myrawpng

Bash script that converts a raw framebuffer dump (/dev/fb0) into a viewable PNG.

Instead of guessing the pixel format by hand in GIMP (which no longer handles raw framebuffer imports reliably), it automatically tries every reasonable pixel format with ffmpeg and ImageMagick, dumping one PNG per attempt into a folder — you just scroll through and pick the one that's readable.

Useful in privilege escalation scenarios where you can read /dev/fb0 (e.g. membership in the video group) and want to see what's currently displayed on a logged-in session's screen.

Requirements

• ffmpeg
• imagemagick (convert)

sudo apt install ffmpeg imagemagick

Usage

./myrawpng.sh <file.raw> <widthxheight>

Example:

./myrawpng.sh screen.raw 1176x885

The resolution can usually be read on the target from:

cat /sys/class/graphics/fb0/virtual_size

Output

Creates a folder photos_<filename>/ in the current directory containing every attempted conversion:

photos_screen/
├── ffmpeg_bgr0.png
├── ffmpeg_rgba.png
├── ffmpeg_bgra.png
├── ffmpeg_rgb0.png
├── ffmpeg_0rgb.png
├── ffmpeg_0bgr.png
├── ffmpeg_rgb24.png
├── ffmpeg_bgr24.png
├── ffmpeg_rgb565le.png
├── ffmpeg_rgb565be.png
├── ffmpeg_gray.png
├── magick_bgra.png
├── magick_rgba.png
├── magick_rgb0.png
├── magick_0bgr.png
├── magick_0rgb.png
├── magick_bgr.png
└── magick_gray.png

Open the folder and check which one actually looks like an image:

xdg-open photos_screen

Install globally (optional)

chmod +x myrawpng.sh
sudo cp myrawpng.sh /usr/local/bin/myrawpng

Then just run it from anywhere as myrawpng.

Why

Raw framebuffer dumps don't carry any header — no width, height, or pixel format info. You have to supply the resolution yourself, and guess the pixel layout (channel order, byte order, bit depth) separately. GIMP used to make this bearable via its raw image import dialog, but recent versions changed that flow and it's no longer reliable for framebuffer-style dumps. Brute-forcing every plausible format with ffmpeg/ImageMagick is faster than fighting with GIMP's import settings one attempt at a time.

Disclaimer

For authorized security testing, CTFs, and labs (HackTheBox, VulnLab, and similar) only.