这个问题中得票最多的答案(
Detecting a password-protected document
)介绍一种确定Microsoft Office文件是否受密码保护的有效方法。
如果我从“ScanForPassword”方法中理解正确,它将根据文件中存在的FILEPASS节(filePassMagic byte,值0x002F/47)确定密码保护。
// check for Excel header
const string workbookName = "W\0o\0r\0k\0b\0o\0o\0k" + afterNamePadding;
headerOffset = bufferString.IndexOf(workbookName, StringComparison.InvariantCulture);
if (headerOffset >= 0)
{
sectionId = BitConverter.ToInt32(buffer, headerOffset + sectionIdOffset);
int sectionOffset = coBaseOffset + sectionId * sectionSize;
const int streamScanSize = 0x100;
if (sectionOffset < 0 || sectionOffset + streamScanSize > stream.Length)
return false; // invalid document
var workbookStream = new byte[streamScanSize];
stream.Seek(sectionOffset, SeekOrigin.Begin);
ReadFromStream(stream, workbookStream);
short record = BitConverter.ToInt16(workbookStream, 0);
short recordSize = BitConverter.ToInt16(workbookStream, sizeof(short));
const short bofMagic = 0x0809;
const short eofMagic = 0x000A;
const short filePassMagic = 0x002F;
if (record != bofMagic)
return false; // invalid BOF
// scan for FILEPASS record until the end of the buffer
int offset = sizeof(short) * 2 + recordSize;
int recordsLeft = 16; // simple infinite loop check just in case
do
{
record = BitConverter.ToInt16(workbookStream, offset);
if (record == filePassMagic)
return true;
recordSize = BitConverter.ToInt16(workbookStream, sizeof(short) + offset);
offset += sizeof(short) * 2 + recordSize;
recordsLeft--;
} while (record != eofMagic && recordsLeft > 0);
}
是否可以分离使用“保护工作簿结构”方法加密的文件,而不将其报告为受密码保护的文件?我试图检查FILEPASS部分中的下一个值是否有意义。通常是54或200,但我已经看到完全密码保护和结构保护文件的54值。
我也找不到有用的文档(中的第168页)
https://www.yumpu.com/en/document/read/46184961/openofficeorgs-documentation-of-the-microsoft-excel-file-format-
).