@Guest
Here you have the source code:
https://mon-partage.fr/f/WkYqI6uE/
https://megaupload.nz/9232Abo5b0
https://megaup.net/nh1R/pngfixer_src.7z
https://www.mirrored.to/files/CYI9TWEE/pngfixer_src.7z_links

And the binary compiled for windows (used cgywin32 in windows 7)
https://mon-partage.fr/f/WkYqI6uE/
https://megaupload.nz/0f4fA6o3b1
https://megaup.net/nh1X/pngfixer.7z
https://www.mirrored.to/files/Q7XNWLDH/pngfixer.7z_links

The link doesn't works. Please reup. Thaks.

Full source code for decrypt and encrypt any png, i tested in Linux and works at 100% (7kb's)

http://www111.zippyshare.com/v/HwUsqHNI/file.html

tha bad news is..the engine checks if the image it's manipulated, i mean, i can modifiy a bit an image, then encrypt again, but is not working, looks we have some crc file check there?

It's just a source snippet written in C. If you want to build yourself a fully working solution, you will have to write it yourself. My snippet will just give you idea about the attack vector i used.

Noob question, but how do you run that on windows?

#include <windows.h>
#include <stdio.h>
#include <direct.h>
#include <vector>

unsigned int crc32(char *buf, size_t len);

int readint32(FILE *fp)
{
int ch, value = 0;

for(int i = 3; i >= 0; i--)
{
if( (ch = getc(fp)) == EOF )
return 0;
value |= (ch << (i<<3));
}

return value;
}

unsigned int swap_endian(unsigned int value)
{
unsigned char *bytes = (unsigned char*)&value;

std::swap(bytes[0], bytes[3]);
std::swap(bytes[1], bytes[2]);

return value;
}

int getfiles(const char *search, std::vector<std::string> &files)
{
WIN32_FIND_DATA ffd;
HANDLE hFind;

hFind = FindFirstFile(search, &ffd);
files.erase(files.begin(), files.end());

if (INVALID_HANDLE_VALUE == hFind)
{
return -1;
}

do
{
if (!(ffd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY))
{
files.push_back(ffd.cFileName);
}
}
while (FindNextFile(hFind, &ffd) != 0);

return files.size();
}

int main(int argc, char **argv)
{
std::vector<std::string> files;
unsigned int w, h, i;
char filename[256];
std::vector<char> data;

getfiles("*.png", files);

for(i = 0; i < files.size(); i++)
{
FILE *fp;
int crc, offset, length;

strcpy_s(filename, files[i].c_str());

if( fopen_s(&fp, filename, "rb+") )
break;

int header = readint32(fp);

// skip unused bytes
readint32(fp);

if( header != 0x89504e47 )
{
printf("%s is not a PNG...\n", filename);
fclose(fp);
continue;
}

offset = 0;
while((length = readint32(fp)) > 0)
{
data.resize(length + 4, 0);

offset = ftell(fp);
fread(&data[0], 1, data.size(), fp);
crc = readint32(fp);

if( memcmp(&data[0], "IHDR", 4) == 0 )
{
break;
}
}

if( length == 0 )
{
printf("failed to find IHDR in %s...\n", filename);
fclose(fp);
continue;
}

bool doneProcessing = false;
for(w = 1; !doneProcessing && w < 2048; w++)
{
for(h = 1; !doneProcessing && h < 2048; h++)
{
*(unsigned int*)&data[4] = swap_endian(w);
*(unsigned int*)&data[8] = swap_endian(h);

if (crc32(&data[0], data.size()) == crc)
{
printf("%s correct size: W:%d x H:%d\n", filename, w, h);
fseek(fp, offset, SEEK_SET);
fwrite(&data[0], 1, data.size(), fp);
doneProcessing = true;
}
}
}

fclose(fp);

if( doneProcessing == false )
{
printf("Failed to find a correct size for %s...\n", filename);
}
}

return 0;
}