/qresearch/ - Q Research

The identified pxlknot images I looked at were all 96dpi and 24bit color.

A general approach to decryption is to start with the simplest image, and then encode one character. Examine the resulting image. Do it again with the same characterto see if there is a change.

Then sequentially encode '1','2', '3', etc. and see if there is a predictable pattern.

What you're looking for is a way to brute-force decode the image.

Also try to find the original images before they were subjected to pxlknot.

Here is source code for determining entropy of a file. Can be used in connection with brute force decrypter to identify results with significantly different entropies.

https://pastebin.com/raw/Gx34MNZF

>>2371713

The spiral has many meanings. It is an ancient symbol.

https://en.m.wikipedia.org/wiki/Spiral

>>2371388

So just so to be sure, are you are saying the app store version is incompatible with the F5 library that is used with say tools built on linux?

I can't seem to extract data on linux that I embeded with the appstore apk (that I built from the source). I can't figure out why, but it mimic's some of the other responses from the previous bread.

Huffman decoding starts

Permutation starts

921600 indices shuffled

Extraction starts

Length of embedded file: 1798344 bytes

(1, 8388607, -9) code used

Incomplete file: only 0 of 1798344 bytes extracted

I ran the pixelknot python detection script that was on here in the last few days on my cache of qresearch image files and found there was a few of them.

Uploaded what i found so far to https://anonfile.com/h8k8Adf3b6/pkfiles.zip as i don't have the computing power to tinker with them.

>>2366398

>>2371388

But is it still possible that another, entirely irrelevant piece of software could coincidentally produce images with the same header?

>>2373244

Wish i had a faster computer. Glad someone can make a go of it.

>>2373544

This is a stretch, but what if they didn't use PixelNot at all? What if they used the JS version of F5?

updated PixelUnknot main with timer

https://pastebin.com/KrbEYrE7

>>2373016

Thanks for your help. I think I'm missing something, PixelUnknot is needed to decode the output from f5?

After getting bounced around in the 'bouncy castle' I was able to run PixelUnknot, but not sure how to get the message decoded.

>>2373244

Honestly, the only way I know of to speed this up would be to do what the bitcoin miners do and find a way to shunt the data into a graphics card to 'render' out the solution.

Not knowledgeable enough on this topic though to even wrap my head around how this gets done on a mathematical level, I just know that a graphics card can pump out hashes like there's no tomorrow.

>>2373544

Yes. Any software that uses the "james" library to write JPEG images.

>>2374957

Huffman decoding starts

non good byte - at 0

non good byte - at 1

non good byte - at 2

non good byte - at 3

!!!!!!!!!!! PARTIAL MATCH - non

!!!!!!!!!!! PARTIAL MATCH - non

!!!!!!!!!!! PARTIAL MATCH - non

!!!!!!!!!!! PARTIAL MATCH - non

I'm not getting the message … Since in my case I just added qanon to the passwords.txt

>>2371258

Don't know if it was already done, but I ran the python pixelknot detection script in a folder with all of Q's images he posted.

0 pixelknot images…

>>2375171

that py script is trash, can't tell its ass from a hole in the ground

>>2375089

Yes, it's probably used by nothing else than the F5 library, but James JPEG Encoder actually predates F5.

https://web.archive.org/web/20100111121336/https://www.obrador.com/essentialjpeg/jpeg.htm

>>2375234

hmm pretty widespread, still all write JFIF

https://github.com/lxyu/52pai/blob/master/j2me/src/me/zhaoren/JpegEncoder.java

https://github.com/abronte/f5-steganography/blob/master/src/james/JpegEncoder.java

https://www.media.mit.edu/pia/Research/deepview/src/JpegEncoder.java

weird that somebody would move it down to line 666 and comment it out

>>2375198

So how do you detect a pixelknot image?

>>2375234

>>2375351

https://www.google.com/search?q=WriteArray%28JFIF%2C

Not sure which is more important, trying to decipher hidden messaging/files in Q's posts are PixelKnot comms.

We are going to have to start from scratch if try to extract (if any) hidden data from Q's images.

>>2375458

Anything to back this up, or just guess work?

>>2375402

I used the f5.jar to add a message to a picture, and to extract it again for verification.

That encoded picture does have JFIF in it and does not have that FF C0 00 11 @ 88

>>2375458

I know this, I'm saying what if Q hid data in PNG's, all this PK work is for not. Some of the PNG's Q uploaded seemed pretty large for what they are..

>>2375402

I think the C0 is the start of the image, but I could be wrong.

>>2375616

Marker Identifier 2 bytes 0xff, 0xc0 to identify SOF0 marker.

My hex compare using PixelKnot app, the image with message is 0xff, 0xc0, and the image without is 0xff, 0xc2

>>2375707

>pixelknot only does jpg/jpeg

I know :)

Hence why I said start all over …

>>2375702

If I specify the full password to f5.jar it chokes, if I specify the last 3 digits I get (in out.txt):

—-* PK v 1.0 REQUIRES PASSWORD —-*vNOvTv6i78CsQvHg

WUnqE8Qmo0GnUuJ/Gj52/pRgCjCkPGuRF00t8+Kd0w+ccVU=

>>2375793

By choke I get this instead:

java -jar f5.jar x -p qanon ~/Downloads/goods.jpg

Huffman decoding starts

Permutation starts

1238400 indices shuffled

Extraction starts

Length of embedded file: 485098 bytes

(1, 67108863, -6) code used

Incomplete file: only 0 of 485098 bytes extracted

>>2375402

This is not a consistent way to find f5 images. In fact, it doesn't even work with the q test image available in this thread. Also, I see the same patterns in images I've created myself. Also if you use a hex editor to examine various images that are implicated as f5 this pattern does not fit. If you want to start comparing I recommend using beyondcompare and renaming the jpg to txt.

>>2375386

Still trying to determine that consistently. I saw someone here using stegdetect but I haven't tried it yet and it looks like based on settings you use can result in a high rate of false positives

>>2376493

Thanks, I get this when I build with your changes …

java -jar PixelUnknot-1.0-SNAPSHOT.jar ~/Downloads/goods.jpg passwords.txt

Huffman decoding starts

non good byte - at 0

non good byte - at 1

non good byte - at 2

non good byte - at 3

!!!!!!!!!!! PARTIAL MATCH - qanon

!!!!!!!!!!! PARTIAL MATCH - qanon

!!!!!!!!!!! PARTIAL MATCH - qanon

!!!!!!!!!!! PARTIAL MATCH - qanon

java.security.InvalidKeyException: Illegal key size

at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:1039)

at javax.crypto.Cipher.init(Cipher.java:1393)

at javax.crypto.Cipher.init(Cipher.java:1327)

at q.Main.DecryptWithPassword(Main.java:45)

at q.Main.extract(Main.java:107)

at q.Main.lambda$main$0(Main.java:153)

at java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:184)

at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374)

at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)

at java.util.stream.ForEachOps$ForEachTask.compute(ForEachOps.java:291)

at java.util.concurrent.CountedCompleter.exec(CountedCompleter.java:731)

at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)

at java.util.concurrent.ForkJoinTask.doInvoke(ForkJoinTask.java:401)

at java.util.concurrent.ForkJoinTask.invoke(ForkJoinTask.java:734)

at java.util.stream.ForEachOps$ForEachOp.evaluateParallel(ForEachOps.java:160)

at java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateParallel(ForEachOps.java:174)

at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:233)

at java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:418)

at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:583)

at q.Main.main(Main.java:151)

>>2376678

I'll check, but someone was able to extract the message in the image I uploaded earlier. So there is some difference with my runtime vs. anon's runtime, or some bug someplace.

I want to make sure that I can verify results from PK app and then extract then on my box, this way I know for sure I have something that's reliable. I'm using 1.8 on mac, I was thinking about switching to VB vm instead (I have a couple different VMs aready setup), but I'm just puzzled why I'm not getting the same results as the other anon.

>>2376809

I haz both. I started on the evil eye but I noticed the rate was way low on that image (in comparison to test images)… you may want to check yourself. Much faster against illumipepe

>>2376447

You got the fellow anon part right but sliding, in the same thread?

Yours is the first I've seen that matches that cap (just started working on this today). Do you have other images that fit this pattern? Otherwise, I haven't found any yet and the other version of the q example image had the FF C0 starting at 9E not 88, something isn't fitting here.

As for the python script its looking for files that begin with 'ff d8 ff db 00 84' which I also haven't found any images posted as examples on the board fitting this format.

This is also just one implementation of f5 with the missing jfif header. There are many from my understanding.

The CBS eye everyone keeps posting is 9E not 88 and has a header.

many others are FF C2 around 9E instead of C0.

>>2376757

Would be nice to have a distributed setup for this, because if we crack one, we have many others that probably won't have the same password.

New avenue…the instructions to decode are in the original message. Google, Yandex, iqdb. What do they have in common? Reverse image search. Use the Silverman image to reverse search. Now what pictures? Is it given right in the image number? IMG_382. Third pic Google, eighth pic Yandex, 2nd pic iqdb. What info from these three pics? Hit a wall, run with it.

>>23768>>2376856

>Silverman passcode

>New avenue…the instructions to decode are in the original message. Google, Yandex, iqdb. What do they have in common? Reverse image search. Use the Silverman image to reverse search. Now what pictures? Is it given right in the image number? IMG_382. Third pic Google, eighth pic Yandex, 2nd pic iqdb. What info from these three pics? Hit a wall, run with it.

WAIT also stands for what anime is this, and has reverse image search

>>2376887

No it looks like its just how I've been downloading the image to check it.

Thanks for the example and showing me what I was doing wrong, perhaps you'd like to confirm.

Without expanding the image, right-click and save image as. View the hex.

Then expand or use the direct link above the image and you get that header.

>>2376809

>don't forget single and double quotes

Assuming the password accepts unicode, you may have a much bigger fight ahead of you. Consider other symbols like the pound sign (£) or the euro found on keyboards from other countries.

If it's unicode, you can safely assume UTF-8, given it's a pretty widespread standard.

Also, I recommend avoiding random character generators, but having a pre-computed array/table (for 3 characters).

If you're looking at additional bruteforcing power, a couple of recommendations:

1) Each of you should pick one picture each and specify what image you are trying to decode, and how. That way you're not duplicating each other's work.

2) If failed, specify what you tried and the 'results', if any.

For bringing hardware resources to bear:

1) Consider modded PS3s (some of you might have one or two lurking around), they're ideal for bruteforcing

2) Trial periods on cloud hosting repurposed (or alternately rent out some rackspace)

3) Dust off some old laptops, machines, and set them to work continuously whilst you do other things

4) Get some programmerfags to rewrite the testing code in bare metal (like C++) which would see mild performance improvements

Alternatively, if exhausting the three character space is too much, assign each of yourselves a single first character, and brute force all characters under that character.

So if one of you was to do 'A' (A), the next person would do 'B' (B).

Brute forcing isn't just about power but also efficient allocation of resources.

PS, Bitcoin's algorithm is SHA256. So if you're looking to break SHA256, look no further than your own noses. ; )

>>2377313

>>2377440

WHY NOT EMOJIS???

https://emojipedia.org/google/

PNG DECODE HERE in bread 3000.

>>2380591

BFD!!!

>>2371688

I don't understand all the details but F5 stegnography encodes data by altering the DCT coefficients per 8x8 pixel block, those coefficients are stored with Huffman compression. The method of encoding is why the output image is always a JPEG. You would have to do statistical analysis of the JPEG coefficients… (assuming the software wasn't comprimised to leak additional info as well, the absence of JFIF header appears to be such a case)

Not a code flag, but is it possible code/key/password is John Podesta's password p@ssw0rd ? Q said future/news unlocks past?!?idk maybe iz just a baboon loose on board.

>>2385149

The Huffman decoding part is a non issue. You only need to do that once for an unlimited number of password attempts.

It's calling the SHA-based psudorandom number generator a million times in series (can't be paralleled) to decide which integers to shuffle around that takes most of the work.

>>2385219

Sorry that's for the AES decryption portion… still, I think we could use the existing hashcat code for the SHA portion of PRNG. SHA1/256 on hashcat is stupid fast. Something like 600m hashes/s on my old ass card.

>>2385325

Hashcat is doing something totally different. It's trying to find the passwords that produced a set of hashes. It does this by hashing lots for trial passwords once in parallel'. We need to take one password, use it to set the state of the SHA algo, and then cycle the output back in many many times. This is an unavoidably serial process. If I indeed go down this rabbit hole it will probably involved reading the HashCat code as a way of learning how CPU<->GPU coding works. I might even use some parts from it. But beyond that programs like HashCat and John the Ripper are not useful to us.

>>2385604

I know. Rather than shooting for one target hash, we try 1k passwords at once and run each serially with however many iterations required, in parallel. I don't see a problem here. I still think it can be modified to our purpose.

>>2385732

We are not really looking for one target hash. It would be nice if it were that simple. Here is the annoying chunk of code in question. 'random.getNextValue' calls 'SecureRandom' which was previously seeded using the password under test. Inside 'SecureRandom" there is a SHA hash function at the heart of it. 'size' is typically around a million.[code]public Permutation(int size, F5Random random) {

int i, randomIndex, tmp;

shuffled = new int[size];

// To create the shuffled sequence, we initialise an array

// with the integers 0 … (size-1).

for (i=0; i<size; i++) // initialise with size integers

shuffled[i] = i;

int maxRandom = size; // set number of entries to shuffle

for (i=0; i<size; i++) { // shuffle entries

randomIndex = random.getNextValue(maxRandom–);

tmp = shuffled[randomIndex];

shuffled[randomIndex] = shuffled[maxRandom];

shuffled[maxRandom] = tmp;

}[code] It's serial. And it's memory intensive. But at least there need be little conditional branching (which GPUs suck at). So this would use all of the GPUs RAM long before you got enough processes in parallel to use all of its computing power. It can't hurt to have a few hundred more cores helping the main CPU (as long as there are no memory bandwidth issues). But we're not going to get the same astronomical performance boost that HashCat gets.

>>2386063

Oops, for got the /

	for (i=0; i<size; i++) {	// shuffle entries

	    randomIndex = random.getNextValue(maxRandom–);

	    tmp = shuffled[randomIndex];

	    shuffled[randomIndex] = shuffled[maxRandom];

	    shuffled[maxRandom] = tmp;

	}

>>2386063

Is size the size of the decompressed bitmap? Or is it something else?

PS tells me that's about 303K for illumipepe.

Even if it's 1MB as you say, that's still 1500 instances of the image.

With my lame 1.5GB graphics card that's still almost 5K potential instances

>>2386525

Its the size of the DCT coefficient list.. which works out to be the same as the number of pixels * channels (RGB). But, practically, yes. Many of the images are larger than that one.

>With my lame 1.5GB graphics card that's still almost 5K potential instances

Indeed. I just need to work out how it will handle all the out of order loading and storing.

>>2386742

The DCT coefficient list only gets computed once, correct? If so, we only need to push one copy of the data to the graphics card and we should be able to copy it as many times as we want, no? And if we manage to implement it all on the graphics card, then all we really care about getting back is the rate of attempts and the valid key, if any. And yes, I understand many images are larger but essentially it would work out to max available GPU mem divided by decompressed image size in terms of threads. I'm willing to bet that's still a fuckton more than we've got going currently.

>>2386850

Uh-huh. That is why I'm currently reading up on GPU programming.

The stumbling block I foresee is that there is a lot or random accessing going on after very short work segments will very short arrays. This is really not what GPUs are good at.

Disclaimer: I have no experience with this kind of stuff and I'm mostly just talking out my ass. So if anyone who has ever done anything in CUDA or OpenCL would like to weigh in it would be much appreciated.

>>2386977

i've done CUDA and been looking at f5 and no it would not be a good fit… too bad too because i've got some monster gpu power

>>2386977

Roger that.If there's one thing I'm certain of though, it's that we drastically need to speed things up. Perhaps a pure-C implementation would be enough. IDK. I'm gonna sleep on it. G'night anon.

>>2371388

So the only people stupid enough to use that app are media types. Well, that's interesting. So when we crack this, there is a slightly less chance of finding CP from perverts and more of a chance finding gamer gate type collusion between media personal and/or leaks to the press from stupid gov members. Perfect. I knew there had to be a reason why Q pointed us to such a trash app.

I guess a good project, for those who aren't skilled at writing efficient code for password cracking, would be to work at better detecting PK images and scrapping them from the archives of /pol/, 4/pol/, perhaps QResearch, and all the social media of the various media figures/known government leakers. Perhaps even look at some of the pizza gate dumps for stego. And as always, If you do start finding PK images from journalists on their social media, archive and backup everything before you blow your load, so they don't delete more than they already have once they find out we know.

>>2387734

Shhh!

>>2380484

I do android programming and the C0217R code you psoted looks like resource ids compiled by the either android studio or gradle. They must be manually added because usually they are in R.java or sometimes in BuildConfig.java (in the final apk)

I ran the apk version 1.0.1 (last version listed on the playstore) and couldn't find the C0217R class, ran it through two decompilers and neither had it in its output set of files.

I wondered if the first 100 bytes of jpeg files we're looking for is not unique to PixelKnot. So I made a "find-pixelknot.sh" shell script to recursively search directories on my computer. I searched a backup from an old hard drive to see if any jpeg files that predate PixelKnot could be found. There were no matches out of 17k jpeg files. I'm leaving it here in case any anons find it useful.

Usage:

./find-pixelknot.sh <path to search recursively from>

#!/bin/bash

PN_HASH_DESIRED_OUTPUT="3f3078870bf5ddc7c4d0e6e5941805b7a062c45d  -"

INPUT_PATH=$1

cd "$INPUT_PATH"

# Make sure globstar is enabled to support recursively searching
shopt -s globstar

declare -i FILES_EXAMINED=0
declare -i MATCHES_FOUND=0

echo "Searching for jpeg files to see if it looks like Pixelknot created them."

function exit_output {
	echo "";
	echo "Terminated. Jpeg files examined: ${FILES_EXAMINED}, matches found: ${MATCHES_FOUND}.";
}

trap exit_output EXIT

for filename in **/*.jp*; do
	((FILES_EXAMINED++))
    FILE_HEADER_SHASUM_OUTPUT=$(head -c 100 "$filename" | shasum)
    if [[ $FILE_HEADER_SHASUM_OUTPUT = $PN_HASH_DESIRED_OUTPUT ]]; then
        echo "File $filename looks like a Pixelknot image.";
		((MATCHES_FOUND++))
    fi;
done

Have the pictures Q posted been checked? Perhaps Q has posted some passwords, like his bolded words.

https://www.rdmag.com/news/2013/03/steganography-hiding-secret-message-plain-sight

>>2387890

Thanks for clarifying, I thought I was on to something. Did the same with another decompiler and they were either absent or listed as R.java like you said.

>>2390679

Welcome, just glad i spotted it so no one wastes time on that than needs to happen :)

>>2391530

I picked a random file and tried generating a 4 letter list using only the characters in a files filename. Nothing.

But occurred to me last night that it was a 13 char filename. If it done by shuffling the filename somehow then I'd be looking for a 5 char key. I don't have the horsepower to attack that in a reasonable time. So when I get home today I'm gonna write a filter that reduces the set to only those that use any single char no more than the number of time it appears in the source filename, unless you want try it first. If you do then let me know so I don't reinvent a bad wheel.

>>2394093

oh, no that was in 2013… the only change besides the 2017 change

>>2394093

I was hoping that the quality that the image was encoded with was written to the file, unfortunately that's not the case. I think the header removal change is all we need for now anyways.

The road is steep from here though, something tells me they aren't going to use a complex password, and I have a feeling that the password will unlock many images.

>>2396389

>>2395061

Very nice finds.

So yes, the filenames are reversed, and perhaps the images are as well.

Try flipping the images horizontally before trying to extract the data from them.

As for what the passwords are.. try the filename without any number appended to the end, both regular and reversed.

Let me know if that works for you… I still haven't found a way to test these out on my own computer.. MacOS.

Anyone know of a way? If so then I can help.

>>2396481

Actually I'm not sure if flipping the image changes the ability to extract data from it or not - that would be the first thing to test with an image we already know has data and already know the password to.

>>2396613

Thank you anon I will set things up in a few hours and try and see if I can get anything out of these images.

I'll report back with any important findings.

>>2396863

Mirrored, yes

0_PDlwBQSymrdu7_5D.jpg

gpj.D5_7udrmySQBwlDP_0

>>2371551

>>2371666

>>2396863

though nothing extracted with steghide with the whole string D5_7udrmySQBwlDP_0 or just the underscored 7udrmySQBwlDP

>>2397994

oops not the same image

>>2398717

K so all we need to do is image search medium.com for an image with that header. If no results found (and the original filename isn't like medium's random naming bullshit) then we probably have a PK image.

>>2399125

Does stegdetect hit false positives?

Here's a medium article with the exact illumipepe image [positive ID by SHA] that's in your list.

https://medium. com/@Freequincy/right-wing-dove-squad-how-trash-dove-became-the-symbol-of-the-alt-right-c7794b84a48d

Can someone with pixelknot give me more test images with known passwords to experiment with?

>>2399203

And it is before the header change.

So we have now established that stegdetect gives false positives, and all medium.com JPEGs meet the other criteria.

A new approach is needed. Perhaps focus less on finding PixelKnot images and more on Q's images.

>>2399532

Thank you anon, that one works perfectly.

>>2399313

>if you get near the actual password

this theory is bunk.

disregard it.

>>2394535

This and several other posts…

The tech literate have always known spy agencies cripple publicly available encryption but good grief! We aren't even experts at this stuff, just code monkeys poking through an open source repo. The whole thing is vulnerable! It's only a matter of time before we crack this.

>>2400150

Scratch that - wrong header

>>2394381

>>2394093

Use the ImageMagick command "identify" like this:

$ identify -format '%Q\n' yourimage.jpg

>>2400272

Thank you anon.

>>2401017

Thanks anon. Just wanted to confirm I understood that code correctly.

I had posted to this thread, but my post appears to have mysteriously (?) gone missing.

I mentioned to factor in symbols from international keyboards (£, euro sign), dusting off old hardware to assist in brute-forcing, and divying up tasks between yourselves (and let each other know) so you're not all trying to brute force the same issue.

It's curious my suggestions on ways to improve the efficiency of detecting PixelKnot 'magically disappeared', given no other post I've written so far has.

Oh yeah, don't forget to factor in unicode (if the password supports it and isn't just ASCII). Most format common is UTF-8 (non-BOM), and would exponentially increase the number of characters you'd need to check before solving.

But I digress.

>>2401778

https://anonfile.com/EaG3B8fbb8/PKunknot.zip

This is what I'm using anon - single thread per instance though. You'll have to manually split your wordlists. It will automatically generate every permutation for a given charset and exit if a correct solution is found.

Run by calling the following on your command line:

java -cp bcprov-jdk15on-160.jar; q.Main %IMGNAME% %CHARSETFILE% %STARTINGWORD%

>>2372815

I'm losing my mind, I cannot decode my own image from the app, but another anon could UGH!

What's somewhat strange when I download the image from 8chan, it has the header even though the app removes it.

Also, I thought I saw someplace in the code where there is maximum dimensions for an image, but I can't seem to find it.

You know how a bunch of qposts have weird codes in them? Any way we could incorporate a line for line, raw text record of all drops as a password list?

I think this would be especially applicable to any knotted images found in the drops themselves, if there are any.

>>2402218

Kek! Yeah, I had a flash of terror when I though of that too.

Thankfully, no.

>>2405387

It's weird how similar the filenames are to the stringers, no idea if they encoded the passwords this way, but it's possible. How else would DS operators share passwords? and if they could share passwords why not share messages that way? why F5?

Wait a second… files that I uploaded yesterday that were encoded with PK are no longer so.

Check 'em. Their sha256 hashes no longer match their sha256 filenames. CodeMonkey must have heard about what we've discovered and not liked that his site is being used for such purposes.

https://www.rt.com/usa/434891-chinese-engineer-trade-secrets/

Steg in the news

>>2407861

How much you wanna bet half-chan is doing the same thing? We shouldn't have announced our finds so publicly. Now we can't scrape pages to find more such images. That spoils all my fun.

I discovered this while testing a python script to scrape and quickly check all the images on a page. It detected 36 images on this page on one test and none on a subsequent test without changing anything in that section of code. They must be checking and reencoding old images when accessed.

Here is my code to scrape and scan a chan and forum type sites (anything without fancy-shmancy frames or JS). Doesn't work on Pinterest, Instagram, Medium, etc.

I don't know what good it will do now that the word is out about how easy it is to find this kind of stenago. Damnit. If we find another way to detect such hidden messages let's swap PGP keys and discuss it privately.

https://pastebin.com/yAFSVY86

>>2399125

It's not just the missing header. The first 139 bytes of nearly every file in Medium is identical.

The "James" that wrote the JPEG encoder in f5.jar and PK used to sell/license that same code. It may have found it way into the Medium back end. And it's conceivable that someone annoyed by the default comment that it normally produces got a little over zealous when they went in to shut-up that section and also commented out the JFIF part.

Alternately, Medium is know to be badguy territory. Maybe they either use stegano extensively. Or perhaps they know that PK images are easily recognizable and are intentionally sowing innocuous images with same signature to create cover for people using PK.

>>2408637

I will verify this myself here soon, I believe this is a huge discovery.

So imageboard must reference the original uploaded file in the database for the site. Likely , someone has written some script to re-encode/change headers of all the jpg files that have been uploaded.

I know when I uploaded my PK image it didn't have the header, and now it does! I believe this is going to be the case for every stego file on 4&8.

This is a potential huge FU to all of us, this is why we archive offline, but it means that we cannot pass jpgs around on here since the headers (at least) have been changed or the files have been re-encoded.

IF this is indeed the case the question is why?

>>2409640

>So imageboard must reference the original uploaded file in the database for the site.

*file=filename

>>2409560

I'm not aware of Medium, is it connected to these boards?

I'm curious, is thre a PC version of Pixelknot somewhere?

>>2410424

have to run it through an emulator.

>>2373016

Can you download the jpg from my test again, and compare against your original download from Tuesday? (Sadly I don't have the original)

Also, can you even decode it – once you download the new copy of it?

Might be nothing, but "Sarah" is posting again over on halfchan. Figured I'd let you pixelfags take a look.

https://boards.4chan.org/pol/thread/180896139

>>2409701

Medium.com

One of the spoopy images we found on QResearch was traced back to hear:

https://medium.com/pedophiles-about-pedophilia/you-say-potato-i-say-pedophile-5a9ad0ee0f99

>>2412561

*here

>>2411942

I get the german huffman error with lime-cat.jpg.

>>2412101

>https://boards.4chan.org/pol/thread/180896139

steg detect was positive, these aren't following the filename formats though, i think they are changing password exchange up.

>>2416423

from a medium post from 2016 filename on medium is 1*07NuaT7Ds4D5eaufbUMVnA.png

>>2414691

There is an image called goods.jpg (pw: qanon) - that was extracted previously (not by me). Something tells me the image that was uploaded then, is no longer the same as it is now.

This refers back to >> 2408637, when I uploaded this other pick and re-downloaded it, it still has the header.

This likely means that some script was run around Tuesday sometime, that altered the images stored here and would have had to be done by someone on the back end. So if anyone was able to decode any images earlier in the bread, and have the source files (before they were uploaded), could verify that there was changes done on the back-end to those files that would be great.

If the files were re-encoded then the stego is gone, and that is a huge blow to finding more images here and on half-chan. (I'm assuming the same was done on half too)

>>2417121

I think this is the case. The photos of the letter 'Q' for example only partially worked when I was looking at these last night. avenger.jpg didn't work but GreatAwakening.jpeg still did. maybe it missed the .jpeg extensions..

>>2416423

Interesting, I'm starting to think the filenames are a result of tooling or cache systems rather than being an autokey cipher of sorts. Back to the drawing board I guess. Maybe Q will help us out later with the 'key'.

>>2417299

running 3 char combos on these files

>https://nofile.io/f/UCGFkYAMMxN/f5-detected.zip

'abcdefghijklmnopqrstuvABCDFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=-[]\|}{,./<>?" '"'"

these files done scanning with all 3 char combos and no matche

f5-detected/a5e5c137d0b352d8dbacaf8e2802f62bf59dac5dbd2b6af2d8379ac308b7b3d8.jpg

f5-detected/2c19435a6c6d0b75661f8bed4269e540bdea162d20426e2865fa99473d164863.jpg

f5-detected/51122a1f8b76dbb185dfcece22a900a07165f4f270f414afd4e4eef183863cf8.jpg

f5-detected/a1677d3d755fabf1c73b1786f5ac39f714c59cf72fc288029c166f9be119b7cf.jpg

f5-detected/abbbd389003d0b2b919ac73fcb490239be4570effacacd9c653ebbe2e2940fc8.jpg

f5-detected/11dc6ed351634c39a8faee69dc8c85b5a8a83c8f58485d69711a71a68e19783d.jpg

f5-detected/8b74493ae9233d7ed319efe95b96f9d1e16a3975c3a8d9ab1361b3fe5be4b5a8.jpg

f5-detected/18e535c2558973824cf2f11ea009066d0cd1fe3ac6c8b4bc0d5fa687d89da67a.jpg

f5-detected/1b01e2fbd7483fe2167a417ed605269fa0fc8aaf9bbd1859898ea13b22ba4dee.jpg

f5-detected/b4ffa2fe6ba7c7b732e36af3595e33a38893146d1411be202c3bc259c2d5b2ec.jpg

f5-detected/be471d6d62109bc5be47082d1cf9a537777d9f6de5b1d777d4ee113a9c47ab63.jpg

f5-detected/f5ee16710b749e2c4dd3e95a1f725723b322f9963010256dc3cffad0eddff752.jpg

f5-detected/9d65a2f8806914b900b7e51e3a16500b60b7f48dc3f52cf82958761c8aac3e96.jpg

f5-detected/57139014c39d5726885d566ad5ba134c275f7fd90ac920f7a171a4adb7dcd095.jpg

f5-detected/ef56efafa8857c6bd9f3e80f5fcdc24749ff27a95dfc0f9313cee0f4b0687c79.jpg

f5-detected/e5393fba4fcca1dab2d66f98e520503ca942e3bf42bae78de2aa08c8576fa024.jpg

f5-detected/60162fec45db2cd5f40b130fbf24f8b921748c965d297816850fb3035ca57904.jpg

>>2417121

Yeah, all the files that I had earlier, and the ones still in my browser cache, would decode fine. After a hard refresh, and a clearing of the cache, the new images showed. They are indeed re encoded and don't work. tip stego

I went through the rest of the f5 detected images and did google image searches and ruled out images that I could find somewhere else and was left with 3. The CBS eye I left in because it was posted on /pol/ and has 5D (D5 mirror) in the filename

focusing on these three now

https://nofile.io/f/au6mKPYtznQ/f5-remain-2.zip

>>2424756

You

Drop a PGP key. I want to talk to you about something privatively.

Here's mine,

https://pastebin.com/Xx5wmuWP

Remember the Wikileaks that contained Antarctica photos that John Kerry took of the ice? Didn't JA/Wikileaks put a tweet out prior to the dump with a hash code? I always wondered why photos of the ice were of significance. I am looking for the photos and the hash code tweet to see if anything is there now that I am aware of pixelknot. Any assistance would be appreciated.

>>2427826

https://pastebin.com/bem2GEHW

>>2431674

Great time for by modem to reset. :/ But that's what signing is for.

https://pastebin.com/WsRmRCJn

>>2431983

WWG1WGA

https://pastebin.com/p4TJ7smz

>>2428579

Is this the one

https://www.nytimes.com/2016/11/16/science/antarctica-john-kerry-global-warming.html

>>2428579

Or this

https://mysteriousuniverse.org/2016/11/wikileaks-photos-john-kerry-visit-and-ufos-in-antarctica/

>>2371258

What's taking so long?

They decode top secret passwords in movies in just a few minutes.

Thought that was gonna be easy peasy?

>>2439305

Maybe you are just lacking some skillz?

I did the maths - we might see some results in about 100 yrs

What is you ETA for the results?

>>2438149

Tick tock

>>2433919

>>2433945

The photos were released in one of the Wikileaks drops.

>>2449514

Well if anybody wants to study a pixelknot mask we have a source and an encode photo. also bump.

>>2449249

done, none of those

Does anybody have more details on the underlying implementation of SecureRandom? Depending on the psuedo random number generator we may be able to reduce the search space to the possible values of the seed (ex, 0 to maxint).

>>2371258

Moar results - fewer pictures

>>2450617

Beyond 4 chars we are going to have to get a lot smarter with how we pick what passwords to try. It not hard to imaging a 20 char passphrase.

One way to do this is to try the endings of long dictionary world and short words with a space and short random prefix. Then run the same set through 1337 speak substitutions. And then add ending punctuations.

Another idea I had is to score perspective random passwords based on the combinatorial frequency of character pairs. "TH" is more common than "ZD". We could have crunch generate a 100, 000 times as many passwords as we could directly check and then filter them down to the top 99.999th percentile.

Obviously the optimizing it from the start would be better. But I don't think I'm smart enough to work out all of the patterns in how people chooses passwords and phrases or to build a highly optimized generator (I could eventually, but I'm not going to spend the rest of my life on this).

In the short term we could keep a file of all failed password. Diff might get awfully bogged down comparing TB scale sets. But if the archive is kept asciibetically presorted then a custom tool could be it efficiently enough for it to be worthwhile.

>>2427826

Did you just realize the same attack vector I did? There a way we can group up outside public space? Here's a quick rundown, use your key.

https://pastebin.com/DP7avPrx

>>2463119

>>2457804

SecureRandom basically works by taking the password, hashing it with SHA1 to set the initial state (160 bits, 20 bytes), passing these bytes out as requested, and rehashing the state to create a new state when it runs out of bytes. It does this as many times as needed to create as many psudorandom bytes as requested.

This data is first used to shuffle a list of integers (0 to the number of DCT coefficents, which is also happens to be the number of pixels) which is used as a secret treasure map to scatter bits the message throughout the image. Further output of SecureRandom acts as a simple XOR cypher upon the payload message.

Without the password we don't even know which bit of what pixels and in what order contain the encrypted message. We are not even sure there IS a message. It could just be a wonky JPEG encoder.

Any kind of REAL cryptanalysis, linear or differential, is waayyyyy out of our league. And the password is always going to be the weakest part of the system. Efficient and smart password guessing is really the only option.

If you want to see the exact details you can download it directly from Oracle. https://download.java.net/openjdk/jdk8/

>>2463526

Thanks for the reply. I noticed the message byte XOR with a random byte after the fact, so yea I don't think we can reconstruct the first steps of 'the map'. If we are to take the brute force approach tho, I would suggest we patch F5.jar to short circuit if the first message byte doesn't come out as expected. We can also make it retry different passwords without reloading too to save some more time (instead of decompressing the image over and over again, reading disk, etc). Just some ideas.

>>2463615

That is exactly what I did immediately.

Lines 147 to 149. I also early abort if the 32bit message length comes out as an unreasonable number. It should never be more then a couple kilobytes.

BruteCrackPK.java. Give it a file and feed it lines through STDIN. I haven't got around to multithreading it. So just run it in four terminals.

https://pastebin.com/hu1nZLLn

When ( if ) I ever stop getting distracted by side projects, I intend to make a C based implementation. There are a lot of steps between the five state integers in the SHA algo and the permutation table could be trimmed down.

>>2463782

* Add the above to the F5-steganography files from here. Drop in next to Embed and Extract compile.

https://github.com/matthewgao/F5-steganography

ANONS

Found an old password used by Robert the Bruce in Aberdeen….

"Bon-Appart" tgry with and without dash. Try capital and lower-case. try backwards.

==Please try for password on all Q pics you can and POTUS tweet pics"

>>2463526

This paper talks about detecting F5 by analyzing the histogram of DCT coefficients. I suspect this may be a more accurate means than stegdetect.

https://ws2.binghamton.edu/fridrich/Research/f5.pdf

>>2467100

After looking at the source for stegdetect, it appears it uses exactly the method in the paper.

>>2376493

>>2463526

>>2402121

>>2461532

With PixelUnknot code, is this kind of the workflow it's taking?

get wordlist string ~ "lovely8unch0fcoconut$"

test last third string "oconut$" in e.extract(coeff, ostream, extractF5Seed(mPassword))

if matched, test DecryptWithPassword with string "lovely8unch0fcoconut$"

return secret message

else, get new wordlist string

or ist it doing this?

get wordlist string1 ~ "oconut$"

test string1 "oconut$" in e.extract(coeff, ostream, extractF5Seed(mPassword))

if matched, crunch wordlist string2 with 2x length of string "oconut$" ~ "lovely8unch0fc"

test DecryptWithPassword with string "lovely8unch0fc"+"oconut$"

return secret message

else get new string2

else get new string1

>>2469199

right now the code

https://github.com/banona/PixelUnknot/blob/master/src/q/Main.java

loads the words from the file and tries it (and every substring of the end over 3 chars) to decode the f5 layer. it early exits if the chars don't match the PixelKnot special string '—-*' and if it finds one it will print out the pass and exit. this would be the last 1/3 of the password and we can change the code back to try to decode the rest

this code is a little better, tries the word backward and forward and prints out the progress

https://pastebin.com/ZRUAzEPh

>>2469199

Neither. For detecting F5 it's analyzing the DCT histogram of the image in comparison to the (predicted) histogram of the original image before F5 data was embedded.

>>2463782

anon multithread it like this:

Files.readAllLines(filePath, StandardCharsets.ISO_8859_1)

.parallelStream()

.forEach(line -> {

// your code

});

see https://pastebin.com/ZRUAzEPh

>>2469199

>>2469702

Fuck sorry answering the wrong question… apparently I have two IDs but still getting my (you)s

>get wordlist string ~ "lovely8unch0fcoconut$"

>test last third string "oconut$" in e.extract(coeff, ostream, extractF5Seed(mPassword))

>if matched, test DecryptWithPassword with string "lovely8unch0fcoconut$"

>return secret message

>else, get new wordlist string

What I uploaded is like this, except it is modified to only do the F5 seed portion - the output of the string generator gets passed directly

<e.extract(coeff, ostream, mPassword)

>>2469295

The [1] is new actually. When I first pulled the file it was not there. Only after 'scrubpocalypse' last teusday evening did I look again and saw [1] added on the chan archives. Was strange.

>>2479397

I mean that it wasn't one on the archives before Tuesday. They CHANGED the archives. PixelKnot adds '_#' for conflicting filenames, so it wasn't from that. I literally downloaded a steg'd version from the archive without the [1]. plz no gaslight.

>>2479397

That's odd. I found the same image on Medium last week and it had the same hash as the one from /pol/. Now it doesn't. It has indeed been changed. And the archive now has one with yet a different hash.

Someone is cleaning up. Good thing we have offline backups.

>>2479397

All of the files from our reduced set all traced back to Medium, Motherboard, or Flipboard. And I spot checked a few of them last week; and the files from there had the same hashes as on their source sites.

It’s amazing the pushback I get from my own, they think I’m crazy when sharing Q. They give me every reason to prove the Great Awakening false. But I know better than they and push that they might also consider. They don’t believe me when i speak about the gospel either or the covenant our True God made with mankind.

“A prophet is not without honor, except in his own country, and his own kin, and in his own house.”

>>2482058

another one:

https://boards.4chan.org/pol/thread/181352041

https://boards.4chan.org/pol/thread/181367598

$ md5sum 1533557639424.png

9f4a2a5c8b07b183e2de8fd4908c77aa 1533557639424.png

$ md5sum 1533557639424~2.png

1831a96086323b3994c9caa924467cb4 1533557639424~2.png

The ~2 may actually be the chan's way of handling duplicate filenames.. odd the md5s are different however. saw something said something.

>>2485093

I'm probably not the first with this, but is this related? https://www.cnet.com/news/qanon-anonymous-launches-attempt-to-debunk-conspiracy-theory/

>>2486032

(I tried cntrl-f "anonymous" but on this page I got more hay than needle)

>>2482058

CM has been doing that here too, but without changing the filenames. After we found a easy way to spot the products of the weird JPEG encoder used by PixelKnot (hash the first 100 bytes) images posted here with that characteristic started being reencoded behind the scenes. 4Chan has probably heard by now and is doing the same.

>>2490756

FYI - CM / 8ch is NOT altering originals.

It's CloudFlare. When snagging the originals gotta make sure to bust the caching front ends.

A simple "?13245123" or something random at the end of the filename will help.

Also: curl -H -vvvv is your friend.

Finally: the jpeg header hex signature isn't a 100% guarantee it's PixelKnot. All it says is that the image has been through some sort of image editing tool.

The more you know…

>>2490855

I posted this image that I made with PK,

>>2384816

It has been totally reencoded. It's not a case of them appending a few bytes.

8chan uses the SHA256 sums of files when they're uploaded to uniquely identify them. Grab a random file from around here and check it. The SHA256 hash of the above impostor is now

e27a833560d84ee9260920b61f8ec4de287386b2eddd22774c885b929b32b38b

They would never just stick extra bytes onto the end of a file. And they have no reason to "bust the cache" for guaranteed uniquely named static content. It's only files missing their JFIF headers that are mysteriously changing.

>>2490855

failed to confirm, avatar.jpg still doesn't extract correctly when fetching uncached with ?blablabla.

>>2491957

did you post the password somewhere for that photo? I can run a test on my end to confirm.

>>2491957

steg detect comes back negative on your photo btw.

>>2490855

The more you know, you mean? I have confirmed this myself, files were altered on here on last Tuesday sometime. Someone got worried and started re-encoding files on the back-end. AFAIK they only did it in once, on last Tuesday, this was to prevent us from finding more images that were uploaded. So basically we have whatever we have archived, everything beyond that point is likely lost forever.

>>2490855

I agree. I uploaded a test image last bread. The hash hasn't changed (I checked against my own copy). Downloading the file and running sha256sum returns an identical hash.

>>2346641

Test image I uploaded in this comment still works. sha256sum starts with 3b51fbf. Right clicking on the file link, pasting the link to download with wget works. Use the link on the left side (with a hash). Using the one on the right side (user-friendly filename) resulted in a different sha256sum.

Downloading using the link on the right side had a different hash.

$ cd /tmp
$ wget https:''//''media.8ch.net/file_dl/3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg/pixelknot_test_image.jpg
--2018-08-09 00:13:11--  https:''//''media.8ch.net/file_dl/3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg/pixelknot_test_image.jpg
Resolving media.8ch.net (media.8ch.net)... 104.20.44.57, 104.20.43.57
Connecting to media.8ch.net (media.8ch.net)|104.20.44.57|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 21247 (21K) [image/jpeg]
Saving to: ‘pixelknot_test_image.jpg’

pixelknot_test_image.jpg     100%\[=============================================>\]  20.75K  62.1KB/s    in 0.3s    

2018-08-09 00:13:13 (62.1 KB/s) - ‘pixelknot_test_image.jpg’ saved [21247/21247]

Downloading using the link on the left side had the correct hash.

$ sha256sum pixelknot_test_image.jpg
b8fb084705fb6301e6313c5207e8a71d39d4bbd850fc568dfd90bf99006c0b01  pixelknot_test_image.jpg
$ 
$ wget https:''//''media.8ch.net/file_store/3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg
--2018-08-09 00:14:13--  https:''//''media.8ch.net/file_store/3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg
Resolving media.8ch.net (media.8ch.net)... 104.20.43.57, 104.20.44.57
Connecting to media.8ch.net (media.8ch.net)|104.20.43.57|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 28771 (28K) [image/jpeg]
Saving to: ‘3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg’

3b51fbf8b6a2597e1e31ca33c6b8 100%\[=============================================>\]  28.10K  --.-KB/s    in 0.1s    

2018-08-09 00:14:13 (223 KB/s) - ‘3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg’ saved [28771/28771]

$ sha256sum 3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg
3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98  3b51fbf8b6a2597e1e31ca33c6b836af6d70054ca14155461381ff67118aaf98.jpg
$ 

>>2521648

Oops, I split the terminal output at the wrong spot. The first line in the second section should have been at the end of the previous section. Also, extra characters were added to the beginning of the download urls by the board apparently. So not the best example, but the point is to download using the left link (the one with the hash, not the user-friendly filename).

>>2521648

Curious. The originals have all been restored.

Anyway, this thing seems to have fizzled. There is a legitimate explanation for all of the spoopyness that we have been examining. It's coming from Medium's weird backend image resizing code. They appear to be using the same funky Java-based encoder library from the late '90s that's only other use was in the F5 stegano demo code, also from the late '90s, which is what PixelKnot is based around.

So I think I might switch teams and instead work on patching all the problems with F5 and PixelKnot. ;)

>>2525416

Very strange indeed. The fuckery occurred on Tuesday July 31st. I believe the following day I uploaded an image here and downloaded it the following day, and it was unchanged from the OG (still had PK header – missing JIFF). The following days I downloaded an image that I had uploaded prior to the 'fuckery', and it had the JIFF header (and wasn't a PK file). I just downloaded the same image now, and it's been restored and is the same as the one I uploaded prior to the 'fuckery' on July 31st.

Hard to know if all the files have returned to the originals, maybe some of the F5 files that had important messages were never restored.

I think we should work on a distributed BF tool, would be great if it could be done is JS, so we can have people just visit a website and have it go. There is a f5 JS stego, but it's not compatible with this one, but perhaps it could be altered to be compatible.

>>2371258

>YOU CAN HELP

>look at the old posts, at the id of the post and replies

>find the originals

>figure out clues for the keys

Or, alternately, you could just go to 4chan where Q gets all his info and get it yourself. You're in a messageboard roleplaying game and you don't even know it. But oh well, carry on detectives

8 char password.

So he wanted it hackable or he is fake. why wouldn't an intel person add another char or 2?

That would make it infinitely harder to crack. So either Q is a genius or a complete moron.

Pamphlet is a moron soooooo… who knows?

>>2541994

I think this was done on purpose by Q's Peeps to give some insight or help with hacking the STEG images. We have been asking for help, maybe this is it!

>>2525792

I finally quit screwing around and got that C-based cracker I've been talking about to a (unfinished but) usable state. It's a bit faster than the Java code, but not by as much as I had thought. I have newfound respect for the JIT compiler.

(You can probably tell from my folk-code that I'm not a professional programmer. I'm a welder and machinist at a widget factory. All that I know about coding I learned through many late segfault filled evenings. )

https://nofile.io/f/NB4x9EOZYd3/BruteCrackF5.zip

>>2537744

The ambitous stego decode here has apparently been silently abandoned (because the approach was ill-defined and doomed to fail)

>>2567227

…because we don't know what software was used… or if there is even anything there.

Q linked to the PixelKnot app. PK leaves behind a very distinctive signature in the JPEG file that does not exist in the Sarah Silverman pic. So either 1) it's a modified version of PK made to fix its weaknesses, it's and entirely different program, or there is no hidden data and Q was simply citing PK as an example of the sort of thing that is widely uses on the Chans.

If there is an expectation that were are to crack this thing then we are going to need more clues.

>>2573936

it amazes me how dead this thread is, Q gives us an android app the decode messages from images/memes and we only go 270 posts deep digging it? come on guys, wheres the beef?

>>2573936

In the previous bread you said you were trying RockYou and some others against the SS pic. Did you finish? And was this only with the last third of the password?

>>2576121

They just want to be spoon feed now, liked zoo animals who have lost the talent to hunt and are just bored and lazy.

Then they can still tell all their friends about how they researched and gave it to Q to a take action.

After all do you think Lenin & Trotsky did any street fighting in their revolution?

>>2576121

They gave up on guessing the password and didn't even know the length to brute force it

>>2622913

>looked closely and I think what you did is perfect for GPU

Really? The random series generation is pretty straight forward. But the permutation stage is all out-of-order memory access. And the decrypt stage is very heavy in conditional branching.

>still need more target images

https://pastebin.com/Mj4d1jXM

It doesn't look like spidering through chan sites looking for PK images is going to work. 8chan has started reencoding again. And I tested halfchan: they don't fully reencode, but do add the missing JFIF header. Game forums are likely going to be the same way.

So until Q points at a image and says, "This pic contains a hidden message and was used by No Name to arrange a weapons sale. Have at it boys!" then I don't think there is anything left for us to do with this.