The Anatomy of the IHDR Height Exploit
In PNG files, the IHDR chunk immediately follows the 8-byte file signature. It hardcodes image width (4 bytes) and height (4 bytes). Image renderers decode precisely up to the specified height and terminate.
CTF authors frequently shrink the height from 600px to 200px to crop out a flag drawn at the bottom. However, because they edit the bytes directly in a hex editor, they leave the original 4-byte CRC32 checksum untouched.
The CRC32 mismatch is an immutable proof that the height was altered. Bruteforcing height from 1 to 8192 reveals the original dimension.
High-Speed In-Browser Bruteforce
Our PNG chunk repairer iterates through height values directly in browser memory using precomputed CRC32 tables. When a height candidate yields a CRC matching the stored chunk trailer, the true height is restored and the hidden flag is exposed.