Обеспечение надежности и безопасности использования информационных технологий, базирующееся на методах стеганографии

Содержимое SP4

The raindrop quickly slides to the sly navel. I wonder dry

raindrops near the squishy huge porch. Sometimes, sandwichs

flow behind ugly roofs, unless they're messy. Never think

absolutely while you're listening through a pathetic Bible.

We really lean around untouched idle infernos. While balls

freely close, the raindrops often toot on the shiny bushs.

Other white loud dryers will believe admiringly with aches.

Going below a barn with a ball is often flat. Have a clear

sandwich. The flat yogi rarely creates. Tell the cold ulcer

it's incredibly infecting against a jacket. Many ugly flat

pens will think wanly to frogs. To be wet or closed will cause ajar

raindrops to relay. Will you love the blank ugly raindrops?

Let's close near the shiny islands, but don't hug the lazy

films. The unique lazy tapes undoubtably know as the cloudy

shoes flow. Where is the card for the silly pin? She will surely

restrain when the plastic bushs get to the strong island.

Go hug a coffee! It's very yellow today, I'll run tamely.

The secret rough dog plays over the wierd cloud. Shall we ski

before the tubular dryers train? I'd rather place amazingly

than destroy with a blue tree. If the ugly hens are able to sniff

easily, the shiny pens may lean. The cars, frames,

and tyrants are all red and odd. My clear disk won't recoil

unless I enjoy. He will dream halfheartedly if the elbow isn't pathetic.

The tree loudly pulls to the strange obelisk. I play silly

arrows near the soft new alley. Sometimes, cats swim behind wierd

moons, unless they're idle. Never kill familiarly while you're darkening

through a wooden ulcer. We subtly infect around loud squishy

lanes. While frogs fully wonder, the eggs often sow on the idle

puddles. Other official lazy trees will run truly with sauces.

Going below a highway with a arrow is often red. Have a huge

frame. The silly exit rarely vends. Tell the ugly hen it's strongly

engulfing against a can. Many pathetic clear desks will destroy

finally to bushs. To be dim or lazy will cause dull stickers

to love. Will you relay the silly shiny games? Let's relay

near the unique mountains, but don't learn the huge counters.

The red tubular sandwichs eerily climb as the untouched shoes

wash. Where is the tag for the dense floor? She will steadily

keep when the huge eggs get to the cloudy road. Go open a can!

It's very new today, I'll engulf smartly. The plastic unique

printer buys over the yellow dust. Shall we sever before the idle

printers flow? I'd rather recoil smartly than know with a goofy

tree. If the red elbows are able to smile eventually, the clear

jars may sniff. The bushs, forks, and books are all clear

and sharp. My ajar Bible won't climb unless I relay. He will know

quietly if the brush isn't squishy. The hat sneakily kills

to the tubular bathroom. I smile flat tyrants near the clear

dim planet. Sometimes, boxs sever behind official signs,

unless they're filthy. Never listen

Список произведений предназначенных для создания пустых контейнеров

Распределение Вероятностей Байт

N - значение байта, P - вероятность его появления в окне.

N	P	N	P	N	P	N	P	N	P	N	P
0	0,232	51	0,004	101	0,061	151	0	201	0,002	251	0
1	0,021	52	0,001	102	0,011	152	0,002	202	0	252	0,002
2	0,007	53	0	103	0,008	153	0	203	0	253	0
3	0,004	54	0	104	0,009	154	0,001	204	0,004	254	0
4	0,002	55	0	105	0,019	155	0	205	0	255	0,032
5	0	56	0,001	106	0,002	156	0	206	0
6	0	57	0	107	0,002	157	0	207	0
7	0	58	0,002	108	0,023	158	0	208	0
8	0,003	59	0,001	109	0,009	159	0	209	0
9	0	60	0	110	0,019	160	0,001	210	0
10	0	61	0,001	111	0,017	161	0,001	211	0
11	0	62	0	112	0,014	162	0	212	0,001
12	0,001	63	0	113	0	163	0	213	0
13	0,001	64	0,001	114	0,025	164	0	214	0,002
14	0	65	0,005	115	0,022	165	0	215	0
15	0	66	0,001	116	0,046	166	0	216	0
16	0,013	67	0,009	117	0,013	167	0	217	0
17	0	68	0,004	118	0,003	168	0,001	218	0
18	0	69	0,011	119	0,001	169	0	219	0
19	0,001	70	0,002	120	0,009	170	0	220	0,001
20	0,001	71	0,008	121	0,006	171	0	221	0
21	0	72	0,004	122	0	172	0	222	0
22	0	73	0,002	123	0	173	0	223	0
23	0,001	74	0	124	0,001	174	0	224	0,001
24	0,003	75	0,003	125	0	175	0	225	0,002
25	0	76	0,006	126	0	176	0,001	226	0,002
26	0,006	77	0,006	127	0	177	0	227	0
27	0,019	78	0,002	128	0,001	178	0	228	0,001
28	0,013	79	0,004	129	0,001	179	0	229	0
29	0,004	80	0,01	130	0,001	180	0	230	0
30	0	81	0,004	131	0	181	0	231	0
31	0	82	0,005	132	0	182	0,002	232	0,002
32	0	83	0,005	133	0,004	183	0	233	0,001
33	0	84	0,003	134	0	184	0	234	0
34	0,002	85	0,001	135	0	185	0	235	0
35	0	86	0,005	136	0,001	186	0	236	0,003
36	0,005	87	0,006	137	0,005	187	0	237	0,001
37	0,005	88	0,003	138	0,001	188	0	238	0
38	0	89	0,003	139	0,009	189	0	239	0
39	0	90	0,001	140	0	190	0	240	0,002
40	0	91	0,001	141	0,002	191	0	241	0
41	0	92	0	142	0	192	0,002	242	0
42	0	93	0	143	0,001	193	0	243	0,001
43	0,002	94	0,001	144	0	194	0,001	244	0
44	0,002	95	0,03	145	0	195	0,006	245	0
45	0,001	96	0	146	0	196	0,002	246	0,002
46	0,003	97	0,019	147	0	197	0,001	247	0
47	0,001	98	0	148	0,001	198	0	248	0,003
48	0	99	0,011	149	0	199	0,001	249	0,001
49	0,001	100	0,017	150	0,001	200	0,004	250	0,001

Исходные коды программ стегоанализа

Исходные коды файлов программы стегоанализа текстовых файлов, полученных с помощью Texto.

StegFind.cpp

#include <stdio.h>

float Global[2*13];

float x1,x2;

float Diff[11];

int getfilesize(char * path[])

{int i=-1;

FILE * f;

f=fopen(path,"rb"); if (f==NULL){printf("Path not found\n");return -1;}

fseek(f,0,SEEK_END);

i=ftell(f);

fclose(f);

return i;

}

void concat(char *dest, char *src)

{int i=0,j=strlen(dest);

while(src[i]!='\0')

{

dest[j]=src[i];

i++;j++;

}

dest[j]='\0';

}

void inttostr(char * str,int x )

{int i=0;

char s[80];

while(x!=0)

{

s[i]=(x%10)+'0';

x=(x/10);

i++;

}s[i]='\0';

for(i=0;i<strlen(s);i++)

{

str[i]=s[strlen(s)-i-1];

} str[i]='\0';

}

void prepare1()

{

int i,filesize;

FILE * f;

char cmd[80],cmd1[80];

char filename[20],tmp[13][50];

float x;

strcpy(tmp[1],"temp/n.txt");

strcpy(tmp[2],"temp/n.tar");

strcpy(tmp[3],"temp/nx.txt");

strcpy(tmp[4],"temp/nx.tar");

strcpy(tmp[5],"temp/t.txt");

strcpy(tmp[6],"temp/t.tar");

strcpy(tmp[7],"temp/tx.txt");

strcpy(tmp[8],"temp/tx.tar");

strcpy(tmp[9],"temp/p.txt");

strcpy(tmp[10],"temp/p.tar");

strcpy(tmp[11],"temp/px.txt");

strcpy(tmp[12],"temp/px.tar");

Global[1]=getfilesize(tmp[1]);

Global[2]=getfilesize(tmp[2]);

Global[3]=getfilesize(tmp[3]);

Global[4]=getfilesize(tmp[4]);

Global[5]=getfilesize(tmp[5]);

Global[6]=getfilesize(tmp[6]);

Global[7]=getfilesize(tmp[7]);

Global[8]=getfilesize(tmp[8]);

Global[9]=getfilesize(tmp[9]);

Global[10]=getfilesize(tmp[10]);

Global[11]=getfilesize(tmp[11]);

Global[12]=getfilesize(tmp[12]);

x1=(100.0*Global[2]/Global[1]-100.0*Global[4]/Global[3]);

x2=(100.0*Global[6]/Global[5]-100.0*Global[8]/Global[7]);

x3=(100.0*Global[10]/Global[9]-100.0*Global[12]/Global[11]);

if ((x1>0.9)||(x2<1)){printf("Simple\n");}else{printf("Texto\n");}

}

int main(int argc,char * argv[])

{

prepare1();

return 0;

}

Исходные коды программы стегоанализа исполняемого файла.

Analyse.exe (анализирует последние 80 байт файла, содержащего только секцию кода)

const

Granitza=56;analyze_size=80;

type

{ TMyApplication }

TMyApplication = class(TCustomApplication)

protected

procedure DoRun; override;

public

constructor Create(TheOwner: TComponent); override;

destructor Destroy; override;

procedure WriteHelp; virtual;

end;

Fbyte= file of byte;

Pvertex=^Tvertex;

Tvertex =record

l,r:Pvertex;

data:byte;

friq:integer;

tip:integer;

end;

var

path:string;

path1:string;

friq:array [0..255] of longint;

fsize:integertree:array [0..255] of integer;

elem:array [0..255] of pvertex;

tree_n:integeradds:widestring;

s:array[0..255] of widestring

{ TMyApplication }

procedure sort;forward;

procedure prepare;

var

i:integer;

begin

for i:=0 to 255 do

begin

friq[i]:=0;

tree[i]:=0;

new(elem[i]);

elem[i]^.l:=nil;

elem[i]^.r:=nil;

elem[i]^.data:=i;

elem[i]^.friq:=0;

elem[i]^.tip:=1;

s[i]:='';

end;tree_n:=0;

adds:='';

end;

procedure readdata;

var f:file of byte;

b:byte;

begin

assignfile(f,path);

reset(f);

while not eof(f) do

begin

read(f,b);

inc(elem[b]^.friq);

end;

closefile(f);

end;

function strtobin(x:string):byte;

var b:byte;i:integer;

begin

b:=0;

for i:=1 to 8 do

begin

b:=(b shl 1 )+ord(x[i])-ord('0');

end;

strtobin:=b;

end;

procedure addinfile(b:byte;var f1:Fbyte;ends:boolean);

var tmp:widestring;

i:integer;

begin

if ends then

begin

for i:=length(adds) to 8 do

adds:=adds+'0';

write(f1,strtobin(adds));

exit;

end;

adds:=adds+s[b];

while length(adds)>=8 do

begin

tmp:=adds;

delete(tmp,9,length(tmp));

write(f1,strtobin(tmp));

delete(adds,1,8);

end;

end;

procedure writedata;

var f,f1:file of byte;

b:byte;

begin

assignfile(f1,path1);rewrite(f1);

assignfile(f,path);

reset(f);

while not eof(f) do

begin

read(f,b);

addinfile(b,f1,false);

end;

addinfile(0,f1,true);

closefile(f);closefile(f1);

end;

procedure sort;

var i:integer;

tmp:pvertex;

p,q:Tvertex;

f:boolean;

begin

f:=true;

while f do

begin

f:=false;

for i:=0 to tree_n-2 do

begin

if elem[i]^.friq<elem[i+1]^.friq then

begin

tmp:=elem[i];

elem[i]:=elem[i+1];

elem[i+1]:=tmp;

f:=true;

end;

end;

end;

end;

procedure getcode(V:pvertex;ss:widestring);

var p:tvertex;

begin

p:=v^;

if V^.tip=0 then

begin

getcode(v^.l,ss+'0');

getcode(v^.r,ss+'1');

end else

s[v^.data]:=ss;

end;

procedure buildtree;

var i:integer;

tmp:Pvertex;

begin

tree_n:=255;

sort;

i:=tree_n-1;

while i>0 do

begin

sort;

new(tmp);tmp^.tip:=0;//tmp^.data:=-1;

tmp^.friq:=elem[i-1]^.friq+elem[i]^.friq;

tmp^.l:=elem[i-1];

tmp^.r:=elem[i]; elem[i-1]:=tmp;

dec(i);

end;

getcode(elem[i],'');

end;

procedure TMyApplication.DoRun;

var f,f1:file of byte;

b:byte;

size:integer;

Si: TStartupInfo;

begin

if paramcount<>1 then halt;

path:= paramstr(1);

assignfile(f,path); //будем копировать последние 80 байт в специальную папку для анализа

assignfile(f1,'out\0.cut');

reset(f);

seek(f,filesize(f)-analyze_size);

rewrite(f1);

while not eof(f) do

begin

read(f,b);

write(f1,b);

end;

closefile(f1);

closefile(f);

// отрезали 80 байт , теперь будем сжимать

path:='out\0.cut';

path1:='out\0.cut.bz2';

prepare;

readdata;

buildtree;

writedata;

// внедрено ?

assignfile(f,path1);

reset(f);size:=filesize(f);closefile(f);

if size>granitza then writeln('1') else writeln('0');

Terminate; {внедрено} {пусто}

end;

Peanalyse.exe (извлекает секцию кода из файла формата PE)

Tpefile=class

f:file of byte;

o_pe:integer;

DD:dword;

start_offs,size:integer;

name:string;

procedure Open(s:string);

procedure close;

procedure readB;

procedure readW;

procedure readD;

procedure readO;

procedure gotooff;

procedure Crop;

end;

var

Form1: TForm1;

count:integer;

implementation

{ TForm1 }

procedure Tpefile.open(s:string);

begin

//form1.caption:=s;

//application.ProcessMessages;

assignfile(self.f,s);

reset(self.f);

end;

procedure Tpefile.close;

begin

closefile(self.f);

end;

procedure Tpefile.readB;

var b:byte;

begin

read(f,b);

DD:=b;

end;

procedure Tpefile.readw;

var a,b:byte;

begin

dd:=0;

if eof(f) then exit;

read(f,a); read(f,b);

DD:=a+b*$100;

end;

procedure Tpefile.readd;

var a,b,c,d:byte;

begin

read(f,a); read(f,b);read(f,c); read(f,d);

self.DD:=a+b*$100+c*$10000+d*$1000000;

end;

procedure Tpefile.reado;

var a:byte;

i:integer;

s:string;

begin

s:='';

for i:=1 to 8 do

begin

read(f,a);

s:=s+chr(a);

end;

self.name:=s;

end;

procedure Tpefile.gotooff;

begin

seek(self.f,self.dd);

end;

procedure Tpefile.crop;

var f1:file of byte;

pos,i:integer;

b:byte;

begin

assignfile(f1,'g:\b\'+inttostr(count));rewrite(f1);

self.DD:=self.start_offs;

self.gotooff;

for i:=1 to self.size do

begin

self.readb;

b:=byte(self.DD and 255);

if b<>0 then pos:=i;

write(f1,b);

end;

seek(f1,pos);truncate(f1);

closefile(f1);

end;

procedure analyse(s:string);

var p:Tpefile;

pe_offs,header_offs,total_offs:integer;

begin

p:=Tpefile.Create;

p.Open(s);

p.dd:=$3c;

p.gotooff;

p.readw;

pe_offs:=p.dd;

p.gotooff;

p.readw;

if p.dd<>$4550 then

begin

form1.ListBox1.Items.Add(s+' Error: PE header not found');

p.close;

p.Free;

exit;

end;

p.dd:=pe_offs+$54;

p.gotooff;

p.readd;

total_offs:=p.dd;

header_offs:=pe_offs+$f8;

repeat

p.dd:=header_offs;

p.gotooff;

p.reado; form1.ListBox1.Items.Add(p.name);

p.dd:=header_offs+$24;

p.gotooff;

p.readD;

//form1.ListBox1.Items.Add(inttohex(p.DD,8));

if (p.dd = $60000020) then

begin

p.dd:=header_offs+$10;

p.gotooff;

p.readD; p.size:=p.dd;

//form1.ListBox1.Items.Add('size '+inttohex(p.DD,8)); // size of code

p.readD; p.start_offs:=p.dd;

//form1.ListBox1.Items.Add('offset '+inttohex(p.DD,8));// offset to code

form1.ListBox1.Items.Add(s+' Ok '+inttostr(count));

p.Crop;

break;

end;

header_offs:=header_offs+$28;

until header_offs<total_offs;

p.close;

p.Free;

end;

procedure TForm1.Button2Click(Sender: TObject);

var f:textfile;

s:string;

begin

assignfile(f,'g:\a\1.lst');

reset(f);

count:=0;

while not eof(f) do

begin

readln(f,s);

if fileexists(s) then

analyse(s);

form1.ListBox1.ItemIndex:=form1.ListBox1.Items.Count-1;

application.ProcessMessages;

inc(count);

end;

closefile(f);

form1.Caption:='Ok';

Размещено на Allbest.ru

...