A data steganography method, system and medium based on BPlist file carrier

Abstract

The present application proposes a data steganography method based on a BPlist file carrier, comprising: reading in a binary attribute list file; analyzing the data structure of the binary attribute list file: the binary attribute list file is composed of a file header, an object table, an offset table, and a file tail sequence; writing redundant data in at least one steganographic area in the binary attribute list file, thereby achieving the steganography of the redundant data, the steganographic area comprising: a critical area between the file header and the object table, a critical area between the object table and the offset table, a middle area of ​​the object table, and a spare byte area at the end of the file. The present application can write redundant data in multiple steganographic areas in a BPlist file, thereby achieving the purpose of hiding information without disrupting the browsing of the original BPlist file data.

Description

Technical Field

[0001] The present application relates to the technical field of data steganography, and in particular to a data steganography method, system and medium based on a BPlist file carrier. Background Art

[0002] Plist file is a unique file format that is often encountered in the process of iOS application development or iOS device forensics. As one of the solutions for system data persistence, this file format is very convenient and fast to use.

[0003] Plist, short for Property List, is a file used to store serialized objects. It comes in two formats: XML and binary (BPlist). The binary format is currently the most widely used. Figure 1 A specific hexadecimal data interface diagram of a Plist file is shown, wherein the upper half is a Plist file in XML format, and the lower half is a Plist file in binary format.

[0004] Modern steganography often uses images, audio, and video as carriers. Using a variety of methods, either singly or in combination, such as least significant bit (LBS), frequency domain steganography, DCT steganography, and data encryption, the desired text or file is hidden and written, achieving the purpose of concealed transmission. Binary Property List files (BPlists), a common file format for iOS devices, are often used to store basic device information and application configuration data. However, there are currently no steganographic methods using BPlist files as carriers on the market.

[0005] In view of this, it is particularly important to provide a data steganography method based on BPlist files. Summary of the Invention

[0006] In order to solve the above technical problems, the present application proposes a data steganography method, system and medium based on the BPlist file carrier.

[0007] According to the first aspect of the present application, a data steganography method based on a BPlist file carrier is proposed, comprising:

[0008] Read in a binary property list file;

[0009] Analyze the data structure of the binary attribute list file: the binary attribute list file consists of a file header, an object table, an offset table, and a file tail in sequence;

[0010] Redundant data is written into at least one steganographic area in the binary attribute list file to achieve steganography of the redundant data. The steganographic area includes: a critical area between the file header and the object table, a critical area between the object table and the offset table, a middle area of ​​the object table, and a spare byte area at the end of the file.

[0011] Preferably, performing data steganography in the critical area between the file header and the object table specifically includes: writing the redundant data in the critical area between the file header and the object table, and simultaneously modifying the index value in the offset table and the starting index of the offset table in the file tail.

[0012] Preferably, performing data steganography in the critical area of ​​the object table and the offset table specifically includes: writing the redundant data in the critical area of ​​the object table and the offset table, and modifying the starting index of the offset table in the file tail.

[0013] Preferably, performing data steganography in the middle area of ​​the object table specifically includes: writing the redundant data in the middle area of ​​the object table, and simultaneously modifying the index value of the affected element in the offset table and the starting index of the offset table in the file tail.

[0014] Preferably, performing data steganography in the spare byte area at the end of the file specifically includes: modifying the spare bytes in the spare byte area at the end of the file into the redundant data.

[0015] Preferably, after the redundant data steganography is completed, the redundant data is encrypted using an encryption algorithm.

[0016] Preferably, the redundant data includes text and / or files.

[0017] According to the second aspect of the present application, a data steganography system based on a BPlist file carrier is proposed, comprising:

[0018] The reading unit is configured to read the binary attribute list file;

[0019] An analyzing unit configured to analyze a data structure of the binary attribute list file: the binary attribute list file is composed of a file header, an object table, an offset table, and a file footer in sequence;

[0020] A data steganography unit is configured to write redundant data into at least one steganographic area in the binary attribute list file, thereby realizing the steganography of the redundant data, wherein the steganographic area includes: a critical area between the file header and the object table, a critical area between the object table and the offset table, a middle area of ​​the object table, and a spare byte area at the end of the file.

[0021] According to the third aspect of the present application, a computer-readable storage medium is proposed, which stores a computer program. When the computer program is executed by a processor, it implements the data steganography method based on the BPlist file carrier as described in the first aspect of the present application.

[0022] This application proposes a data steganography method, system, and medium based on a BPlist file. By analyzing the data structure of a BPlist file, four steganographic regions within the file are identified for data steganography. Data is written into these regions, and an encryption algorithm is used to enhance security and concealment. This method achieves the goal of hiding data without disrupting the browsing of the original BPlist file data. This application supports the concealed transmission of text and files, complementing modern steganography techniques with high practicality and application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and, together with the description, serve to explain the principles of the present application. Other embodiments and many of the expected advantages of the embodiments will be readily apparent as they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with respect to each other. Like reference numerals designate corresponding similar parts.

[0024] Figure 1 It is a hexadecimal data interface diagram of a specific Plist file;

[0025] Figure 2 This is a flow chart of a data steganography method based on a BPlist file carrier according to an embodiment of the present application;

[0026] Figure 3 is a data composition diagram of a BPlist file according to an embodiment of the present application;

[0027] Figure 4 This is a diagram of the original data browsing interface and hexadecimal data interface of a sample file according to a specific embodiment of the present application;

[0028] Figure 5 This is a data interface diagram for performing data steganography in the critical area between the file header and the object table according to a specific embodiment of the present application;

[0029] Figure 6 This is a data interface diagram for performing data steganography in a critical area of ​​an object table and an offset table according to a specific embodiment of the present application;

[0030] Figure 7This is a data interface diagram for performing data steganography in the middle area of ​​an object table according to a specific embodiment of the present application;

[0031] Figure 8 This is a data interface diagram for performing data steganography in the spare byte area at the end of a file according to a specific embodiment of the present application;

[0032] Figure 9 This is a diagram showing the effect of combining steganographic data with an encryption algorithm in the critical area of ​​the object table and the offset table according to a specific embodiment of the present application;

[0033] Figure 10 This is a diagram showing the effect of combining steganographic data with an encryption algorithm in the critical area of ​​the object table and the offset table according to another specific embodiment of the present application;

[0034] Figure 11 It is a block diagram of a data steganography system based on a BPlist file carrier according to an embodiment of the present application.

[0035] Explanation of the accompanying symbols: 1. Reading unit; 2. Analysis unit; 3. Data steganography unit. DETAILED DESCRIPTION

[0036] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0037] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of additional identical elements in the process, method, article, or device comprising the elements.

[0038] According to the first aspect of the present application, a data steganography method based on a BPlist file carrier is proposed. Figure 2 The flowchart of the data steganography method based on the BPlist file carrier according to the embodiment of the present application is shown as follows: Figure 2 As shown, the method includes the following steps:

[0039] S1. Read in the binary attribute list file.

[0040] S2. Analyze the data structure of the binary attribute list file: The binary attribute list file consists of a file header, an object table, an offset table, and a file tail in sequence.

[0041] Figure 3 The data composition diagram of the BPlist file according to the embodiment of the present application is shown as follows: Figure 3 As shown, in a specific embodiment, each binary property list file (BPlist file) consists of four parts, which are, in order, a file header (Header), an object table (Object Table), an offset table (Offset Table), and a file tail (Tail), where the file header is the first 8 bytes and the file tail is the last 32 bytes.

[0042] S3. Redundant data is written into at least one steganographic area in the binary attribute list file, thereby achieving steganography of the redundant data. The steganographic areas include: a critical area between the file header and the object table, a critical area between the object table and the offset table, a middle area of ​​the object table, and a spare byte area at the end of the file.

[0043] In a specific embodiment, the redundant data may be text and / or files.

[0044] In a specific embodiment, when browsing BPlist file data, the file type is first identified through the 8 bytes of the file header, and then the offset table starting index (Offset Table Index), the number of elements in the offset table (Element Count), the integer byte length (Element Length) in the offset table, and the integer value length (Integer Length) of the object table defined in the 32 bytes of the file tail are combined with the element indexes written in the offset table to iterate and retrieve the corresponding data from the object table.

[0045] From the above data interpretation steps, it can be seen that the file header and file tail (except for the spare byte area at the end of the file) cannot be used to write redundant data. However, the data is iterated by starting the offset table index, and then the index of the element in the offset table is used to retrieve the data from the object table. This creates a loophole that can be exploited. Therefore, this application is to find four steganographic areas in the BPlist file to write redundant data, thereby realizing the steganography of redundant data. These four steganographic areas are: the critical area between the file header and the object table, the critical area between the object table and the offset table, the middle area of ​​the object table, and the spare byte area at the end of the file.

[0046] Figure 4 The original data browsing interface and hexadecimal data interface of a sample file according to a specific embodiment of the present application are shown as follows: Figure 4 As shown, the first 8 bytes of the file (62 70 6C 69 73 74 30 30) are the file header, the 9th to 46th bytes (D1 01 02 5F 10 13 4E 53 48 54 54 50 41 63 63 65 70 74 43 6F 6F 6B69 65 73 5C 63 75 72 72 65 6E 74 20 70 61 67 65) are the object table, the 47th to 79th bytes (08 0B21) are the offset table, and the last 32 bytes (00 00 00 00 00 00 01 01 00 00 00 00 00 00 03 00 0000 00 The first six bytes of the file tail (0000 00 00 00 00 00) are the spare byte area. The following describes how to steganographically write redundant data in the four steganographic areas of the BPlist file.

[0047] 1. Data steganography in the critical area between the file header and the object table

[0048] Figure 5 A data interface diagram showing data steganography in the critical area of ​​the file header and the object table according to a specific embodiment of the present application is shown. Figure 5 As shown, a piece of redundant data is written in the critical area between the file header and the object table (for example, the plain text "Hello World!", corresponding to Figure 5 The white-shaded bytes (bytes 48, 65, 6C, 6C, 6F, 20, 57, 6F, 72, 6C, 64, 21) are modified. The index value in the offset table (08, 0B, 21 → 14, 17, 2D) and the starting index of the offset table (2E → 3A) at the end of the file are also modified. After this modification, the data browsing interface of the BPlist file is exactly the same as the original file, indicating successful data steganography.

[0049] 2. Data steganography in the critical area of ​​the object table and offset table

[0050] Figure 6 FIG. 1 shows a data interface diagram for performing data steganography in the critical area of ​​the object table and the offset table according to a specific embodiment of the present application. Figure 6 As shown, a piece of redundant data is written in the critical area of ​​the object table and the offset table (for example, the plain text "Hello World!", corresponding to Figure 6 The white-shaded bytes (bytes 48, 65, 6C, 6C, 6F, 20, 57, 6F, 72, 6C, 64, 21) are modified, and the offset table starting index at the end of the file is changed (2E→3A). After the modification, the data browsing interface of the BPlist file is exactly the same as the original file, indicating that the data steganography was successful.

[0051] 3. Data steganography in the middle area of ​​the object table

[0052] Figure 7 FIG. 1 shows a data interface diagram for performing data steganography in the middle area of ​​an object table according to a specific embodiment of the present application, as shown in FIG. Figure 7 As shown, a redundant data is written in the middle area of ​​the object table (for example, the plain text "Hello World!", corresponding to Figure 7 The white-shaded bytes (bytes 48, 65, 6C, 6C, 6F, 20, 57, 6F, 72, 6C, 64, and 21) are modified. The index of the affected element in the offset table (21 → 2D) and the starting index of the offset table in the file's tail (2E → 3A) are also modified. After the modification, the BPlist file's data browsing interface is identical to the original file, demonstrating successful data steganography.

[0053] 4. Data steganography in the spare byte area at the end of the file

[0054] Figure 8 FIG. 1 shows a data interface diagram for performing data steganography in the spare byte area at the end of a file according to a specific embodiment of the present application, as shown in FIG. Figure 8 As shown in the figure, the spare bytes in the spare byte area at the end of the file are modified to a piece of redundant data (for example, the plain text "Hello World!"). This area can steganographically write up to 6 bytes of data, namely 00 00 00 00 00 00 → 48 65 6C 6C 6F 21). After the modification, the data browsing interface of the BPlist file is exactly the same as the original file, and the data steganography is successful.

[0055] In a preferred embodiment, in order to improve the concealment effect of redundant data, after the redundant data steganography is completed, the redundant data is encrypted using an encryption algorithm.

[0056] Figure 9 The effect diagram of the steganographic data in the critical area of ​​the object table and the offset table combined with the encryption algorithm according to a specific embodiment of the present application is shown as follows: Figure 9 As shown, the text "Hello World!" is steganographically encrypted ( Figure 9 (The shaded part in the middle) "Hello World!" becomes garbled text and is successfully hidden.

[0057] Figure 10 FIG shows the effect of combining the steganographic data in the critical area of ​​the object table and the offset table with the encryption algorithm according to another specific embodiment of the present application, as shown in FIG. Figure 10 As shown, a file 123.txt is steganographically encrypted ( Figure 10 The file 123.txt becomes garbled text and is successfully hidden.

[0058] In summary, this application proposes a data steganography method based on the BPlist file carrier, which has the following beneficial effects: by analyzing the data structure of the BPlist file, finding four steganographic areas in the BPlist file where data can be steganographic, writing redundant data in the steganographic areas, and coordinating with the encryption algorithm to improve security and concealment, and achieving the purpose of hiding data without destroying the browsing of the original BPlist file data. This application supports the hidden transmission of text and files, complements modern steganography, is highly practical, and has high application value.

[0059] According to the second aspect of the present application, a data steganography system based on a BPlist file carrier is proposed. The data steganography system is built based on the above-mentioned data steganography method. Figure 11 A block diagram of a data steganography system based on a BPlist file carrier according to an embodiment of the present application is shown. Figure 11 As shown, the system includes:

[0060] Reading unit 1, configured to read a binary attribute list file;

[0061] Analysis unit 2 is configured to analyze the data structure of a binary attribute list file: a binary attribute list file is composed of a file header, an object table, an offset table, and a file footer in sequence;

[0062] The data steganography unit 3 is configured to write redundant data in at least one steganographic area in the binary attribute list file, thereby realizing the steganography of redundant data. The steganographic areas include: the critical area between the file header and the object table, the critical area between the object table and the offset table, the middle area of ​​the object table, and the spare byte area at the end of the file.

[0063] According to a third aspect of the present application, a computer-readable storage medium is proposed, which stores a computer program. When the computer program is executed by a processor, it implements the data steganography method based on the BPlist file carrier of the first aspect of the present application.

[0064] This application proposes a data steganography method, system and medium based on BPlist file carrier.

[0065] In the embodiments of the present application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device / system / method embodiments described above are merely schematic. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0066] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0067] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0068] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0069] Obviously, those skilled in the art can make various modifications and changes to the embodiments of the present application without departing from the spirit and scope of the present application. In this way, if these modifications and changes are within the scope of the claims of the present application and their equivalents, the present application is also intended to cover these modifications and changes. The word "comprising" does not exclude the presence of other elements or steps not listed in the claims. The simple fact that certain measures are recited in mutually different dependent claims does not indicate that the combination of these measures cannot be used to advantage. Any reference signs in the claims should not be considered as limiting the scope.

Claims

1. A data steganography method based on BPlist file carrier, characterized in that: include: Read the binary attribute BPlist list file. When browsing the BPlist file data, first identify the file type through the 8 bytes of the file header, then use the offset table starting index, the number of elements in the offset table, the integer byte length in the offset table, and the integer value length of the object table defined in the 32 bytes of the file tail, combined with the index of each element written in the offset table, to iterate and retrieve the corresponding data from the object table; Analyze the data structure of the BPlist list file of the binary attribute: the BPlist list file of the binary attribute consists of a file header, an object table, an offset table and a file tail in sequence; Redundant data is written into at least one steganographic area in the BPlist list file of the binary attribute, thereby realizing the steganography of the redundant data. The steganographic area includes: the critical area between the file header and the object table, the critical area between the object table and the offset table, the middle area of ​​the object table, and the spare byte area at the end of the file.

2. The method according to claim 1, characterized in that Performing data steganography in the critical area between the file header and the object table specifically includes: writing the redundant data in the critical area between the file header and the object table, and modifying the index value in the offset table and the starting index of the offset table in the file tail.

3. The method according to claim 1, characterized in that Performing data steganography in the critical area of ​​the object table and the offset table specifically includes: writing the redundant data in the critical area of ​​the object table and the offset table, and modifying the starting index of the offset table in the file tail.

4. The method according to claim 1, wherein Performing data steganography in the middle area of ​​the object table specifically includes: writing the redundant data in the middle area of ​​the object table, and modifying the index value of the affected element in the offset table and the starting index of the offset table in the file tail.

5. The method according to claim 1, wherein Performing data steganography in the spare byte area at the end of the file specifically includes: modifying the spare bytes in the spare byte area at the end of the file into the redundant data.

6. The method according to claim 1, characterized in that After the redundant data is steganographically written, the redundant data is encrypted using an encryption algorithm.

7. The method according to claim 1, characterized in that The redundant data includes text and / or files.

8. A data steganography system based on BPlist file carrier, characterized in that: include: The reading unit is configured to read the BPlist list file of binary attributes. When browsing the BPlist file data, the file type is first identified by the 8 bytes of the file header, and then the offset table starting index, the number of elements in the offset table, the integer byte length in the offset table, and the integer value length of the object table defined in the 32 bytes of the file tail are combined with the index of each element written in the offset table to iteratively retrieve the corresponding data from the object table; An analyzing unit configured to analyze a data structure of the BPlist file of the binary attribute: the BPlist file of the binary attribute consists of a file header, an object table, an offset table and a file tail in sequence; A data steganography unit is configured to write redundant data in at least one steganographic area in the BPlist list file of the binary attribute, thereby realizing the steganography of the redundant data, wherein the steganographic area includes: a critical area between the file header and the object table, a critical area between the object table and the offset table, a middle area of ​​the object table, and a spare byte area at the end of the file.

9. A computer-readable storage medium storing a computer program, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by a processor.

Images