that py script is trash, can't tell its ass from a hole in the ground
This is not a consistent way to find f5 images. In fact, it doesn't even work with the q test image available in this thread. Also, I see the same patterns in images I've created myself. Also if you use a hex editor to examine various images that are implicated as f5 this pattern does not fit. If you want to start comparing I recommend using beyondcompare and renaming the jpg to txt.
Still trying to determine that consistently. I saw someone here using stegdetect but I haven't tried it yet and it looks like based on settings you use can result in a high rate of false positives
You got the fellow anon part right but sliding, in the same thread?
Yours is the first I've seen that matches that cap (just started working on this today). Do you have other images that fit this pattern? Otherwise, I haven't found any yet and the other version of the q example image had the FF C0 starting at 9E not 88, something isn't fitting here.
As for the python script its looking for files that begin with 'ff d8 ff db 00 84' which I also haven't found any images posted as examples on the board fitting this format.
This is also just one implementation of f5 with the missing jfif header. There are many from my understanding.
The CBS eye everyone keeps posting is 9E not 88 and has a header.
many others are FF C2 around 9E instead of C0.
No it looks like its just how I've been downloading the image to check it.
Thanks for the example and showing me what I was doing wrong, perhaps you'd like to confirm.
Without expanding the image, right-click and save image as. View the hex.
Then expand or use the direct link above the image and you get that header.