The FLACFox Experiment
So... apparently some will tell you that FLAC has filters, it screws audio around and can never exactly recover the original audio...Hmmmmm...... but isn't it just like WinZip or WinRAR for audio? Well, go grab a beer, gather your kids and family around the PC and let FiH guide you on an ever so exciting story.....
Firstly, lets download a reasonable size file that everyone can access (Firefox Setup 1.5.0.1.exe - US English). Grab it here: http://www.mozilla.com/products/download.html?product=firefox-1.5.0.1&os=win&lang=en-US
This file is useful because if you look at the size you'll see it's 5,175,696 bytes. Divide that by 4 and you'll get 1,293,924 samples. To you and me samples are sound, to a computer, hi-fi, CD or any other machine they're just numbers. You can choose any file for this experiment as long as its size is divisable by 4. This is because each sample of music in CD standards is 4 bytes long (2 bytes for each channel).
OK, now I'm gonna open up this using a Hex Editor, my one of choice is WinHex
Looks exciting doesn't it
Lets use WinHex's internal Checksuming routines to make a MD5 hash of this file:
In fact here are the results of all the hashes I bothered to run on it:
CRC32: 09B143EA
MD5: 8E1E0AEBFB24B09066BD70301C957D93
SHA-1: 88C940D9EA5A3BC0496B5EDA66428E564B88EBD9
SHA-256: 483770E3438FB0969FFA3101400786213535E45EB8FF388B70D0060A52F3E466
This post itself was the result of a far superior hash :D
In fact you can even go to this FireFox page and find the above SHA-1 on it (file ./win32/en-US/Firefox Setup 1.5.0.1.exe) as Firefox use this number to verify the integrity of their release. Let's move on as this is ever so exciting.....
OK. Now this is an .exe file so the first thing we need to do is turn into a audio sample. Change the extension to .raw and then fire up Adobe Audition and load it in.
It will ask you what the format of the sample is - give it the same info as in the screenshots below:
OK, so now it's loaded in Adobe Audition you can play it if you want and see that whilst Firefox is a great app, it doesn't sound too good. Maybe IE sounds better? Maybe not
You can run frequency analysis or whatever you want on this - just don't change anything. OK, now lets save this as a WAV file, close Audition and **DELETE THE RAW FILE**. We're already on the road to losing our data if you believe those who somehow misbelieve FLAC isn't lossless. This WAV file has already changed size and even if you changed the extension to .exe it now wouldn't run. We've just lost this exe
So, you can see the filesize of the .wav is now 5,175,740 bytes. The earlier .exe was 5,175,696 bytes. We've gained 44 bytes. Now this 44 bytes is the WAV header. This tells whatever program opens the file what the sample rate is, how many channels etc... (this is why when opening the raw file in audition we had to specify this stuff manually).
So, if we open the file up in WinHex you'll see I've highlighted the header for you. Compare with the earlier WinHex screenshot above.
Now we'll do something completely pointless - a MD5 sum of the entire WAV file. Why torrent releasers do this I'll never know.....
However, if you be careful and select every single byte in that file except for the header and tell it to run a MD5 on *only the selection* you'll get this:
That's our magic 8E1E0AEBFB24B09066BD70301C957D93 MD5 again. You could delete the header from the WAV file at this point and save it as a .exe and we've got our exe back. But let's not do something that sensible.....Let's fire up the FLAC front-end
Now you'll see the important option not to have on is "Align On Sector Boundaries" - I won't go into why just yet, lets just say it could add some samples on. Also lets tick the Verify, Add tags, ReplayGain, and delete input file. This is it, once you click that encode button the FLAC will be created and the WAV deleted - so we're really gonna lose everything now
Now depending on your tagging options you may have got an Error like I did. That's nothing to worry about, the FLAC was still made and the wav deleted - it was just informing you it couldn't guess the tags and was a nice way to ensure you'd see a "Press any key" message. For those not using the front-end, these were the parameters passed to FLAC: --delete-input-file -P 4244 -b 4608 -m -l 12 -e -q 0 -r 0,6 -V
Now the FLAC file it made on my system was 5,181,555 bytes. Huh it's bigger? That's right - FLAC is a great audio encoder and compresses pretty well, but as a encoder of an exe however much I love it it does suck. Those who know anything would know that the the setup.exe was pretty compressed anyway to begin with. Feel free at this stage to use an APX compression on the WAV however and I can guarantee you will not have much luck getting the exe back.
Let's have a look at this FLAC in out hex editor, just to see if we can find any trace of the original file (anything that looks like it).
OK, so this is the start of the file and look - it's basically REPLAYGAIN tags. Note the first four characters - "fLaC" - every FLAC file starts with this. Also there's another suprise if you examine line 2 and look for "8E 1E" - this position is where the MD5 checksum gets internally stored so when it decodes it can compare the checksum of the result against the one it stored earlier.
If we move down we'll then find a shed load of 0's... but keep going until we get to some more content, what can only be the encoded data. Does it look anything like the original?....
...Not at all. Let's now do another pointless thing and MD5 the entire FLAC file....
Holy shit! That looks nothing like our original 8E1E0AEBFB24B09066BD70301C957D93 MD5. We've lost everything, we're screwed In addition tag this FLAC file, and run a MD5 on the entire file again... it changes every time doesn't it.
Wait... I have an idea. It might sound silly, but lets fire up the FLAC front-end, drag the FLAC file across and click the Fingerprint button.
Wooha! Look - I can't believe it! You mean these fingerprints actually mean something? That's right, I wasn't bullshitting in an earlier post when I said FLAC fingerprints & MD5's are the same thing.
So off you can now go, decode this FLAC, open in Adobe Audition and save as a raw sample (or delete the WAV header manually in a hex editor). Then you rename it to .exe and go and install Firefox, as NOTHING was lost
You know what I'm gonna do? Well... I'm gonna take this idea a little bit further. Stay tuned for the follow up to this post..... the FLACFox Experiment Part II - EAC Strikes Back!
By the mighty flacinhell
Firstly, lets download a reasonable size file that everyone can access (Firefox Setup 1.5.0.1.exe - US English). Grab it here: http://www.mozilla.com/products/download.html?product=firefox-1.5.0.1&os=win&lang=en-US
This file is useful because if you look at the size you'll see it's 5,175,696 bytes. Divide that by 4 and you'll get 1,293,924 samples. To you and me samples are sound, to a computer, hi-fi, CD or any other machine they're just numbers. You can choose any file for this experiment as long as its size is divisable by 4. This is because each sample of music in CD standards is 4 bytes long (2 bytes for each channel).
OK, now I'm gonna open up this using a Hex Editor, my one of choice is WinHex
Looks exciting doesn't it
Lets use WinHex's internal Checksuming routines to make a MD5 hash of this file:
In fact here are the results of all the hashes I bothered to run on it:
CRC32: 09B143EA
MD5: 8E1E0AEBFB24B09066BD70301C957D93
SHA-1: 88C940D9EA5A3BC0496B5EDA66428E564B88EBD9
SHA-256: 483770E3438FB0969FFA3101400786213535E45EB8FF388B70D0060A52F3E466
This post itself was the result of a far superior hash :D
In fact you can even go to this FireFox page and find the above SHA-1 on it (file ./win32/en-US/Firefox Setup 1.5.0.1.exe) as Firefox use this number to verify the integrity of their release. Let's move on as this is ever so exciting.....
OK. Now this is an .exe file so the first thing we need to do is turn into a audio sample. Change the extension to .raw and then fire up Adobe Audition and load it in.
It will ask you what the format of the sample is - give it the same info as in the screenshots below:
OK, so now it's loaded in Adobe Audition you can play it if you want and see that whilst Firefox is a great app, it doesn't sound too good. Maybe IE sounds better? Maybe not
You can run frequency analysis or whatever you want on this - just don't change anything. OK, now lets save this as a WAV file, close Audition and **DELETE THE RAW FILE**. We're already on the road to losing our data if you believe those who somehow misbelieve FLAC isn't lossless. This WAV file has already changed size and even if you changed the extension to .exe it now wouldn't run. We've just lost this exe
So, you can see the filesize of the .wav is now 5,175,740 bytes. The earlier .exe was 5,175,696 bytes. We've gained 44 bytes. Now this 44 bytes is the WAV header. This tells whatever program opens the file what the sample rate is, how many channels etc... (this is why when opening the raw file in audition we had to specify this stuff manually).
So, if we open the file up in WinHex you'll see I've highlighted the header for you. Compare with the earlier WinHex screenshot above.
Now we'll do something completely pointless - a MD5 sum of the entire WAV file. Why torrent releasers do this I'll never know.....
However, if you be careful and select every single byte in that file except for the header and tell it to run a MD5 on *only the selection* you'll get this:
That's our magic 8E1E0AEBFB24B09066BD70301C957D93 MD5 again. You could delete the header from the WAV file at this point and save it as a .exe and we've got our exe back. But let's not do something that sensible.....Let's fire up the FLAC front-end
Now you'll see the important option not to have on is "Align On Sector Boundaries" - I won't go into why just yet, lets just say it could add some samples on. Also lets tick the Verify, Add tags, ReplayGain, and delete input file. This is it, once you click that encode button the FLAC will be created and the WAV deleted - so we're really gonna lose everything now
Now depending on your tagging options you may have got an Error like I did. That's nothing to worry about, the FLAC was still made and the wav deleted - it was just informing you it couldn't guess the tags and was a nice way to ensure you'd see a "Press any key" message. For those not using the front-end, these were the parameters passed to FLAC: --delete-input-file -P 4244 -b 4608 -m -l 12 -e -q 0 -r 0,6 -V
Now the FLAC file it made on my system was 5,181,555 bytes. Huh it's bigger? That's right - FLAC is a great audio encoder and compresses pretty well, but as a encoder of an exe however much I love it it does suck. Those who know anything would know that the the setup.exe was pretty compressed anyway to begin with. Feel free at this stage to use an APX compression on the WAV however and I can guarantee you will not have much luck getting the exe back.
Let's have a look at this FLAC in out hex editor, just to see if we can find any trace of the original file (anything that looks like it).
OK, so this is the start of the file and look - it's basically REPLAYGAIN tags. Note the first four characters - "fLaC" - every FLAC file starts with this. Also there's another suprise if you examine line 2 and look for "8E 1E" - this position is where the MD5 checksum gets internally stored so when it decodes it can compare the checksum of the result against the one it stored earlier.
If we move down we'll then find a shed load of 0's... but keep going until we get to some more content, what can only be the encoded data. Does it look anything like the original?....
...Not at all. Let's now do another pointless thing and MD5 the entire FLAC file....
Holy shit! That looks nothing like our original 8E1E0AEBFB24B09066BD70301C957D93 MD5. We've lost everything, we're screwed In addition tag this FLAC file, and run a MD5 on the entire file again... it changes every time doesn't it.
Wait... I have an idea. It might sound silly, but lets fire up the FLAC front-end, drag the FLAC file across and click the Fingerprint button.
Wooha! Look - I can't believe it! You mean these fingerprints actually mean something? That's right, I wasn't bullshitting in an earlier post when I said FLAC fingerprints & MD5's are the same thing.
So off you can now go, decode this FLAC, open in Adobe Audition and save as a raw sample (or delete the WAV header manually in a hex editor). Then you rename it to .exe and go and install Firefox, as NOTHING was lost
You know what I'm gonna do? Well... I'm gonna take this idea a little bit further. Stay tuned for the follow up to this post..... the FLACFox Experiment Part II - EAC Strikes Back!
By the mighty flacinhell
posted by FLACFox at 8:18 AM
1 comments
