From 4235feb25769cc74f64046f9dafe032e9450fa71 Mon Sep 17 00:00:00 2001 From: pulorsok Date: Fri, 14 Aug 2026 16:46:45 +0800 Subject: [PATCH] fix: replace image URLs that serve WebP under a .png name The PDF build has failed since early August, which stops Read the Docs from publishing any format. Builds 5edfa4f and later end with: ! error: (file dna1NWm_xl.png) (readpng): internal error libpng error: Not a PNG file ! ==> Fatal error occurred, no output PDF file produced! The seven cdn.imgpile.com images in the DroidKungFu and GoldDream sections now return WebP data while keeping the .png extension and an image/png content type. Browsers detect the real format and render them, so the HTML pages look fine, but LuaLaTeX picks its decoder from the file name and libpng rejects the WebP payload. latexmk then exits 12 and Read the Docs marks the whole build failed, so the successfully built HTML is never published. The site has served the 2026-07-31 build ever since. Convert the seven images to real PNG files, re-host them alongside the other report images, and point the document at the new URLs. All four Sphinx builders pass locally, and every one of the 100 images the LaTeX builder downloads is now a valid PNG. Nothing in this repository changed to cause this; the image host began converting stored files to WebP. Co-Authored-By: Claude Opus 4.7 (1M context) --- docs/source/malware_report.rst | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/source/malware_report.rst b/docs/source/malware_report.rst index f72fdd42..e695ec17 100644 --- a/docs/source/malware_report.rst +++ b/docs/source/malware_report.rst @@ -11,7 +11,7 @@ With these rules, Quark is now able to identify the DroidKungFu malware family a Below is a summary report of a DroidKungFu sample (``D277C97B1A8A78F859672B4A20E74B3313E9F964E68A6E857C1E9D33763434A5``). The report shows that Quark identified the sample as **high-risk** and provided a list of the sample's behaviors. -.. image:: https://cdn.imgpile.com/f/dna1NWm_xl.png +.. image:: https://i.ibb.co/99dXBM7f/quark-dna1-NWm-xl.png Identified Well-Known Threats ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -20,7 +20,7 @@ With Quark's rule classification feature, analysts can generate behavior maps an **1. Gain unlimited access to a device** -.. image:: https://cdn.imgpile.com/f/4nCi9mL_xl.png +.. image:: https://i.ibb.co/ZpGgwNjL/quark-4n-Ci9m-L-xl.png The diagram shows that the ``Lcom/google/update/UpdateService;getPermission2`` function runs shell scripts and Linux commands directly, and also calls the ``Lcom/google/update/Utils;oldrun`` function to execute additional commands. @@ -31,7 +31,7 @@ Behaviors detected by Quark: **2. Install/Uninstall additional apps** -.. image:: https://cdn.imgpile.com/f/jpAr3Tm_xl.png +.. image:: https://i.ibb.co/23Qfyq76/quark-jp-Ar3-Tm-xl.png The diagram shows that the ``Lcom/waps/k;a`` function installs APKs from a file, and calls the ``Lcom/waps/l;a`` function to install more APKs and the ``Lcom/waps/k;b`` function to connect to a URL. @@ -42,7 +42,7 @@ Behaviors detected by Quark: **3. Forward confidential data** -.. image:: https://cdn.imgpile.com/f/TsURgyN_xl.png +.. image:: https://i.ibb.co/zT3vVjBB/quark-Ts-URgy-N-xl.png The diagram shows that the ``Lcom/madhouse/android/ads/_;_`` function queries confidential data such as SMS and call logs and also calls the ``Lcom/madhouse/android/ads/_;__`` function to check for network connectivity. @@ -651,7 +651,7 @@ With these rules, Quark is now able to identify the GoldDream malware family as Below is a summary report of a GoldDream sample (``ECA3A3666B0FD72028431431E7FAE6774A8CA692E35AE3CB44FD8F2AA418F746``). The report shows that Quark identified the sample as **high-risk**, with a list of behaviors as evidence. -.. image:: https://cdn.imgpile.com/f/qg9XDXG_xl.png +.. image:: https://i.ibb.co/zVzQntPH/quark-qg9-XDXG-xl.png Identified Well-Known Threats ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -660,7 +660,7 @@ With Quark's rule classification feature, analysts can generate behavior maps an **1. Monitor SMS messages and phone calls** -.. image:: https://cdn.imgpile.com/f/egCf5BD_xl.png +.. image:: https://i.ibb.co/QFcHWfYR/quark-eg-Cf5-BD-xl.png The behavior map shows that the ``Lcom/sjhi/client/zjReceiver;onReceive`` function monitors SMS messages and phone call activity. It also calls the ``Lcom/sjhi/client/zjReceiver;a`` function to collect the data into files. @@ -673,7 +673,7 @@ Behaviors detected by Quark: **2. Upload SMS messages and phone calls to remote servers** -.. image:: https://cdn.imgpile.com/f/SOrA9Qz_xl.png +.. image:: https://i.ibb.co/rGGtzyWJ/quark-SOr-A9-Qz-xl.png The behavior map shows that the ``Lcom/sjhi/client/e;a`` function connects to a URL and writes a file to an output stream. If the output stream is from the URL, this indicates the function uploads a file to a remote server.