Home Grown Stegger
~~~~~~~~~~~~~~~~~~

  I was working on my own Steganography tool for the HCU mailing list but now it 
seems that I am no longer receiving it, I'll post it here and hope that everyone 
gets it. This is for those involved in the Steganography project and I suggest 
that those who were not in it, do not touch this program as it was not intended 
to be released to the public in this form.

  The program takes IN.BMP and hides the file STEG.DAT inside it putting the 
output in OUT.BMP. It does this in the simplest way possible (except for a 
little eccentricity of mine: saving it backwards!)

  The program is a little quirky, if you watch how it works with a debugger or 
examine the output file, you'll notice where it writes it's information.

  The program DOES NOT CHECK the filesizes so you should make sure there is 
enough space in the BMP to hold the data otherwise the header of the BMP will be 
overwritten and because it works backwards, if you do too much then it will 
overwrite the code of the program and cause a crash.

  If you look at how I coded it you may understand what I was going through at 
two o'clock in the morning. It's not nice. I forgot some addressing modes and 
worked around them instead of looking them up, I used a loop to multiply as I 
didn't want to look up the MUL instruction, I moved pieces of code around to 
make the near jumps in range instead of just fixing it, the list is endless. Any 
asm programmer should have a good laugh at it.

  I'm releasing this now incomplete and without the extractor part because 
I'm going to take a break from cracking and computing in general (due to a 
tragedy in real life) and may not be back for a while. You should be able to 
write an extractor for this quite easily and if you do, please email it to me.
I might be able to check email from time to time, but I can't say for sure at 
the moment. The discussion server will be moderated by a friend until I get 
back.

  Note: The filelength of the hidden data is not encoded into the BMP.
		I haven't even tested the file yet to see if it actually does encode 
data properly!
		Disassemble to get the source code. You should be able to improve it 
without much effort.

  For those who haven't yet extracted ghiric18. Use steganos (you can get it 
from http://www.demcom.com/english/steganos) to extract the data. 49.pgp. 
Take 49 bytes away from the front of the file and then decrypt with password 
'Ghiribizzo'. The file was 2 PGP files binary concatenated. PGP for DOS only 
decrypts the first one. I think PGP5 for 95 doesn't decrypt at all.


~~
Ghiribizzo


begin 644 bmpwrite.com
MZ8P`24XN0DU0`%-414<N1$%4``T*1FEL92!7<FET=&5N+@T*)$5R<F]R(0T*
M)```#0I"35`@4W1E9V=E<B!!3%!(02!214%,14%312`M($Y/5"!43R!"12!2
M14Q%05-%1"!43R!054),24,A("A#*2!':&ER:6)I>GIO(#$Y.3<-"@T*)$]5
M5"Y"35````"Z,`&T"<TA,\FZ`P&X`CW-(7,#Z9``B]BY__^Z0`*T/\TAB_B+
M+DH"@<5``G)X,\FZ"@&X`CW-(7)LB]BY__^Z0`(#UX/"`8D6C0&T/\TA<E6+
M\+D(``$V+@'B^@,VC0&*9/\K-HT!N0@`BL0D`0,N+@$,_B!&`"0!"$8`*RXN
M`=#L_PXN`>+B3H/^`'_.NH4!,\FT/,TA<@V+V(O/ND`"M$#-(7(`NB4!M`G-
%(;1,S2%,
`
end