├── LICENSE
├── README.md
└── poly.py
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2025 REDD
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # PolyZip
2 | ## (Nothing.. is.. Safe..)
3 |
4 | PolyZip is a Python 3 command-line tool that embeds ZIP archives into a wide range of media and document formats—PNG, JPEG, GIF, PDF, BMP, WebP, TIFF, WAV, MP3, FLAC, OGG, AVI, MKV, WebM, FLV, ICO, CUR, ICNS, MP4, MOV, M4A, EXE, DLL, ELF, MSI, TTF, OTF, and WOFF —by leveraging each format's trailing-data tolerance or internal chunk/atom structure. For PNG, it injects the ZIP archive into the first IDAT chunk and corrects central directory offsets; for JPEG/GIF/PDF, it appends ZIP data after the EOI/trailer/EOF markers; for RIFF-based formats (BMP, WebP, WAV, AVI), it appends ZIP data beyond the declared chunk size; for TIFF, MP3, FLAC, OGG, ICO/CUR/ICNS, MP4/MOV/M4A, ELF, MSI, and font formats (TTF/OTF/WOFF), it appends after the last valid header/frame/atom and updates ZIP offsets accordingly. The resulting files display normally in standard viewers yet remain fully valid ZIP archives when renamed to `.zip` or extracted with standard tools.
5 |
6 | **🆕 NEW: Enhanced with full encryption support!** PolyZip 2.1.2 now includes AES-256 encryption for both file hiding and chat functionality. Hide encrypted files or create encrypted chat logs within any supported file format. All encrypted data is completely invisible to external analysis and protected by military-grade encryption using Argon2id password derivation (with Scrypt fallback) or secure key files.
7 |
8 | Original PNG+ZIP polyglot technique by [DavidBuchanan314](https://github.com/DavidBuchanan314/tweetable-polyglot-png); extended multi-format embedding, multi-file packing, extraction, detection, and encrypted chat implementation by [InfoSecREDD](https://github.com/InfoSecREDD).
9 |
10 | ## Features
11 |
12 | - Create polyglot files from multiple formats:
13 | - **PNG + ZIP**
14 | - **JPG + ZIP**
15 | - **JPEG + ZIP**
16 | - **GIF + ZIP**
17 | - **PDF + ZIP**
18 | - **BMP + ZIP**
19 | - **WebP + ZIP**
20 | - **TIFF + ZIP**
21 | - **WAV + ZIP**
22 | - **MP3 + ZIP**
23 | - **FLAC + ZIP**
24 | - **OGG + ZIP**
25 | - **AVI + ZIP**
26 | - **MKV + ZIP**
27 | - **WebM + ZIP**
28 | - **FLV + ZIP**
29 | - **ICO + ZIP**
30 | - **CUR + ZIP**
31 | - **ICNS + ZIP**
32 | - **MP4 + ZIP**
33 | - **MOV + ZIP**
34 | - **M4A + ZIP**
35 | - **EXE + ZIP**
36 | - **DLL + ZIP**
37 | - **ELF + ZIP**
38 | - **MSI + ZIP**
39 | - **TTF + ZIP**
40 | - **OTF + ZIP**
41 | - **WOFF + ZIP**
42 |
43 | - **🔒 Comprehensive Encryption System**:
44 | - **Encrypted File Hiding**: Secure file embedding with AES-256-GCM encryption
45 | - **Encrypted Chat Logs**: Create secure chat logs hidden in any supported file format
46 | - **Military-Grade Security**: AES-256-GCM encryption with authenticated encryption
47 | - **Robust Key Derivation**: Argon2id password derivation with Scrypt fallback for maximum compatibility
48 | - **Key File Authentication**: Auto-generated secure keys with file-based authentication
49 | - **Perfect Steganography**: Files appear completely normal to external analysis
50 | - **Tamper Detection**: GCM authentication prevents modification without detection
51 | - **Export Options**: Chat export to HTML, JSON, or text formats
52 |
53 | - Automatic detection of embedded content
54 | - Extract hidden files from polyglot containers
55 | - Support for multiple files in a single container
56 | - Automatic virtual environment management
57 | - Cross-platform compatibility
58 |
59 | ## Installation
60 |
61 | 1. Clone the repository:
62 | ```bash
63 | git clone https://github.com/InfoSecREDD/PolyZip.git
64 | cd PolyZip
65 | ```
66 |
67 | 2. Make the script executable:
68 | ```bash
69 | chmod +x poly.py
70 | ```
71 |
72 | 3. Run the script - it will automatically set up the required environment:
73 | ```bash
74 | ./poly.py
75 | ```
76 |
77 | ## Usage
78 |
79 | ### Packing Files
80 |
81 | Embed one or more files into a cover file:
82 | ```bash
83 | ./poly.py pack cover.[format] file1 [file2 ...] output.[format] [--key=file.key|--password=pass]
84 | ```
85 |
86 | **Basic Examples:**
87 | ```bash
88 | # Hide files without encryption
89 | ./poly.py pack cover.png secret.txt output.png
90 |
91 | # Hide multiple files
92 | ./poly.py pack cover.jpg file1.txt file2.pdf output.jpg
93 | ```
94 |
95 | **🔒 Encrypted File Hiding:**
96 | ```bash
97 | # Hide files with password encryption
98 | ./poly.py pack cover.png secret.txt encrypted.png --password=MySecurePass123
99 |
100 | # Hide files with key file encryption (auto-generates key if missing)
101 | ./poly.py pack cover.pdf confidential.doc encrypted.pdf --key=mykey.key
102 |
103 | # Hide multiple files with encryption
104 | ./poly.py pack cover.mp4 file1.txt file2.jpg encrypted.mp4 --password=SecretPass
105 | ```
106 |
107 | ### Extracting Files
108 |
109 | Extract hidden files from a polyglot container:
110 | ```bash
111 | ./poly.py extract input.[format] [output_directory] [--key=file.key|--password=pass]
112 | ```
113 |
114 | If no output directory is specified, files will be extracted to a directory named after the input file.
115 |
116 | **Basic Examples:**
117 | ```bash
118 | # Extract unencrypted files
119 | ./poly.py extract hidden.png
120 |
121 | # Extract to specific directory
122 | ./poly.py extract hidden.png extracted_files/
123 | ```
124 |
125 | **🔒 Encrypted File Extraction:**
126 | ```bash
127 | # Extract password-protected files
128 | ./poly.py extract encrypted.png decrypted/ --password=MySecurePass123
129 |
130 | # Extract key-protected files
131 | ./poly.py extract encrypted.pdf decrypted/ --key=mykey.key
132 |
133 | # Extract with automatic directory creation
134 | ./poly.py extract encrypted.mp4 --password=SecretPass
135 | ```
136 |
137 | ### Detecting Embedded Content
138 |
139 | Scan files for embedded content:
140 | ```bash
141 | ./poly.py detect [input.[png|jpg|jpeg|gif|pdf|bmp|webp|tiff|tif|wav|mp3|flac|ogg|avi|mkv|webm|flv|ico|cur|icns|mp4|mov|m4a|exe|dll|elf|msi|ttf|otf|woff]]
142 | ```
143 |
144 | If no file is specified, it will scan the current directory for all supported files.
145 |
146 | Example:
147 | ```bash
148 | ./poly.py detect
149 | ```
150 |
151 | ### 🔒 Encrypted Hidden Chat System
152 |
153 | #### Creating Encrypted Chats
154 |
155 | Create a new encrypted chat hidden in any file format:
156 |
157 | **With Password Protection:**
158 | ```bash
159 | ./poly.py chat create cover.[any] output.[any] "Chat Title" --password=yourpassword
160 | ```
161 |
162 | **With Key File Authentication:**
163 | ```bash
164 | ./poly.py chat create cover.[any] output.[any] "Chat Title" --key=keyfile.key
165 | ```
166 |
167 | **Examples:**
168 | ```bash
169 | # Create password-protected chat in PNG
170 | ./poly.py chat create photo.png secret_chat.png "Team Communications" --password=SecurePass123
171 |
172 | # Create key-protected chat in PDF
173 | ./poly.py chat create document.pdf secret_chat.pdf "Private Discussion" --key=team.key
174 |
175 | # Create unencrypted chat in JPEG
176 | ./poly.py chat create image.jpg chat.jpg "Public Chat"
177 |
178 | # Works with any file format
179 | ./poly.py chat create video.mp4 secret_chat.mp4 "Mission Planning" --password=classified
180 | ```
181 |
182 | #### Adding Messages
183 |
184 | Add messages to existing chats:
185 |
186 | ```bash
187 | ./poly.py chat add chat.[any] "Sender Name" "Message content" [encryption_option]
188 | ```
189 |
190 | **Examples:**
191 | ```bash
192 | # Add to password-protected chat
193 | ./poly.py chat add secret_chat.png "Alice" "Hello team!" --password=SecurePass123
194 |
195 | # Add to key-protected chat
196 | ./poly.py chat add secret_chat.pdf "Bob" "Mission status update" --key=team.key
197 |
198 | # Add to unencrypted chat
199 | ./poly.py chat add chat.jpg "Charlie" "Public message"
200 | ```
201 |
202 | #### Reading Chats
203 |
204 | Display chat contents:
205 |
206 | ```bash
207 | ./poly.py chat read chat.[any] [--format=terminal|json|html] [encryption_option]
208 | ```
209 |
210 | **Examples:**
211 | ```bash
212 | # Read password-protected chat
213 | ./poly.py chat read secret_chat.png --password=SecurePass123
214 |
215 | # Read key-protected chat with JSON format
216 | ./poly.py chat read secret_chat.pdf --format=json --key=team.key
217 |
218 | # Read with HTML format
219 | ./poly.py chat read chat.mp4 --format=html
220 | ```
221 |
222 | #### Exporting Chats
223 |
224 | Export chats to files:
225 |
226 | ```bash
227 | ./poly.py chat export chat.[any] output.[txt|json|html] [encryption_option]
228 | ```
229 |
230 | **Examples:**
231 | ```bash
232 | # Export to HTML
233 | ./poly.py chat export secret_chat.png backup.html --password=SecurePass123
234 |
235 | # Export to JSON
236 | ./poly.py chat export secret_chat.pdf backup.json --key=team.key
237 |
238 | # Export to text
239 | ./poly.py chat export chat.jpg backup.txt
240 | ```
241 |
242 | ### 🔐 Security Features
243 |
244 | - **AES-256-GCM Encryption**: Military-grade encryption with authenticated encryption
245 | - **Argon2id Password Derivation**: Secure password hashing resistant to GPU attacks (with Scrypt fallback for compatibility)
246 | - **Key File Authentication**: Auto-generated secure keys for file-based authentication
247 | - **Perfect Steganography**: Hidden data is completely undetectable by external analysis
248 | - **Tamper Detection**: GCM authentication prevents modification of encrypted data
249 | - **No Information Leakage**: Even if extracted, encrypted data remains unreadable
250 |
251 | **💡 Pro Tip**: Files with hidden chats can be opened normally in any image viewer, PDF reader, or media player. The hidden chat is completely invisible to external tools and analysis.
252 |
253 | ## Technical Details
254 |
255 | Our tool leverages each format's tolerance for extra or embedded data beyond its standard file structure. Most viewers stop reading at defined end markers or fields and ignore trailing bytes, allowing a valid ZIP archive to be appended without affecting normal display.
256 |
257 | #### PNG + ZIP
258 | - **Chunk-based format**: PNG files begin with an 8-byte signature, followed by a sequence of chunks (4-byte length, 4-byte type, chunk data, 4-byte CRC). IDAT chunks contain compressed image data; decoders concatenate all IDAT payloads based on declared lengths and verify each chunk's CRC. Any extra bytes beyond a chunk's specified length (including our appended ZIP) are ignored by standard PNG parsers.
259 | - **Embedding approach**: We insert the ZIP archive into the first IDAT chunk after its declared data, update the length and CRC so the image remains valid, and leave IEND untouched. Viewers decode the image normally, while the ZIP central directory offsets point into the embedded data.
260 |
261 | #### JPEG + ZIP
262 | - **Marker-based format**: JPEG streams consist of markers (`FF D8` SOI, APPn segments, `FF DA` SOS, compressed scan data, `FF D9` EOI). Parsers stop decoding at the EOI marker and ignore any trailing bytes.
263 | - **Embedding approach**: We split the file at the final `FF D9`, write out the image data, then append the ZIP archive. ZIP offsets are fixed so renaming to `.zip` yields a valid archive, while image viewers ignore the appended data.
264 |
265 | #### GIF + ZIP
266 | - **Block-oriented format**: GIF files start with a header (`GIF87a`/`GIF89a`), logical screen descriptor, optional color tables, data blocks, and end with a single trailer byte (`0x3B`).
267 | - **Embedding approach**: We truncate the file at the trailer, append our ZIP archive, and adjust ZIP pointers. GIF viewers stop at `0x3B` and ignore the ZIP data.
268 |
269 | #### PDF + ZIP
270 | - **Text-based format**: PDF documents end with a `%%EOF` marker (often followed by a newline). PDF readers scan backwards to locate the last `%%EOF` and ignore any content that follows.
271 | - **Embedding approach**: We write out the PDF up to and including the final `%%EOF`, then append the ZIP archive. PDF viewers load the document normally, while ZIP tools see a playable archive.
272 |
273 | #### BMP + ZIP
274 | - **Header-driven format**: BMP files start with 'BM', followed by a 4-byte file size field at offset 2 (little-endian), reserved fields, and a pixel-data offset pointer. Readers rely on the declared file size or pixel-data offset to load image data, ignoring trailing data.
275 | - **Embedding approach**: We append the ZIP archive after the pixel data, then fix ZIP offsets. Standard image loaders read only the declared bytes and dismiss extra content.
276 |
277 | #### WebP + ZIP / WAV + ZIP / AVI + ZIP
278 | - **RIFF container**: These formats use a RIFF header (`RIFF`, 4-byte total size, format tag) followed by sub-chunks (e.g., `WEBP`, `WAVE`, `AVI `). Parsers read chunks based on length fields and ignore bytes beyond the container size.
279 | - **Embedding approach**: We append the ZIP archive after the declared RIFF data and update ZIP offsets so the archive remains valid.
280 |
281 | #### TIFF + ZIP
282 | - **Tagged format**: TIFF files begin with an endianness marker (`II`/`MM`), magic number 42, and an offset to the first Image File Directory (IFD). Readers traverse IFD pointers and image data strips; trailing bytes are never referenced.
283 | - **Embedding approach**: We append the ZIP archive at the end, then update ZIP offsets. TIFF viewers ignore the extra data.
284 |
285 | #### MP3 + ZIP
286 | - **Frame-based format**: MP3 audio is composed of sequential frames, each with a frame sync header (`0xFFF`) and payload. Decoders process frames until no valid header remains; any extra bytes at the end are ignored.
287 | - **Embedding approach**: We append the ZIP archive after the last frame and fix ZIP offsets; audio players play all frames and disregard the ZIP.
288 |
289 | #### FLAC + ZIP
290 | - **Block-based format**: FLAC files start with `fLaC`, followed by metadata blocks (ending with the LAST-METADATA-BLOCK flag) and audio frames. Decoders read until the last audio frame and ignore trailing data.
291 | - **Embedding approach**: We append the ZIP archive after the final frame and adjust ZIP offsets.
292 |
293 | #### ICO + ZIP / CUR + ZIP
294 | - **Directory-entry format**: Icon/Cursor files begin with an ICONDIR header (entry count) and ICONDIRENTRY array (each with image data offset and size). Readers load images based on these offsets and ignore data beyond.
295 | - **Embedding approach**: We append the ZIP archive after all image entries and fix ZIP offsets.
296 |
297 | #### MP4 + ZIP / MOV + ZIP
298 | - **ISO BMFF container**: MP4/MOV files are organized in boxes (4-byte size, 4-byte type, data). Parsers read each box based on its size field and disregard any extra bytes after the final box.
299 | - **Embedding approach**: We append the ZIP archive after the last atom and update ZIP offsets so renaming to `.zip` yields a valid archive.
300 |
301 | #### EXE + ZIP / DLL + ZIP
302 | - **PE executable format**: Windows PE files start with an `MZ` DOS stub, followed by a PE header (at `e_lfanew`), section table, and section data blocks. Loaders and PE tools reference section table sizes to map data; trailing bytes beyond the last section are ignored.
303 | - **Embedding approach**: We append the ZIP archive after all declared sections and fix ZIP offsets so the archive remains valid.
304 |
305 | #### OGG + ZIP
306 | - **Container format**: OGG files use a bitstream container with pages containing packet data. Each page has a header with capture pattern, stream serial number, and page sequence. Decoders process pages sequentially until no more valid pages remain; trailing bytes are ignored.
307 | - **Embedding approach**: We append the ZIP archive after the last valid OGG page and update ZIP offsets. Audio players decode all valid pages and ignore the appended ZIP data.
308 |
309 | #### MKV + ZIP
310 | - **Matroska container**: MKV files use the Extensible Binary Meta Language (EBML) format with elements containing size and data fields. The container has a defined structure with header, segment info, tracks, and clusters. Parsers read elements based on size fields and ignore trailing data.
311 | - **Embedding approach**: We append the ZIP archive after the last cluster element and fix ZIP offsets so the archive remains valid while video players ignore extra bytes.
312 |
313 | #### WebM + ZIP
314 | - **Matroska-based format**: WebM is a subset of the Matroska container using VP8/VP9 video and Vorbis/Opus audio. Like MKV, it uses EBML structure with size-defined elements. Decoders stop at the last valid element and ignore trailing bytes.
315 | - **Embedding approach**: We append the ZIP archive after the final cluster and update ZIP offsets. WebM players process only the declared elements and disregard the ZIP data.
316 |
317 | #### FLV + ZIP
318 | - **Adobe Flash Video format**: FLV files start with an FLV header (signature, version, flags, header length) followed by tag packets (type, size, timestamp, data). Decoders process tags sequentially based on size fields and ignore any data beyond the last valid tag.
319 | - **Embedding approach**: We append the ZIP archive after the final tag and adjust ZIP offsets. Flash players and compatible decoders ignore the trailing ZIP data.
320 |
321 | #### ICNS + ZIP
322 | - **Apple Icon format**: ICNS files begin with a 4-byte type identifier (`icns`), followed by a 4-byte file length, then a series of icon elements (4-byte type, 4-byte length, icon data). Readers process elements based on declared lengths and ignore trailing bytes.
323 | - **Embedding approach**: We append the ZIP archive after all icon elements and fix ZIP offsets so the archive remains valid while icon viewers ignore extra data.
324 |
325 | #### M4A + ZIP
326 | - **ISO BMFF container**: M4A files use the same ISO Base Media File Format as MP4, organized in atoms/boxes (4-byte size, 4-byte type, data). Audio players read atoms based on size fields and ignore trailing data beyond the last atom.
327 | - **Embedding approach**: We append the ZIP archive after the final atom and update ZIP offsets. M4A players process only the declared atoms and disregard the ZIP data.
328 |
329 | #### ELF + ZIP
330 | - **Linux executable format**: ELF files start with an ELF header containing entry point, program header table offset, section header table offset, and other metadata. Loaders map segments based on program headers and ignore data beyond the declared sections.
331 | - **Embedding approach**: We append the ZIP archive after all section data and fix ZIP offsets so the archive remains valid while ELF loaders ignore trailing bytes.
332 |
333 | #### MSI + ZIP
334 | - **Microsoft Installer format**: MSI files are structured storage compound documents with a defined directory structure. Installers read the compound document structure and ignore any trailing data beyond the declared storage size.
335 | - **Embedding approach**: We append the ZIP archive after the compound document structure and update ZIP offsets. MSI installers process only the declared storage content and ignore extra bytes.
336 |
337 | #### TTF + ZIP / OTF + ZIP / WOFF + ZIP
338 | - **Font file formats**: TTF/OTF files contain font tables with a table directory specifying offsets and lengths. WOFF adds compression wrapper with declared uncompressed size. Font renderers read tables based on directory entries and ignore trailing data.
339 | - **Embedding approach**: We append the ZIP archive after all font table data and fix ZIP offsets. Font systems load only the declared tables and disregard the ZIP data.
340 |
341 | #### 🔒 Encrypted Chat Technical Implementation
342 |
343 | The encrypted chat system uses a sophisticated multi-layered approach:
344 |
345 | 1. **Data Structure**: Chat messages are stored in JSON format with timestamps, participants, and message content
346 | 2. **Encryption Layer**:
347 | - **AES-256-GCM**: Provides both confidentiality and authentication
348 | - **Argon2id**: Password-based key derivation resistant to GPU attacks (with Scrypt fallback)
349 | - **Random Salt**: Unique salt for each chat prevents rainbow table attacks
350 | - **Key Files**: Auto-generated 256-bit keys for file-based authentication
351 | 3. **Steganographic Embedding**: Encrypted data is embedded using the same techniques as ZIP files
352 | 4. **Format Agnostic**: Works with any supported file format (PNG, JPEG, PDF, MP4, etc.)
353 | 5. **Tamper Detection**: GCM authentication tag prevents modification without detection
354 |
355 | **Security Guarantees**:
356 | - Even if the cover file is extracted, the chat data remains encrypted
357 | - No information leakage about chat contents or participants
358 | - Files appear completely normal to external analysis tools
359 | - Brute force attacks are mitigated by Argon2id's computational cost
360 |
361 | ### Limitations
362 |
363 | 1. **Cover File Requirements**:
364 | - **PNG**:
365 | - Must compress well to leave space for embedded data
366 | - Must have at least 257 unique colors if not using a palette (to prevent Twitter from converting to indexed color)
367 | - Example: A 1000x1000 pixel PNG with 256 colors will be converted to indexed color by Twitter, breaking the polyglot
368 | - Example: A noisy or complex PNG might not compress well, leaving little space for embedded data
369 |
370 | - **JPEG**:
371 | - Must have a valid EOI (End of Image) marker (0xFFD9)
372 | - Some JPEGs may have multiple EOI markers - only the last one is used
373 | - Example: A JPEG with corrupted EOI marker will fail to embed data
374 |
375 | - **GIF**:
376 | - Must have a valid trailer marker (0x3B)
377 | - Multi-frame GIFs are supported, but data is embedded after the last frame
378 | - Example: A GIF with corrupted trailer will fail to embed data
379 |
380 | - **PDF**:
381 | - Must have a valid EOF marker (%%EOF)
382 | - Some PDFs may have multiple EOF markers - only the last one is used
383 | - Example: A PDF with corrupted EOF marker will fail to embed data
384 |
385 | - **BMP**:
386 | - Must have a valid file size field at offset 2 (little endian); viewers ignore trailing bytes
387 | - Example: A malformed BMP size field may prevent the image from loading
388 |
389 | - **WebP**:
390 | - Must start with "RIFF" and include the "WEBP" chunk within the first 12 bytes; parsers read only declared chunk size
391 | - Example: Missing or corrupted "WEBP" chunk can break embedding
392 |
393 | - **TIFF**:
394 | - Must have a valid byte-order marker ("II" or "MM") and correct IFD pointers; viewers ignore trailing data
395 | - Example: Corrupted IFD pointers may cause the viewer to reject the file
396 |
397 | - **WAV**:
398 | - Must start with "RIFF" and include the "WAVE" chunk; header chunk size must match file length
399 | - Example: Incorrect RIFF size can break audio playback
400 |
401 | - **MP3**:
402 | - Must end with a proper frame sequence; decoders ignore trailing bytes after the last valid frame
403 | - Example: Frame sync errors will prevent embedding
404 |
405 | - **FLAC**:
406 | - Must start with the "fLaC" marker; decoders ignore trailing bytes after the last metadata block
407 | - Example: Missing STREAMINFO block will prevent decoding
408 |
409 | - **AVI**:
410 | - Must start with "RIFF" and include the "AVI " chunk; chunk size header must be correct
411 | - Example: Corrupted chunk size will break video playback
412 |
413 | - **ICO**:
414 | - Must include a valid icon directory and entries; parsers read only declared images
415 | - Example: Invalid entry headers may prevent the icon from displaying
416 |
417 | - **CUR**:
418 | - Must include a valid cursor directory and entries; trailing bytes are ignored
419 | - Example: Incorrect hotspot coordinates can affect cursor positioning
420 |
421 | - **MP4/MOV**:
422 | - Must include valid ISO BMFF atoms ("ftyp", "moov"); atom size fields must match declared lengths
423 | - Example: Missing or misplaced "moov" atom will break playback
424 |
425 | - **OGG**:
426 | - Must have valid OGG page headers with correct capture patterns and checksums
427 | - Example: Corrupted page headers will prevent audio/video decoding
428 |
429 | - **MKV**:
430 | - Must include valid EBML header and segment structure; element size fields must be accurate
431 | - Example: Missing or corrupted EBML header will prevent video playback
432 |
433 | - **WebM**:
434 | - Must be a valid Matroska subset with VP8/VP9 video and Vorbis/Opus audio codecs
435 | - Example: Using unsupported codecs may cause playback failures
436 |
437 | - **FLV**:
438 | - Must have valid FLV header and properly formatted tag structure
439 | - Example: Incorrect tag sizes will break Flash video playback
440 |
441 | - **ICNS**:
442 | - Must include valid icon elements with correct type identifiers and sizes
443 | - Example: Malformed icon elements may prevent macOS from displaying the icon
444 |
445 | - **M4A**:
446 | - Must follow ISO BMFF structure with valid audio-specific atoms ("mdhd", "stsd")
447 | - Example: Missing audio track information will prevent playback
448 |
449 | - **ELF**:
450 | - Must have valid ELF header with correct magic number and architecture information
451 | - Example: Incorrect architecture or corrupted headers will prevent execution
452 |
453 | - **MSI**:
454 | - Must be a valid compound document with proper storage structure
455 | - Example: Corrupted storage directory will prevent installation
456 |
457 | - **TTF/OTF**:
458 | - Must have valid font table directory and required tables ("cmap", "glyf", "head", "hhea", "hmtx", "loca", "maxp", "name", "post")
459 | - Example: Missing required tables will prevent font rendering
460 |
461 | - **WOFF**:
462 | - Must have valid WOFF header with correct signature and table directory
463 | - Example: Incorrect compression or table checksums will prevent font loading
464 |
465 | 2. **Size Limitations**:
466 | - **PNG**:
467 | - Maximum size depends on the image characteristics and hosting platform
468 | - For Twitter: Must be under 3MB to avoid JPEG conversion
469 | - Compressed size must be less than `(width * height) - size_of_embedded_file`
470 | - Image must have enough space in its IDAT chunks to embed the ZIP data
471 | - Example: A 2000x2000 PNG with simple content might compress to 500KB, leaving 2.5MB for embedded data
472 | - Example: A 2000x2000 PNG with complex content might compress to 2.9MB, leaving only 100KB for embedded data
473 |
474 | - **JPEG/GIF/PDF**:
475 | - No strict size limits beyond the file format's maximum size
476 | - Limited only by the available space after the file's end marker
477 | - Hosting platforms may impose their own size restrictions
478 | - Example: A 1MB JPEG can embed up to 2MB of data (if the platform allows 3MB total)
479 | - Example: A 5MB PDF can embed up to 5MB of data (if the platform allows 10MB total)
480 |
481 | - **BMP**:
482 | - Limited by the 32-bit file size field (max ~4 GB); can embed up to (file size field) minus header size
483 | - Example: Embedding near 4 GB may hit format or hosting limits
484 |
485 | - **WebP**:
486 | - Limited by the 32-bit RIFF chunk size (max ~4 GB); subject to image hosting size restrictions
487 | - Example: Very large WebP files may be disallowed by some platforms
488 |
489 | - **TIFF**:
490 | - Limited by 32-bit IFD offsets (max ~4 GB); trailing data supports large payloads
491 | - Example: Hosting large TIFFs may incur platform-specific size constraints
492 |
493 | - **WAV**:
494 | - Limited by 32-bit RIFF chunk size (max ~4 GB); decoders ignore trailing bytes
495 | - Example: Embedding several GB of data in WAV may exceed hosting quotas
496 |
497 | - **MP3**:
498 | - No strict format size limit; embed until file system or hosting limits are reached
499 | - Example: Some services re-encode or strip trailing bytes on MP3 uploads
500 |
501 | - **FLAC**:
502 | - No strict format size limit; embed until file system or hosting limits are reached
503 | - Example: FLAC uploads may be converted or transcoded by certain platforms
504 |
505 | - **AVI**:
506 | - Limited by 32-bit RIFF chunk size (max ~4 GB); supports large embedded payloads
507 | - Example: Video hosting sites may strip trailing bytes when transcoding
508 |
509 | - **ICO/CUR**:
510 | - Limited by 32-bit directory offsets; can embed up to (file size) minus icon data
511 | - Example: Many icon hosting services discard non-icon data
512 |
513 | - **MP4/MOV**:
514 | - Limited by 32-bit atom size fields (max ~4 GB); larger files require extended atoms not commonly supported
515 | - Example: Embedding >4 GB requires extended format support, which is uncommon in viewers
516 |
517 | - **OGG**:
518 | - No strict format size limit; limited by available disk space and hosting platform restrictions
519 | - Example: Large OGG files may be transcoded by streaming services, removing ZIP data
520 |
521 | - **MKV**:
522 | - Limited by EBML variable-length encoding (practically unlimited for most use cases)
523 | - Example: Some players may have performance issues with very large files
524 |
525 | - **WebM**:
526 | - Same as MKV but typically smaller due to web optimization requirements
527 | - Example: Web browsers may impose stricter size limits for streaming
528 |
529 | - **FLV**:
530 | - Limited by 32-bit size fields in tags and file header (max ~4 GB)
531 | - Example: Flash players may not handle files approaching the size limit
532 |
533 | - **ICNS**:
534 | - Limited by icon element count and size fields; typically small files unsuitable for large payloads
535 | - Example: Very large ICNS files may be rejected by macOS icon caching
536 |
537 | - **M4A**:
538 | - Same limitations as MP4/MOV due to shared ISO BMFF structure (max ~4 GB)
539 | - Example: Audio streaming services often strip trailing data during processing
540 |
541 | - **ELF**:
542 | - Limited by architecture-specific constraints and section table size limits
543 | - Example: Some systems may reject executables with unusual sizes or structures
544 |
545 | - **MSI**:
546 | - Limited by compound document format constraints (max ~4 GB for compatibility)
547 | - Example: Windows installer may flag very large MSI files as suspicious
548 |
549 | - **TTF/OTF/WOFF**:
550 | - Limited by font table size fields and system font loading limits
551 | - Example: Font renderers may reject fonts with unusual file sizes or structures
552 |
553 | 3. **Image Hosting**:
554 | - **Works on**:
555 | - Twitter: PNGs under 3MB, JPEGs under 5MB
556 | - Imgur: Various size limits depending on account type
557 | - GitHub: Large file support available
558 | - Discord: Supports large files
559 |
560 | - **May not work on**:
561 | - Reddit: Re-encodes images, breaking the polyglot
562 | - Facebook: Re-encodes and strips metadata
563 | - Instagram: Re-encodes and strips metadata
564 |
565 | - **Platform-specific considerations**:
566 | - Some platforms may strip metadata or re-encode images
567 | - Example: Twitter's image processing preserves PNG structure but may convert to JPEG if over 3MB
568 | - Example: Reddit's image processing breaks the polyglot by re-encoding the image
569 |
570 | - **Audio & Video Hosting**:
571 | - Streaming platforms (YouTube, Vimeo, SoundCloud) often re-encode media, removing trailing ZIP data
572 | - Use direct file hosting (GitHub Releases, cloud storage) to preserve raw polyglot files
573 | - **Document Hosting**:
574 | - PDF attachments in email or file-sharing services typically preserve trailing data
575 | - Example: Sending a polyglot PDF as an email attachment maintains both viewability and ZIP payload
576 |
577 | - **New Format Hosting Considerations**:
578 | - **OGG/MKV/WebM/FLV**: Video platforms typically transcode these formats, breaking polyglots
579 | - **M4A**: Audio services may normalize or compress files, stripping trailing data
580 | - **ICNS**: macOS icon services may process or cache icons, potentially removing ZIP data
581 | - **ELF**: Linux package repositories may strip or modify executables during processing
582 | - **MSI**: Software distribution platforms may scan and modify installer files
583 | - **TTF/OTF/WOFF**: Font hosting services may validate and potentially strip non-font data
584 | - **Recommendation**: Use direct file hosting or cloud storage for new formats to preserve polyglot integrity
585 |
586 | 4. **Technical Limitations**:
587 | - ZIP file offsets must be adjusted to account for the cover file's size
588 | - Some file formats may have internal size checks that limit embedding
589 | - Example: A ZIP file with absolute paths may fail if the cover file is too large
590 | - Example: Some PDF readers may fail to open very large polyglot PDFs
591 | - **PE Formats (EXE/DLL)**:
592 | - Some third-party GUI utilities (WinRAR, macOS Archive Utility) may report the archive as corrupted due to trailing data. Windows Explorer's built-in extractor and command-line tools (`unzip`, `7z`) handle it correctly after renaming to `.zip`.
593 |
594 | 5. **🔒 Encryption System Limitations**:
595 | - **Password Security**: Passwords are only as strong as the user makes them
596 | - **Key File Security**: Key files must be stored securely and transmitted safely
597 | - **Platform Processing**: Some platforms may strip or modify files, breaking the hidden data
598 | - **File Size**: Large encrypted files may exceed platform upload limits
599 | - **Backup Responsibility**: Users must backup key files and passwords - lost credentials mean lost access to both files and chats
600 | - **Compatibility**: Scrypt fallback provides compatibility when Argon2id is unavailable, but with slightly different security parameters
601 |
602 | ### Dependencies
603 |
604 | - Python 3.x
605 | - `cryptography` library (for AES-256-GCM and Argon2id)
606 | - Optional: python-magic (for better file type detection)
607 |
608 | ## Security Considerations
609 |
610 | - The tool creates valid files that can be viewed normally
611 | - **🔒 Both files and chats are protected by military-grade AES-256-GCM encryption**
612 | - **🔑 Passwords use Argon2id derivation (with Scrypt fallback) resistant to GPU attacks**
613 | - **🛡️ Key files provide secure file-based authentication**
614 | - **👁️ Hidden data is completely undetectable by external analysis**
615 | - **🔒 Even if extracted, encrypted data remains unreadable without proper credentials**
616 | - Embedded data is not encrypted by default (except for chat system)
617 | - Files can be extracted using standard ZIP tools by renaming the file extension
618 | - Detection tools may flag these files as suspicious
619 | - **⚠️ Users are responsible for securing their passwords and key files**
620 |
621 | ## Quick Start Examples
622 |
623 | ### File Hiding
624 | ```bash
625 | # Hide files in an image (unencrypted)
626 | ./poly.py pack photo.png secrets.txt hidden_photo.png
627 |
628 | # Hide files with encryption
629 | ./poly.py pack photo.png secrets.txt encrypted_photo.png --password=MyPassword123
630 |
631 | # Extract hidden files (unencrypted)
632 | ./poly.py extract hidden_photo.png
633 |
634 | # Extract encrypted files
635 | ./poly.py extract encrypted_photo.png --password=MyPassword123
636 |
637 | # Detect hidden data
638 | ./poly.py detect hidden_photo.png
639 | ```
640 |
641 | ### 🔒 Encrypted Chat System
642 | ```bash
643 | # Create encrypted chat
644 | ./poly.py chat create photo.jpg secret_chat.jpg "Team Alpha" --password=SecretMission2024
645 |
646 | # Add encrypted messages
647 | ./poly.py chat add secret_chat.jpg "Smith" "Package secured" --password=SecretMission2024
648 | ./poly.py chat add secret_chat.jpg "Jones" "Extraction complete" --password=SecretMission2024
649 |
650 | # Read encrypted chat
651 | ./poly.py chat read secret_chat.jpg --password=SecretMission2024
652 |
653 | # Export to HTML
654 | ./poly.py chat export secret_chat.jpg backup.html --password=SecretMission2024
655 | ```
656 |
657 | ### Multi-Format Support
658 | ```bash
659 | # Works with any format
660 | ./poly.py chat create document.pdf secret.pdf "Legal Team" --key=legal.key
661 | ./poly.py chat create video.mp4 secret.mp4 "Production Team" --password=MovieSecret
662 | ./poly.py chat create audio.mp3 secret.mp3 "Music Team" --key=band.key
663 | ```
664 |
665 | ## Credits
666 |
667 | - Original PNG polyglot technique by [DavidBuchanan314](https://github.com/DavidBuchanan314/tweetable-polyglot-png)
668 | - Current implementation & new techniques by InfoSecREDD
669 |
670 | ## License
671 |
672 | MIT License - See LICENSE file for details
673 |
--------------------------------------------------------------------------------
/poly.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python3
2 | """
3 | PolyZip - A tool for creating polyglot files (FILE + ZIP)
4 | Based on the work of DavidBuchanan314 (https://github.com/DavidBuchanan314/tweetable-polyglot-png)
5 | Author: InfoSecREDD
6 | Version: 2.1.3
7 | """
8 |
9 | import zlib
10 | import sys
11 | import os
12 | import glob
13 | import json
14 | import struct
15 | import mimetypes
16 | import subprocess
17 | import importlib.util
18 | import platform
19 | import tempfile
20 | import zipfile
21 | import datetime
22 | import base64
23 | import secrets
24 | import shutil
25 |
26 | ARGON2_AVAILABLE = False
27 |
28 | def check_and_install_dependencies():
29 | """Always ensure we're running in our own virtual environment with all dependencies"""
30 | venv_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), '.poly_venv')
31 |
32 | if platform.system() == 'Windows':
33 | our_venv_python = os.path.join(venv_dir, 'Scripts', 'python.exe')
34 | else:
35 | our_venv_python = os.path.join(venv_dir, 'bin', 'python')
36 |
37 | current_python = os.path.abspath(sys.executable)
38 | our_python = os.path.abspath(our_venv_python)
39 |
40 | in_our_venv = (
41 | current_python == our_python or
42 | os.path.basename(current_python) == os.path.basename(our_python) and current_python.startswith(os.path.abspath(venv_dir)) or
43 | (hasattr(sys, 'base_prefix') and sys.base_prefix != sys.prefix and os.path.abspath(sys.prefix) == os.path.abspath(venv_dir))
44 | )
45 |
46 | if not in_our_venv:
47 | venv_exists = os.path.exists(venv_dir)
48 | venv_python_working = False
49 |
50 | if platform.system() == 'Windows':
51 | venv_python = os.path.join(venv_dir, 'Scripts', 'python.exe')
52 | else:
53 | venv_python = os.path.join(venv_dir, 'bin', 'python')
54 |
55 | if venv_exists and os.path.exists(venv_python):
56 | try:
57 | result = subprocess.run([venv_python, '--version'],
58 | capture_output=True, timeout=10)
59 | venv_python_working = result.returncode == 0
60 | except Exception:
61 | venv_python_working = False
62 |
63 | if not venv_exists or not venv_python_working:
64 | if venv_exists and not venv_python_working:
65 | print(f"[\033[33m!\033[0m] Virtual environment is corrupted, recreating...")
66 | try:
67 | shutil.rmtree(venv_dir)
68 | except Exception as e:
69 | print(f"[\033[33m!\033[0m] Warning: Could not remove old venv: {e}")
70 |
71 | print(f"[\033[36m*\033[0m] Setting up dedicated virtual environment...")
72 | print(f"[\033[36m+\033[0m] Creating virtual environment in {venv_dir}")
73 | try:
74 | subprocess.check_call([sys.executable, '-m', 'venv', venv_dir])
75 | except Exception as e:
76 | print(f"[\033[31m!\033[0m] Failed to create virtual environment: {e}")
77 | sys.exit(1)
78 | print(f"[\033[36m*\033[0m] Restarting script in virtual environment...")
79 |
80 | if not os.path.exists(venv_python):
81 | print(f"[\033[31m!\033[0m] Virtual environment Python not found at {venv_python}")
82 | sys.exit(1)
83 |
84 | try:
85 | result = subprocess.run([venv_python, '--version'],
86 | capture_output=True, timeout=10)
87 | if result.returncode != 0:
88 | print(f"[\033[31m!\033[0m] Virtual environment Python is not functional")
89 | sys.exit(1)
90 | except Exception as e:
91 | print(f"[\033[31m!\033[0m] Virtual environment Python test failed: {e}")
92 | sys.exit(1)
93 |
94 | os.execl(venv_python, venv_python, *sys.argv)
95 |
96 | required_packages = [
97 | {'package': 'python-magic', 'import_name': 'magic', 'optional': True},
98 | {'package': 'cryptography', 'import_name': 'cryptography', 'optional': False}
99 | ]
100 |
101 | missing_packages = []
102 | for package_info in required_packages:
103 | if importlib.util.find_spec(package_info['import_name']) is None:
104 | missing_packages.append(package_info['package'])
105 |
106 | if missing_packages:
107 | print(f"[\033[36m*\033[0m] Installing missing packages: {', '.join(missing_packages)}")
108 | try:
109 | subprocess.check_call([sys.executable, '-m', 'pip', 'install'] + missing_packages)
110 | print(f"[\033[32m✓\033[0m] Dependencies installed successfully!")
111 | except Exception as e:
112 | print(f"[\033[33m!\033[0m] pip failed: {e}, trying pip3...")
113 | try:
114 | subprocess.check_call([sys.executable, '-m', 'pip3', 'install'] + missing_packages)
115 | print(f"[\033[32m✓\033[0m] Dependencies installed successfully using pip3!")
116 | except Exception as e2:
117 | print(f"[\033[31m!\033[0m] Failed to install dependencies with both pip and pip3: {e2}")
118 | print(f"[\033[31m!\033[0m] Please install manually in the virtual environment:")
119 | print(f" source {venv_dir}/bin/activate # or {venv_dir}\\Scripts\\activate on Windows")
120 | print(f" pip install {' '.join(missing_packages)}")
121 | sys.exit(1)
122 | else:
123 | print(f"[\033[32m✓\033[0m] Using virtual environment")
124 |
125 | def import_cryptography():
126 | """Import cryptography modules after dependency checking"""
127 | global ARGON2_AVAILABLE, Cipher, algorithms, modes, Scrypt, hashes, default_backend, Argon2id
128 |
129 | try:
130 | from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
131 | from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
132 | from cryptography.hazmat.primitives import hashes
133 | from cryptography.hazmat.backends import default_backend
134 |
135 | try:
136 | from cryptography.hazmat.primitives.kdf.argon2 import Argon2id
137 | ARGON2_AVAILABLE = True
138 | except ImportError:
139 | ARGON2_AVAILABLE = False
140 |
141 | except ImportError as e:
142 | print(f"\033[31m[!] Error importing cryptography: {e}\033[0m")
143 | print(f"\033[31m[!] Please install cryptography: pip install cryptography\033[0m")
144 | sys.exit(1)
145 |
146 | if __name__ == "__main__":
147 | check_and_install_dependencies()
148 | import_cryptography()
149 |
150 | BANNER = r'''
151 | ██████╗ ██████╗ ██╗ ██╗ ██╗███████╗██╗██████╗
152 | ██╔══██╗██╔═══██╗██║ ╚██╗ ██╔╝╚══███╔╝██║██╔══██╗
153 | ██████╔╝██║ ██║██║ ╚████╔╝ ███╔╝ ██║██████╔╝
154 | ██╔═══╝ ██║ ██║██║ ╚██╔╝ ███╔╝ ██║██╔═══╝
155 | ██║ ╚██████╔╝███████╗██║ ███████╗██║██║
156 | ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚══════╝╚═╝╚═╝
157 |
158 | [ Multi-Format Polyglot Tool - Hide Any Data ]
159 | ╔══════════════════════════════════════════╗
160 | ║ pack ≫ extract ≫ detect ≫ ghost in file ║
161 | ╚══════════════════════════════════════════╝
162 | '''
163 |
164 | PNG_MAGIC = b"\x89PNG\r\n\x1a\n"
165 | JPEG_MAGIC = b"\xff\xd8\xff"
166 | GIF_MAGIC = b"GIF8"
167 | PDF_MAGIC = b"%PDF-"
168 | BMP_MAGIC = b"BM"
169 | WEBP_MAGIC = b"RIFF"
170 | TIFF_MAGIC_LE = b"II*\x00"
171 | TIFF_MAGIC_BE = b"MM\x00*"
172 | WAV_MAGIC = b"RIFF"
173 | MP3_MAGIC = b"\xFF\xFB"
174 | MP3_MAGIC2 = b"\xFF\xF3"
175 | MP3_MAGIC3 = b"\xFF\xFA"
176 | MP3_MAGIC4 = b"\xFF\xF2"
177 | FLAC_MAGIC = b"fLaC"
178 | OGG_MAGIC = b"OggS"
179 | AVI_MAGIC = b"RIFF"
180 | MKV_MAGIC = b"\x1a\x45\xdf\xa3"
181 | M4A_MAGIC = b"ftyp"
182 | WEBM_MAGIC = b"\x1a\x45\xdf\xa3"
183 | FLV_MAGIC = b"FLV"
184 | ICO_MAGIC = b"\x00\x00\x01\x00"
185 | CUR_MAGIC = b"\x00\x00\x02\x00"
186 | ICNS_MAGIC = b"icns"
187 | MP4_MAGIC = b"ftyp"
188 | MZ_MAGIC = b"MZ"
189 | ELF_MAGIC = b"\x7fELF"
190 | MSI_MAGIC = b"\xd0\xcf\x11\xe0"
191 | TTF_MAGIC = b"\x00\x01\x00\x00"
192 | OTF_MAGIC = b"OTTO"
193 | WOFF_MAGIC = b"wOFF"
194 |
195 |
196 |
197 | def print_banner():
198 | colors = {
199 | 'cyan': '\033[36m',
200 | 'green': '\033[32m',
201 | 'blue': '\033[34m',
202 | 'red': '\033[31m',
203 | 'magenta': '\033[35m',
204 | 'yellow': '\033[33m',
205 | 'white': '\033[37m',
206 | 'reset': '\033[0m'
207 | }
208 |
209 | colored_banner = colors['cyan'] + BANNER + colors['reset']
210 | print(colored_banner)
211 |
212 | version_info = f"{colors['green']}[+]{colors['reset']} {colors['white']}Version 2.1.3{colors['reset']} | " + \
213 | f"{colors['green']}[+]{colors['reset']} {colors['white']}Data Hidden in Plain Sight{colors['reset']}"
214 | print(version_info)
215 | print(f"{colors['green']}[+]{colors['reset']} {colors['white']}Use {colors['cyan']}detect{colors['reset']} to scan for hidden data")
216 | print()
217 |
218 | def print_usage():
219 | colors = {
220 | 'cyan': '\033[36m',
221 | 'green': '\033[32m',
222 | 'blue': '\033[34m',
223 | 'red': '\033[31m',
224 | 'magenta': '\033[35m',
225 | 'yellow': '\033[33m',
226 | 'white': '\033[37m',
227 | 'bold': '\033[1m',
228 | 'reset': '\033[0m'
229 | }
230 |
231 | print(f"\n{colors['bold']}{colors['cyan']}USAGE:{colors['reset']}")
232 | print(f" {colors['white']}{sys.argv[0]}{colors['reset']} {colors['yellow']}[command]{colors['reset']} {colors['green']}[options...]{colors['reset']}")
233 | print(f"\n{colors['bold']}{colors['magenta']}COMMANDS:{colors['reset']}")
234 | print(f"\n {colors['bold']}{colors['cyan']}pack{colors['reset']} - {colors['white']}Hide files inside images/documents{colors['reset']}")
235 | print(f" {colors['yellow']}Usage:{colors['reset']} {sys.argv[0]} pack {colors['green']}cover_file{colors['reset']} {colors['blue']}file1 [file2 ...]{colors['reset']} {colors['magenta']}output_file{colors['reset']} {colors['red']}[encryption]{colors['reset']}")
236 | print(f" {colors['yellow']}Example:{colors['reset']} {sys.argv[0]} pack photo.png secret.txt hidden_photo.png")
237 | print(f" {colors['yellow']}Encrypted:{colors['reset']} {sys.argv[0]} pack photo.png secret.txt hidden_photo.png --key=my.key")
238 | print(f" {colors['yellow']}Supports:{colors['reset']} PNG, JPEG, GIF, PDF, BMP, WebP, TIFF, WAV, MP3, FLAC, OGG,")
239 | print(f" AVI, MKV, WebM, FLV, ICO, CUR, ICNS, MP4, MOV, M4A, EXE, DLL, ELF, MSI, TTF, OTF, WOFF")
240 | print(f"\n {colors['bold']}{colors['cyan']}extract{colors['reset']} - {colors['white']}Extract hidden files from images/documents{colors['reset']}")
241 | print(f" {colors['yellow']}Usage:{colors['reset']} {sys.argv[0]} extract {colors['green']}input_file{colors['reset']} {colors['blue']}[output_directory]{colors['reset']} {colors['red']}[encryption]{colors['reset']}")
242 | print(f" {colors['yellow']}Example:{colors['reset']} {sys.argv[0]} extract hidden_photo.png extracted_files/")
243 | print(f" {colors['yellow']}Encrypted:{colors['reset']} {sys.argv[0]} extract hidden_photo.png extracted_files/ --key=my.key")
244 | print(f" {colors['yellow']}Note:{colors['reset']} If output directory is omitted, extracts to folder named after input file")
245 | print(f"\n {colors['bold']}{colors['cyan']}detect{colors['reset']} - {colors['white']}Scan for hidden data in files{colors['reset']}")
246 | print(f" {colors['yellow']}Usage:{colors['reset']} {sys.argv[0]} detect {colors['green']}[file]{colors['reset']}")
247 | print(f" {colors['yellow']}Example:{colors['reset']} {sys.argv[0]} detect suspicious_image.png")
248 | print(f" {colors['yellow']}Note:{colors['reset']} If no file specified, scans all supported files in current directory")
249 | print(f"\n {colors['bold']}{colors['cyan']}chat{colors['reset']} - {colors['white']}Create encrypted hidden chat logs in images{colors['reset']}")
250 | print(f" {colors['bold']}{colors['green']}Subcommands:{colors['reset']}")
251 | print(f"\n {colors['bold']}{colors['yellow']}create{colors['reset']} - Create new encrypted chat")
252 | print(f" {colors['yellow']}Usage:{colors['reset']} {sys.argv[0]} chat create {colors['green']}cover.[any]{colors['reset']} {colors['magenta']}output.[any]{colors['reset']} {colors['blue']}[\"title\"]{colors['reset']} {colors['red']}[encryption]{colors['reset']}")
253 | print(f" {colors['yellow']}Examples:{colors['reset']}")
254 | print(f" {sys.argv[0]} chat create photo.jpg secret_chat.jpg \"Team Chat\" --key=team.key")
255 | print(f" {sys.argv[0]} chat create document.pdf secret_chat.pdf \"Private\" --password=mypass123")
256 | print(f" {sys.argv[0]} chat create image.gif secret_chat.gif # Unencrypted")
257 | print(f" {sys.argv[0]} chat create cover.png output.png \"Any file type works!\"")
258 | print(f" {colors['cyan']}Supported formats:{colors['reset']} PNG, JPG, GIF, PDF, BMP, WEBP, TIFF, WAV, MP3, FLAC, OGG, AVI, MKV, WebM, FLV, ICO, MP4, MOV, EXE, and more")
259 | print(f"\n {colors['bold']}{colors['yellow']}add{colors['reset']} - Add message to existing chat")
260 | print(f" {colors['yellow']}Usage:{colors['reset']} {sys.argv[0]} chat add {colors['green']}chat.[any]{colors['reset']} {colors['blue']}sender{colors['reset']} {colors['cyan']}\"message\"{colors['reset']} {colors['magenta']}[output.[any]]{colors['reset']} {colors['red']}[encryption]{colors['reset']}")
261 | print(f" {colors['yellow']}Examples:{colors['reset']}")
262 | print(f" {sys.argv[0]} chat add secret_chat.jpg Alice \"Hello team!\" --key=team.key")
263 | print(f" {sys.argv[0]} chat add secret_chat.pdf Bob \"Secret message\" --password=mypass123")
264 | print(f" {sys.argv[0]} chat add hidden_chat.gif Charlie \"Works with any file type!\"")
265 | print(f"\n {colors['bold']}{colors['yellow']}read{colors['reset']} - Display chat messages")
266 | print(f" {colors['yellow']}Usage:{colors['reset']} {sys.argv[0]} chat read {colors['green']}chat.[any]{colors['reset']} {colors['blue']}[--format=terminal|json|html]{colors['reset']} {colors['red']}[encryption]{colors['reset']}")
267 | print(f" {colors['yellow']}Examples:{colors['reset']}")
268 | print(f" {sys.argv[0]} chat read secret_chat.jpg --key=team.key")
269 | print(f" {sys.argv[0]} chat read secret_chat.pdf --format=json --password=mypass123")
270 | print(f" {sys.argv[0]} chat read hidden_chat.mp4 --format=html")
271 | print(f"\n {colors['bold']}{colors['yellow']}export{colors['reset']} - Export chat to file")
272 | print(f" {colors['yellow']}Usage:{colors['reset']} {sys.argv[0]} chat export {colors['green']}chat.[any]{colors['reset']} {colors['magenta']}output.[txt|json|html]{colors['reset']} {colors['red']}[encryption]{colors['reset']}")
273 | print(f" {colors['yellow']}Examples:{colors['reset']}")
274 | print(f" {sys.argv[0]} chat export secret_chat.jpg backup.html --key=team.key")
275 | print(f" {sys.argv[0]} chat export secret_chat.pdf backup.json --password=mypass123")
276 | print(f" {sys.argv[0]} chat export hidden_chat.mkv backup.txt")
277 | print(f"\n {colors['bold']}{colors['red']}ENCRYPTION OPTIONS:{colors['reset']}")
278 | print(f" {colors['cyan']}--key=filename.key{colors['reset']} Use AES-256 encryption with key file (auto-generated if missing)")
279 | print(f" {colors['cyan']}--password=yourpass{colors['reset']} Use AES-256 encryption with password (Argon2id + salt)")
280 | print(f" {colors['yellow']}Note:{colors['reset']} Encrypted chats are completely secure and undetectable")
281 | print(f"\n{colors['bold']}{colors['green']}QUICK EXAMPLES:{colors['reset']}")
282 | print(f" {colors['white']}Hide files:{colors['reset']} {sys.argv[0]} pack photo.jpg document.pdf hidden.jpg")
283 | print(f" {colors['white']}Hide files encrypted:{colors['reset']} {sys.argv[0]} pack photo.jpg secret.txt hidden.jpg --key=my.key")
284 | print(f" {colors['white']}Extract files:{colors['reset']} {sys.argv[0]} extract hidden.jpg")
285 | print(f" {colors['white']}Extract encrypted:{colors['reset']} {sys.argv[0]} extract hidden.jpg output/ --key=my.key")
286 | print(f" {colors['white']}Scan for hidden data:{colors['reset']} {sys.argv[0]} detect")
287 | print(f" {colors['white']}Create encrypted chat:{colors['reset']} {sys.argv[0]} chat create cover.jpg chat.jpg --key=my.key")
288 | print(f" {colors['white']}Add encrypted message:{colors['reset']} {sys.argv[0]} chat add chat.pdf Alice \"Hello!\" --key=my.key")
289 | print(f" {colors['white']}Read encrypted chat:{colors['reset']} {sys.argv[0]} chat read chat.gif --key=my.key")
290 | print(f" {colors['cyan']}💡 Both files AND chat work with ANY file format - images, videos, documents, executables, etc!{colors['reset']}")
291 | print(f"\n{colors['bold']}{colors['yellow']}SECURITY FEATURES:{colors['reset']}")
292 | print(f" • {colors['green']}AES-256-GCM encryption{colors['reset']} with authenticated encryption for files & chat")
293 | print(f" • {colors['green']}Perfect steganography{colors['reset']} - files appear completely normal")
294 | print(f" • {colors['green']}Key file generation{colors['reset']} - automatic secure key creation")
295 | print(f" • {colors['green']}Password protection{colors['reset']} - Argon2id or Scrypt with secure parameters")
296 | print(f" • {colors['green']}Tamper detection{colors['reset']} - GCM authentication prevents modification")
297 |
298 | print(f"\n{colors['bold']}{colors['cyan']}💡 TIP:{colors['reset']} {colors['white']}Files with hidden data can be opened normally in any image viewer/PDF reader!{colors['reset']}")
299 | print()
300 | sys.exit(1)
301 |
302 | if len(sys.argv) < 2:
303 | print_banner()
304 | print_usage()
305 |
306 | def create_chat_data(title="Chat Log"):
307 | """Create initial chat data structure"""
308 | return {
309 | "version": "1.0",
310 | "title": title,
311 | "created": datetime.datetime.now().isoformat(),
312 | "participants": [],
313 | "messages": []
314 | }
315 |
316 | def add_message_to_chat(chat_data, sender, message):
317 | """Add a message to the chat data"""
318 | timestamp = datetime.datetime.now().isoformat()
319 |
320 | if sender not in chat_data["participants"]:
321 | chat_data["participants"].append(sender)
322 |
323 | chat_data["messages"].append({
324 | "timestamp": timestamp,
325 | "sender": sender,
326 | "message": message
327 | })
328 |
329 | return chat_data
330 |
331 | def generate_key():
332 | """Generate a new AES-256 key"""
333 | return secrets.token_bytes(32)
334 |
335 | def save_key_to_file(key, filename):
336 | """Save AES key to file in base64 format"""
337 | with open(filename, 'wb') as f:
338 | f.write(base64.b64encode(key))
339 | print(f"[\033[32m+\033[0m] New encryption key saved to: {filename}")
340 |
341 | def load_key_from_file(filename):
342 | """Load AES key from file"""
343 | try:
344 | with open(filename, 'rb') as f:
345 | return base64.b64decode(f.read())
346 | except Exception as e:
347 | raise ValueError(f"Could not load key from {filename}: {e}")
348 |
349 | def derive_key_from_password(password, salt):
350 | """Derive AES key from password using Argon2id or Scrypt fallback"""
351 | if 'Cipher' not in globals():
352 | import_cryptography()
353 |
354 | if ARGON2_AVAILABLE:
355 | kdf = Argon2id(
356 | salt=salt,
357 | length=32,
358 | lanes=4,
359 | memory_cost=65536,
360 | iterations=3
361 | )
362 | else:
363 | kdf = Scrypt(
364 | salt=salt,
365 | length=32,
366 | n=2**15, # 32768
367 | r=8,
368 | p=1,
369 | backend=default_backend()
370 | )
371 | return kdf.derive(password.encode())
372 |
373 | def encrypt_data(data, key):
374 | """Encrypt text data using AES-256-GCM"""
375 | if 'Cipher' not in globals():
376 | import_cryptography()
377 |
378 | iv = secrets.token_bytes(12)
379 |
380 | cipher = Cipher(algorithms.AES(key), modes.GCM(iv), backend=default_backend())
381 | encryptor = cipher.encryptor()
382 | ciphertext = encryptor.update(data.encode()) + encryptor.finalize()
383 | encrypted_payload = iv + encryptor.tag + ciphertext
384 | return base64.b64encode(encrypted_payload).decode()
385 |
386 | def decrypt_data(encrypted_data, key):
387 | """Decrypt text data using AES-256-GCM"""
388 | if 'Cipher' not in globals():
389 | import_cryptography()
390 |
391 | try:
392 | encrypted_payload = base64.b64decode(encrypted_data.encode())
393 | iv = encrypted_payload[:12]
394 | auth_tag = encrypted_payload[12:28]
395 | ciphertext = encrypted_payload[28:]
396 | cipher = Cipher(algorithms.AES(key), modes.GCM(iv, auth_tag), backend=default_backend())
397 | decryptor = cipher.decryptor()
398 | plaintext = decryptor.update(ciphertext) + decryptor.finalize()
399 | return plaintext.decode()
400 |
401 | except Exception as e:
402 | raise ValueError(f"Decryption failed: {e}")
403 |
404 | def encrypt_file_data(data, key):
405 | """Encrypt binary file data using AES-256-GCM"""
406 | if 'Cipher' not in globals():
407 | import_cryptography()
408 |
409 | iv = secrets.token_bytes(12)
410 | cipher = Cipher(algorithms.AES(key), modes.GCM(iv), backend=default_backend())
411 | encryptor = cipher.encryptor()
412 | ciphertext = encryptor.update(data) + encryptor.finalize()
413 | encrypted_payload = iv + encryptor.tag + ciphertext
414 | return encrypted_payload
415 |
416 | def decrypt_file_data(encrypted_data, key):
417 | """Decrypt binary file data using AES-256-GCM"""
418 | if 'Cipher' not in globals():
419 | import_cryptography()
420 |
421 | try:
422 | iv = encrypted_data[:12]
423 | auth_tag = encrypted_data[12:28]
424 | ciphertext = encrypted_data[28:]
425 | cipher = Cipher(algorithms.AES(key), modes.GCM(iv, auth_tag), backend=default_backend())
426 | decryptor = cipher.decryptor()
427 | plaintext = decryptor.update(ciphertext) + decryptor.finalize()
428 | return plaintext
429 |
430 | except Exception as e:
431 | raise ValueError(f"File decryption failed: {e}")
432 |
433 | def parse_encryption_args(args):
434 | """Parse encryption arguments from command line"""
435 | key_file = None
436 | password = None
437 |
438 | for arg in args:
439 | if arg.startswith("--key="):
440 | key_file = arg.split("=", 1)[1]
441 | elif arg.startswith("--password="):
442 | password = arg.split("=", 1)[1]
443 |
444 | return key_file, password
445 |
446 | def get_encryption_key(key_file, password, create_if_missing=False):
447 | """Get encryption key from file or password"""
448 | if key_file and password:
449 | raise ValueError("Cannot specify both --key and --password options")
450 |
451 | if key_file:
452 | if os.path.exists(key_file):
453 | return load_key_from_file(key_file), None
454 | elif create_if_missing:
455 | key = generate_key()
456 | save_key_to_file(key, key_file)
457 | return key, None
458 | else:
459 | raise ValueError(f"Key file '{key_file}' not found")
460 |
461 | elif password:
462 | salt = secrets.token_bytes(16)
463 | key = derive_key_from_password(password, salt)
464 | return key, salt
465 |
466 | else:
467 | return None, None
468 |
469 | def format_chat_terminal(chat_data):
470 | """Format chat data for terminal display"""
471 | output = []
472 | output.append(f"\n[\033[36m*\033[0m] \033[1m{chat_data['title']}\033[0m")
473 | output.append(f"[\033[36m+\033[0m] Created: {chat_data['created']}")
474 | output.append(f"[\033[36m+\033[0m] Participants: {', '.join(chat_data['participants'])}")
475 | output.append(f"[\033[36m+\033[0m] Messages: {len(chat_data['messages'])}")
476 | output.append("\n" + "=" * 60)
477 |
478 | for msg in chat_data["messages"]:
479 | timestamp = datetime.datetime.fromisoformat(msg["timestamp"]).strftime("%Y-%m-%d %H:%M:%S")
480 | output.append(f"\n[\033[32m{timestamp}\033[0m] \033[1m{msg['sender']}\033[0m:")
481 | output.append(f" {msg['message']}")
482 |
483 | output.append("\n" + "=" * 60)
484 | return "\n".join(output)
485 |
486 | def format_chat_html(chat_data):
487 | """Format chat data as HTML"""
488 | html = f"""
489 |
490 |
491 | {chat_data['title']}
492 |
499 |
500 |
501 |
507 | """
508 |
509 | for msg in chat_data["messages"]:
510 | timestamp = datetime.datetime.fromisoformat(msg["timestamp"]).strftime("%Y-%m-%d %H:%M:%S")
511 | html += f"""
512 |
513 |
{timestamp}
514 |
{msg['sender']}:
515 |
{msg['message']}
516 |