Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

stegdetect: missing rules.ini for stegbreak and FTBFS #3965

Closed
2 tasks done
135e2 opened this issue Oct 3, 2023 · 4 comments · Fixed by #3967
Closed
2 tasks done

stegdetect: missing rules.ini for stegbreak and FTBFS #3965

135e2 opened this issue Oct 3, 2023 · 4 comments · Fixed by #3967

Comments

@135e2
Copy link
Contributor

135e2 commented Oct 3, 2023

  • I have searched open and closed issues for duplicates
  • I am submitting a bug report for existing functionality that does not work as intended

Bug description

Attempting to use stegbreak (part of stegdetect) to search for a JPHSed file leads to the following error:

stegbreak -f ~/Projects/ctf/rockyou.txt -tj hide\ and\ seek.jpg
stegbreak: fopen: /usr/share/stegbreak/rules.ini: No such file or directory

After some searching, I found some related bug reports (from a loooooooong time ago):
[Debian Bug #345230]
[Ubuntu Bug #55363]

Had to download the rules.ini from comments to /usr/share/stegbreak/ to make stegbreak work.
Although it can be manually configured by end-users using the -r <rules> chooser, providing a usable default rules file would greatly enhance user experience.


What's worse, trying to build from the PKGBUILD results in a FTBFS:

gcc  -O2 -Wall -g  -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now -o stegdetect common.o jphide_table.o util.o stegdetect.o chi2cdf.o extraction.o discrimination.o math.o dct.o jutil.o f5.o dirname.o md5.o -L./jpeg-6b -ljpeg -L./file -lfile -lm -L./jpeg-6b -ljpeg
/usr/bin/ld: ./file/libfile.a(file.o):(.bss+0x8): multiple definition of `progname'; stegdetect.o:/home/shang/stegdetect/src/stegdetect/stegdetect.c:76: first defined here
collect2: error: ld returned 1 exit status
make[2]: *** [Makefile:557: stegdetect] Error 1
make[2]: Leaving directory '/home/shang/stegdetect/src/stegdetect'
make[1]: *** [Makefile:631: all-recursive] Error 1
make[1]: Leaving directory '/home/shang/stegdetect/src/stegdetect'
make: *** [Makefile:448: all] Error 2
==> ERROR: A failure occurred in build().
    Aborting...

I understand that the stegdetect project is quite obsolete and hasn't been maintained for years, with a CVE, easy-to-trigger segfaults, and outdated source code. However, stegbreak remains the only program that can launch dictionary attacks against the JPHS algorithm (afaik).
I sincerely appreciate the packaging work you all have done and hope for an update.

Actual result: stegbreak cannot run without rules.ini, FTBFS
Expected result: have the rules.ini installed as default (without the need to manually download and specify)

Info for developers

GNU/Linux distribution: ArchLinux
Tool version: 20.28a4f07-1

@135e2 135e2 added the type::bug Valid bug label Oct 3, 2023
@ikstream
Copy link
Member

ikstream commented Oct 4, 2023

rules.ini link for reference https://launchpadlibrarian.net/16697277/rules.ini

@ikstream
Copy link
Member

ikstream commented Oct 4, 2023

There seems to be a solution to the compile issue. I tried to build from the provided source, and it works. We would need to create a patch file from there, so it can be applied during the build process.

If you have some time at hand I would appreciate it, if you could have a look at it. If not, it might take a moment to fix this for me.

@135e2
Copy link
Contributor Author

135e2 commented Oct 5, 2023

There seems to be a solution to the compile issue. I tried to build from the provided source, and it works. We would need to create a patch file from there, so it can be applied during the build process.

If you have some time at hand I would appreciate it, if you could have a look at it. If not, it might take a moment to fix this for me.

Roger. PR #3967 is ready for review.

@ikstream
Copy link
Member

ikstream commented Oct 5, 2023

Thanks a lot!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants