@patrickdk77/office-defuse 0.1.1 → 0.2.1

package/dist/offcrypto.js

@@ -33,8 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Rc4 = exports.DEFAULT_PASSWORD = void 0;
+exports.Rc4 = exports.POWERPOINT_PASSWORD = exports.DEFAULT_PASSWORD = void 0;
 exports.unlockWorkbook = unlockWorkbook;
+exports.unlockDocument = unlockDocument;
+exports.unlockPresentation = unlockPresentation;
 exports.openPackage = openPackage;
 const crypto = __importStar(require("node:crypto"));
 const errors_1 = require("./errors");
@@ -42,6 +44,10 @@ const oleobj_1 = require("./oleobj");
 const types_1 = require("./types");
 /** The password Excel opens a workbook with when nobody set one to open it (MS-OFFCRYPTO 2.4.3). */
 exports.DEFAULT_PASSWORD = 'VelvetSweatshop';
+/** The password PowerPoint 97 to 2003 opens a presentation with when nobody set one to open it. */
+exports.POWERPOINT_PASSWORD = '/01Hannes Ruescher/01';
+const EXCEL = { password: exports.DEFAULT_PASSWORD, application: 'Excel' };
+const POWERPOINT = { password: exports.POWERPOINT_PASSWORD, application: 'PowerPoint' };
 /** MS-OFFCRYPTO allows a spin count of at most 10,000,000. */
 const MAX_SPIN = 10_000_000;
 /** More of a Standard EncryptionInfo than its header and verifier take, which are a few hundred bytes. */
@@ -73,15 +79,21 @@ const STANDARD_AES = new Map([
 ]);
 /** A value from the file for a message, cut short. */
 const shown = (v) => (v ?? 'none').slice(0, 40);
-/** The passwords tried, in order: the caller's, then Excel's default. */
-function passwords(ctx) {
-    const out = ctx.settings.password !== undefined ? [{ password: ctx.settings.password, supplied: true }] : [];
-    return [...out, { password: exports.DEFAULT_PASSWORD, supplied: false }];
+/**
+ * The passwords tried, in order: the caller's, each once, then the application's default, which Word has none of.
+ * One upload can hold files with different passwords, so a password meant for another file must not keep the default
+ * from opening this one.
+ */
+function passwords(ctx, fallback = EXCEL) {
+    const given = [...new Set(ctx.settings.passwords)];
+    const out = given.map(password => ({ password }));
+    return !fallback || given.includes(fallback.password) ? out : [...out, { password: fallback.password, default: fallback }];
 }
 /** Which password opened the file, and the cipher, as findings. */
-function opened(ctx, supplied, cipher, location, bits) {
-    ctx.report(types_1.OfficeCategory.Encrypted, supplied ? types_1.OfficeDetail.UserPassword : types_1.OfficeDetail.DefaultPassword, location, supplied ? {} : { password: exports.DEFAULT_PASSWORD });
-    ctx.report(types_1.OfficeCategory.Encrypted, cipher, location, { bits });
+function opened(ctx, tried, cipher, location, bits) {
+    const d = tried.default;
+    ctx.report(types_1.OfficeCategory.Encrypted, d ? types_1.OfficeDetail.DefaultPassword : types_1.OfficeDetail.UserPassword, location, d ? { password: d.password, application: d.application } : {});
+    ctx.report(types_1.OfficeCategory.Encrypted, cipher, location, bits === undefined ? {} : { bits });
 }
 const utf16le = (s) => Buffer.from(s, 'utf16le');
 const le32 = (n) => {
@@ -136,73 +148,279 @@ function cryptoApiKey(password, salt, bits) {
         return bits === 40 ? Buffer.concat([h.subarray(0, 5), Buffer.alloc(11)]) : h.subarray(0, bits / 8);
     };
 }
+/**
+ * The key of a binary document encrypted with RC4 (MS-OFFCRYPTO 2.3.6) or RC4 CryptoAPI (2.3.5), from its
+ * EncryptionHeader, which `r` reads from its version on. Returns undefined when no password at hand opens it.
+ * `cryptoApiOnly` refuses plain RC4, as PowerPoint does.
+ */
+function binaryKey(ctx, r, stream, fallback, cryptoApiOnly = false) {
+    const major = r.u16();
+    const minor = r.u16();
+    if (major === 1 && minor === 1 && !cryptoApiOnly) {
+        const salt = r.bytes(16);
+        const verifier = r.bytes(16);
+        const verifierHash = r.bytes(16);
+        for (const p of passwords(ctx, fallback)) {
+            const k = rc4Key(p.password, salt);
+            const plain = new Rc4(k(0)).crypt(Buffer.concat([verifier, verifierHash]));
+            if (hash('md5', plain.subarray(0, 16)).equals(Buffer.from(plain.subarray(16, 32)))) {
+                opened(ctx, p, types_1.OfficeDetail.Rc4_40, stream, 40);
+                return k;
+            }
+        }
+        return undefined;
+    }
+    if ((major === 2 || major === 3 || major === 4) && minor === 2) {
+        r.skip(4);
+        const headerSize = r.u32();
+        const header = new oleobj_1.ByteReader(r.bytes(headerSize));
+        header.skip(8);
+        const algorithm = header.u32();
+        header.skip(4);
+        const bits = header.u32() || 40;
+        if (algorithm !== 0x6801 || bits < 40 || bits > 128 || bits % 8)
+            throw unsupported(`CryptoAPI algorithm 0x${algorithm.toString(16)} with a ${bits}-bit key`, { stream });
+        const cipher = bits === 40 ? types_1.OfficeDetail.Rc4_40 : bits === 128 ? types_1.OfficeDetail.Rc4_128 : types_1.OfficeDetail.Rc4Other;
+        const saltSize = r.u32();
+        const salt = r.bytes(saltSize);
+        const verifier = r.bytes(16);
+        const hashSize = r.u32();
+        const verifierHash = r.bytes(Math.min(hashSize, r.left));
+        for (const p of passwords(ctx, fallback)) {
+            const k = cryptoApiKey(p.password, salt, bits);
+            const plain = new Rc4(k(0)).crypt(Buffer.concat([verifier, verifierHash]));
+            if (hash('sha1', plain.subarray(0, 16)).equals(Buffer.from(plain.subarray(16, 36)))) {
+                opened(ctx, p, cipher, stream, bits);
+                return k;
+            }
+        }
+        return undefined;
+    }
+    throw unsupported(`encryption version ${major}.${minor}`, { stream });
+}
 /**
  * Opens a workbook that its FILEPASS record (MS-XLS 2.4.117) encrypts with RC4 or RC4 CryptoAPI, with the caller's
  * password or VelvetSweatshop. The records after FILEPASS are encrypted in 1024-byte blocks of the stream, each with its
- * own key. Their headers are not, but take keystream bytes, and some records are never encrypted.
+ * own key. Their headers are not, but take keystream bytes, and some records are never encrypted. XOR obfuscation,
+ * the only kind an Excel 5.0 or 95 workbook has, is undone the same way record by record.
  */
 function unlockWorkbook(ctx, filePass, stream) {
     const r = new oleobj_1.ByteReader(filePass.body);
-    let key;
-    let cipher = types_1.OfficeDetail.Rc4_40;
-    let bits = 40;
     try {
-        const type = r.u16();
-        if (type !== 1)
-            throw unsupported('XOR obfuscation', { stream });
-        const major = r.u16();
-        const minor = r.u16();
-        if (major === 1 && minor === 1) {
-            const salt = r.bytes(16);
-            const verifier = r.bytes(16);
-            const verifierHash = r.bytes(16);
-            for (const p of passwords(ctx)) {
-                const k = rc4Key(p.password, salt);
-                const plain = new Rc4(k(0)).crypt(Buffer.concat([verifier, verifierHash]));
-                if (hash('md5', plain.subarray(0, 16)).equals(Buffer.from(plain.subarray(16, 32)))) {
-                    key = k;
-                    opened(ctx, p.supplied, types_1.OfficeDetail.Rc4_40, stream, 40);
-                    break;
-                }
-            }
-        }
-        else if ((major === 2 || major === 3 || major === 4) && minor === 2) {
-            r.skip(4);
-            const headerSize = r.u32();
-            const header = new oleobj_1.ByteReader(r.bytes(headerSize));
-            header.skip(8);
-            const algorithm = header.u32();
-            header.skip(4);
-            bits = header.u32() || 40;
-            if (algorithm !== 0x6801 || bits < 40 || bits > 128 || bits % 8)
-                throw unsupported(`CryptoAPI algorithm 0x${algorithm.toString(16)} with a ${bits}-bit key`, { stream });
-            cipher = bits === 40 ? types_1.OfficeDetail.Rc4_40 : bits === 128 ? types_1.OfficeDetail.Rc4_128 : types_1.OfficeDetail.Rc4Other;
-            const saltSize = r.u32();
-            const salt = r.bytes(saltSize);
-            const verifier = r.bytes(16);
-            const hashSize = r.u32();
-            const verifierHash = r.bytes(Math.min(hashSize, r.left));
+        // A BIFF5 FILEPASS holds only the XOR key and verifier. BIFF8 names the method first.
+        const xor = filePass.body.length === 4 || r.u16() === 0;
+        if (xor) {
+            const key = r.u16();
+            const verifier = r.u16();
             for (const p of passwords(ctx)) {
-                const k = cryptoApiKey(p.password, salt, bits);
-                const plain = new Rc4(k(0)).crypt(Buffer.concat([verifier, verifierHash]));
-                if (hash('sha1', plain.subarray(0, 16)).equals(Buffer.from(plain.subarray(16, 36)))) {
-                    key = k;
-                    opened(ctx, p.supplied, cipher, stream, bits);
-                    break;
-                }
+                const pw = xorPassword(p.password);
+                if (!pw.length || xorKey1(pw) !== key || verifier1(pw) !== verifier)
+                    continue;
+                opened(ctx, p, types_1.OfficeDetail.XorObfuscation, stream);
+                return xorDecrypt(xorArray1(pw));
             }
+            throw required('the workbook is obfuscated with a password that is not VelvetSweatshop', { stream });
         }
-        else
-            throw unsupported(`encryption version ${major}.${minor}`, { stream });
+        const key = binaryKey(ctx, r, stream, EXCEL);
+        if (!key)
+            throw required('the workbook is encrypted with a password that is not VelvetSweatshop', { stream });
+        return biffDecrypt(key);
     }
     catch (e) {
         if (e instanceof oleobj_1.Truncated)
             throw required('a FILEPASS record cut short', { stream });
         throw e;
     }
-    if (!key)
-        throw required('the workbook is encrypted with a password that is not VelvetSweatshop', { stream });
-    return biffDecrypt(key);
+}
+/** XOR obfuscation method 1 tables (MS-OFFCRYPTO 2.3.7.2). */
+const PAD = [0xbb, 0xff, 0xff, 0xba, 0xff, 0xff, 0xb9, 0x80, 0x00, 0xbe, 0x0f, 0x00, 0xbf, 0x0f, 0x00];
+const INITIAL_CODE = [0xe1f0, 0x1d0f, 0xcc9c, 0x84c0, 0x110c, 0x0e10, 0xf1ce, 0x313e, 0x1872, 0xe139, 0xd40f, 0x84f9, 0x280c, 0xa96a, 0x4ec3];
+// biome-ignore format: the table as the specification prints it
+const XOR_MATRIX = [
+    0xaefc, 0x4dd9, 0x9bb2, 0x2745, 0x4e8a, 0x9d14, 0x2a09, 0x7b61, 0xf6c2, 0xfda5, 0xeb6b, 0xc6f7, 0x9dcf, 0x2bbf, 0x4563, 0x8ac6,
+    0x05ad, 0x0b5a, 0x16b4, 0x2d68, 0x5ad0, 0x0375, 0x06ea, 0x0dd4, 0x1ba8, 0x3750, 0x6ea0, 0xdd40, 0xd849, 0xa0b3, 0x5147, 0xa28e,
+    0x553d, 0xaa7a, 0x44d5, 0x6f45, 0xde8a, 0xad35, 0x4a4b, 0x9496, 0x390d, 0x721a, 0xeb23, 0xc667, 0x9cef, 0x29ff, 0x53fe, 0xa7fc,
+    0x5fd9, 0x47d3, 0x8fa6, 0x0f6d, 0x1eda, 0x3db4, 0x7b68, 0xf6d0, 0xb861, 0x60e3, 0xc1c6, 0x93ad, 0x377b, 0x6ef6, 0xddec, 0x45a0,
+    0x8b40, 0x06a1, 0x0d42, 0x1a84, 0x3508, 0x6a10, 0xaa51, 0x4483, 0x8906, 0x022d, 0x045a, 0x08b4, 0x1168, 0x76b4, 0xed68, 0xcaf1,
+    0x85c3, 0x1ba7, 0x374e, 0x6e9c, 0x3730, 0x6e60, 0xdcc0, 0xa9a1, 0x4363, 0x86c6, 0x1dad, 0x3331, 0x6662, 0xccc4, 0x89a9, 0x0373,
+    0x06e6, 0x0dcc, 0x1021, 0x2042, 0x4084, 0x8108, 0x1231, 0x2462, 0x48c4,
+];
+/**
+ * A password as the XOR methods read it (MS-OFFCRYPTO 2.3.7.4): each character's low byte, or its high byte when the
+ * low one is 0, at most 15 of them.
+ */
+function xorPassword(password) {
+    const out = [];
+    for (let i = 0; i < password.length && out.length < 15; i++) {
+        const c = password.charCodeAt(i);
+        out.push(c & 0xff ? c & 0xff : (c >> 8) & 0xff);
+    }
+    return Uint8Array.from(out);
+}
+/** CreateXorKey_Method1 (MS-OFFCRYPTO 2.3.7.2). */
+function xorKey1(pw) {
+    let key = INITIAL_CODE[pw.length - 1];
+    let element = 0x68;
+    for (let i = pw.length - 1; i >= 0; i--) {
+        let c = pw[i];
+        for (let k = 0; k < 7; k++) {
+            if (c & 0x40)
+                key ^= XOR_MATRIX[element];
+            c *= 2;
+            element--;
+        }
+    }
+    return key & 0xffff;
+}
+/** CreatePasswordVerifier_Method1 (MS-OFFCRYPTO 2.3.7.1). */
+function verifier1(pw) {
+    let v = 0;
+    for (const b of [...pw].reverse().concat(pw.length))
+        v = (((v & 0x4000) >> 14) | ((v << 1) & 0x7fff)) ^ b;
+    return (v ^ 0xce4b) & 0xffff;
+}
+/** One right rotation of a byte. */
+const ror = (b) => ((b >> 1) | (b << 7)) & 0xff;
+/** CreateXorArray_Method1 (MS-OFFCRYPTO 2.3.7.2). */
+function xorArray1(pw) {
+    const key = xorKey1(pw);
+    const hi = key >> 8;
+    const lo = key & 0xff;
+    const out = new Uint8Array(16);
+    let i = pw.length;
+    if (i % 2 === 1) {
+        out[i] = ror(PAD[0] ^ hi);
+        i--;
+        out[i] = ror(pw[pw.length - 1] ^ lo);
+    }
+    while (i > 0) {
+        i--;
+        out[i] = ror(pw[i] ^ hi);
+        i--;
+        out[i] = ror(pw[i] ^ lo);
+    }
+    let at = 15;
+    for (let pad = 15 - pw.length; pad > 0;) {
+        out[at--] = ror(PAD[pad--] ^ hi);
+        out[at--] = ror((PAD[pad--] ?? 0) ^ lo);
+    }
+    return out;
+}
+/** CreateXorArray_Method2 (MS-OFFCRYPTO 2.3.7.5), which Word uses. */
+function xorArray2(pw) {
+    const key = xorKey1(pw);
+    const out = new Uint8Array(16);
+    for (let i = 0; i < 16; i++)
+        out[i] = i < pw.length ? pw[i] : PAD[i - pw.length];
+    for (let i = 0; i < 16; i += 2) {
+        out[i] = ror(out[i] ^ (key & 0xff));
+        out[i + 1] = ror(out[i + 1] ^ (key >> 8));
+    }
+    return out;
+}
+/**
+ * Undoes XOR obfuscation method 1 in each record after FILEPASS (MS-OFFCRYPTO 2.3.7.3). The array index of a record's
+ * first byte is its stream offset plus its size, as Excel and LibreOffice count it, and each byte is XORed and then
+ * rotated right by 5 bits. The records MS-XLS leaves plain, and BoundSheet8's lbPlyPos, stay as they are.
+ */
+function xorDecrypt(array) {
+    return r => {
+        if (PLAIN.has(r.type))
+            return r.body;
+        const out = new Uint8Array(r.body);
+        const start = r.offset + 4;
+        for (let k = r.type === 0x0085 ? 4 : 0; k < out.length; k++) {
+            const v = out[k] ^ array[(start + r.body.length + k) % 16];
+            out[k] = ((v >> 5) | (v << 3)) & 0xff;
+        }
+        return out;
+    };
+}
+/** RC4 keyed per 512-byte block, as Word encrypts its streams, applied from `plain` on. */
+function blockStream(key, plain) {
+    const cache = new Map();
+    const keystream = (b) => {
+        let ks = cache.get(b);
+        if (!ks) {
+            if (cache.size > 64)
+                cache.clear();
+            ks = new Rc4(key(b)).crypt(new Uint8Array(512));
+            cache.set(b, ks);
+        }
+        return ks;
+    };
+    return (offset, bytes) => {
+        const out = new Uint8Array(bytes);
+        for (let k = Math.max(0, plain - offset); k < out.length; k++) {
+            const at = offset + k;
+            out[k] ^= keystream(Math.floor(at / 512))[at % 512];
+        }
+        return out;
+    };
+}
+/** XOR obfuscation method 2 over a stream (MS-OFFCRYPTO 2.3.7.6), from `plain` on. */
+function xorStream(array, plain) {
+    return (offset, bytes) => {
+        const out = new Uint8Array(bytes);
+        for (let k = Math.max(0, plain - offset); k < out.length; k++) {
+            const a = array[(offset + k) % 16];
+            // A byte that was 0x00 or equal to its array element was left as it was.
+            if (out[k] !== 0 && out[k] !== a)
+                out[k] ^= a;
+        }
+        return out;
+    };
+}
+/**
+ * Opens an encrypted Word 97 to 2003 document (MS-DOC 2.2.6) with the caller's passwords. XOR obfuscation keeps its
+ * verifier in FibBase.lKey. RC4 and RC4 CryptoAPI keep their EncryptionHeader in the table stream's first lKey bytes.
+ * The WordDocument stream stays plain for its first 68 bytes, and Word has no default password.
+ */
+async function unlockDocument(ctx, fib, table, stream) {
+    const flags = fib[10] | (fib[11] << 8);
+    const lKey = (fib[14] | (fib[15] << 8) | (fib[16] << 16) | (fib[17] << 24)) >>> 0;
+    if (flags & 0x8000) {
+        for (const p of passwords(ctx, undefined)) {
+            const pw = xorPassword(p.password);
+            if (!pw.length || ((xorKey1(pw) << 16) | verifier1(pw)) >>> 0 !== lKey)
+                continue;
+            opened(ctx, p, types_1.OfficeDetail.XorObfuscation, stream);
+            const array = xorArray2(pw);
+            return { word: xorStream(array, 68), table: xorStream(array, 0), data: xorStream(array, 0) };
+        }
+        throw required('the document is obfuscated with a password not at hand', { stream });
+    }
+    if (lKey < 8 || lKey > 65536)
+        throw required('an EncryptionHeader of an impossible size', { stream });
+    try {
+        const key = binaryKey(ctx, new oleobj_1.ByteReader(await table.read(0, lKey)), stream, undefined);
+        if (!key)
+            throw required('the document is encrypted with a password not at hand', { stream });
+        return { word: blockStream(key, 68), table: blockStream(key, lKey), data: blockStream(key, 0) };
+    }
+    catch (e) {
+        if (e instanceof oleobj_1.Truncated)
+            throw required('an EncryptionHeader cut short', { stream });
+        throw e;
+    }
+}
+/**
+ * Opens an encrypted PowerPoint 97 to 2003 presentation (MS-PPT 2.3.7): `session` is the CryptSession10Container's
+ * data, an RC4 CryptoAPI EncryptionHeader. Returns the key of each persist object, whose block number is its persist
+ * id, after the caller's passwords and PowerPoint's own default have been tried.
+ */
+function unlockPresentation(ctx, session, stream) {
+    try {
+        const key = binaryKey(ctx, new oleobj_1.ByteReader(session), stream, POWERPOINT, true);
+        if (!key)
+            throw required('the presentation is encrypted with a password not at hand', { stream });
+        return id => new Rc4(key(id));
+    }
+    catch (e) {
+        if (e instanceof oleobj_1.Truncated)
+            throw required('a CryptSession10Container cut short', { stream });
+        throw e;
+    }
 }
 /** Records MS-XLS 2.2.10 never encrypts: BOF, FILEPASS, UsrExcl, FileLock, InterfaceHdr, RRDInfo and RRDHead. */
 const PLAIN = new Set([0x0809, 0x002f, 0x0194, 0x0195, 0x00e1, 0x0196, 0x0138]);
@@ -259,7 +477,7 @@ async function openPackage(ctx, cfb, info, pkg) {
         const key = cipher.key(p.password);
         if (!key)
             continue;
-        opened(ctx, p.supplied, cipher.cipher.detail, pkg.name, cipher.cipher.bits);
+        opened(ctx, p, cipher.cipher.detail, pkg.name, cipher.cipher.bits);
         const data = cfb.source(pkg);
         return { source: cipher.source((offset, length) => data.read(8 + offset, length), size, key), size };
     }
@@ -272,6 +490,26 @@ function aes(cipher, key, data, iv) {
     const whole = data.subarray(0, data.length - (data.length % 16));
     return Buffer.concat([d.update(whole), d.final()]);
 }
+/**
+ * AES in CFB with an 8-bit window, which Agile's ChainingModeCFB names, built on AES-ECB. Each byte is XORed with the
+ * first byte of the encryption of the 16 ciphertext bytes before it, the IV standing in front. Decryption knows every
+ * ciphertext byte, so all those blocks go through ECB in one call.
+ */
+function aesCfb8(cipher, key, data, iv) {
+    const feed = Buffer.concat([iv.subarray(0, 16), data]);
+    const blocks = Buffer.alloc(data.length * 16);
+    for (let i = 0; i < data.length; i++)
+        feed.copy(blocks, i * 16, i, i + 16);
+    const e = crypto.createCipheriv(cipher.ecb, key, null);
+    e.setAutoPadding(false);
+    const stream = Buffer.concat([e.update(blocks), e.final()]);
+    const out = new Uint8Array(data.length);
+    for (let i = 0; i < data.length; i++)
+        out[i] = data[i] ^ stream[i * 16];
+    return out;
+}
+/** Decrypts with the chaining an Agile element names. */
+const agileDecrypt = (cipher, cfb, key, data, iv) => (cfb ? aesCfb8(cipher, key, data, iv) : aes(cipher, key, data, iv));
 /** Standard encryption (MS-OFFCRYPTO 2.3.4.5): AES-ECB with a key from SHA-1 over 50,000 rounds. */
 function standard(b) {
     const r = new oleobj_1.ByteReader(b);
@@ -339,16 +577,17 @@ async function agile(ctx, xml) {
     const ek = found.encryptedKey;
     if (!kd || !ek)
         throw required('an Agile descriptor without key data or a password key');
-    /** The hash and cipher a key data or key encryptor element names, when both are on the allowlist. */
+    /** The hash, cipher and chaining a key data or key encryptor element names, when all are on the allowlist. */
     const algorithms = (a) => {
         const h = HASHES.get(a.hashAlgorithm);
         const c = AES.get(Number(a.keyBits));
-        if (!h || !c || a.cipherAlgorithm !== 'AES' || a.cipherChaining !== 'ChainingModeCBC' || Number(a.blockSize) !== 16)
+        const chaining = a.cipherChaining;
+        if (!h || !c || a.cipherAlgorithm !== 'AES' || (chaining !== 'ChainingModeCBC' && chaining !== 'ChainingModeCFB') || Number(a.blockSize) !== 16)
             throw unsupported(`Agile encryption with ${shown(a.cipherAlgorithm)} in ${shown(a.cipherChaining)}, a ${shown(a.keyBits)}-bit key and ${shown(a.hashAlgorithm)}`);
-        return { h, c };
+        return { h, c, cfb: chaining === 'ChainingModeCFB' };
     };
-    const { h: dh, c: dc } = algorithms(kd);
-    const { h: eh, c: ec } = algorithms(ek);
+    const { h: dh, c: dc, cfb: dcfb } = algorithms(kd);
+    const { h: eh, c: ec, cfb: ecfb } = algorithms(ek);
     const spin = Number(ek.spinCount);
     if (!Number.isInteger(spin) || spin < 0 || spin > MAX_SPIN)
         throw required('an Agile spin count past 10,000,000');
@@ -368,18 +607,18 @@ async function agile(ctx, xml) {
             }
             const derive = (block) => pad(hash(eh, h, block), ec.bits / 8, 0x36);
             const iv = pad(salt, 16, 0x36);
-            const input = aes(ec, derive(BLOCKS.input), b64(ek.encryptedVerifierHashInput), iv).subarray(0, Number(ek.saltSize) || 16);
-            const expected = aes(ec, derive(BLOCKS.value), b64(ek.encryptedVerifierHashValue), iv);
+            const input = agileDecrypt(ec, ecfb, derive(BLOCKS.input), b64(ek.encryptedVerifierHashInput), iv).subarray(0, Number(ek.saltSize) || 16);
+            const expected = agileDecrypt(ec, ecfb, derive(BLOCKS.value), b64(ek.encryptedVerifierHashValue), iv);
             const got = hash(eh, input);
             if (!got.equals(Buffer.from(expected.subarray(0, got.length))))
                 return undefined;
-            return aes(ec, derive(BLOCKS.key), b64(ek.encryptedKeyValue), iv).subarray(0, dc.bits / 8);
+            return agileDecrypt(ec, ecfb, derive(BLOCKS.key), b64(ek.encryptedKeyValue), iv).subarray(0, dc.bits / 8);
         },
         source: (read, size, key) => blockSource(size, 4096, async (index, count) => {
             const raw = await read(index * 4096, count * 4096);
             const out = [];
             for (let k = 0; k * 4096 < raw.length; k++)
-                out.push(aes(dc, key, raw.subarray(k * 4096, (k + 1) * 4096), pad(hash(dh, dsalt, le32(index + k)), 16, 0x36)));
+                out.push(agileDecrypt(dc, dcfb, key, raw.subarray(k * 4096, (k + 1) * 4096), pad(hash(dh, dsalt, le32(index + k)), 16, 0x36)));
             return Buffer.concat(out);
         }),
     };

package/dist/ole.d.ts

@@ -1,12 +1,29 @@
 import type { CompoundFile } from './cfb';
 import type { RunContext } from './context';
+import type { Format } from './formats';
+import { ZipArchive } from './zip';
 /** The families a compound file can hold, by the stream or storage that marks each. */
-type Family = 'word' | 'excel' | 'powerpoint' | 'visio' | 'outlook' | 'publisher' | 'project' | 'encrypted';
+export type Family = 'word' | 'excel' | 'powerpoint' | 'visio' | 'outlook' | 'publisher' | 'project' | 'encrypted';
 /** What the root of a compound file holds, read by the names of its children, ignoring case as MS-CFB does. */
 export declare function families(cfb: CompoundFile): Family[];
+/**
+ * The family whose format a compound file holds, by the streams and storages at its root. Throws for a root that
+ * holds no Office document, or the documents of two families.
+ */
+export declare function mainFamily(cfb: CompoundFile): Family;
+/**
+ * The format of a compound file of `family`. A Word document is a template when its FIB says so, and a workbook a
+ * template or an add-in when its globals do; both are read without a password. An encrypted package names no format
+ * until it is decrypted, so for one this is undefined.
+ */
+export declare function compoundFormat(cfb: CompoundFile, family: Family, deadline?: number): Promise<Format | undefined>;
+/**
+ * Decrypts the package of an encrypted compound file with the run's passwords, then VelvetSweatshop, and reads it as
+ * a ZIP archive. Throws ENCRYPTED/PASSWORD_REQUIRED when no password opens it.
+ */
+export declare function openEncryptedPackage(ctx: RunContext, cfb: CompoundFile): Promise<ZipArchive>;
 /**
  * Inspects a compound file: the rules every compound file gets, over its whole tree, and then those of the format
  * its root names.
  */
 export declare function inspectCompound(ctx: RunContext, cfb: CompoundFile): Promise<void>;
-export {};