Tok Janggut
Repair a corrupted JPEG header to recover Tok Janggut's historical image and the flag hidden inside it.
Tok Janggut
Challenge Overview
- Event: Bahtera 3108 2025
- Category: Forensics
- Points: 100
Pada tahun 1915, Tok Janggut bangkit menentang penjajahan British di Kelantan. Selepas pertempuran tragis di Pasir Puteh, satu-satunya gambar terakhir beliau disimpan dalam bentuk digital oleh seorang sejarawan moden.
Namun, gambar bersejarah ini telah diubah oleh pihak tidak bertanggungjawab, dipercayai untuk memadam bukti perjuangan beliau.
Sebagai penyiasat forensik, tugas anda adalah untuk membaik pulih fail ini dan mengesan mesej rahsia yang tersembunyi dalam gambar tersebut.
The supplied image would not open normally, so I inspected it in the HexEd.it online hex editor.
Inspecting the File Header
The first bytes were clearly not a valid image signature. They began with the placeholder sequence 12 34 56 78 90 AB CD EF even though the rest of the file contained JPEG-related data such as JFIF and Exif.

I compared the file against the list of file signatures. A JFIF JPEG should begin with the following bytes:
FF D8 FF E0 00 10 4A 46 49 46 00 01

Repairing the JPEG
I replaced the corrupted opening bytes with the correct JFIF signature. The repaired header now began with FF D8 FF E0 and retained the existing JFIF marker.

I then saved the repaired file with the .jpeg extension.

Opening the repaired image revealed Tok Janggut’s portrait and the flag printed across it.

Flag
3108{T0K_J4NGGUT_P3JU4NG_J1H4D} Authorized security practice only. These notes are for lab, CTF, and explicitly permitted environments.