Fc2-ppv-1864525 [DIRECT × SERIES]

# Get the offset of the final `moov` atom (e.g. 124,567,890) tail -c +124567891 fc2_1864525.mp4 > trailing.bin hexdump -C trailing.bin | head The dump shows plain ASCII:

dd if=fc2_1864525.mp4 of=payload.bin bs=1 skip=124567890 strings payload.bin | grep -i flag # => flagFC2_PPV_1864525_fake Flag: fc2-ppv-1864525

from morse_talk import decode_morse # Convert the timing into dots/dashes manually or with a script. # The result: .... .-.. .-.. --- ... (example) Decoded text: – again a hint that the flag is embedded elsewhere. 7. Final Flag Extraction The most reliable source turned out to be the trailing bytes after the MP4 container. 7.1 Isolate the trailing segment # Find the start of the trailing data (use `mp4dump` from Bento4) mp4dump fc2_1864525.mp4 | grep -n 'moov' # last occurrence gives offset # Assume last moov ends at byte 124,567,890 # Get the offset of the final `moov` atom (e

https://video.fc2.com/content/2022/09/1864525_720p.mp4?auth=... wget -O fc2_1864525.mp4 "https://video.fc2.com/content/2022/09/1864525_720p.mp4?auth=..." The file size is ~120 MB – typical for a 720p MP4. 3. File Inspection 3.1 Basic file info file fc2_1864525.mp4 # => ISO Media, MP4 Base Media v1 [ISO 14496-12] ... (example) Decoded text: – again a hint that

import re, sys, json, urllib.parse, requests html = open('page.html').read() m = re.search(r'var\s+videoUrl\s*=\s*"([^"]+)"', html) url = urllib.parse.unquote(m.group(1)) print(url) Result (example):

zsteg -a frames/frame_00123.png No obvious LSB payload. The audio track is often used for hidden data. 6.1 Convert audio to WAV ffmpeg -i audio.aac audio.wav 6.2 Spectrogram inspection sonogram -i audio.wav -o spectrogram.png # (or use Audacity → Analyze → Plot Spectrum) The spectrogram shows a faint pattern resembling Morse code near 10 s. 6.3 Extract Morse Export the 8–10 s slice:

But let’s assume the real challenge hides it deeper (e.g., the trailing data is just a decoy). We’ll keep digging to illustrate a full methodology. Even though we already located a flag, extracting the raw streams is useful for later analysis.