SnipRecover CLI

Detection and restoration of Windows Snipping Tool PNG captures vulnerable to CVE-2023-28303

SnipRecover CLI is a minimal, dependency-free command-line utility designed to:

• Detect PNG files modified by the Windows Snipping Tool vulnerability (CVE‑2023‑28303).

• Restore the original image by recovering compressed data appended after the IEND chunk.

By default, restored images use RGBA and a resolution of 1920×1080, and if no output path is specified, the tool writes to restored-<original_name>.png.

🧠 Theoretical Background

According to the PNG specification (ISO/IEC 15948), all image data (IDAT chunks) must appear before the final IEND chunk. Windows Snipping Tool mistakenly appends additional IDAT data after IEND, violating the standard and exposing the full image content that was “cropped.”

Standard PNG structure:

1. Signature (8 bytes): 89 50 4E 47 0D 0A 1A 0A

2. Chunks:

   • IHDR: image header (width, height, color type, etc.)

   • IDAT: compressed pixel data

   • IEND: end-of-file marker

A Snipping Tool–cropped PNG contains extra bytes beyond IEND. SnipRecover CLI detects this anomaly and reconstructs the compression stream to recover the original image.

🚀 Installation

Prerequisites:

• Python 3.10 or newer

Steps:

git clone https://github.com/m31r0n/SnipRecover-CLI.git
cd SnipRecover-CLI
chmod +x sniprecover

No external libraries are needed—only Python’s standard _struct_, _zlib_, and _io_ modules.

⚙️ Usage

# Display help
python3 sniprecover --help

# 1. Detect vulnerable PNG(s)
python3 sniprecover detect /path/to/images/

# 2. Restore a cropped capture
python3 sniprecover restore capture.png --output restored-capture.png

Note: If you omit --width, --height, or --alpha, defaults of 1920×1080 and RGBA are applied. If you omit --output, restored images are saved as restored-<original_name>.png.

🔧 Restore Options

📁 Project Structure

SnipRecover-CLI/
├── sniprecover      # Main CLI executable (make sure it's executable)
└── README.md        # Documentation and theory

🔗 References

• CVE‑2023‑28303: Windows Snipping Tool vulnerability – Microsoft Security Response Center

• PNG Specification (ISO/IEC 15948) – W3C

📜 License

MIT © 2025 – Developed by m31r0n