7 of the Wireshark series uses WinHex to restore files

Next, we use WinHex to restore the uploaded image from the saved original file.

Open the previously saved temp.bin with WinHex, and you can see that the file contains the HTTP request information, our picture information, and the tail information at the end of the file. What we need to do is to determine the header and tail of the original information of the image file and remove the redundant parts.

Going back to Wireshark, you will see the header of the image in the data stream we just saw.

There are two newline characters after Content-Type: p_w_picpath/pjpeg. In the original file, the newline character is "0D 0A" in hexadecimal. Because there are two, we look for "0D 0A 0D 0A" near the picture name test.jpg, and the latter part indicates the beginning of the picture.

At this time, we need to remove the part above the picture. Click alt+1 at the 00000000 offset to indicate the start of block selection.

Click alt+2 at the last 0A at "0D 0A 0D 0A" we found. Indicates the end of the block selection. At this point, we selected the extra part before the picture.

Press the delete key to confirm deletion of the extra headers in the file.

Back in wireshark, let's take a look at the tail after the picture has been transmitted. As you can see, this time it is a newline character, followed by some "-" at the end of the file.

Also delete them from the original file.

At this point, we will only have the contents of the original picture in our file. Save the file as test.jpg.

The most exciting step is to finally see the real content of the picture.