From: Caolan McNamara (Caolan.McNamara at domain ul.ie)
Date: Fri 03 Sep 1999 - 16:17:52 IST
Quite some time ago I attempted to add word 97 decryption to wv.
I managed to track down a few people who helped me out. And the fruit of
that labour produced some code that can validate that a given password is
correct or incorrect for a particular encrypted word 97 document.
A word document is an ole2 document and as such contains a number of streams,
the two encrypted streams in a word document are the table stream and the
word document stream. The password validation code can also decrypt the
first 512 bytes of the table stream, but then fails for the rest. MS appears
to be rekeying the rc4 algorithm that is the encryption mechanism. Im
definitely at the end of my ability, and after much plinking about I've
decided that Im not going to be to finish myself, so im releaseing it
publically for everyone to have a look at it.
There is some information at http://www.crak.com/word8.htm that lists
what occurs in the {en|de}crypting process, and the source is reasonably
explanatory.
The source is available at http://www.csn.ul.ie/~caolan/publink/wvDecryptTest
Its written under linux, and should work on all similiar systems, theres
nothing too special required except that it uses the wv library to access
the internals of the word document, the version of wv that it needs is at
http://www.csn.ul.ie/~caolan/publink/mswordview/development/wv-0.5.28.tar.gz
Give it a whirl if you are interested.
C.
Real Life: Caolan McNamara * Doing: MSc in HCI
Work: Caolan.McNamara at domain ul.ie * Phone: +353-86-8790257
URL: http://www.csn.ul.ie/~caolan * Sig: an oblique strategy
Discover the recipes you are using and abandon them
This archive was generated by hypermail 2.1.6 : Thu 06 Feb 2003 - 13:04:32 GMT