ooxml Steg

[will ton]

INTRODUCTION

This toolsuite will let peolple hide or unhide secret message inside of Microsoft Office 2007 files .just in an intelligent way.Since the newer Office files are basically just zip files containing XML and resources.By zip library,we can extract some xml parts inside of the file.This tool concludes two parts or two methods:method based on element order and method based on attribute order.Two methods are both designed based on xml characteristics, which any xml files can conclude many elements and atributes.So, the method of changing elements's or attributes' order to hide secret data is used. Now this tool is adapt to .docx file,later tool adapt to .xlsx and .pptx file will published.

EXAMPLIE

Take a method based on element order as a example.
With zip library,we can extract "document.xml" parts from .docx,some fragment shows below:

<w:rPr>
       <w:rFonts w:eastAsia="仿宋_GB2312" w:ascii="仿宋_GB2312" w:hint="eastAsia"    w:cs="宋体" w:hAnsi="宋体"/>
       <w:b/>
       <w:kern w:val="0"/>
      <w:sz w:val="32"/>
      <w:szCs w:val="32"/>
</w:rPr>

From xml fragment above, we can see the element "w:rPr" has some sub_elements: "w:rFonts", "w:b","w:kern","w:sz","w:szCs".We can select two sub_elements above,then change their orders to embed watermark bit "0" or "1".The method of attribute order is similar.

How to use

Embed:

By this tool,people just follow some simple steps below ro embed secret data in carrier files:
step1: select a .docx file as a carrier;

step2: select a method of two above;

step3: select a secret data to be hided.

then just click the button "Embed",the operation of embed is done. The generated file will be "(elem).docx" or "(attr).docx".

Extract :

The operation of extract is similar to embed;
step1:select a file to detect;

step2:select method;

then just click teh button "Extract",the potential message is extracted which is save in "msg.txt".

[will ton]

Updated tool is published,the tool above has some bugs ,not adapt to win7 os,now the tool is changed.