How to get Encryption Header form a encrypted Binary File.(such as *.xls *.doc *.ppt)

Question

1. How to get Encryption Header form a encrypted Binary File.(such as *.xls *.doc *.ppt)

2. Where stored The Encryption Header in a Binary File

 

I am writing a project to crack MS office File that encrypted by a password using NVIDIA GPU ,but I can’t Detect  Salt \EncryptedVerifier \EncryptedVerifierHash from MS office File using C#

 

someone could help me get Encryption Header form a encrypted file ,and Difficult to understand [MS-OFFCRYPTO] ,and I have tried [2.3.6 Office Binary Document RC4 Encryption] Failure

C# Source code and a RC4Encrypted Example [not RC4 CryptoAPI Encryption] well be best ~~!!

Answer 1

Hi YM333mmm,

Thanks for your questions regarding [MS-OFFCRYPTO] and the EncryptionHeader (section 2.3.2).  One of the Open Specifications team will contact you shortly.

Best regards,

Tom Jebo
Senior Support Escalation Engineer
Microsoft Open Specifications

Answer 2

Hello  YM333mmm, 

I am the engineer who has taken ownership of your issue. I am currently investigating this and will update you once things progress.

Best Regards, 

Dominic Salemno

Answer 3

Allow me to call this problem is a Useability BUG~!

I am very willing to help Open Specifications team to Building the Specifications ,but actually not everyone can read the Specifications like a development experts just like me~~

 

Answer 4

Fist from a XLS[MS office 2003] file begin the Painful Journey. Open the file by Excel 2003 saved using UltraEdit-32 .

then I found the following information

 

00000000h: D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00 00 00 ; ÐÏ.ࡱ.á........

00000010h: 00 00 00 00 00 00 00 00 3E 00 03 00 FE FF 09 00 ; ........>...þÿ..

00000020h: 06 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ; ................

00000030h: 19 00 00 00 00 00 00 00 00 10 00 00 FE FF FF FF ; ............þÿÿÿ

00000040h: 00 00 00 00 FE FF FF FF 00 00 00 00 18 00 00 00 ; ....þÿÿÿ........

00000050h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

……..[FF]

000001f0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

00000200h: 09 08 10 00 00 06 05 00 EC 15 CD 07 C1 C0 00 00 ; ........ì.Í.ÁÀ..

00000210h: 06 03 00 00 2F 00 36 00 01 00 01 00 01 00 B5 D1 ; ..../.6.......µÑ

00000220h: E2 AE 99 70 E9 5B 49 0A 20 5F C7 92 59 A7 C3 9E ; â®™pé[I. _Ç’Y§Ãž

00000230h: 1B 49 C0 DA CF 6C 1C 5E 69 C3 9D 75 13 CB D4 7D ; .IÀÚÏl.^iÝu.ËÔ}

00000240h: 0B AF 6E C4 87 E8 DE 9E 76 7F 85 F2 B9 98 E1 00 ; .¯nćèÞžv…ò¹˜á.

00000250h: 02 00 B0 04 C1 00 02 00 15 87 E2 00 00 00 5C 00 ; ..°.Á....‡â...\.

00000260h: 70 00 96 B2 A1 E7 0D F0 47 FA 43 07 C3 A0 30 72 ; p.–²¡ç.ðGúC.à0r

00000270h: 00 1B 65 11 0E 26 87 1D AC 55 FA A2 6A AA 41 FB ; ..e..&‡.¬Uú¢jªAû

00000280h: 3A EF 82 26 D6 80 AF 50 BC E7 38 27 C1 F1 A8 37 ; :ï‚&Ö€¯P¼ç8'Áñ¨7

00000290h: 7E 29 7C 3C A5 A7 75 DA 7F 69 2C 46 54 39 5A 4C ; ~)|<¥§uÚi,FT9ZL

000002a0h: 43 6E 30 1E 29 BE 4E EF D8 10 80 6E 58 B6 9C 6B ; Cn0.)¾NïØ.€nX¶œk

000002b0h: 3A B9 83 BD 84 EF 8E 4E 61 F1 D3 4C 6E DC A3 C3 ; :¹ƒ½„ïŽNañÓLnÜ£Ã

000002c0h: DC 90 42 D2 63 39 4C 49 3E 74 9B 30 EE E7 05 17 ; ܐBÒc9LI>t›0îç..

000002d0h: 5B 89 42 00 02 00 2E 57 61 01 02 00 CE 36 C0 01 ; [‰B....Wa...Î6À.

000002e0h: 00 00 3D 01 02 00 2E 90 9C 00 02 00 F2 7A 19 00 ; ..=....œ...òz..

000002f0h: 02 00 CC EC 12 00 02 00 01 92 13 00 02 00 35 4F ; ..Ìì.....’....5O

00000300h: AF 01 02 00 7F 10 BC 01 02 00 40 5D 3D 00 12 00 ; ¯....¼...@]=...

00000310h: E8 FB 7B 4B 48 EA 59 F8 35 58 26 F8 E3 EE E2 DC ; èû{KHêYø5X&øãîâÜ

00000320h: BE 80 40 00 02 00 50 25 8D 00 02 00 AB 8A 22 00 ; ¾€@...P%...«Š".

00000330h: 02 00 B1 EC 0E 00 02 00 74 98 B7 01 02 00 1B 3A ; ..±ì....t˜·....:

00000340h: DA 00 02 00 57 C1 31 00 14 00 6B DE 4F C3 1F 37 ; Ú...WÁ1...kÞOÃ.7

00000350h: C7 E8 A0 C8 AE 14 31 8D 16 AF 33 54 F6 07 31 00 ; Çè È®.1.¯3Tö.1.

00000360h: 14 00 52 5F 98 43 DD 3A 24 C5 9A 6D A9 39 93 44 ; ..R_˜CÝ:$Åšm©9“D

00000370h: 18 95 B7 23 9B DC 31 00 14 00 11 7A C3 43 6B 93 ; .•·#›Ü1....zÃCk“

00000380h: 83 2C C7 98 19 B9 83 CA 98 5B 31 38 A4 D3 31 00 ; ƒ,ǘ.¹ƒÊ˜[18¤Ó1.

00000390h: 14 00 2F BA 6E F1 E5 42 A3 B3 04 56 0A 71 65 F3 ; ../ºnñåB£³.V.qeó

000003a0h: BF 4D 49 56 69 63 31 00 14 00 42 66 80 D1 00 65 ; ¿MIVic1...Bf€Ñ.e

000003b0h: F5 D0 67 3D B6 E0 26 20 F2 4B FB C1 7B 40 31 00 ; õÐg=¶à& òKûÁ{@1.

000003c0h: 14 00 63 8A 60 5B FD 2A D9 1B AE AF 88 4B AC 25 ; ..cŠ`[ý*Ù.®¯ˆK¬%

000003d0h: ED 2A CF E1 7E AC 1E 04 2B 00 45 03 EE 68 5E B1 ; í*Ïá~¬..+.E.îh^±

000003e0h: 97 A0 CD 54 79 35 70 35 9F CC A5 85 4F 19 0C A3 ; — ÍTy5p5ŸÌ¥…O..£

000003f0h: 90 7B 74 36 3F D4 BD A8 AC 9C 30 BC E1 70 B1 BE ; {t6?Ô½¨¬œ0¼áp±¾

00000400h: 0D F3 BD 85 A1 1E 04 35 00 6A 0C 47 F8 51 36 D3 ; .ó½…¡..5.j.GøQ6Ó

00000410h: 45 6F B2 48 A3 B0 12 8F 35 C9 D2 D6 43 B5 D2 D2 ; Eo²H£°.5ÉÒÖCµÒÒ

00000420h: C0 A9 60 48 2F D9 00 2F A9 6A DF 22 01 95 48 FD ; À©`H/Ù./©jß".•Hý

00000430h: 90 CC 17 12 FA E7 03 FE 9F EB A8 20 9F 95 1E 04 ; Ì..úç.þŸë¨ Ÿ•..

00000440h: 37 00 FB A7 B7 AA 45 94 C3 96 AD F5 A2 5C F3 5E ; 7.û§·ªE”Ö­õ¢\ó^

00000450h: 6E 79 27 2B 12 E3 49 79 9D 53 38 86 CE 48 1A 77 ; ny'+.ãIyS8†ÎH.w

00000460h: 2D 2A 49 29 6B DE A9 B6 23 86 95 62 DE 31 8F 72 ; -*I)kÞ©¶#†•bÞ1r

00000470h: 67 74 6B DB 28 38 E1 87 FC 1E 04 41 00 B4 FA 19 ; gtkÛ(8á‡ü..A.´ú.

00000480h: B1 65 AC FF E5 7A B0 F2 4C C3 B8 56 53 48 CF 6C ; ±e¬ÿåz°òLøVSHÏl

00000490h: A8 20 04 B5 0B 86 24 D6 FE CB 01 4F C3 F8 2C 62 ; ¨ .µ.†$ÖþË.OÃø,b

000004a0h: AE E4 CB C0 DC AD 5C F1 2F B9 30 31 79 3A 06 E4 ; ®äËÀÜ­\ñ/¹01y:.ä

000004b0h: 24 0D 0F 8A 31 18 E4 55 2C 67 DA 2C D0 88 1E 04 ; $..Š1.äU,gÚ,Ј..

000004c0h: 65 00 64 28 7B 0B 6C 5D 12 DD FB 40 66 67 6F 3D ; e.d({.l].Ýû@fgo=

000004d0h: 04 35 5E E3 0D DE 03 88 30 B3 5E FC 66 73 5A ED ; .5^ã.Þ.ˆ0³^üfsZí

000004e0h: 1E 90 F2 62 2D CD 28 3C 09 A5 01 2B 98 74 3F 0B ; .òb-Í(<.¥.+˜t?.

000004f0h: FB E8 46 11 6D 95 35 A0 DE 2A 2B C9 DF 67 FB EA ; ûèF.m•5 Þ*+Éßgûê

00000500h: A2 2D 1C 52 37 85 63 75 B7 3F E8 48 30 D8 F3 8B ; ¢-.R7…cu·?èH0Øó‹

00000510h: 5F F0 5B 3C A8 DA AA E9 3D CC 97 24 F6 DF 48 90 ; _ð[<¨Úªé=Ì—$ößH

00000520h: DC BA E6 93 6F CE F4 1E 04 2C 00 E4 DB 39 F2 E8 ; ܺæ“oÎô..,.äÛ9òè

00000530h: 6B E4 44 BD 23 0B 8A 14 3C EC 00 75 48 18 8E 58 ; käD½#.Š.<ì.uH.ŽX

00000540h: 46 E6 65 18 7F C7 2D 4F B0 0B 87 3A F1 E5 51 56 ; Fæe.Ç-O°.‡:ñåQV

00000550h: 4E 81 67 BD 43 5D 42 1E 04 75 00 1C 3C A5 80 5F ; Ng½C]B..u..<¥€_

00000560h: D9 9D AA 24 DD D9 E0 9C DC E1 EC 9D D9 8E E7 C7 ; ٝª$ÝÙàœÜáìÙŽçÇ

00000570h: 4D 08 8C 16 87 7B F0 FF B5 F5 A3 E2 25 7D 31 CC ; M.Œ.‡{ðÿµõ£â%}1Ì

00000580h: 1B 4B 7E F1 47 1E 87 1A 54 B4 FA C2 9A 98 A2 6A ; .K~ñG.‡.T´úš˜¢j

00000590h: 5F B7 58 73 4D 3E 13 52 2E F3 82 C5 02 55 59 5E ; _·XsM>.R.ó‚Å.UY^

000005a0h: 75 CB B0 A7 46 73 EB 93 14 6A 35 E9 51 92 6E 0A ; uË°§Fsë“.j5éQ’n.

000005b0h: 69 E2 3B 74 E7 D9 BA 39 5C 9A 3E 21 CC 9B 00 72 ; iâ;tçÙº9\š>!Ì›.r

000005c0h: CA 05 A9 BA ED C5 BF B2 23 70 DF 9C 32 69 F8 12 ; Ê.©ºíÅ¿²#pßœ2iø.

000005d0h: 1E 04 34 00 89 42 A7 DE 4F D6 CA B5 BE AB EB 25 ; ..4.‰B§ÞOÖʵ¾«ë%

000005e0h: CC CF 92 E5 A9 4B 62 80 D9 81 CE 97 A9 BD 78 1C ; ÌÏ’å©Kb€ÙÎ—©½x.

000005f0h: 04 91 CA E4 BB B7 E5 4C 37 08 78 8D 59 71 31 CF ; .‘Êä»·åL7.xYq1Ï

00000600h: 10 41 CD 30 F1 87 1B C0 1E 04 1A 00 84 EA C8 20 ; .AÍ0ñ‡.À....„êÈ

00000610h: FF 24 5A 07 09 BB DC D4 26 6D 8C 12 2D EE 16 A7 ; ÿ$Z..»ÜÔ&mŒ.-î.§

00000620h: CA 7A 6C 04 D1 70 1E 04 1F 00 3A DA 6E 09 CB 7B ; Êzl.Ñp....:Ún.Ë{

00000630h: 41 D4 11 8D 13 EB 22 08 8E CF 42 97 70 E9 41 42 ; AÔ..ë".ŽÏB—péAB

00000640h: 0A 4A 1B 04 82 55 D5 10 E4 1E 04 20 00 F8 B0 4B ; .J..‚UÕ.ä.. .ø°K

00000650h: 07 39 C6 0F 0E 3C 12 CA 78 92 34 91 29 16 29 8D ; .9Æ..<.Êx’4‘).)

00000660h: 4F 01 CD 68 E3 CF 9E A2 BA 40 59 64 A7 1E 04 25 ; O.ÍhãÏž¢º@Yd§..%

00000670h: 00 07 F9 11 06 D3 C0 32 42 73 7D 5E C7 65 2F 6B ; ..ù..ÓÀ2Bs}^Çe/k

00000680h: 65 A0 1D 79 15 5C E3 23 63 EB CB A1 EA 28 BD 57 ; e .y.\ã#cëË¡ê(½W

00000690h: C4 F7 CE 29 62 52 E0 00 14 00 FC 21 E9 23 A1 B5 ; Ä÷Î)bRà...ü!é#¡µ

000006a0h: 64 DE 5B 41 9C CC 0B E5 59 36 AC 4A 85 8D E0 00 ; dÞ[AœÌ.åY6¬J…à.

000006b0h: 14 00 1B 87 C0 58 FF 26 63 51 0B E5 ED C7 04 E3 ; ...‡ÀXÿ&cQ.åíÇ.ã

000006c0h: 60 A1 45 EB BE DE E0 00 14 00 B1 1E 5B 4A 08 1B ; `¡Eë¾Þà...±.[J..

000006d0h: C9 58 DE 1C 60 89 80 49 94 82 31 B6 BC A2 E0 00 ; ÉXÞ.`‰€I”‚1¶¼¢à.

000006e0h: 14 00 30 86 10 A9 F8 E6 5B FB 4C A5 CC 07 1F 57 ; ..0†.©øæ[ûL¥Ì..W

000006f0h: 0E 26 37 59 91 C4 E0 00 14 00 B7 36 DC 27 F8 88 ; .&7Y‘Äà...·6Ü'øˆ

00000700h: 48 68 60 22 8A 5D 9A F8 BA 3A DF CD 54 50 E0 00 ; Hh`"Š]šøº:ßÍTPà.

00000710h: 14 00 BC AD B4 31 66 80 06 85 A7 88 1C 87 FF D2 ; ..¼­´1f€.…§ˆ.‡ÿÒ

00000720h: 33 7B FA D2 4C E1 E0 00 14 00 BC C8 DA B5 A7 E7 ; 3{úÒLáà...¼ÈÚµ§ç

00000730h: F2 45 A4 6E 36 FB 47 3A 5C 40 20 B3 83 E3 E0 00 ; òE¤n6ûG:\@ ³ƒãà.

00000740h: 14 00 CF 02 0E 91 0E D9 C1 B1 26 65 2A 70 37 9F ; ..Ï..‘.ÙÁ±&e*p7Ÿ

00000750h: 3F BA 4E 28 52 A2 E0 00 14 00 6B E6 E7 A1 6E F5 ; ?ºN(R¢à...kæç¡nõ

00000760h: 48 23 0F 5D 5E D9 B3 20 E2 75 22 65 5E 69 E0 00 ; H#.]^Ù³ âu"e^ià.

00000770h: 14 00 78 15 20 8A EB 09 E3 19 33 84 1D 6B 3D 30 ; ..x. Šë.ã.3„.k=0

00000780h: 9F 3C ED 1F 8B F2 E0 00 14 00 09 E3 82 98 AC 21 ; Ÿ<í.‹òà....゘¬!

00000790h: 48 9D C3 26 C3 0F D2 00 ED 1B DC 37 B7 DA E0 00 ; HÃ&Ã.Ò.í.Ü7·Úà.

000007a0h: 14 00 A3 19 FD D0 B6 E5 9B 7E A2 3E 1D EF 72 BB ; ..£.ýжå›~¢>.ïr»

000007b0h: 72 26 8A E6 8B 70 E0 00 14 00 E6 F8 2F 53 B6 B8 ; r&Šæ‹pà...æø/S¶¸

000007c0h: C6 E6 2D 7C 1B 8D 1A D7 1C 35 36 35 C8 54 E0 00 ; Ææ-|..×.565ÈTà.

000007d0h: 14 00 F2 59 8B 57 8F 90 70 C4 C5 61 45 30 8A 7F ; ..òY‹WpÄÅaE0Š

000007e0h: DC 35 89 38 8C BC E0 00 14 00 D2 F7 8B F3 83 73 ; Ü5‰8Œ¼à...Ò÷‹óƒs

000007f0h: 0D 75 E4 50 EE 5D AF 24 3A CD 74 A9 70 ED E0 00 ; .uäPî]¯$:Ít©píà.

00000800h: 14 00 0D 3A 53 B8 AE B0 EA 4B 18 CE B9 C8 11 AE ; ...:S¸®°êK.ιÈ.®

00000810h: 59 59 13 51 E6 FA E0 00 14 00 72 D7 51 8D CC 77 ; YY.Qæúà...r×QÌw

00000820h: AB 13 7F 4F AD 3E ED EB 3C F8 D4 EA 68 0B E0 00 ; «.O­>íë<øÔêh.à.

00000830h: 14 00 1D 91 2F 59 E2 A6 43 4A 55 98 D5 5C D9 D3 ; ...‘/Yâ¦CJU˜Õ\ÙÓ

00000840h: A3 92 F0 AB 94 21 E0 00 14 00 9A 48 EF 1E 6F 8A ; £’ð«”!à...šHï.oŠ

00000850h: 01 2B B7 60 46 8A 50 C0 89 6F BC 3F 44 7D E0 00 ; .+·`FŠPÀ‰o¼?D}à.

00000860h: 14 00 FE 81 7D 92 A3 29 88 66 23 30 45 EF E8 B7 ; ..þ}’£)ˆf#0Eïè·

00000870h: 43 CE 89 63 C6 8B E0 00 14 00 52 72 21 EE 1F 9D ; CΉcÆ‹à...Rr!î.

00000880h: CB 6A F0 A4 FD AC F2 D4 EA 94 0F D5 65 AC 93 02 ; Ëjð¤ý¬òÔê”.Õe¬“.

00000890h: 04 00 5E 5A 16 A9 93 02 04 00 FE A0 78 F7 93 02 ; ..^Z.©“...þ x÷“.

000008a0h: 04 00 B4 F2 B7 62 93 02 04 00 A9 AE EC 68 93 02 ; ..´ò·b“...©®ìh“.

000008b0h: 04 00 30 C5 2E 8B 93 02 04 00 73 D8 9A 6D 60 01 ; ..0Å.‹“...sØšm`.

000008c0h: 02 00 1A 65 85 00 0E 00 19 07 00 00 F2 57 98 F9 ; ...e….......òW˜ù

000008d0h: CC 37 45 CB 37 23 8C 00 04 00 49 76 5C 1F C1 01 ; Ì7EË7#Œ...Iv\.Á.

000008e0h: 08 00 6E B3 BD 62 8E C9 CC 51 FC 00 08 00 E1 B7 ; ..n³½bŽÉÌQü...á·

000008f0h: 03 F9 53 A5 37 D7 FF 00 02 00 21 DE 63 08 15 00 ; .ùS¥7×ÿ...!Þc...

00000900h: A3 A1 8B 65 63 81 D1 69 06 CB 77 52 73 BA 9A 8A ; £¡‹ecÑi.ËwRsºšŠ

00000910h: 9E B3 89 29 C9 0A 00 00 00 09 08 10 00 00 06 10 ; ž³‰)É...........

00000920h: 00 EC 15 CD 07 C1 C0 00 00 06 03 00 00 0B 02 10 ; .ì.Í.ÁÀ.........

00000930h: 00 13 AF AB 9F 53 7E F3 12 64 7D E9 13 7E 61 94 ; ..¯«ŸS~ó.d}é.~a”

00000940h: C0 0D 00 02 00 28 DF 0C 00 02 00 F4 53 0F 00 02 ; À....(ß....ôS...

00000950h: 00 C0 C1 11 00 02 00 8C 60 10 00 08 00 7F 62 B8 ; .ÀÁ....Œ`....b¸

00000960h: 36 07 86 88 EC 5F 00 02 00 E0 02 2A 00 02 00 9E ; 6.†ˆì_...à.*...ž

00000970h: 83 2B 00 02 00 52 87 82 00 02 00 C8 E1 80 00 08 ; ƒ+...R‡‚...Èá€..

00000980h: 00 3C 3E AA 06 6C F2 6C CB 25 02 04 00 A2 7F 8E ; .<>ª.lòlË%...¢Ž

00000990h: FF 81 00 02 00 5A ED 14 00 00 00 15 00 00 00 83 ; ÿ...Zí........ƒ

000009a0h: 00 02 00 B9 8B 84 00 02 00 B0 82 A1 00 22 00 94 ; ...¹‹„...°‚¡.".”

000009b0h: 4F FE DD BF BE 30 14 37 9C A3 85 A3 4C 94 46 06 ; OþÝ¿¾0.7œ£…£L”F.

000009c0h: C9 92 23 56 31 1C 01 3B 17 9A F8 A7 53 0E E0 6F ; É’#V1..;.šø§S.ào

000009d0h: 4E 55 00 02 00 4F B5 00 02 0E 00 3B 79 55 20 0E ; NU...Oµ....;yU .

000009e0h: 27 77 84 D3 A4 C9 27 F2 85 3E 02 12 00 AA B0 04 ; 'w„Ó¤É'ò…>...ª°.

000009f0h: FF A2 9E 89 AC 5B 0C D4 18 01 32 34 E5 33 64 1D ; ÿ¢ž‰¬[.Ô..24å3d.

00000a00h: 00 0F 00 76 CC 66 BC 00 C1 C6 4B 6A 2B FC 4F 7F ; ...vÌf¼.ÁÆKj+üO

00000a10h: C5 EF EF 00 06 00 67 1B D1 9C F4 25 0A 00 00 00 ; Åïï...g.Ñœô%....

00000a20h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

………[00]

000011f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00001200h: FE FF 00 00 05 01 02 00 00 00 00 00 00 00 00 00 ; þÿ..............

00001210h: 00 00 00 00 00 00 00 00 01 00 00 00 E0 85 9F F2 ; ............à…Ÿò

00001220h: F9 4F 68 10 AB 91 08 00 2B 27 B3 D9 30 00 00 00 ; ùOh.«‘..+'³Ù0...

00001230h: A0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 ;  ...........@...

00001240h: 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 ; ....H.......X...

00001250h: 12 00 00 00 68 00 00 00 0C 00 00 00 80 00 00 00 ; ....h.......€...

00001260h: 0D 00 00 00 8C 00 00 00 13 00 00 00 98 00 00 00 ; ....Œ.......˜...

00001270h: 02 00 00 00 A8 03 00 00 1E 00 00 00 08 00 00 00 ; ....¨...........

00001280h: 61 64 6D 69 6E 71 00 00 1E 00 00 00 08 00 00 00 ; adminq..........

00001290h: 61 64 6D 69 6E 71 00 00 1E 00 00 00 10 00 00 00 ; adminq..........

000012a0h: 4D 69 63 72 6F 73 6F 66 74 20 45 78 63 65 6C 00 ; Microsoft Excel.

000012b0h: 40 00 00 00 80 E4 3A 0E F1 1B CB 01 40 00 00 00 ; @...€ä:.ñ.Ë.@...

000012c0h: 00 86 3E 2A F1 1B CB 01 03 00 00 00 01 00 00 00 ; .†>*ñ.Ë.........

000012d0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000012e0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

..............[00]

000021f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00002200h: FE FF 00 00 05 01 02 00 00 00 00 00 00 00 00 00 ; þÿ..............

00002210h: 00 00 00 00 00 00 00 00 01 00 00 00 02 D5 CD D5 ; .............ÕÍÕ

00002220h: 9C 2E 1B 10 93 97 08 00 2B 2C F9 AE 30 00 00 00 ; œ...“—..+,ù®0...

00002230h: C4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 ; Ä...........P...

00002240h: 0F 00 00 00 58 00 00 00 17 00 00 00 68 00 00 00 ; ....X.......h...

00002250h: 0B 00 00 00 70 00 00 00 10 00 00 00 78 00 00 00 ; ....p.......x...

00002260h: 13 00 00 00 80 00 00 00 16 00 00 00 88 00 00 00 ; ....€.......ˆ...

00002270h: 0D 00 00 00 90 00 00 00 0C 00 00 00 A3 00 00 00 ; ...........£...

00002280h: 02 00 00 00 A8 03 00 00 1E 00 00 00 08 00 00 00 ; ....¨...........

00002290h: 42 53 44 44 00 00 00 00 03 00 00 00 E6 15 0B 00 ; BSDD........æ...

000022a0h: 0B 00 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 ; ................

000022b0h: 0B 00 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 ; ................

000022c0h: 1E 10 00 00 01 00 00 00 07 00 00 00 53 68 65 65 ; ............Shee

000022d0h: 74 31 00 0C 10 00 00 02 00 00 00 1E 00 00 00 07 ; t1..............

000022e0h: 00 00 00 B9 A4 D7 F7 B1 ED 00 03 00 00 00 01 00 ; ...¹¤×÷±í.......

000022f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00002300h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

...........[00]

000031f0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00003200h: 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 ; ................

00003210h: 05 00 00 00 06 00 00 00 07 00 00 00 FE FF FF FF ; ............þÿÿÿ

00003220h: 09 00 00 00 0A 00 00 00 0B 00 00 00 0C 00 00 00 ; ................

00003230h: 0D 00 00 00 0E 00 00 00 0F 00 00 00 FE FF FF FF ; ............þÿÿÿ

00003240h: 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00 ; ................

00003250h: 15 00 00 00 16 00 00 00 17 00 00 00 FE FF FF FF ; ............þÿÿÿ

00003260h: FD FF FF FF FE FF FF FF FF FF FF FF FF FF FF FF ; ýÿÿÿþÿÿÿÿÿÿÿÿÿÿÿ

00003270h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

…….[FF]

000033f0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

00003400h: 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 ; R.o.o.t. .E.n.t.

00003410h: 72 00 79 00 00 00 00 00 00 00 00 00 00 00 00 00 ; r.y.............

00003420h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00003430h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00003440h: 16 00 05 01 FF FF FF FF FF FF FF FF 02 00 00 00 ; ....ÿÿÿÿÿÿÿÿ....

00003450h: 20 08 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 ;  .......À......F

00003460h: 00 00 00 00 00 00 00 00 00 00 00 00 C0 37 1F 2D ; ............À7.-

00003470h: F1 1B CB 01 FE FF FF FF 00 00 00 00 00 00 00 00 ; ñ.Ë.þÿÿÿ........

00003480h: 57 00 6F 00 72 00 6B 00 62 00 6F 00 6F 00 6B 00 ; W.o.r.k.b.o.o.k.

00003490h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000034a0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000034b0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000034c0h: 12 00 02 01 FF FF FF FF FF FF FF FF FF FF FF FF ; ....ÿÿÿÿÿÿÿÿÿÿÿÿ

000034d0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000034e0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000034f0h: 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 ; ................

00003500h: 05 00 53 00 75 00 6D 00 6D 00 61 00 72 00 79 00 ; ..S.u.m.m.a.r.y.

00003510h: 49 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 ; I.n.f.o.r.m.a.t.

00003520h: 69 00 6F 00 6E 00 00 00 00 00 00 00 00 00 00 00 ; i.o.n...........

00003530h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00003540h: 28 00 02 01 01 00 00 00 03 00 00 00 FF FF FF FF ; (...........ÿÿÿÿ

00003550h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00003560h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

00003570h: 00 00 00 00 08 00 00 00 00 10 00 00 00 00 00 00 ; ................

00003580h: 05 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 ; ..D.o.c.u.m.e.n.

00003590h: 74 00 53 00 75 00 6D 00 6D 00 61 00 72 00 79 00 ; t.S.u.m.m.a.r.y.

000035a0h: 49 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 ; I.n.f.o.r.m.a.t.

000035b0h: 69 00 6F 00 6E 00 00 00 00 00 00 00 00 00 00 00 ; i.o.n...........

000035c0h: 38 00 02 01 FF FF FF FF FF FF FF FF FF FF FF FF ; 8...ÿÿÿÿÿÿÿÿÿÿÿÿ

000035d0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000035e0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

000035f0h: 00 00 00 00 10 00 00 00 00 10 00 00 00 00 00 00 ; ................

 

This file using  Password=”123” Encryption Type= “Office 97/2000 compatible”  encrypted ,

 

  

How to determine from the information in the type of encryption ??

According to [MS-OFFCRYPTO] 2.3.6 Office Binary Document RC4 Encryption Search “00 01 00 01”[ EncryptionVersionInfo]  to fond the Header

 

00000210h: 06 03 00 00 2F 00 36 00 01 00 01 00 01 00 B5 D1 ; ..../.6.......µÑ

00000220h: E2 AE 99 70 E9 5B 49 0A 20 5F C7 92 59 A7 C3 9E ; â®™pé[I. _Ç’Y§Ãž

00000230h: 1B 49 C0 DA CF 6C 1C 5E 69 C3 9D 75 13 CB D4 7D ; .IÀÚÏl.^iÝu.ËÔ}

00000240h: 0B AF 6E C4 87 E8 DE 9E 76 7F 85 F2 B9 98 E1 00 ; .¯nćèÞžv…ò¹˜á.

00000250h: 02 00 B0 04 C1 00 02 00 15 87 E2 00 00 00 5C 00 ; ..°.Á....‡â...\.

00000260h: 70 00 96 B2 A1 E7 0D F0 47 FA 43 07 C3 A0 30 72 ; p.–²¡ç.ðGúC.à0r

 

So

                       Salt (16 bytes)             =B5 D1 E2 AE 99 70 E9 5B 49 0A 20 5F C7 92 59 A7

 EncryptedVerifier (16 bytes)            =C3 9E 1B 49 C0 DA CF 6C 1C 5E 69 C3 9D 75 13 CB

EncryptedVerifierHash (16 bytes)    =D4 7D 0B AF 6E C4 87 E8 DE 9E 76 7F 85 F2 B9 98

 

Did I get the correct value ?

 

Answer 5

Hello  YM333mmm, 

I am the engineer who has taken ownership of your issue. I am currently investigating this and will update you once things progress.

Best Regards, 

Dominic Salemno

I am Update project ,pleaess help me~!

Answer 6

You say your intention is to crack, so I'm not sure that the question is

appropriate here. That said, your approach seems to be one of digging in the

dark and you need to start by understanding the basic structure of compound

files, and then to read the [MS-OFFCRYPTO] documentation in the context of

the [MS-XLS] document, which describes the Workbook substreams.

 

After that, nothing I can see in the documentation actually says where the

Encryption Header is stored and one is left to guess. It does appear, in

your particular example you _may_ (I don't know) have identified what you

want by chance - with the Encryption Header coming in the Workbook Stream

immediately after the Global Substream - but there is no indication that you

can guarantee to find it that way every time. In Word it _appears_ to come

at the start of the 1Table Stream - there appearing to be a single

encryption header applying to all streams, although the format varies

according to the Encryption Provider being used - but, again, no indication

that I can see as to whether it will always be there.

 

--

Enjoy,

Tony

 

www.WordArticles.com

 

 

---

Enjoy,
Tony
www.WordArticles.com

Answer 7

YM333mmm, 

The location of the Encryption Header will be different for each different application (.doc, .ppt, .xls).
There is an example of what you seek with source, comments, and sample binary files located at: http://offcrypto.codeplex.com/

Dominic Salemno
Escalation Engineer
US-CSS DSC Protocols Team

 

Answer 8

Thanks for every thing ~!!

now I can find the Encryption Header from the Streem ~!!

Answer 9

Thanks for helping ~~!!

Answer 10

HI YM333mmm

Could you please guide me if you get the encryptedHeader programatically.

e-mail: [e-mail]