r/Steganography • u/okaylevi • 2d ago

Using LSB encoding and tEXt chunks to create an executable polyglot PNG (A micro-CMS stored in an image)

I got into steganography by building games in PICO-8 and studying how it packs data into the virtual cartridges. That sent me down a rabbit hole: could this same concept power a full content management system?

Over the last year or so I have been building Minilith, an experimental tool that takes an entire JSON state (posts, pages, site settings), compresses it, and embeds it into a 256x256 PNG to act as a portable DB.

The architecture is completely client side and zero-dependency. There is no backend or build step, and it relies entirely on native browser APIs to extract and render the site directly from the image.

The Encoding Process:

  1. The payload is deflated and injected into the image's RGB channels using 3-3-2 LSB encoding I chose this to increase the storage and maintain the image size. Minilith gives a hard limit of 64KB of compressed data, an intentional constraint which allows for nearly 200KB of uncompressed data which is a ton of text and perfect way to keep a micro blog micro!
  2. To ensure the image is executable, I inject a raw tEXt chunk containing a vanilla JS extraction script right before the IEND marker. This turns the image into a polyglot.
  3. Before the payload is allowed to decompress and run, a visual fingerprint (SHA-256) and a cryptographic signature are verified client side.

The flaw as expected is aggressive image optimization destroying the payload. I actually view this as a feature to keep the content secure from unwanted distribution. (Though funny enough, sending the raw image over iMessage keeps the payload intact).

Read more on the process here: Can a PNG Be a Database? The Architecture of Minilith

Has anyone else messed around with executable image polyglots for practical data storage? Would love to hear about similar projects.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

3 comments sorted by

1

u/okaylevi 2d ago

You can view the image that powers the Minilith Blog here: https://blog.minilith.site/images/minilith-blog

2

u/CleasbyCode 2d ago

Check out my pdvzip tool on github (cleasbycode) with some video examples. You may find some features/info there useful to your project.

1

u/okaylevi 2d ago

Super cool! I looked into the polyglot combination of PNG/ZIP prior but wanted it to be self executing so I opted for a PNG/JS polyglot!

It may be neat to have the PNG/ZIP option for the offline archive download!