Copyright: Copyright 1996 Andy Brown


Contents

How to...

Get started with S-Tools

Open a sound file

Open a picture file

Hide data in a sound

Hide data in a picture

Reveal a hidden file

Customise file compression

Contact the author

In depth topics...

What is steganography?

How S-Tools hides your data

How data is hidden in sounds

How data is hidden in pictures

Credits and other stuff


Getting started with S-Tools

In order to use S-Tools you will also need to run either the Windows Explorer or File Manager, whichever is your favourite.  Arrange it on your desktop so you can see it and S-Tools at the same time.

Whenever you want to open a file, such as a picture or sound, just locate it in the Explorer and drag it over to the S-Tools Window.  It's as easy as that.

When you want to hide some files in an object that S-Tools is displaying, just select them (there can be more than one) using the Explorer then drag them over the open window in S-Tools.

If you want to manipulate an object in some way, perhaps to find information about it or to attempt to reveal data from it, press the right mouse button over the object and use the context menu that appears.


Opening a sound file

Use the Windows Explorer to locate the sound file that you want to open and simply drag it over an empty space in the S-Tools Window.  Do ensure that you let go of the file over an empty space otherwise S-Tools will think that you want to hide the file in the object below the mouse pointer.

S-Tools only knows about WAV files and will complain if you try to open other types of sound files.

Click on an area of the picture to find out more about it.  Remember that you can manipulate the sound file by pressing the right button over the open window.

See also

Saving a sound file

Sound properties


Opening a picture file

Use the Windows Explorer to locate the picture file that you want to open and simply drag it over an empty space in the S-Tools Window.  Do ensure that you let go of the file over an empty space otherwise S-Tools will think that you want to hide the file in the object below the mouse pointer.

S-Tools only knows about BMP and GIF files and will complain if you try to open other types of picture files.

Note: GIF files can have advanced features such as multiple images (used for animation) and transparent colours (used in web pages).  S-Tools will quite happily read these files but those advanced features will be lost when the file is saved back to disk.

See also

Saving a picture

Picture properties


Hiding data in a sound

Use the Windows Explorer to select all the files that you would like to hide and simply drag them over the open sound file that you want to hide them in and let go.

If you have opted to compress the files then there may be a short pause whilst compression takes place.  After checking that there is enough space in the sound to hold the hidden data you will be presented with the security dialog that is used to choose the level and type of protection you require for your hidden data.

Finally, the hiding process will start and you can check on its progress by watching the Actions window.  You are completely free to do other things whilst the hiding is taking place, including hiding other files in the same sound.  When the hiding process is complete, another sound window will appear that you can use to play back the sound to prove to yourself that it still sounds the same as the original.

See also

Saving a sound file

Revealing hidden data

How data is hidden in sounds


Saving a sound file

Click the right mouse button over the sound file that you want to save.  Choose either the "Save" or "Save as..." menu option to save the sound to disk.  The "Save" option saves the sound with same filename as you used to open it, the "Save as..." option will display a dialog box that you can use to choose a new name for the sound.


Saving a picture file

Click the right mouse button over the picture file that you want to save.  Choose either the "Save" or "Save as..." menu option to save the sound to disk.  The "Save" option saves the picture with same filename as you used to open it, the "Save as..." option will display a dialog box that you can use to choose a new name for the picture.

Note:  If you choose a new name for the picture, be sure that the filename ends in either .BMP or .GIF (capital letters or lower case, it does not matter).  S-Tools looks at this part of the filename to decide whether to save the picture as a BMP or GIF file.


The security dialog

The security dialog is displayed by S-Tools whenever you are hiding or revealing a file.

When hiding a file you must choose a passphrase and an encryption algorithm to use.  Remember this passphrase carefully because without it there is no chance of you being able to reveal your hidden data.  If you don't understand the difference between the encryption algorithms on offer then don't worry, they are all very strong.

When you come to reveal hidden data you must get both the passphrase and the encryption algorithm right or you will not be able to reveal anything.


The actions window

The actions window is where S-Tools displays all the tasks that it is currently working on.

S-Tools is a multi-threaded program.  It assigns one thread to each task that you start, which may be either hiding or revealing data.  You can have as many tasks as you want all running simultaneously, all protected from interfering both from each other and from the data in the S-Tools main workspace.

Each task that is running 'knows' what it should do when it finishes.  For 'Hiding' tasks this will involve a copy of the original data appearing with your files hidden in it.  'Reveal' tasks will display a window with names of the revealed files in it.

When you quit from S-Tools all active tasks are automatically killed.


Revealing a hidden file

Position the mouse pointer over the object that you would like to reveal data from and press the right button.  Choose the "Reveal..." option from the context-menu that appears.  The "Reveal..." option will always appear on the menu regardless of whether or not there is data hidden in the object.  This is because there is no way for S-Tools to tell if you've got any data hidden in there until you try to reveal something.

The security dialog will appear and you must enter the same passphrase and encryption algorithm that was used to hide the data in the first place.

Whether you get these details correct or not, the reveal task will appear in the Actions window for you to check on its progress.  If you get the passphrase wrong then S-Tools will only briefly display the task before automatically and quietly killing it.  If you get it right then you can monitor the progress of the task before it completes and a revealed archive window appears.


The archive window

The archive window is displayed by S-Tools when a reveal task has successfully completed.

The archive window has a context-menu that you can access with the right mouse button.  For example, to save a file to disk from the revealed archive you need only select it with the left button, click the right button to get a context menu and choose "Save as...".


Hiding data in a picture

Use the Windows Explorer to select all the files that you would like to hide and simply drag them over the open picture file that you want to hide them in and let go.

If you have opted to compress the files then there may be a short pause whilst compression takes place.  After checking that there is enough space in the picture to hold the hidden data you will be presented with the security dialog that is used to choose the level and type of protection you require for your hidden data.

When you have chosen your desired security options the following dialog will appear in which you can choose how S-Tools processes your picture during the hiding process.

Click on an area of the picture to learn more about it.

Finally, the hiding process will start and you can check on its progress by watching the Actions window.  You are completely free to do other things whilst the hiding is taking place, including hiding other files in the same picture.  When the hiding process is complete, another picture window will appear that you can use to prove to yourself that it still looks the same as the original.

See also

Saving a picture file

Revealing hidden data

How data is hidden in pictures


popup_SoundPanel
The sound wave form is displayed in this area.  You can visually check the shape of a wave that contains hidden data to see if it looks too different from the original.


popup_PlaySound
This button will play the sound.  Naturally only one sound can be played at a time so S-Tools will disable the play button on all other sound windows until the sound has finished playing.  You must have a suitable Windows sound driver installed to be able to play sounds.


popup_StopSound
This button causes the sound that is currently playing to stop immediately.


popup_SoundScroll
You can use this slider to adjust the portion of the sound wave that is currently displayed in the window.


popup_Convert24
The images will be converted to a 24 bit image and will remain that way.  There will be no loss of image detail but the resulting file will be quite large.  If you only have a 256 colour Windows display driver installed then the resulting image may look strange.  This is perfectly normal and you should use a dedicated painting package to view the bitmap.  Note that 24 bit images cannot be saved as GIF files.


popup_ReduceColours
This option causes S-Tools to reduce the number of colours in the picture by the minimum amount necessary to hold the data you are hiding.  This option takes longer to process but the resulting picture may be saved as either a GIF or BMP file with 256 colours.


Advanced picture options

The quantisation method used by S-Tools to reduce the number of colours in an image has some customisable parameters.  You can use the options in the following dialog to alter its default behaviour.

Click on an area of the dialog to learn more about it.

See also

How data is hidden in pictures


popup_BoxColour
This option governs how a colour is chosen for each 'box' that the algorithm generates.  You can choose the centre of the box (ignoring the box structure), the average box colour (recommended by Heckbert in his paper), or the average pixels in the box.


popup_Dimension
This option allows you to specify how the largest dimension is chosen.  Either the range in RGB space can be chosen, or you can compare luminosities.


popup_Dithering
This option as nothing to do with the colourmap generator.  It is used to dither the image as it is converted to the new colourmap.  Selecting this option (recommended) results in a final image with much better definition than without dithering.  The drawback is that dithering introduces many more colours into the image than it originally had, and this slows down the mapping of the old colours to the new ones.  In my opinion this is a price worth paying for the extra quality.


popup_SecurityTitle
The title bar of the security dialog reflects the action that you are trying to perform.  When hiding data it is sometimes useful to see how well the files that you are hiding have compressed.


popup_SecurityPass
Type the passphrase that you want to use into this box.  The passphrase can be as long as you like, and the longer the better.


popup_SecurityPass2
You must type your passphrase again in this box so that S-Tools can be sure that you didn't make any typing errors.  The OK button will not enable itself until both passphrases match up.


popup_SecurityAlg
Choose the encryption algorithm that you want to use from this list.  At the time of writing there are no known practical attacks on any of the algorithms that are presented here.


popup_RevealName
This is the name of the revealed file.  If you want to see the full pathname then you should use the context menu available by clicking the right button.  The "Properties..." option will tell you what you want to know.


popup_RevealSize
This is the original size of the file.  If the file was stored compressed then you can find out its compressed size by using the context menu available by clicking the right button.  The "Properties..." option will tell you what you want to know.


How data is hidden in pictures

All computer based pictures are composed of an array of dots, called pixels, that make up a very fine grid.  Each one of these pixels has its own colour, represented internally as separate quantities of red, green and blue.  Within Windows, each of these colour levels may range between 0 (none of the colour) and 255 (a full amount of the colour).  A pixel with an RGB value of 0 0 0 is black, and one with a value of 255 255 255 is white.

S-Tools works by 'spreading' the bit-pattern of the file that you want to hide across the least-significant bits (LSB's) of the colour levels in the image.

For a 24 bit image this is simple because 24 bit images are stored internally as RGB triples, and all we need to do is spread our bits and save out the new file.  The drawback to this is that 24 bit images are uncommon at the moment, and would therefore attract the attention of those whose attention you are trying to avoid attracting!  They are also very large as they contain 3 bytes for every pixel (for a 640x480 image this is 640x480x3=921600 bytes).

It is considerably more difficult to hide anything within a 256 colour image.  This is because the image may already have over 200 colours which our meddling will carry to way over the absolute maximum of 256.

Looking at a little theory it is easy to see that an image with 32 or less colours will never exceed 256 colours, no matter how much we meddle with it.  To see this, visualise the 3 LSB's of an RGB triple as a 3-bit number.  As we pass through it in our hiding process we can change it to any one of 8 possible values, the binary digits from 000 to 111, one of which is the original pattern.  If one colour can 'expand' to up to 8 colours, how many distinct colours can we have before we are in danger of exceeding the limit of 256?  Simple, 256/8=32 colours.  There is no guarantee that 32 colours is our upper limit for every file that you want to hide though. If you're lucky the file will not change a colour to all of its 8 possible combinations and then we are able to keep one more of the original colours.  In practice, however, you will often find pictures being reduced to the minimum of 32 colours.

S-Tools tries to reduce the number of image colours in a manner that preserves as much of the image detail as possible. It usually makes a very good job too, I can often not tell the difference between a 256 colour scanned image and one reduced to 32.

The actual colour reduction algorithm is the one used in the ppmquant program, a part of the pbmplus graphics toolkit. It is based on a median-cut colourmap generator from Paul Heckbert's paper Colour Image Quantization for Frame Buffer Display, SIGGRAPH '82 Proceedings, page 297.  The advanced picture hiding options allow you to tune to the behaviour of this algorithm to your taste.  You will, however, require a knowledge of how it works to use these options effectively.


How data is hidden in sounds

Sound samples are, by their very nature, inaccurate estimates of the correct value of the sound wave at a particular moment in time. The sound samples in Windows WAV files are stored as either 8 or 16 bit values that eventually get passed to the DA convertor in your sound board. For 8 bit samples this means that the values can range between 0 and 255. 16 bit samples range between 0 and 65535.

All S-Tools does is to distribute the bit-pattern that corresponds to the file that you want to hide across the least significant bits of the sound sample.

For example, suppose that a sound sample had the following eight bytes of information in it somewhere:

132	134	137	141	121	101	74	38

In binary, this is:

10000100  10000110  10001001  10001101  01111001  01100101  01001010  00100110

(LSB of each byte shown in red)

Suppose that we want to hide the binary byte 11010101 (213) inside this sequence. We simply replace the LSB (Least Significant bit) of each sample byte with the corresponding bit from the byte we are trying to hide. So the above sequence will change to:

133      135      136       141      120      101      74       39

In binary, this is:

10000101  10000111  10001000  10001101  01111000  01100101  01001010  00100111

As you can clearly see, the values of the sound samples have changed by, at most, one value either way. This will be inaudible to the human ear, yet we have concealed 8 bits of information within the sample. This is the theory behind how S-Tools does its job.


What is steganography?

Since the advent of computers there has been a vast dissemination of information, some of which needs to be kept private, some of which does not.  S-Tools (Steganography Tools) brings you the capability of concealing files within various forms of data.  The key to most applications of steganography is digital data, such as a scanned image, or a sampled sound.  Most computer data has to be 100% accurate in order to function correctly, but digitally sampled data need not be.  By making subtle alterations to sampled data it is possible to conceal information whilst retaining nearly all the content of the original sample.

Users of S-Tools can opt to encrypt their information using the strongest state-of-the-art encryption algorithms currently known within the academic world, so that even an enemy equipped with a copy of S-Tools cannot be completely sure data is hidden unless he has your secret passphrase.

You could use S-Tools to conceal private or confidential information that you don't want to fall into the wrong hands.  You could use it to send information to another individual via a broadcast network such as Usenet.  By agreeing on a passphrase you can keep the information out of unauthorised hands.  Alternatively you could use S-Tools to verify your copyright over an image by storing an encrypted copyright statement in the graphic and extracting it in the event of a dispute.

In short, S-Tools allows you to place private information in an inconspicuous 'envelope' that will not arouse suspicion.


How S-Tools hides your data

You may have noticed whilst using S-Tools that you can hide multiple files in one object.  The question I'll answer here is how S-Tools processes these files before hiding them.

If you have selected compression then the files are individually compressed and stored together with their names.  If you are not using compression then just the raw file data is stored along with the names.  Then S-Tools prepends some random garbage on to the front of the data in order to prevent two identical sets of files encrypting the same.  The whole lot is then encrypted using the passphrase that you chose to generate the key (actually, MD5 is used to hash the passphrase down to 128 evenly distributed key bits).  The encryption algorithms all operate in Cipher Feedback Mode (CFB).

It would be too easy to hide the data by just spreading it across the available bits in a linear fashion, so S-Tools seeds a cryptographically strong pseudo-random number generator from your passphrase and uses its output in order to choose the position of the next bit from the cover data to use.

For instance, if your sound file had 100 bits available for hiding, and you wanted to hide 10 bits in it, then S-Tools would not choose bits 0 through 9 as that would be trivially detectable by a potential enemy.  Instead it might choose bits 63, 32, 89, 2, 53, 21, 35, 44, 99, 80.  Or it might choose any ten others, it all depends on the passphrase that you enter.  As you can see, the job of a potential enemy has just become very difficult indeed.

See also

How data is hidden in sounds

How data is hidden in pictures


Contacting the author

I can be reached by email at a.brown@nexor.co.uk, though do bear in mind that this is my work address and as such I may not be able to reply until after office hours.

If you would like a copy of the S-Tools source code then please write to me at the following address, enclosing either a UK cheque, cash (sent at your own risk), international money order or travellers cheque (in pounds sterling) for the sum of 20 pounds sterling.  In return I'll mail you a copy of the source code on 3.5" disk.  In order to understand it you will need to know C++ and be familiar with the Microsoft Foundation Classes.  A project files is included for Visual C++ 4 users.

Andrew Brown

28 Ashburn Drive

Wetherby

West Yorkshire

LS22 5RD

United Kingdom


Credits and other stuff

Credit where credit is due

The compression routines are contained within ZLIB.DLL and are written by Jean-loup Gailly and Mark Adler.  zlib is freely available from Internet ftp sites.

The cryptographic routines are contained in CRYPTLIB.DLL  Together they form the cryptlib library which contains code written by Peter Gutmann, Eric Young and Colin Plumb.  cryptlib is freely available from Internet ftp sites.

Other information

S-Tools version 4 is not compatible with earlier versions.  You cannot reveal files hidden using earlier version of S-Tools, and vice-versa.

During testing I have managed to cause one of the compression code to crash, though it is unclear whether it was caused by my code or the compression library.  If you run into such problems then use the File, Properties menu option to switch off compression.

Note that S-Tools makes no attempt to correctly display 24-bit images on 256 colour displays.  If you open such an image you will notice that it has strange colours.  Do not worry, this is normal.  Other dedicated painting/image display programs will display the image correctly.  You will not notice this effect if you are using a display with 64K or 16M colours.

Copyright

Copyright 1996 Andrew Brown.  You may copy and distribute this program freely within the national laws of your country.  Please be aware that S-Tools contains strong cryptographic routines which some countries place distribution and/or use restrictions upon.  Always verify that you are allowed to use/distribute S-Tools before doing so.


Customising file compresion

S-Tools allows you to enable/disable the compression the files that you are hiding, and also to set the level of the compression that is used.  Use the File, Properties menu option to display the following dialog box.

Click on an area of the dialog box to learn more about it.


popup_EnableCompression
If this box is checked then S-Tools will compress files that you hide, using the compression level you choose with the slider bar below.


popup_CompressionLevel
This slider controls the level of compression that S-Tools will apply to your files.  Less compression results in faster operation, more compression slows things down a bit but results in smaller files.  You should always use compression if you can since it limits redundancy in your data and makes the job of a cryptanalyst (your enemy) more difficult.


Sound file properties

The sound file properties dialog is accessed by pressing the right button over a sound file window and selecting the "Properties" option from the context menu that appears.

Click on an area of the picture to learn more about it.


popup_WAVchannels
A sound file may be either mono or stereo.  S-Tools does not support sounds that have more than 2 channels.


popup_WAVfreq
This is the frequency at which the sound was sampled when it was recorded.  The higher the frequency the better quality the sound, but the more disk and memory space it will occupy.


popup_WAVbits
This is the resolution of the sample.  S-Tools supports both 8 and 16 bit samples.  16 bit samples have the potential of being much better quality than 8 bit samples, but will occupy more disk and memory space.


Picture properties

The picture properties dialog is accessed by pressing the right button over a picture window and selecting the "Properties" option from the context menu that appears.

Click on an area of the picture to learn more about it.


popup_BMPsize
This is the size of the picture, in pixels.


popup_DIBbpp
The number of bits-per-pixel indicates the number of colours in the image as follows:

1 - monochrome

4 - 16 colours

8 - 256 colours

16 - 65536 colours (not supported by S-Tools)

24 - 16 million colours

32 - 4 billion colours (not supported by S-Tools)


popup_BMPmemory
This indicates the number of memory bytes used by the picture.


popup_BMPcomp
This indicates the type of compression used by the image.  The only mode not supported by S-Tools is RLE-4, which can occur on 16 colour pictures.  If you get a file of this type then you should use an image editor to save it out with another compression mode.


Archive properties

The archive properties dialog is accessed by pressing the right button over a selected filename in an archive window and selecting the "Properties" option from the context menu that appears.

Click on an area of the picture to learn more about it.


popup_Archivename
This is the full pathname of the file that was hidden.


popup_ArchiveCompsize
This is the size, in bytes, of the file after it was compressed.


popup_ArchiveUncompsize
This is the original size of the file, i.e. the number of bytes it will occupy on disk when you save it.