Introduction : ============== Steghide is a steganography tool which is able to hide data in "container files" and to extract this data again. If you do not know what steganography is take a look at Neil F. Johnson's paper about steganography at http://www.isse.gmu.edu/~njohnson/stegdoc/ Steghide is designed to be portable and configurable and features hiding data in bmp, wav and au files, blowfish encryption, MD5 hashing of passphrases to blowfish keys and pseudo-random distribution of hidden bits ("stego bits") in the container data. The current version is 0.3. Compilation and Installation : ============================== Linux / Unix : -------------- 1) ./configure 2) make 3) make install For more info see the generic installation instructions in the file INSTALL. Tarballs and RPM packages are available from the steghide website at: http://www.crosswinds.net/~shetzl/steghide/index.html Windows : --------- The easiest way is probably downloading the win32 console executable which is available from http://www.crosswinds.net/~shetzl/steghide/index.html If you want to compile the sources yourself you need a C compiler. How you need to compile the source code depends on the compiler you are using: Please consult your compiler's documentation. Description : ============= Steghide can be run in interactive mode or in non-interactive mode. Non-interactive mode simply means that steghide is called from the command line with some arguments. If steghide is started without arguments or with the "-i" argument only, then interactive mode is started. In interactive mode you need not enter all arguments on one line (like you would have to if you would call steghide directly from the command line), but can type one or more arguments, then hit return and type more arguments on another line and so on. In interactive mode, all commands have the same syntax as the arguments on the command line. A stego file (a bmp, wav or au file with embedded data) has a special format: The first three bytes after the "native header(s)" (bmp, wav or au header(s)) contain a value in their least significant bits: the amount of space between two bytes in the stego file that contain an embedded bit of the "stego header". The stego header is a few bytes long and contains the information that is necessary to permit the receiver to extract the plain data from the stego data again. Immediately after the last byte that contains a hidden bit of the stego header is the first byte that contains a hidden bit / hidden bits of the plain data. Steghide is able to encrypt the plain data before embedding it / after extracting it. The encryption process works as follows: The user enters a passphrase that can be of any length. Steghide hashes this passphrase to a 128 bit value using the MD5 algorithm. This 128 bit hash value is passed to blowfish and used as a key for encrypting or decrypting the plain data and/or the stego header. Steghide is able to use bmp, wav and au files as container files. The file format of the container and the stego file is detected automatically. However, there are some restrictions: only Windows 3.1 and later bmp files, OS/2 1.x bmp files; pcm wav files with a bit per sample rate that is a multiple of 8; and all au files can be used. These "sub-"formats are the most common anyway so it will hardly ever happen that steghide refuses to hide data in a file because it does not know its format. If you are in doubt if the file you want to use is in one of the formats mentioned above, just try it. Usage : ======= -i, --interactive If this argument is given or if no arguments are given at all, steghide starts in interactive mode. In interactive mode, all arguments have the same syntax as on the command line, however there are two more commands than on the command line: You can quit steghide (without embedding or extracting data) if you type "quit" or "cancel". If you have finished giving arguments you can embed or extract data if you type "start" or "ok". To get help you can type "help" which prints the same info as "-h" or "--help" but does not quit afterwards. See the sample session below (in the examples section) for more info. -w, --write, --embed Embed plain data in container data, resulting in stego data. -r, --read, --extract Extract plain data from stego data. One of these two arguments ("-w" and "-r") must be given. -s, --space This argument defines the method that is used to calculate the space between two bytes that contain hidden data ("stego bytes") in the stego file. You can choose among two different methods: a constant space and a pseudo-random space. To use a constant space you have to specify this argument in the following form: "-s cnst ", whereas "cnst" tells steghide to use a CoNSTant space and is a decimal number that defines the amount of space between two stego bytes (in bytes). To use a pseudo-random space this argument should be given as follows: "-s linc ", whereas "linc" tells steghide to use pseudo-random numbers that are generated using a LINear Congruency generator, is the seed of the generator ( can be any positive integer, but will be truncated if its value exceeds 2^32) and is the maximum value that the generator will output and therefor also the maximum space between two stego bytes. This argument ("-s") must always be given if "-w" is activated (if data is embedded) and will be ignored if "-r" is activated. -H, --stegoheader This argument defines how the "stego header" is embedded in the container file. The first argument of -H can be a a value for the constant space (must be between 0-7). This value is also embedded in the container file to make it possible for the receiver to extract the senders message again. If you omit this number, a random number is chosen if -w is enabled. If -r is enabled the number you specify is ignored because the correct value is embedded in the file anyway. The second argument of -H is the encryption algorithm that is used to encrypt the stego header. You have two possibilities: "blowfish" and "none". If you specify "none" the stego header will not be encrypted which is very insecure. If you specify "blowfish" the stego header will be encrypted with the blowfish algorithm. You then have to specify a passphrase as third argument of -H. If this passphrase consists of more than one word, you must enclose it in quotes ("). This will enable the program to recognize the passphrase as one argument. If you specify "none", you - of course - do not need a passphrase. If the -H argument is not given and data is embedded, a random number is used as constant space and no encryption is used. If -H is not given and data is extracted it is supposed that the embedded stego header is not encrypted. Be careful: Steghide can not find out if an embedded stego header is encrypted or not, you have to tell it! It can lead to weird results or error messages if you tell steghide that an embedded and encrypted stego header is not encrypted. -e, --encryption This argument defines if and which encryption is applied to the plain data before embedding it / after extracting it. You have three different possibilities: "blowfish", "sthdr" and "none". If you specify "blowfish", the second argument of -e is a passphrase (use quotes if the passphrase is longer than one word!). If you specify "sthdr", the same encryption (with the same passphrase) that has been applied to the stego header is used on the plain data (this can be blowfish or none). This option is pretty handy if you want to use the same encryption (and the same passphrase) for the stego header and the plain data but do not want to type your 789-character passphrase twice. If you specify "none" then - you guessed it - the plain data is not encrypted. -m, --mask This argument is followed by a decimal number which specifies an 8 bit mask that is used to hide data in the container bytes. If the mask is for example 3 then data is embedded in the least significant and second least significant bit of the container byte. Normally, you do not have to worry about this. The default is 1 which is pretty secure, you should not change it. Note that it can be very insecure to embed data in bits other than the least significant. -cf, --containerfile This argument is followed by a filename. This file will be used as container file (file in which data will be embedded). -sf, --stegofile This argument is followed by a filename. The given file will be used as stego file (file that contains or will contain embedded data). -pf, --plainfile This argument is followed by a filename. This file will be used as plain file (file that contains the data to be embedded / will contain the embedded data). If one of the file-arguments is not given or if the filename is a -, standard input or standard output is used like appropriate (standard input is used if data is needed and standard output is used if data is generated), see the following table: | -pf | -cf | -sf | ----------------------------------------- -w | stdin | stdin | stdout | ----------------------------------------- -r | stdout | / | stdin | -v, --version Print version information. -h, --help Print short help (usage information). Examples : ========== Here are some examples how steghide could be used: A sample interactive session (constant space 3 for data, space 5 for stego header, blowfish encryption for stego header and for plain data, container file: cnt.au, plain file: secret.txt, stego file: stg.au). You can give one or more commands on one line: $ steghide steghide 0.3 Copyright 1999, Stefan Hetzl steghide is covered by the GNU General Public License (steghide) -w (steghide) -s cnst 3 (steghide) -H 5 blowfish "This is a passphrase." -e sthdr (steghide) -cf cnt.au (steghide) -pf secret.txt (steghide) -sf stg.au (steghide) ok done. $ The following command has the same effect as the example above (in interactive mode). The order of the arguments does not matter. steghide -cf cnt.au -s cnst 3 -pf secret.txt -H 5 blowfish "This is a passphrase." -w -sf stg.au -e sthdr To extract the data that has been embedded with the command(s) above, type: steghide -r -sf stg.au -pf result.txt -H blowfish "This is a passphrase." -e sthdr If you are using a system that supports pipes you can also pass data via standard input to steghide. In the following example data is compressed before it is (encrypted and) embedded: gzip -c pln.txt | steghide -w -s linc 1234567 5 -cf cnt.bmp -sf stg.bmp -H blowfish "This is another passphrase." -e sthdr To extract (and read) the data from this file again, you could do something like this: steghide -r -sf stg.bmp -H blowfish "This is another passphrase." -e sthdr | gunzip | less How to Contact me : =================== If you have found a bug or if you have questions, comments, suggestions, etc. please contact me at shetzl@teleweb.at. You can get the latest version of steghide as well as some additional info from http://www.crosswinds.net/~shetzl/steghide/index.html