how to decrypt ppt Pictures stream ?

[jilieryuyi]

No description provided.

[zurmokeeper]

@jilieryuyi Can you provide the ppt file and the corresponding code example?

[jilieryuyi]

@jilieryuyi Can you provide the ppt file and the corresponding code example?

I have implemented the parsing of the Golang version in the past two days

code：
`func (file *File) decryptPicture() error {
if file.pictures == nil {
return nil
}

_, err := file.pictures.Seek(0, io.SeekStart)
if err != nil {
	return err
}

pictures, err := io.ReadAll(file.pictures)
if err != nil {
	return err
}

key := decrypt.RC4CryptoAPI.MakeKey(
	file.password,
	file.cryptSession10Container.data.EncryptionVerifier.Salt,
	file.cryptSession10Container.data.EncryptionHeader.KeySize,
	0)

var decBuffer bytes.Buffer
var picturesReader = bytes.NewReader(pictures)

total := 0
for {
	if total >= len(pictures) {
		break
	}

	var header, _, err = file.decryptPictureField(picturesReader, &decBuffer, key, 8)
	if err != nil {
		return err
	}
	total += 8
	var rh RecordHeader
	_, err = rh.parse(file, bytes.NewReader(header))
	if err != nil {
		return err
	}


	blipLen := int(rh.RecLen)

	var rgbUidCnt = 1
	if rh.recInstance == 0x217 || rh.recInstance == 0x3D5 || rh.recInstance == 0x46B || rh.recInstance == 0x543 ||
		rh.recInstance == 0x6E1 || rh.recInstance == 0x6E3 || rh.recInstance == 0x6E5 || rh.recInstance == 0x7A9 {
		rgbUidCnt = 2
	}

	// rgbUid 1/2
	for i := 0; i < rgbUidCnt; i++ {
		_, _, err = file.decryptPictureField(picturesReader, &decBuffer, key, 16)
		if err != nil {
			return err
		}

		total += 16
		blipLen -= 16
	}

	var nextBytes int
	if rh.RecType == 0xF01A || rh.RecType == 0xF01B || rh.RecType == 0xF01C {
		// metafileHeader
		nextBytes = 34
	} else {
		// tag
		nextBytes = 1
	}

	_, _, err = file.decryptPictureField(picturesReader, &decBuffer, key, nextBytes)
	if err != nil {
		return err
	}

	total += nextBytes
	blipLen -= nextBytes

	_, n, err := file.decryptPictureField(picturesReader, &decBuffer, key, blipLen)
	if err != nil {
		return err
	}

	total += blipLen
	if n < blipLen {
		break
	}
}

file.pictures = bytes.NewReader(decBuffer.Bytes())
return nil

}
`

[zurmokeeper]

@jilieryuyi

Can you post the more complete code? Or the github address? Appreciate it if you can.