I already posted this in another thread - but I thought I would repeat it as it is important for the value of PB screenshots as proof of cheating.

Lately, some claims have been made that fake PB images are easy to make.

I did a couple of experiments...

I opened the image aab.png in a hex viewer.  The .png format has certain tags in the start of the file.  PNG, IHDR, IDAT was there in the original file.  I then opened the file in PSP7 and MS Paint (5.1 from WinXP) and saved a copy in each without making any changes.

PSP7 adds the tIME, pHYs, and gAMA tags btween IHDR and IDAT.  

MS Paint adds sRGB, gAMA, cHRM, and pHYS between IHDR and IDAT.

I then opened the file that had been saved with MS Paint in PSP7 and saved it again.  The tags added by MS Paint were gone, and the same tags as the original PSP7 save where there.

And then there is the filesize changes...

Original size: 48740 bytes
Saved with PSP: 58319 bytes
Saved with MS Paint: 62829 bytes
Reopened MS Paint copy, saved a second time: 62829 bytes
Open MS Paint copy in PSP7 and saved: 58319 bytes.

I repeated this for one other image as well: aaa.png
The PNG tag differences were the same as before.

Original size: 77036 bytes
Saved with PSP: 61659 bytes
Saved with MS Paint: 89088 bytes
Reopened MS Paint copy, saved a second time: 89088 bytes
Open MS Paint copy in PSP7 and saved: 61659 bytes.

Conclusion

Anti-tamper indication 1:
The PB PNG image is most likely NOT tampered with if it contains only the PNG, IHDR and IDAT tags.

Anti-tamper indication 2:
Both MS Paint and PSP7 saves the image to a different size than the original. ie if the size DIFFERS from the original - the original has most likely NOT been tampered with.

Someone else might want to repeat this with other popular image editors. My bet is that you will find characteristica that are unique to those editors as well.

Posted this at other thread too.

Couldn't you simply remove the Photoshop/Pain/etc tags with a hex-editor?
Did you try this?

And are all PB-screens the same size?

That would have to be a pretty advanced hex editor... or you would have to leave an area of zeros in the header, which most likely would make the file invalid.  I haven't actually studied the PNG file format in detail, but it seems to be CRC checked as well.  

The PB scr shots are not the same file size - they are compressed - and the image sizes - ie screen area - can be set individually for each server.

I am not saying it can't be done, but you would have to do some serious crufting to make it happen.  Who would take all that trouble and go to such length to fake an image of a cheat?

that doesnt really make sense tho... what u say is that whatever pb ss u open in pic editing prog, it adds some more code thus the change in filesize.. that change does not  in any way prove a fake screen.

Stage,

That is my theory as well... that all image editors will leave traces in the PNG header that makes an edited image distinguishable from the real McCoy.

nice work fuz. is there anyway you can pass this along to the people at punkbuster so they could put it on their site if they deem it reliable. im just trying to get this info out to as many people as possible, im sure they would be intrested. also i would send it to the people at www.punksbusted.com im sure they would find it intresting and would probably post it.

Thanks, Turgon.

I did actually mail Bjoern (from evenbalance), and he promised to get back with further info next tuesday.  

I suggested a service where u could upload an image to EvenBalance's web site and get an automated validation of authenticity - but it remains to be seen if they will bite

Cheating is a problem - but so is being wrongfully accused - so hopefully we will be able to validate the PB images to rule out picture manipulation.

The ability to make OSP take screenshots at different intervals increased the chance to get the cheaters, and there is nothing more satisfying than to watch them get caught.  

Play honestly, play fair, play fun. Cheats are for losers.