About glotfiles

What this is

glotfiles builds polyglot files: single files whose bytes satisfy two or more format specifications at the same time. One file can be a valid PDF and a valid ZIP, and both readers consider it well-formed. Nothing is renamed, wrapped or hidden — the formats genuinely coexist in the same byte stream.

It runs in the browser, needs no account, and processes files in memory. Nothing is written to disk or retained after the result is returned.

Why polyglots are possible

File formats disagree about where a file begins. ZIP readers find the central directory by scanning backwards from the end, so an archive need not start at byte zero. PDF readers look for the %PDF header near the start and read structure from the trailer at the end. MP4 is a chain of length-prefixed atoms, and parsers skip atoms they do not recognise. Image formats identify themselves from a signature in the first few bytes.

Those differing strategies leave room for several complete structures to share one file, each discoverable by the reader that cares about it. That is the whole trick — no exploit, no corruption, just formats that tolerate bytes they were not looking for.

Prior work

Polyglot files are not a new discovery. The technique has a long history in security research and CTF challenges — Ange Albertini's Corkami proofs-of-concept and file-format posters, and the polyglot issues of PoC‖GTFO, are the canonical references. Command-line tools such as TruePolyglot have existed for years.

What glotfiles adds is accessibility: the same constructions, without cloning a repository or running a script. If you want to understand the underlying structures properly, the prior work above is where to start.

Responsible use

Polyglot files are useful precisely because software disagrees about what they are, which is also what makes them a way to probe upload filters and content scanners. They are intended here for educational, research and authorised testing use. You are asked to confirm that before every download, and you are responsible for what you do with the output.

Who builds it

glotfiles is built and maintained by Lalith Kothuru. The frontend is public on GitHub, which is also where bugs and combination requests are tracked. There is an API if you would rather generate these programmatically, and you can reach me at lalith.kothuru@gmail.com.