none
How to get Encryption Header form a encrypted Binary File.(such as *.xls *.doc *.ppt)

    Question

  • 1. How to get Encryption Header form a encrypted Binary File.(such as *.xls *.doc *.ppt)

    2. Where stored The Encryption Header in a Binary File

     

    I am writing a project to crack MS office File that encrypted by a password using NVIDIA GPU ,but I can’t Detect  Salt \EncryptedVerifier \EncryptedVerifierHash from MS office File using C#

     

    someone could help me get Encryption Header form a encrypted file ,and Difficult to understand [MS-OFFCRYPTO] ,and I have tried [2.3.6 Office Binary Document RC4 Encryption] Failure

    C# Source code and a RC4Encrypted Example [not RC4 CryptoAPI Encryption] well be best ~~!!

    Thursday, July 22, 2010 9:08 AM

Answers

All replies

  • Hi YM333mmm,

    Thanks for your questions regarding [MS-OFFCRYPTO] and the EncryptionHeader (section 2.3.2).  One of the Open Specifications team will contact you shortly.

    Best regards,

    Tom Jebo
    Senior Support Escalation Engineer
    Microsoft Open Specifications

    Thursday, July 22, 2010 12:24 PM
  • Hello  YM333mmm, 

    I am the engineer who has taken ownership of your issue. I am currently investigating this and will update you once things progress.

    Best Regards, 
    Dominic Salemno
    Thursday, July 22, 2010 3:58 PM
  • Allow me to call this problem is a Useability BUG~!

    I am very willing to help Open Specifications team to Building the Specifications ,but actually not everyone can read the Specifications like a development experts just like me~~

     

    Tuesday, July 27, 2010 8:25 AM
  • Fist from a XLS[MS office 2003] file begin the Painful Journey. Open the file by Excel 2003 saved using UltraEdit-32 .

    then I found the following information

     

    00000000h: D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00 00 00 ; ÐÏ.ࡱ.á........

    00000010h: 00 00 00 00 00 00 00 00 3E 00 03 00 FE FF 09 00 ; ........>...þÿ..

    00000020h: 06 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ; ................

    00000030h: 19 00 00 00 00 00 00 00 00 10 00 00 FE FF FF FF ; ............þÿÿÿ

    00000040h: 00 00 00 00 FE FF FF FF 00 00 00 00 18 00 00 00 ; ....þÿÿÿ........

    00000050h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

    ……..[FF]

    000001f0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

    00000200h: 09 08 10 00 00 06 05 00 EC 15 CD 07 C1 C0 00 00 ; ........ì.Í.ÁÀ..

    00000210h: 06 03 00 00 2F 00 36 00 01 00 01 00 01 00 B5 D1 ; ..../.6.......µÑ

    00000220h: E2 AE 99 70 E9 5B 49 0A 20 5F C7 92 59 A7 C3 9E ; â®™pé[I. _Ç’Y§Ãž

    00000230h: 1B 49 C0 DA CF 6C 1C 5E 69 C3 9D 75 13 CB D4 7D ; .IÀÚÏl.^iÝu.ËÔ}

    00000240h: 0B AF 6E C4 87 E8 DE 9E 76 7F 85 F2 B9 98 E1 00 ; .¯nćèÞžv…ò¹˜á.

    00000250h: 02 00 B0 04 C1 00 02 00 15 87 E2 00 00 00 5C 00 ; ..°.Á....‡â...\.

    00000260h: 70 00 96 B2 A1 E7 0D F0 47 FA 43 07 C3 A0 30 72 ; p.–²¡ç.ðGúC.à0r

    00000270h: 00 1B 65 11 0E 26 87 1D AC 55 FA A2 6A AA 41 FB ; ..e..&‡.¬Uú¢jªAû

    00000280h: 3A EF 82 26 D6 80 AF 50 BC E7 38 27 C1 F1 A8 37 ; :ï‚&Ö€¯P¼ç8'Áñ¨7

    00000290h: 7E 29 7C 3C A5 A7 75 DA 7F 69 2C 46 54 39 5A 4C ; ~)|<¥§uÚi,FT9ZL

    000002a0h: 43 6E 30 1E 29 BE 4E EF D8 10 80 6E 58 B6 9C 6B ; Cn0.)¾NïØ.€nX¶œk

    000002b0h: 3A B9 83 BD 84 EF 8E 4E 61 F1 D3 4C 6E DC A3 C3 ; :¹ƒ½„ïŽNañÓLnÜ£Ã

    000002c0h: DC 90 42 D2 63 39 4C 49 3E 74 9B 30 EE E7 05 17 ; ܐBÒc9LI>t›0îç..

    000002d0h: 5B 89 42 00 02 00 2E 57 61 01 02 00 CE 36 C0 01 ; [‰B....Wa...Î6À.

    000002e0h: 00 00 3D 01 02 00 2E 90 9C 00 02 00 F2 7A 19 00 ; ..=....œ...òz..

    000002f0h: 02 00 CC EC 12 00 02 00 01 92 13 00 02 00 35 4F ; ..Ìì.....’....5O

    00000300h: AF 01 02 00 7F 10 BC 01 02 00 40 5D 3D 00 12 00 ; ¯....¼...@]=...

    00000310h: E8 FB 7B 4B 48 EA 59 F8 35 58 26 F8 E3 EE E2 DC ; èû{KHêYø5X&øãîâÜ

    00000320h: BE 80 40 00 02 00 50 25 8D 00 02 00 AB 8A 22 00 ; ¾€@...P%...«Š".

    00000330h: 02 00 B1 EC 0E 00 02 00 74 98 B7 01 02 00 1B 3A ; ..±ì....t˜·....:

    00000340h: DA 00 02 00 57 C1 31 00 14 00 6B DE 4F C3 1F 37 ; Ú...WÁ1...kÞOÃ.7

    00000350h: C7 E8 A0 C8 AE 14 31 8D 16 AF 33 54 F6 07 31 00 ; Çè È®.1.¯3Tö.1.

    00000360h: 14 00 52 5F 98 43 DD 3A 24 C5 9A 6D A9 39 93 44 ; ..R_˜CÝ:$Åšm©9“D

    00000370h: 18 95 B7 23 9B DC 31 00 14 00 11 7A C3 43 6B 93 ; .•·#›Ü1....zÃCk“

    00000380h: 83 2C C7 98 19 B9 83 CA 98 5B 31 38 A4 D3 31 00 ; ƒ,ǘ.¹ƒÊ˜[18¤Ó1.

    00000390h: 14 00 2F BA 6E F1 E5 42 A3 B3 04 56 0A 71 65 F3 ; ../ºnñåB£³.V.qeó

    000003a0h: BF 4D 49 56 69 63 31 00 14 00 42 66 80 D1 00 65 ; ¿MIVic1...Bf€Ñ.e

    000003b0h: F5 D0 67 3D B6 E0 26 20 F2 4B FB C1 7B 40 31 00 ; õÐg=¶à& òKûÁ{@1.

    000003c0h: 14 00 63 8A 60 5B FD 2A D9 1B AE AF 88 4B AC 25 ; ..cŠ`[ý*Ù.®¯ˆK¬%

    000003d0h: ED 2A CF E1 7E AC 1E 04 2B 00 45 03 EE 68 5E B1 ; í*Ïá~¬..+.E.îh^±

    000003e0h: 97 A0 CD 54 79 35 70 35 9F CC A5 85 4F 19 0C A3 ; — ÍTy5p5ŸÌ¥…O..£

    000003f0h: 90 7B 74 36 3F D4 BD A8 AC 9C 30 BC E1 70 B1 BE ; {t6?Ô½¨¬œ0¼áp±¾

    00000400h: 0D F3 BD 85 A1 1E 04 35 00 6A 0C 47 F8 51 36 D3 ; .ó½…¡..5.j.GøQ6Ó

    00000410h: 45 6F B2 48 A3 B0 12 8F 35 C9 D2 D6 43 B5 D2 D2 ; Eo²H£°.5ÉÒÖCµÒÒ

    00000420h: C0 A9 60 48 2F D9 00 2F A9 6A DF 22 01 95 48 FD ; À©`H/Ù./©jß".•Hý

    00000430h: 90 CC 17 12 FA E7 03 FE 9F EB A8 20 9F 95 1E 04 ; Ì..úç.þŸë¨ Ÿ•..

    00000440h: 37 00 FB A7 B7 AA 45 94 C3 96 AD F5 A2 5C F3 5E ; 7.û§·ªE”Ö­õ¢\ó^

    00000450h: 6E 79 27 2B 12 E3 49 79 9D 53 38 86 CE 48 1A 77 ; ny'+.ãIyS8†ÎH.w

    00000460h: 2D 2A 49 29 6B DE A9 B6 23 86 95 62 DE 31 8F 72 ; -*I)kÞ©¶#†•bÞ1r

    00000470h: 67 74 6B DB 28 38 E1 87 FC 1E 04 41 00 B4 FA 19 ; gtkÛ(8á‡ü..A.´ú.

    00000480h: B1 65 AC FF E5 7A B0 F2 4C C3 B8 56 53 48 CF 6C ; ±e¬ÿåz°òLøVSHÏl

    00000490h: A8 20 04 B5 0B 86 24 D6 FE CB 01 4F C3 F8 2C 62 ; ¨ .µ.†$ÖþË.OÃø,b

    000004a0h: AE E4 CB C0 DC AD 5C F1 2F B9 30 31 79 3A 06 E4 ; ®äËÀÜ­\ñ/¹01y:.ä

    000004b0h: 24 0D 0F 8A 31 18 E4 55 2C 67 DA 2C D0 88 1E 04 ; $..Š1.äU,gÚ,Ј..

    000004c0h: 65 00 64 28 7B 0B 6C 5D 12 DD FB 40 66 67 6F 3D ; e.d({.l].Ýû@fgo=

    000004d0h: 04 35 5E E3 0D DE 03 88 30 B3 5E FC 66 73 5A ED ; .5^ã.Þ.ˆ0³^üfsZí

    000004e0h: 1E 90 F2 62 2D CD 28 3C 09 A5 01 2B 98 74 3F 0B ; .òb-Í(<.¥.+˜t?.

    000004f0h: FB E8 46 11 6D 95 35 A0 DE 2A 2B C9 DF 67 FB EA ; ûèF.m•5 Þ*+Éßgûê

    00000500h: A2 2D 1C 52 37 85 63 75 B7 3F E8 48 30 D8 F3 8B ; ¢-.R7…cu·?èH0Øó‹

    00000510h: 5F F0 5B 3C A8 DA AA E9 3D CC 97 24 F6 DF 48 90 ; _ð[<¨Úªé=Ì—$ößH

    00000520h: DC BA E6 93 6F CE F4 1E 04 2C 00 E4 DB 39 F2 E8 ; ܺæ“oÎô..,.äÛ9òè

    00000530h: 6B E4 44 BD 23 0B 8A 14 3C EC 00 75 48 18 8E 58 ; käD½#.Š.<ì.uH.ŽX

    00000540h: 46 E6 65 18 7F C7 2D 4F B0 0B 87 3A F1 E5 51 56 ; Fæe.Ç-O°.‡:ñåQV

    00000550h: 4E 81 67 BD 43 5D 42 1E 04 75 00 1C 3C A5 80 5F ; Ng½C]B..u..<¥€_

    00000560h: D9 9D AA 24 DD D9 E0 9C DC E1 EC 9D D9 8E E7 C7 ; ٝª$ÝÙàœÜáìÙŽçÇ

    00000570h: 4D 08 8C 16 87 7B F0 FF B5 F5 A3 E2 25 7D 31 CC ; M.Œ.‡{ðÿµõ£â%}1Ì

    00000580h: 1B 4B 7E F1 47 1E 87 1A 54 B4 FA C2 9A 98 A2 6A ; .K~ñG.‡.T´úš˜¢j

    00000590h: 5F B7 58 73 4D 3E 13 52 2E F3 82 C5 02 55 59 5E ; _·XsM>.R.ó‚Å.UY^

    000005a0h: 75 CB B0 A7 46 73 EB 93 14 6A 35 E9 51 92 6E 0A ; uË°§Fsë“.j5éQ’n.

    000005b0h: 69 E2 3B 74 E7 D9 BA 39 5C 9A 3E 21 CC 9B 00 72 ; iâ;tçÙº9\š>!Ì›.r

    000005c0h: CA 05 A9 BA ED C5 BF B2 23 70 DF 9C 32 69 F8 12 ; Ê.©ºíÅ¿²#pßœ2iø.

    000005d0h: 1E 04 34 00 89 42 A7 DE 4F D6 CA B5 BE AB EB 25 ; ..4.‰B§ÞOÖʵ¾«ë%

    000005e0h: CC CF 92 E5 A9 4B 62 80 D9 81 CE 97 A9 BD 78 1C ; ÌÏ’å©Kb€ÙÎ—©½x.

    000005f0h: 04 91 CA E4 BB B7 E5 4C 37 08 78 8D 59 71 31 CF ; .‘Êä»·åL7.xYq1Ï

    00000600h: 10 41 CD 30 F1 87 1B C0 1E 04 1A 00 84 EA C8 20 ; .AÍ0ñ‡.À....„êÈ

    00000610h: FF 24 5A 07 09 BB DC D4 26 6D 8C 12 2D EE 16 A7 ; ÿ$Z..»ÜÔ&mŒ.-î.§

    00000620h: CA 7A 6C 04 D1 70 1E 04 1F 00 3A DA 6E 09 CB 7B ; Êzl.Ñp....:Ún.Ë{

    00000630h: 41 D4 11 8D 13 EB 22 08 8E CF 42 97 70 E9 41 42 ; AÔ..ë".ŽÏB—péAB

    00000640h: 0A 4A 1B 04 82 55 D5 10 E4 1E 04 20 00 F8 B0 4B ; .J..‚UÕ.ä.. .ø°K

    00000650h: 07 39 C6 0F 0E 3C 12 CA 78 92 34 91 29 16 29 8D ; .9Æ..<.Êx’4‘).)

    00000660h: 4F 01 CD 68 E3 CF 9E A2 BA 40 59 64 A7 1E 04 25 ; O.ÍhãÏž¢º@Yd§..%

    00000670h: 00 07 F9 11 06 D3 C0 32 42 73 7D 5E C7 65 2F 6B ; ..ù..ÓÀ2Bs}^Çe/k

    00000680h: 65 A0 1D 79 15 5C E3 23 63 EB CB A1 EA 28 BD 57 ; e .y.\ã#cëË¡ê(½W

    00000690h: C4 F7 CE 29 62 52 E0 00 14 00 FC 21 E9 23 A1 B5 ; Ä÷Î)bRà...ü!é#¡µ

    000006a0h: 64 DE 5B 41 9C CC 0B E5 59 36 AC 4A 85 8D E0 00 ; dÞ[AœÌ.åY6¬J…à.

    000006b0h: 14 00 1B 87 C0 58 FF 26 63 51 0B E5 ED C7 04 E3 ; ...‡ÀXÿ&cQ.åíÇ.ã

    000006c0h: 60 A1 45 EB BE DE E0 00 14 00 B1 1E 5B 4A 08 1B ; `¡Eë¾Þà...±.[J..

    000006d0h: C9 58 DE 1C 60 89 80 49 94 82 31 B6 BC A2 E0 00 ; ÉXÞ.`‰€I”‚1¶¼¢à.

    000006e0h: 14 00 30 86 10 A9 F8 E6 5B FB 4C A5 CC 07 1F 57 ; ..0†.©øæ[ûL¥Ì..W

    000006f0h: 0E 26 37 59 91 C4 E0 00 14 00 B7 36 DC 27 F8 88 ; .&7Y‘Äà...·6Ü'øˆ

    00000700h: 48 68 60 22 8A 5D 9A F8 BA 3A DF CD 54 50 E0 00 ; Hh`"Š]šøº:ßÍTPà.

    00000710h: 14 00 BC AD B4 31 66 80 06 85 A7 88 1C 87 FF D2 ; ..¼­´1f€.…§ˆ.‡ÿÒ

    00000720h: 33 7B FA D2 4C E1 E0 00 14 00 BC C8 DA B5 A7 E7 ; 3{úÒLáà...¼ÈÚµ§ç

    00000730h: F2 45 A4 6E 36 FB 47 3A 5C 40 20 B3 83 E3 E0 00 ; òE¤n6ûG:\@ ³ƒãà.

    00000740h: 14 00 CF 02 0E 91 0E D9 C1 B1 26 65 2A 70 37 9F ; ..Ï..‘.ÙÁ±&e*p7Ÿ

    00000750h: 3F BA 4E 28 52 A2 E0 00 14 00 6B E6 E7 A1 6E F5 ; ?ºN(R¢à...kæç¡nõ

    00000760h: 48 23 0F 5D 5E D9 B3 20 E2 75 22 65 5E 69 E0 00 ; H#.]^Ù³ âu"e^ià.

    00000770h: 14 00 78 15 20 8A EB 09 E3 19 33 84 1D 6B 3D 30 ; ..x. Šë.ã.3„.k=0

    00000780h: 9F 3C ED 1F 8B F2 E0 00 14 00 09 E3 82 98 AC 21 ; Ÿ<í.‹òà....゘¬!

    00000790h: 48 9D C3 26 C3 0F D2 00 ED 1B DC 37 B7 DA E0 00 ; HÃ&Ã.Ò.í.Ü7·Úà.

    000007a0h: 14 00 A3 19 FD D0 B6 E5 9B 7E A2 3E 1D EF 72 BB ; ..£.ýжå›~¢>.ïr»

    000007b0h: 72 26 8A E6 8B 70 E0 00 14 00 E6 F8 2F 53 B6 B8 ; r&Šæ‹pà...æø/S¶¸

    000007c0h: C6 E6 2D 7C 1B 8D 1A D7 1C 35 36 35 C8 54 E0 00 ; Ææ-|..×.565ÈTà.

    000007d0h: 14 00 F2 59 8B 57 8F 90 70 C4 C5 61 45 30 8A 7F ; ..òY‹WpÄÅaE0Š

    000007e0h: DC 35 89 38 8C BC E0 00 14 00 D2 F7 8B F3 83 73 ; Ü5‰8Œ¼à...Ò÷‹óƒs

    000007f0h: 0D 75 E4 50 EE 5D AF 24 3A CD 74 A9 70 ED E0 00 ; .uäPî]¯$:Ít©píà.

    00000800h: 14 00 0D 3A 53 B8 AE B0 EA 4B 18 CE B9 C8 11 AE ; ...:S¸®°êK.ιÈ.®

    00000810h: 59 59 13 51 E6 FA E0 00 14 00 72 D7 51 8D CC 77 ; YY.Qæúà...r×QÌw

    00000820h: AB 13 7F 4F AD 3E ED EB 3C F8 D4 EA 68 0B E0 00 ; «.O­>íë<øÔêh.à.

    00000830h: 14 00 1D 91 2F 59 E2 A6 43 4A 55 98 D5 5C D9 D3 ; ...‘/Yâ¦CJU˜Õ\ÙÓ

    00000840h: A3 92 F0 AB 94 21 E0 00 14 00 9A 48 EF 1E 6F 8A ; £’ð«”!à...šHï.oŠ

    00000850h: 01 2B B7 60 46 8A 50 C0 89 6F BC 3F 44 7D E0 00 ; .+·`FŠPÀ‰o¼?D}à.

    00000860h: 14 00 FE 81 7D 92 A3 29 88 66 23 30 45 EF E8 B7 ; ..þ}’£)ˆf#0Eïè·

    00000870h: 43 CE 89 63 C6 8B E0 00 14 00 52 72 21 EE 1F 9D ; CΉcÆ‹à...Rr!î.

    00000880h: CB 6A F0 A4 FD AC F2 D4 EA 94 0F D5 65 AC 93 02 ; Ëjð¤ý¬òÔê”.Õe¬“.

    00000890h: 04 00 5E 5A 16 A9 93 02 04 00 FE A0 78 F7 93 02 ; ..^Z.©“...þ x÷“.

    000008a0h: 04 00 B4 F2 B7 62 93 02 04 00 A9 AE EC 68 93 02 ; ..´ò·b“...©®ìh“.

    000008b0h: 04 00 30 C5 2E 8B 93 02 04 00 73 D8 9A 6D 60 01 ; ..0Å.‹“...sØšm`.

    000008c0h: 02 00 1A 65 85 00 0E 00 19 07 00 00 F2 57 98 F9 ; ...e….......òW˜ù

    000008d0h: CC 37 45 CB 37 23 8C 00 04 00 49 76 5C 1F C1 01 ; Ì7EË7#Œ...Iv\.Á.

    000008e0h: 08 00 6E B3 BD 62 8E C9 CC 51 FC 00 08 00 E1 B7 ; ..n³½bŽÉÌQü...á·

    000008f0h: 03 F9 53 A5 37 D7 FF 00 02 00 21 DE 63 08 15 00 ; .ùS¥7×ÿ...!Þc...

    00000900h: A3 A1 8B 65 63 81 D1 69 06 CB 77 52 73 BA 9A 8A ; £¡‹ecÑi.ËwRsºšŠ

    00000910h: 9E B3 89 29 C9 0A 00 00 00 09 08 10 00 00 06 10 ; ž³‰)É...........

    00000920h: 00 EC 15 CD 07 C1 C0 00 00 06 03 00 00 0B 02 10 ; .ì.Í.ÁÀ.........

    00000930h: 00 13 AF AB 9F 53 7E F3 12 64 7D E9 13 7E 61 94 ; ..¯«ŸS~ó.d}é.~a”

    00000940h: C0 0D 00 02 00 28 DF 0C 00 02 00 F4 53 0F 00 02 ; À....(ß....ôS...

    00000950h: 00 C0 C1 11 00 02 00 8C 60 10 00 08 00 7F 62 B8 ; .ÀÁ....Œ`....b¸

    00000960h: 36 07 86 88 EC 5F 00 02 00 E0 02 2A 00 02 00 9E ; 6.†ˆì_...à.*...ž

    00000970h: 83 2B 00 02 00 52 87 82 00 02 00 C8 E1 80 00 08 ; ƒ+...R‡‚...Èá€..

    00000980h: 00 3C 3E AA 06 6C F2 6C CB 25 02 04 00 A2 7F 8E ; .<>ª.lòlË%...¢Ž

    00000990h: FF 81 00 02 00 5A ED 14 00 00 00 15 00 00 00 83 ; ÿ...Zí........ƒ

    000009a0h: 00 02 00 B9 8B 84 00 02 00 B0 82 A1 00 22 00 94 ; ...¹‹„...°‚¡.".”

    000009b0h: 4F FE DD BF BE 30 14 37 9C A3 85 A3 4C 94 46 06 ; OþÝ¿¾0.7œ£…£L”F.

    000009c0h: C9 92 23 56 31 1C 01 3B 17 9A F8 A7 53 0E E0 6F ; É’#V1..;.šø§S.ào

    000009d0h: 4E 55 00 02 00 4F B5 00 02 0E 00 3B 79 55 20 0E ; NU...Oµ....;yU .

    000009e0h: 27 77 84 D3 A4 C9 27 F2 85 3E 02 12 00 AA B0 04 ; 'w„Ó¤É'ò…>...ª°.

    000009f0h: FF A2 9E 89 AC 5B 0C D4 18 01 32 34 E5 33 64 1D ; ÿ¢ž‰¬[.Ô..24å3d.

    00000a00h: 00 0F 00 76 CC 66 BC 00 C1 C6 4B 6A 2B FC 4F 7F ; ...vÌf¼.ÁÆKj+üO

    00000a10h: C5 EF EF 00 06 00 67 1B D1 9C F4 25 0A 00 00 00 ; Åïï...g.Ñœô%....

    00000a20h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    ………[00]

    000011f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00001200h: FE FF 00 00 05 01 02 00 00 00 00 00 00 00 00 00 ; þÿ..............

    00001210h: 00 00 00 00 00 00 00 00 01 00 00 00 E0 85 9F F2 ; ............à…Ÿò

    00001220h: F9 4F 68 10 AB 91 08 00 2B 27 B3 D9 30 00 00 00 ; ùOh.«‘..+'³Ù0...

    00001230h: A0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 ;  ...........@...

    00001240h: 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 ; ....H.......X...

    00001250h: 12 00 00 00 68 00 00 00 0C 00 00 00 80 00 00 00 ; ....h.......€...

    00001260h: 0D 00 00 00 8C 00 00 00 13 00 00 00 98 00 00 00 ; ....Œ.......˜...

    00001270h: 02 00 00 00 A8 03 00 00 1E 00 00 00 08 00 00 00 ; ....¨...........

    00001280h: 61 64 6D 69 6E 71 00 00 1E 00 00 00 08 00 00 00 ; adminq..........

    00001290h: 61 64 6D 69 6E 71 00 00 1E 00 00 00 10 00 00 00 ; adminq..........

    000012a0h: 4D 69 63 72 6F 73 6F 66 74 20 45 78 63 65 6C 00 ; Microsoft Excel.

    000012b0h: 40 00 00 00 80 E4 3A 0E F1 1B CB 01 40 00 00 00 ; @...€ä:.ñ.Ë.@...

    000012c0h: 00 86 3E 2A F1 1B CB 01 03 00 00 00 01 00 00 00 ; .†>*ñ.Ë.........

    000012d0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000012e0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    ..............[00]

    000021f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00002200h: FE FF 00 00 05 01 02 00 00 00 00 00 00 00 00 00 ; þÿ..............

    00002210h: 00 00 00 00 00 00 00 00 01 00 00 00 02 D5 CD D5 ; .............ÕÍÕ

    00002220h: 9C 2E 1B 10 93 97 08 00 2B 2C F9 AE 30 00 00 00 ; œ...“—..+,ù®0...

    00002230h: C4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 ; Ä...........P...

    00002240h: 0F 00 00 00 58 00 00 00 17 00 00 00 68 00 00 00 ; ....X.......h...

    00002250h: 0B 00 00 00 70 00 00 00 10 00 00 00 78 00 00 00 ; ....p.......x...

    00002260h: 13 00 00 00 80 00 00 00 16 00 00 00 88 00 00 00 ; ....€.......ˆ...

    00002270h: 0D 00 00 00 90 00 00 00 0C 00 00 00 A3 00 00 00 ; ...........£...

    00002280h: 02 00 00 00 A8 03 00 00 1E 00 00 00 08 00 00 00 ; ....¨...........

    00002290h: 42 53 44 44 00 00 00 00 03 00 00 00 E6 15 0B 00 ; BSDD........æ...

    000022a0h: 0B 00 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 ; ................

    000022b0h: 0B 00 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 ; ................

    000022c0h: 1E 10 00 00 01 00 00 00 07 00 00 00 53 68 65 65 ; ............Shee

    000022d0h: 74 31 00 0C 10 00 00 02 00 00 00 1E 00 00 00 07 ; t1..............

    000022e0h: 00 00 00 B9 A4 D7 F7 B1 ED 00 03 00 00 00 01 00 ; ...¹¤×÷±í.......

    000022f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00002300h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    ...........[00]

    000031f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00003200h: 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 ; ................

    00003210h: 05 00 00 00 06 00 00 00 07 00 00 00 FE FF FF FF ; ............þÿÿÿ

    00003220h: 09 00 00 00 0A 00 00 00 0B 00 00 00 0C 00 00 00 ; ................

    00003230h: 0D 00 00 00 0E 00 00 00 0F 00 00 00 FE FF FF FF ; ............þÿÿÿ

    00003240h: 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00 ; ................

    00003250h: 15 00 00 00 16 00 00 00 17 00 00 00 FE FF FF FF ; ............þÿÿÿ

    00003260h: FD FF FF FF FE FF FF FF FF FF FF FF FF FF FF FF ; ýÿÿÿþÿÿÿÿÿÿÿÿÿÿÿ

    00003270h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

    …….[FF]

    000033f0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

    00003400h: 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 ; R.o.o.t. .E.n.t.

    00003410h: 72 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 ; r.y.............

    00003420h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00003430h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00003440h: 16 00 05 01 FF FF FF FF FF FF FF FF 02 00 00 00 ; ....ÿÿÿÿÿÿÿÿ....

    00003450h: 20 08 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 ;  .......À......F

    00003460h: 00 00 00 00 00 00 00 00 00 00 00 00 C0 37 1F 2D ; ............À7.-

    00003470h: F1 1B CB 01 FE FF FF FF 00 00 00 00 00 00 00 00 ; ñ.Ë.þÿÿÿ........

    00003480h: 57 00 6F 00 72 00 6B 00 62 00 6F 00 6F 00 6B 00 ; W.o.r.k.b.o.o.k.

    00003490h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000034a0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000034b0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000034c0h: 12 00 02 01 FF FF FF FF FF FF FF FF FF FF FF FF ; ....ÿÿÿÿÿÿÿÿÿÿÿÿ

    000034d0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000034e0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000034f0h: 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 ; ................

    00003500h: 05 00 53 00 75 00 6D 00 6D 00 61 00 72 00 79 00 ; ..S.u.m.m.a.r.y.

    00003510h: 49 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 ; I.n.f.o.r.m.a.t.

    00003520h: 69 00 6F 00 6E 00 00 00 00 00 00 00 00 00 00 00 ; i.o.n...........

    00003530h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00003540h: 28 00 02 01 01 00 00 00 03 00 00 00 FF FF FF FF ; (...........ÿÿÿÿ

    00003550h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00003560h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    00003570h: 00 00 00 00 08 00 00 00 00 10 00 00 00 00 00 00 ; ................

    00003580h: 05 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 ; ..D.o.c.u.m.e.n.

    00003590h: 74 00 53 00 75 00 6D 00 6D 00 61 00 72 00 79 00 ; t.S.u.m.m.a.r.y.

    000035a0h: 49 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 ; I.n.f.o.r.m.a.t.

    000035b0h: 69 00 6F 00 6E 00 00 00 00 00 00 00 00 00 00 00 ; i.o.n...........

    000035c0h: 38 00 02 01 FF FF FF FF FF FF FF FF FF FF FF FF ; 8...ÿÿÿÿÿÿÿÿÿÿÿÿ

    000035d0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000035e0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

    000035f0h: 00 00 00 00 10 00 00 00 00 10 00 00 00 00 00 00 ; ................

     

    This file using  Password=”123” Encryption Type= “Office 97/2000 compatible”  encrypted ,

     

      

    How to determine from the information in the type of encryption ??

    According to [MS-OFFCRYPTO] 2.3.6 Office Binary Document RC4 Encryption Search “00 01 00 01”[ EncryptionVersionInfo]  to fond the Header

     

    00000210h: 06 03 00 00 2F 00 36 00 01 00 01 00 01 00 B5 D1 ; ..../.6.......µÑ

    00000220h: E2 AE 99 70 E9 5B 49 0A 20 5F C7 92 59 A7 C3 9E ; â®™pé[I. _Ç’Y§Ãž

    00000230h: 1B 49 C0 DA CF 6C 1C 5E 69 C3 9D 75 13 CB D4 7D ; .IÀÚÏl.^iÝu.ËÔ}

    00000240h: 0B AF 6E C4 87 E8 DE 9E 76 7F 85 F2 B9 98 E1 00 ; .¯nćèÞžv…ò¹˜á.

    00000250h: 02 00 B0 04 C1 00 02 00 15 87 E2 00 00 00 5C 00 ; ..°.Á....‡â...\.

    00000260h: 70 00 96 B2 A1 E7 0D F0 47 FA 43 07 C3 A0 30 72 ; p.–²¡ç.ðGúC.à0r

     

    So

                           Salt (16 bytes)             =B5 D1 E2 AE 99 70 E9 5B 49 0A 20 5F C7 92 59 A7

     EncryptedVerifier (16 bytes)            =C3 9E 1B 49 C0 DA CF 6C 1C 5E 69 C3 9D 75 13 CB

    EncryptedVerifierHash (16 bytes)    =D4 7D 0B AF 6E C4 87 E8 DE 9E 76 7F 85 F2 B9 98

     

    Did I get the correct value ?

     

    Wednesday, July 28, 2010 1:02 AM
  • Hello  YM333mmm, 

    I am the engineer who has taken ownership of your issue. I am currently investigating this and will update you once things progress.

    Best Regards, 
    Dominic Salemno

    I am Update project ,pleaess help me~!
    Saturday, July 31, 2010 5:25 AM
  • You say your intention is to crack, so I'm not sure that the question is
    appropriate here. That said, your approach seems to be one of digging in the
    dark and you need to start by understanding the basic structure of compound
    files, and then to read the [MS-OFFCRYPTO] documentation in the context of
    the [MS-XLS] document, which describes the Workbook substreams.
     
    After that, nothing I can see in the documentation actually says where the
    Encryption Header is stored and one is left to guess. It does appear, in
    your particular example you _may_ (I don't know) have identified what you
    want by chance - with the Encryption Header coming in the Workbook Stream
    immediately after the Global Substream - but there is no indication that you
    can guarantee to find it that way every time. In Word it _appears_ to come
    at the start of the 1Table Stream - there appearing to be a single
    encryption header applying to all streams, although the format varies
    according to the Encryption Provider being used - but, again, no indication
    that I can see as to whether it will always be there.
     
    --
    Enjoy,
    Tony
     
    www.WordArticles.com
     
     

    Enjoy,
    Tony
    www.WordArticles.com
    Saturday, July 31, 2010 10:32 AM
  • YM333mmm, 

    The location of the Encryption Header will be different for each different application (.doc, .ppt, .xls).
    There is an example of what you seek with source, comments, and sample binary files located at: http://offcrypto.codeplex.com/

    Dominic Salemno
    Escalation Engineer
    US-CSS DSC Protocols Team

     

    Monday, August 02, 2010 6:02 PM
  • Thanks for every thing ~!!

    now I can find the Encryption Header from the Streem ~!!

    Wednesday, September 15, 2010 3:52 AM
  • Thanks for helping ~~!!
    • Proposed as answer by Hailay Saturday, June 16, 2012 2:44 PM
    • Unproposed as answer by Hailay Saturday, June 16, 2012 2:44 PM
    Wednesday, September 15, 2010 3:54 AM
  • HI YM333mmm Avatar of YM333mmm

    Could you please guide me if you get the encryptedHeader programatically.

    e-mail: hailaygidey5@gamil.com

    Saturday, June 16, 2012 2:46 PM