglot.png", "wb") as out:
    out.write(polyglot)

Did it run?
No.
Did it open as an image?
Also no.

What I created was basically digital Frankenstein — neither alive nor dead. ⚡💀

🧱 The Real Obstacles

Here’s what made this adventure feel like coding on hard mode:

Header collisions – both formats demand the front seat.
Offset alignment – EXE headers rely on fixed memory positions.
Integrity checks – PNG viewers are drama queens about structure.
Antivirus freakouts – apparently mixing code + images is “suspicious.” 🙃
Patience depletion – self-explanatory.

💡 Lessons From the Binary Battlefield

PNGs are flexible — they’ll let you attach data at the end.
EXEs are rigid — one byte out of place, and boom, it’s over.
Hex editors are powerful tools… but they also make you question your life choices at 3 a.m. 😅

🧃 The Safer Realization

After breaking my brain for a while, I discovered there are simpler polyglots that actually work, like:

PNG + ZIP → Image + hidden archive
PDF + HTML → Opens in readers and browsers
JPG + TXT → Your classic hidden-text setup

These combos don’t trigger antivirus alarms and are great for demoing steganography safely. 🧯

🧪 The Present: My Polyglot Project

Right now, I’m working on something I call Polyglot_RNR —
a tool that can take any file as a carrier and any file to embed,
mixing them into a functional polyglot.

It’s currently living in a private repo, because…
well, sometimes what you build is technically working but logically insane. 😂

Soon, as I learn and fix things, it’ll go public.
Because sometimes things don’t work the way you wanted,
but they do work — and honestly, that’s fine, right?

At the end of the day, we just want the job done. 🛠️

🧘 Final Thoughts

If there’s one thing I’ve learned from all this:

“Just because you can merge a PNG and an EXE doesn’t mean you should.”

But hey — every failed experiment teaches you a bit more about how bytes, headers, and file structures really work.

And who knows? Maybe the next time I break something, it’ll actually work exactly how I wanted. 😄

TL;DR:
I tried to make a .png that’s also a .exe.
Ended up fighting binary headers, hex editors, and antivirus warnings.
Now I’m building a tool that can turn any file combo into a polyglot — responsibly. ✨

If you enjoyed this little chaos-filled experiment or want to see what I’m cooking up next,
👉 check out my projects on GitHub @Mrtracker-new.