PpfFormat - read crypted files

RC4 CryptoAPI encrypting
This commit is contained in:
ElenaSubbotina
2017-06-16 16:33:09 +03:00
parent 48587f55b3
commit b8ad1797f0
22 changed files with 776 additions and 224 deletions

View File

@ -133,11 +133,21 @@ namespace DocFileFormat
pos = tStream.GetPosition();
//------------------------------------------------------------------------------------------
crypt_data_aes.hashAlgorithm = CRYPT_METHOD::SHA1; //by AlgIDHash -> 0x0000 || 0x8004
crypt_data_aes.spinCount = 50000;
switch(AlgIDHash)
{
case 0x8003: crypt_data_aes.hashAlgorithm = CRYPT_METHOD::MD5; break;
case 0x0000:
case 0x8004: crypt_data_aes.hashAlgorithm = CRYPT_METHOD::SHA1; break;
}
crypt_data_aes.spinCount = 0;
switch(AlgID)
{
case 0x0000:
if (fAES) crypt_data_aes.cipherAlgorithm = CRYPT_METHOD::AES_ECB;
if (fCryptoAPI) crypt_data_aes.cipherAlgorithm = CRYPT_METHOD::RC4;
crypt_data_aes.keySize = KeySize / 8;
break;
case 0x6801:
crypt_data_aes.cipherAlgorithm = CRYPT_METHOD::RC4;
crypt_data_aes.keySize = KeySize / 8;
@ -156,16 +166,11 @@ namespace DocFileFormat
break;
}
switch(ProviderType)
{
case 0x0001: crypt_data_aes.cipherAlgorithm = CRYPT_METHOD::RC4; break;
case 0x0018: crypt_data_aes.cipherAlgorithm = CRYPT_METHOD::AES_ECB; break;
}
//switch(ProviderType)
//{
// case 0x0001: crypt_data_aes.cipherAlgorithm = CRYPT_METHOD::RC4; break;
// case 0x0018: crypt_data_aes.cipherAlgorithm = CRYPT_METHOD::AES_ECB; break;
//}
}
//RELEASEARRAYOBJECTS( bytes );
}
}

View File

@ -470,6 +470,12 @@ namespace DocFileFormat
delete storageOut;
return false;
}
//DecryptStream(Decryptor, "WordDocument", storageIn, storageOut);
//if (FIB->m_FibBase.fWhichTblStm)
// DecryptStream(Decryptor, "1Table", storageIn, storageOut);
//else
// DecryptStream(Decryptor, "0Table", storageIn, storageOut);
std::list<std::string> listStream = storageIn->entries();
for (std::list<std::string>::iterator it = listStream.begin(); it != listStream.end(); it++)
@ -480,13 +486,20 @@ namespace DocFileFormat
for (std::list<std::string>::iterator it2 = list_entry.begin(); it2 != list_entry.end(); it2++)
{
//if (*it2 != "WordDocument" && std::wstring::npos == it2->find("Table"))
// CopyStream( *it2, storageIn, storageOut);
DecryptStream(Decryptor, *it2, storageIn, storageOut);
}
}
else
{
//if (*it != "WordDocument" && std::wstring::npos == it->find("Table"))
// CopyStream( *it, storageIn, storageOut);
DecryptStream(Decryptor, *it, storageIn, storageOut);
}
}
storageOut->close();
delete storageOut;
@ -508,6 +521,31 @@ namespace DocFileFormat
}
return true;
}
bool WordDocument::CopyStream (std::string streamName, POLE::Storage * storageIn, POLE::Storage * storageOut)
{
POLE::Stream *stream = new POLE::Stream(storageIn, streamName);
if (!stream) return false;
stream->seek(0);
int sz_stream = stream->size();
POLE::Stream *streamNew = new POLE::Stream(storageOut, streamName, true, sz_stream);
if (!streamNew) return false;
unsigned char* data_stream = new unsigned char[sz_stream];
stream->read(data_stream, sz_stream);
streamNew->write(data_stream, sz_stream);
RELEASEARRAYOBJECTS(data_stream);
streamNew->flush();
delete streamNew;
delete stream;
return true;
}
bool WordDocument::DecryptStream(CRYPT::Decryptor* Decryptor, std::string streamName, POLE::Storage * storageIn, POLE::Storage * storageOut)

View File

@ -103,6 +103,7 @@ namespace DocFileFormat
private:
bool DecryptOfficeFile (CRYPT::Decryptor* Decryptor);
bool DecryptStream (CRYPT::Decryptor* Decryptor, std::string streamName, POLE::Storage * storageIn, POLE::Storage * storageOut);
bool CopyStream (std::string streamName, POLE::Storage * storageIn, POLE::Storage * storageOut);
inline StructuredStorageReader* GetStorage() const
{