Magic Ways — BroncoCTF 2026

Description

I rubbed this lamp and out came challenge.png. But, I can't open it for some reason. Help me out and maybe I'll grant you a wish (flag).

A file challenge.png is provided but cannot be opened by any image viewer. The goal is to repair the corrupted PNG and read the flag rendered inside it.

Analysis

The title "Magic Ways" is a semantic clue pointing at PNG magic bytes (the file signature). The flag bronco{REDACTED} confirms this.

file challenge.png reports only data, not a PNG image, so the header is broken. A hex dump of the first bytes reveals the exact damage:

$ xxd -l 64 challenge.png
00000000: dead beef 0000 0000 0000 000d 4948 4452  ............IHDR
00000010: 0000 01f4 0000 0000 0802 0000 00...        ................

Findings:

• PNG signature destroyed — the first 8 bytes are de ad be ef 00 00 00 00 instead of the correct 89 50 4e 47 0d 0a 1a 0a. The deadbeef marker is a classic "I was corrupted on purpose" tell.
• IHDR chunk otherwise intact — length 00 00 00 0d = 13, type IHDR.
  • Width = 00 00 01 f4 = 500.
  • Height = 00 00 00 00 = 0 (zeroed — this is invalid, a PNG cannot have height 0).
  • Bit depth = 8, color type = 02 (truecolor RGB).
• Chunk CRCs zeroed / invalid — the IHDR CRC and other chunk CRC fields were wiped, so even after fixing the signature pngcheck still complains.
• First IDAT length = 00 00 19 3d = 6461 bytes, zlib header 78 9c.

So three things must be repaired: the signature, the IHDR height, and every chunk CRC.

Recovering the height from IDAT geometry

...