/* Copyright (c) 1999, Caolan McNamara All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include #include #include "wv.h" int main(int argc, char *argv[]) { int ret; wvParseStruct ps; FILE *input; if (argc < 3) { printf("Usage: ./a.out password wordfile\n"); return(-1); } input = fopen(argv[2],"rb"); ret = wvInitParser(&ps,input); if (ret != 7) { wvError(("file is not an encrypted word95 document %s\n",argv[1])); wvOLEFree(); return(2); } wvSetPassword(argv[1],&ps); if (wvDecrypt95(&ps)) printf ("Wrong password\n"); else printf ("Correct password\n"); wvOLEFree(); return(ret); } /* ROTATE_LEFT rotates x left n bits , with a bitlen of b*/ #define ROTATE_LEFT(x, n,b) (((x) << (n)) | ((x) >> (b-(n)))) int wvDecrypt95(wvParseStruct *ps) { FILE *mainfd; unsigned char pw[16],z,g; unsigned char key[16]; U8 pwkey[2]; int i,j=0,c,len,ret=1; unsigned long end; unsigned char test[0x10]; U16 hash,h; if (ps->password[0] == 0) return(ret); hash = (U16)ps->fib.lKey&0xffff; pwkey[0] = (U8)((ps->fib.lKey >> 16) & 0xFF); pwkey[1] = (U8)((ps->fib.lKey >> 24) & 0xFF); for (i=0;i<16;i++) pw[i] = ps->password[i]; len = strlen(pw); i = len; z = 0xbb; for(;i<16;i++) { switch(j) { case 0: pw[i]=0xbb; break; case 1: pw[i]=0xff; break; case 2: pw[i]=0xff; break; case 3: pw[i]=0xba; break; case 4: pw[i]=0xff; break; case 5: pw[i]=0xff; break; case 6: pw[i]=0xb9; break; case 7: pw[i]=0x80; break; case 8: pw[i]=0x0; break; case 9: pw[i]=0xbe; break; case 10: pw[i]=0xf; break; case 11: pw[i]=0x0; break; case 12: pw[i]=0xbf; break; case 13: pw[i]=0xf; break; case 14: pw[i]=0; break; j++; } j++; } h = 0xce4b; wvTrace(("hash is now %x\n",hash)); for(i=0;i<16;i++) { g = (pw[i] ^ pwkey[i&1]); g = ROTATE_LEFT(g,7,8); h ^= ( ROTATE_LEFT(pw[i],i+1,15) ^ (i+1) ^ i); wvTrace(("h is now %x\n",h)); if (i == len-1) if (h == hash) ret=0; key[i] = g; } if (ret) return(ret); fseek(ps->mainfd,0,SEEK_END); end = ftell(ps->mainfd); j = 0; fseek(ps->mainfd,j,SEEK_SET); mainfd = fopen("mainfd","w+b"); while(j<0x30) { c = fgetc(ps->mainfd); fputc(c,mainfd); j++; } while(jmainfd); for (i=0;i<16;i++) { if (test[i] != 0) c = key[i]^test[i]; else c = 0; fputc(c,mainfd); } j+=16; } if (ps->tablefd0) fclose(ps->tablefd0); if (ps->tablefd1) fclose(ps->tablefd1); fclose(ps->mainfd); ps->tablefd = mainfd; ps->tablefd0 = mainfd; ps->tablefd1 = mainfd; ps->mainfd = mainfd; rewind(ps->tablefd); rewind(ps->mainfd); ps->fib.fEncrypted=0; wvGetFIB(&ps->fib,ps->mainfd); ps->fib.fEncrypted=0; return(ret); } #if 0 int wvCrack95(wvParseStruct *ps) { /* is is quite possible to crack password 95 files fairly easily, there is standard frequency analysis on the cipher text whiich is simply stamped with a 16byte xor key from 0x28 onwards, but there are quite a few known bytes in the fib header with is also encrypted, for instance unencrypted is the beginning and end of the text stream, encrypted is the len of the text stream, so already you have a few bytes of the xor key, and so on, the fcStshOrig is nearly always the same as the fcStsh so theres another byte or two, and so forth. If a struct has an lcb of 0, it remains zero despite what should happen in a xor and thus you know that the fc before and after the 0 lcb are the same, and so forth, so you could derive a lot of information about the xor key from the header, I might complete this some day, there have been a load of other programs that do similiar things, so i don't know that my adding to that pile will help */ int i; U8 block1[4]; U8 block2[4]; U32 reallen; wvError(("begin is %x\n",ps->fib.fcMin)); wvError(("end is %x\n",ps->fib.fcMac)); wvError(("len is %x\n",ps->fib.fcMac-ps->fib.fcMin)); reallen = ps->fib.fcMac-ps->fib.fcMin; wvError(("encrypted len is %x\n",ps->fib.ccpText)); block1[0] = (U8)(ps->fib.ccpText & 0xFF); block1[1] = (U8)((ps->fib.ccpText >> 8) & 0xFF); block1[2] = (U8)((ps->fib.ccpText >> 16) & 0xFF); block1[3] = (U8)((ps->fib.ccpText >> 24) & 0xFF); block2[0] = (U8)(reallen & 0xFF); block2[1] = (U8)((reallen >> 8) & 0xFF); block2[2] = (U8)((reallen >> 16) & 0xFF); block2[3] = (U8)((reallen >> 24) & 0xFF); key[4] = block1[0] ^ block2[0]; key[5] = block1[1] ^ block2[1]; key[6] = block1[2] ^ block2[2]; key[7] = block1[3] ^ block2[3]; block1[0] = (U8)(ps->fib.lcbStshf & 0xFF); block1[1] = (U8)((ps->fib.lcbStshf >> 8) & 0xFF); block1[2] = (U8)((ps->fib.lcbStshf >> 16) & 0xFF); block1[3] = (U8)((ps->fib.lcbStshf >> 24) & 0xFF); block2[0] = block1[0] ^ key[4]; block2[1] = block1[1] ^ key[5]; block2[2] = block1[2] ^ key[6]; block2[3] = block1[3] ^ key[7]; reallen = sread_32ubit(block2); fprintf(stderr,"reallen is %x\n",reallen); block2[0] = (U8)(reallen & 0xFF); block2[1] = (U8)((reallen >> 8) & 0xFF); block2[2] = (U8)((reallen >> 16) & 0xFF); block2[3] = (U8)((reallen >> 24) & 0xFF); block1[0] = (U8)(ps->fib.lcbStshfOrig & 0xFF); block1[1] = (U8)((ps->fib.lcbStshfOrig >> 8) & 0xFF); block1[2] = (U8)((ps->fib.lcbStshfOrig >> 16) & 0xFF); block1[3] = (U8)((ps->fib.lcbStshfOrig >> 24) & 0xFF); key[12] = block1[0] ^ block2[0]; key[13] = block1[1] ^ block2[1]; key[14] = block1[2] ^ block2[2]; key[15] = block1[3] ^ block2[3]; block1[0] = (U8)(ps->fib.fcStshf & 0xFF); block1[1] = (U8)((ps->fib.fcStshf >> 8) & 0xFF); block1[2] = (U8)((ps->fib.fcStshf >> 16) & 0xFF); block1[3] = (U8)((ps->fib.fcStshf >> 24) & 0xFF); block2[0] = (U8)(ps->fib.fcPlcffndRef & 0xFF); block2[1] = (U8)((ps->fib.fcPlcffndRef >> 8) & 0xFF); block2[2] = (U8)((ps->fib.fcPlcffndRef >> 16) & 0xFF); block2[3] = (U8)((ps->fib.fcPlcffndRef >> 24) & 0xFF); if ( (block1[0] == 0) && (block2[0]) && (reallen < 0xff) ) { fprintf(stderr,"good\n"); key[8] = reallen ^ block2[0]; } else fprintf(stderr,"crap\n"); block2[0] = (U8)(ps->fib.lcbPlcffndRef & 0xFF); block2[1] = (U8)((ps->fib.lcbPlcffndRef >> 8) & 0xFF); block2[2] = (U8)((ps->fib.lcbPlcffndRef >> 16) & 0xFF); block2[3] = (U8)((ps->fib.lcbPlcffndRef >> 24) & 0xFF); fprintf(stderr,"%x %x %x %x\n",block2[0],block2[1],block2[1],block2[0]); if ( (block2[0] == 0) && (block2[1] == 0) && (block2[2] == 0) && (block2[3] == 0) ) { fprintf(stderr,"good\n"); block1[0] = (U8)(ps->fib.fcPlcffndRef & 0xFF); block2[0] = (U8)(ps->fib.fcPlcffndTxt & 0xFF); reallen = key[8] ^ block2[0]; key[0] = reallen ^ block1[0]; } for (i=0;i<16;i++) fprintf(stderr,"key %d is %x\n",i,key[i]); return(0); } #endif