Detection password protected MS Office files in C/C++

Question

How can I detect password protected Ms Office Files? I'm using C/C++ on Linux.

Answer 1

If the files are in Office 2007 format (eg .docx), then their internal storage is either:

1) A zip file of xml docs (if it's not password protected)

2) The old style compound file format (if it IS password protected).

Therefore you could probably do something like this:

1) Check the first few bytes of the file

2) If it's a zip file (non password protected), it'll start with 0x50 0x4b 0x03 0x04.

3) If it's not a zip file, then it's probably password protected. It will start with a different binary signature (eg Word 2007 docs start with 0xd0 0xcf 0x11 0xe0 in this case)

Basically, if it's a new .docx or .xlsx, and it DOESN'T start with the zip signature of 0x50 0x4b 0x03 0x04, it's probably password protected.

For other versions of MS Office, it's a bit trickier...

Answer 2

The file signature of the encrypted file should be different. for an un-encrypted it is 50 4B 03 04 The first 4 bytes of an encrypted are D0 CF 11 E0 (at least for a docx, might be different for excel,ppt,...