Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 11-18-2013, 23:33
nikre's Avatar
nikre nikre is offline
VIP
 
Join Date: Sep 2011
Posts: 181
Rept. Given: 178
Rept. Rcvd 100 Times in 35 Posts
Thanks Given: 1
Thanks Rcvd at 9 Times in 9 Posts
nikre Reputation: 100-199 nikre Reputation: 100-199
need tool

hi all
anyone know tool which work with Word document .doc .docx in low level
sample how change author , title , some text in document w/o ms office ?
Reply With Quote
  #2  
Old 11-19-2013, 00:29
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 467
Rept. Given: 483
Rept. Rcvd 439 Times in 180 Posts
Thanks Given: 570
Thanks Rcvd at 163 Times in 102 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
If I understood your question: Open it with an hexadecimal editor, Winhex, FileInsight,.... and search for the word in the "title of the document" in "unicode" match, below you will find that you want to change.
Reply With Quote
  #3  
Old 11-20-2013, 00:17
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 179
Rept. Given: 36
Rept. Rcvd 54 Times in 24 Posts
Thanks Given: 48
Thanks Rcvd at 120 Times in 70 Posts
evlncrn8 Reputation: 54
docx/xlsx is a zip file, theres a file inside with the document info, which is a simple xml file
doc/xls is ole2 container style, quite exotic in its structure, but theres some source out there (libxl) for example that can process and retrieve the info, then i guess you could code something to scan for the strings found and zero them out...
Reply With Quote
The Following User Gave Reputation+1 to evlncrn8 For This Useful Post:
nikre (11-20-2013)
  #4  
Old 11-20-2013, 01:38
nikre's Avatar
nikre nikre is offline
VIP
 
Join Date: Sep 2011
Posts: 181
Rept. Given: 178
Rept. Rcvd 100 Times in 35 Posts
Thanks Given: 1
Thanks Rcvd at 9 Times in 9 Posts
nikre Reputation: 100-199 nikre Reputation: 100-199
@evlncrn8
yes it's true and not just edit in the hexeditor
but exist tool which work ?
Reply With Quote
  #5  
Old 11-20-2013, 03:02
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 467
Rept. Given: 483
Rept. Rcvd 439 Times in 180 Posts
Thanks Given: 570
Thanks Rcvd at 163 Times in 102 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Attach here any file that you have nikre and I will change what you want with a simple hexadecimal editor, doc,docx=zip file? Where? Maybe in mars planet?
Reply With Quote
  #6  
Old 11-20-2013, 04:47
nikre's Avatar
nikre nikre is offline
VIP
 
Join Date: Sep 2011
Posts: 181
Rept. Given: 178
Rept. Rcvd 100 Times in 35 Posts
Thanks Given: 1
Thanks Rcvd at 9 Times in 9 Posts
nikre Reputation: 100-199 nikre Reputation: 100-199
try change "test" to "exetools forum"
Attached Files
File Type: doc sample.doc (21.5 KB, 9 views)
Reply With Quote
  #7  
Old 11-20-2013, 06:32
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 467
Rept. Given: 483
Rept. Rcvd 439 Times in 180 Posts
Thanks Given: 570
Thanks Rcvd at 163 Times in 102 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Done:
You will see a character 0D in the end of the text, this character cannot be changed, only this. You can use to excel, power point.......
Attached Files
File Type: rar files.rar (166.0 KB, 4 views)
Reply With Quote
  #8  
Old 11-20-2013, 08:35
nikre's Avatar
nikre nikre is offline
VIP
 
Join Date: Sep 2011
Posts: 181
Rept. Given: 178
Rept. Rcvd 100 Times in 35 Posts
Thanks Given: 1
Thanks Rcvd at 9 Times in 9 Posts
nikre Reputation: 100-199 nikre Reputation: 100-199
it does not work bro
or I doing something wrong
see only "exeto" but were other part "ols forum" ?
Attached Files
File Type: doc your sample.doc (19.5 KB, 5 views)
Reply With Quote
  #9  
Old 11-20-2013, 15:46
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 467
Rept. Given: 483
Rept. Rcvd 439 Times in 180 Posts
Thanks Given: 570
Thanks Rcvd at 163 Times in 102 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
You are right Nikre and I'm wrong, sorry for you waste your time.
Reply With Quote
  #10  
Old 01-01-2014, 21:46
wangma wangma is offline
Friend
 
Join Date: Sep 2013
Posts: 8
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 1
Thanks Rcvd at 1 Time in 1 Post
wangma Reputation: 0
I don't know any tools about this yet.But I saw where the author part in the file.docx once.
If there is still no tools available,maybe you want to look into the docx structure and write the code.oh no..Anyway...
I found a link about the MS open XML document structure.It's basic but useful.
Link:http://www.learningace.com/doc/2914424/4b7732e3421746c6501e08dbf2524921/presentationml
You may want to look up ECMA-376(just a keyword) for knowing more about what the functions mean(called functions,is that correct?).
So how can we know where the author part is in the docx file...My suggestion is unpack it and Ctrl+F the keyword and look up ECMA-376.
I know~It sounds dump but it may be the fastest way for getting the work done if there is still no tools available.
Is there anyone knows more about the tools to resolve xml document?

Last edited by wangma; 01-01-2014 at 21:56.
Reply With Quote
  #11  
Old 01-01-2014, 23:09
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 179
Rept. Given: 36
Rept. Rcvd 54 Times in 24 Posts
Thanks Given: 48
Thanks Rcvd at 120 Times in 70 Posts
evlncrn8 Reputation: 54
Quote:
Originally Posted by wilson bibe View Post
Attach here any file that you have nikre and I will change what you want with a simple hexadecimal editor, doc,docx=zip file? Where? Maybe in mars planet?
docx = zip
xlsx = zip
doc = ole2 container
xls = ole 2 container

might be an idea to actually check before you comment eh? i guess we are all living on mars then
Reply With Quote
The Following User Gave Reputation+1 to evlncrn8 For This Useful Post:
Debugger (01-02-2014)
  #12  
Old 01-01-2014, 23:38
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 467
Rept. Given: 483
Rept. Rcvd 439 Times in 180 Posts
Thanks Given: 570
Thanks Rcvd at 163 Times in 102 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Quote:
Originally Posted by evlncrn8 View Post
docx = zip
xlsx = zip
doc = ole2 container
xls = ole 2 container

might be an idea to actually check before you comment eh? i guess we are all living on mars then
Not all but maybe you, if you look inside of the files with winhex you wll see some parts packed by PKZIP, and a lot of lines "with editable strings" did you know pkzip? I believe that not, so, continue with this discussion is waste of time, Good luck and Goodbye.
Reply With Quote
  #13  
Old 01-01-2014, 23:52
TechLord TechLord is offline
Banned User
 
Join Date: Mar 2005
Location: 10 Steps Ahead of You
Posts: 786
Rept. Given: 389
Rept. Rcvd 247 Times in 112 Posts
Thanks Given: 806
Thanks Rcvd at 2,064 Times in 595 Posts
TechLord Reputation: 200-299 TechLord Reputation: 200-299 TechLord Reputation: 200-299
This is what I did.

1. Create a .docx file with MS Word 2010, write dummy text in it and save it as example.docx.
2. Rename the .docx file to .zip. When Windows warns that changing extension of file may not make the program work, just agree.
3. Open the newly renamed example.zip file in Winrar. You can clearly see a lot of xml documents in the .zip file.
4. Find a folder named "word" in the zippped example.zip. It can be seen clearly in Winrar. In that "word" folder, can be seen an xml file named "document.xml".
Double-click on the document.xml file. This contains the text in the body of the word document . You can use the search function in notepad to find the text you want to change. Then change it, save it, and when it asks if you want to update in the archive, then agree.
5. Similarly, there is a folder called "docProps" in the created .zip file.
It contains the file "core.xml" in it.This file contains the author information etc. You can edit it and save it as the .zip file.
6. Finally, rename the .zip file to .docx again. Then you can open it again in MS-Word and you can see that the changes you made are visible in MS-Word.

This does not work with .doc files. Only with .docx files.

Hope this helps.
Reply With Quote
  #14  
Old 01-02-2014, 08:33
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 179
Rept. Given: 36
Rept. Rcvd 54 Times in 24 Posts
Thanks Given: 48
Thanks Rcvd at 120 Times in 70 Posts
evlncrn8 Reputation: 54
Quote:
Originally Posted by wilson bibe View Post
Not all but maybe you, if you look inside of the files with winhex you wll see some parts packed by PKZIP, and a lot of lines "with editable strings" did you know pkzip? I believe that not, so, continue with this discussion is waste of time, Good luck and Goodbye.
actually i do know pkzip, and its not officially a zip file, rather its using gzip / zlib as part of the open document format with an underlying OpenXML structure, also referred to as the open office format...

some editable strings being visible might be just because they didnt compress or are the actual filename structures...

and i have actually looked inside the files, i have numerous projects involving the xls / xlsx and doc / docx formats.. and im also very framiliar with compression formats.. so instead of trying to attack me based on your ignorance of the topic at hand, it might be a good idea to actually research and know what the hell you are actually talking about... but i guess im just a martian... also if you knew the zip format you would know that altering ANYTHING in the file will result in a checksum failure of the file content... go on.. try it...

research is a wonderful thing to expand knowledge.. ignorance and ego isnt....

heres a little helpful link -> http://en.wikipedia.org/wiki/Office_Open_XML
Reply With Quote
  #15  
Old 01-02-2014, 18:14
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 467
Rept. Given: 483
Rept. Rcvd 439 Times in 180 Posts
Thanks Given: 570
Thanks Rcvd at 163 Times in 102 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Quote:
Originally Posted by evlncrn8 View Post
actually i do know pkzip, and its not officially a zip file, rather its using gzip / zlib as part of the open document format with an underlying OpenXML structure, also referred to as the open office format...

some editable strings being visible might be just because they didnt compress or are the actual filename structures...

and i have actually looked inside the files, i have numerous projects involving the xls / xlsx and doc / docx formats.. and im also very framiliar with compression formats.. so instead of trying to attack me based on your ignorance of the topic at hand, it might be a good idea to actually research and know what the hell you are actually talking about... but i guess im just a martian... also if you knew the zip format you would know that altering ANYTHING in the file will result in a checksum failure of the file content... go on.. try it...

research is a wonderful thing to expand knowledge.. ignorance and ego isnt....

heres a little helpful link -> http://en.wikipedia.org/wiki/Office_Open_XML
Of Course, your packer detector, detect a .doc file like a .msi file, so, really research is a good idea for you, maybe RDGmax can help you in something....., this thread for me is dead ok?
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 15:57.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2022 )