Rev 113 | Rev 116 | Go to most recent revision | Blame | Compare with Previous | Last modification | View Log | RSS feed
=============================DC4 FILE FORMAT SPECIFICATION=============================Type: Encrypted fileContents: Binary informationUsed by: ViaThinkSoft (De)Coder 4.0ViaThinkSoft (De)Coder 4.1 BetaViaThinkSoft (De)Coder 5.0Author: Daniel MarschallLast update: May, 27th 2024CONTENTS========[1.0] Sample file-format by Hagen Reddmann[2.0] DC4 Standard 1 used by (De)Coder 4.0[3.0] DC4 Standard 2 used by (De)Coder 4.1 Beta[4.0] DC4 Standard 3 used by (De)Coder 4.1 Final/Cancelled[5.0] DC4 Standard 3 used by (De)Coder 5.0[APP A] Links to websites[1.0] SAMPLE FILE-FORMAT BY HAGEN REDDMANN==========================================This file format is NOT used by (De)Coder.It is only the guideline of the DC4-Format.Hagen Reddmann posted the demo-algorithm in this topic:https://www.delphipraxis.net/66783-sichere-verschluesselung-von-dateien-mit-dem-dec-5-1-a.html (in German)---------------------------------------------------------------------------------------------------Offset Type Size Content/Description---------------------------------------------------------------------------------------------------00h Int32BE 4 DEC 5.1c Cipher idendity with identity-base 0x84485225, big endian0x01BD3D1A TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)0x0402530B TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0x18A1F944 TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)0x2C4D11CF TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)0x3C212341 TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0x42DBD0CA TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)0x43B28323 TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)0x47E376A6 TCipher_Sapphire (KeySize: 1024, BlockSize: 1, BufferSize: 32)0x48B8AEDB TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)0x51C323C2 TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)0x51F07042 TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)0x56555753 TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)0x5BF00A6F TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)0x6113DA7A TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)0x6B431EA1 TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)0x73A67594 TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)0x75D8876B TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)0x76BA0D8C TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)0x8B78B805 TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8, faulty implementation)0x92D7CD5C TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)0x96954A47 TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32, faulty implementation?)0x98B46CA0 TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)0x9FD9A8B9 TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)0xA1EEEAAF TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)0xB211D023 TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)0xB6936130 TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)0xCB1A12F1 TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)0xD731ED9F TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)0xE864D553 TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)0xFDA1E273 TCipher_Rijndael (KeySize: 32, BlockSize: 16, BufferSize: 16, default)04h Byte 1 DEC 5.1c Cipher mode0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block0x02 CFB8 8bit Cipher Feedback mode0x03 CFBx CFB on Blocksize of Cipher0x04 OFB8 8bit Output Feedback mode0x05 OFBx OFB on Blocksize bytes0x06 CFS8 8Bit CFS, double CFB0x07 CFSx CFS on Blocksize bytes0x08 ECBx Electronic Code Book (CalcMAC not possible)05h Int32BE 4 DEC 5.1c Hash-Idendity with identity-base 0x84485225, big endian.0x0B148DEE THash_Tiger (DigestSize: 24, BlockSize: 64)0x1F25A9C7 THash_Haval256 (DigestSize: 32, BlockSize: 128)0x284031A1 THash_RipeMD160 (DigestSize: 20, BlockSize: 64)0x3729E306 THash_Panama (DigestSize: 32, BlockSize: 32)0x3FDA5AEC THash_MD4 (DigestSize: 16, BlockSize: 64)0x42F77C97 THash_RipeMD128 (DigestSize: 16, BlockSize: 64)0x48DD6A7A THash_MD5 (DigestSize: 16, BlockSize: 64)0x4C91953A THash_Snefru256 (DigestSize: 32, BlockSize: 32)0x4FA820CB THash_RipeMD320 (DigestSize: 40, BlockSize: 64)0x59D2CCC4 THash_Whirlpool (DigestSize: 64, BlockSize: 64)0x7E3889A5 THash_SHA1 (DigestSize: 20, BlockSize: 64, default)0x815B1495 THash_Sapphire (DigestSize: 64, BlockSize: 1)0x9BFE22E7 THash_SHA256 (DigestSize: 32, BlockSize: 64)0x9C721C33 THash_Square (DigestSize: 16, BlockSize: 16)0xA07F7DB2 THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)0xA5B81E29 THash_SHA (DigestSize: 20, BlockSize: 64)0xB59AAC5E THash_Haval128 (DigestSize: 16, BlockSize: 128)0xB6BB9C8B THash_Haval192 (DigestSize: 24, BlockSize: 128)0xBE6A5E2C THash_Haval224 (DigestSize: 28, BlockSize: 128)0xC19C57B1 THash_SHA384 (DigestSize: 48, BlockSize: 128)0xD6B9FFD9 THash_MD2 (DigestSize: 16, BlockSize: 16)0xDF2DE168 THash_Haval160 (DigestSize: 20, BlockSize: 128)0xE62E90A3 THash_Snefru128 (DigestSize: 16, BlockSize: 48)0xE848790E THash_RipeMD256 (DigestSize: 32, BlockSize: 64)0xFDB0357F THash_SHA512 (DigestSize: 64, BlockSize: 128)09h Byte 1 Size of seed (Default value: 16 Bytes)0Ah Binary 0-255 Seed (Random data)Int32BE 4 Size of source data, big endianBinary var DEC 5.1c encrypted data; Password = Hash->KDfx(User-Password, Seed); KDFx is proprietary to DECNote that the password is treated as ANSIByte 1 Size of DEC CalcMACBinary 0-255 DEC's "CalcMAC"; This is a C-MAC which is the encryption of the last block concatention feedback.---------------------------------------------------------------------------------------------------[2.0] DC4 STANDARD 1 USED BY (DE)CODER 4.0==========================================This file format is used by (De)Coder 4.0The Idendity-Base of this file format is 0x59178954 (but identities are not used).---------------------------------------------------------------------------------------------------Offset Type Size Content/Description---------------------------------------------------------------------------------------------------00h Byte 1 Compress mode flag00h: Uncompressed file - Default in (De)Coder 4.001h: Folder compressed with ZIP - Default in (De)Coder 4.001h Byte 1 Version flag; Hardcoded value: 01h.02h String var Original file name, ANSI encodedByte 1 Terminus Value: 1Fh ("?")Binary 16 Seed (Random data. Default size: 16 bytes = 0x10Binary var DEC 5.1c encrypted data (read until file end minus the size of the checksum)Password: Hash->KDfx(User-Password, Seed); KDFx is proprietary to DECAlgorithm: RIJNDAEL (AES)Mode: CTSx (proprietary to DEC)Note that the password is treated as ANSIBinary var Checksum of the data before encryptionDefault hash configurationAlgorithm: SHA 512Size dependend on the hash algorithm (DigestSize).The algorithms of DEC give out a hash with the length 16-64.---------------------------------------------------------------------------------------------------[3.0] DC4 STANDARD 2 USED BY (DE)CODER 4.1 BETA===============================================This file format is used by (De)Coder 4.1 Public Beta 1 through (De)Coder 4.1 Public Beta 4b.---------------------------------------------------------------------------------------------------Offset Type Size Content/Description---------------------------------------------------------------------------------------------------00h Byte 1 Compress mode flag00h: Uncompressed file01h: Folder compressed with ZIP02h: ZLib-compressed file - Default in (De)Coder 4.103h: ZLib-compressed folder, packed ZIP - Default in (De)Coder 4.101h Byte 1 Version flag; Hardcoded value: 02h02h Binary var Original file name, ANSI encoded, in BASE64 (binary)Byte 1 Terminus Value: 1Fh ("?")Int32BE 4 DEC 5.1c Idendity-Base, big endian; Default 0x84671842If DEC 6.x is used, then the following changes are done:- Use old DEC 5.1c algorithm to determine the identify.- TCipher_AES (DEC 6.5) will be renamed to TCipher_Rijndael (DEC 5.1)- THash_Whirlpool0 (DEC 6.5) will be renamed to THash_Whirlpool (DEC 5.1)- THash_SHA0 (DEC 6.5) will be renamed to THash_SHA (DEC 5.1)Int32BE 4 DEC 5.1c Cipher idendity, big endian. If the default identitiy base 0x84671842 is used, then the identities are:0x0ACBBBFA TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)0x19348176 TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)0x1DB63065 TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)0x205DE950 TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8, faulty implementation)0x33913DF5 TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)0x34FCF9EC TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)0x39F29C09 TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)0x3DB01B12 TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32, faulty implementation?)0x43418406 TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)0x5684B326 TCipher_Rijndael (KeySize: 32, BlockSize: 16, BufferSize: 16, default)0x603F43A4 TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)0x7C14BCCA TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)0x8768409A TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)0x97047214 TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0xAA986C4F TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)0xAF27025E TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0xB384A811 TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)0xC0664FF4 TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)0xCA368B2F TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)0xD88324C1 TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)0xDD9F5CD9 TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)0xDEFDD63E TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)0xE39DFF8E TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)0xE897D276 TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)0xE9FE819F TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)0xECC627F3 TCipher_Sapphire(KeySize: 1024, BlockSize: 1, BufferSize: 32)0xF0D55B3A TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)0xFAD52117 TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)0xFAE67297 TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)0xFD700606 TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)Byte 1 DEC 5.1c Cipher mode0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block0x02 CFB8 8bit Cipher Feedback mode0x03 CFBx CFB on Blocksize of Cipher0x04 OFB8 8bit Output Feedback mode0x05 OFBx OFB on Blocksize bytes0x06 CFS8 8Bit CFS, double CFB0x07 CFSx CFS on Blocksize bytes0x08 ECBx Electronic Code Book (CalcMAC not possible)Int32 4 DEC 5.1c Hash idendity, big endian. If the default identitiy base 0x84671842 is used, then the identities are:0x0B5A2CE7 THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)0x0E9D4F7C THash_SHA (DigestSize: 20, BlockSize: 64)0x154F0F79 THash_Haval224 (DigestSize: 28, BlockSize: 128)0x1D9ECDDE THash_Haval192 (DigestSize: 24, BlockSize: 128)0x1EBFFD0B THash_Haval128 (DigestSize: 16, BlockSize: 128)0x2A7E45C0 THash_Sapphire (DigestSize: 64, BlockSize: 1)0x30DB73B2 THash_SHA256 (DigestSize: 32, BlockSize: 64)0x37574D66 THash_Square (DigestSize: 16, BlockSize: 16)0x436D285B THash_RipeMD256 (DigestSize: 32, BlockSize: 64)0x4D0BC1F6 THash_Snefru128 (DigestSize: 16, BlockSize: 48)0x5695642A THash_SHA512 (DigestSize: 64, BlockSize: 128, default)0x6AB906E4 THash_SHA384 (DigestSize: 48, BlockSize: 128)0x7408B03D THash_Haval160 (DigestSize: 20, BlockSize: 128)0x7D9CAE8C THash_MD2 (DigestSize: 16, BlockSize: 16)0x836560F4 THash_RipeMD160 (DigestSize: 20, BlockSize: 64)0x94FF0BB9 THash_MD4 (DigestSize: 16, BlockSize: 64)0x9C0CB253 THash_Panama (DigestSize: 32, BlockSize: 32)0xA031DCBB THash_Tiger (DigestSize: 24, BlockSize: 64)0xB400F892 THash_Haval256 (DigestSize: 32, BlockSize: 128)0xD51DD8F0 THash_SHA1 (DigestSize: 20, BlockSize: 64)0xE3F83B2F THash_MD5 (DigestSize: 16, BlockSize: 64)0xE48D719E THash_RipeMD320 (DigestSize: 40, BlockSize: 64)0xE7B4C46F THash_Snefru256 (DigestSize: 32, BlockSize: 32)0xE9D22DC2 THash_RipeMD128 (DigestSize: 16, BlockSize: 64)0xF2F79D91 THash_Whirlpool (DigestSize: 64, BlockSize: 64)Byte 1 Size of seed; Default value: 32 byteBinary 0-255 Seed (Random data)Binary var With DEC 5.1c encrypted data, encrypted with password (read until file end minus the size of the checksum and the file terminus)Password = Hash->KDfx(User-Password, Seed); KDFx is proprietary to DECNote that the password is treated as ANSIBinary var Secured checksum of the data before encryption= Hash(Hash(Original Data) & Seed & User-Password)Size dependend on the hash algorithm (DigestSize).The algorithms of DEC give out a hash with the length 16-64.Note that the password is treated as ANSIBinary 16 DC4-Terminus; Hardcoded value: "RENURVJNSU5VUw==" (BASE64: "DCTERMINUS")---------------------------------------------------------------------------------------------------[4.0] DC4 STANDARD 3 USED BY (DE)CODER 4.1 (CANCELLED)======================================================This file format was intended to be used by the final version of (De)Coder 4.1, which was never finished and never released.---------------------------------------------------------------------------------------------------Offset Type Size Content/Description---------------------------------------------------------------------------------------------------00h Byte 1 Compress mode flag00h: Uncompressed file01h: Folder compressed with ZIP02h: ZLib-compressed file - Default in (De)Coder 4.103h: ZLib-compressed folder, packed ZIP - Default in (De)Coder 4.101h Byte 1 Version flag; Hardcoded value: 03h02h Byte 1 Filename encrypted with User-Password?00h: No01h: Yes03h Int32BE 4 Size (in bytes) of the encrypted filename that follows, big endian07h Binary var Original file name, not null-terminated WideString (UTF-16)Encrypted with DEC 5.1c (cipher/hash see below)If offset 02h of this part has the value 00h:Encryption-Password = Hash->KDfx(5Eh D1h 6Bh 12h 7Dh B4h C4h 3Ch, Seed)If offset 02h of this part has the value 01h:Encryption-Password = Hash->KDfx(User-Password, Seed)Note that the password is treated as ANSIKDFx is proprietary to DECInt32BE 4 DEC 5.1c Idendity-Base, big endian; Default Idendity-Base: 0x19387612If DEC 6.x is used, then the following changes are done:- Use old DEC 5.1c algorithm to determine the identify.- TCipher_AES (DEC 6.5) will be renamed to TCipher_Rijndael (DEC 5.1)- THash_Whirlpool0 (DEC 6.5) will be renamed to THash_Whirlpool (DEC 5.1)- THash_SHA0 (DEC 6.5) will be renamed to THash_SHA (DEC 5.1)Int32BE 4 DEC 5.1c Cipher idendity, big endian. If the default identitiy base 0x84671842 is used, then the identities are:0x0BE40C0E TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)0x0F66BD1D TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)0x1C998791 TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)0x22AEC587 TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)0x25C3019E TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)0x2BE22779 TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32, faulty implementation?)0x2FA0A062 TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)0x360FD53B TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8, faulty implementation)0x40D68F4D TCipher_Rijndael (KeySize: 32, BlockSize: 16, BufferSize: 16, default)0x5513B86D TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)0x6A4680A1 TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)0x766D7FCF TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)0x81564E7F TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0x913A7CF1 TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)0xA5D6947A TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)0xB9753E35 TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0xBCCA5024 TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)0xC8AFEA55 TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)0xCBCD60B2 TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)0xCED118AA TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)0xD634739F TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)0xDC64B744 TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)0xE6876751 TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)0xEB223A6D TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)0xEC871D7C TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)0xECB44EFC TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)0xF5CFC3E5 TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)0xFA941B98 TCipher_Sapphire(KeySize: 1024, BlockSize: 1, BufferSize: 32)0xFEC5EE1D TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)0xFFACBDF4 TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)Byte 1 DEC 5.1c Cipher mode0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block0x02 CFB8 8bit Cipher Feedback mode0x03 CFBx CFB on Blocksize of Cipher0x04 OFB8 8bit Output Feedback mode0x05 OFBx OFB on Blocksize bytes0x06 CFS8 8Bit CFS, double CFB0x07 CFSx CFS on Blocksize bytes0x08 ECBx Electronic Code Book (CalcMAC not possible)Int32BE 4 DEC 5.1c Hash idendity, big endian. If the default identitiy base 0x84671842 is used, then the identities are:0x031D3312 THash_Haval224 (DigestSize: 28, BlockSize: 128)0x08EDC160 THash_Haval128 (DigestSize: 16, BlockSize: 128)0x0BCCF1B5 THash_Haval192 (DigestSize: 24, BlockSize: 128)0x18CF7317 THash_SHA (DigestSize: 20, BlockSize: 64)0x1D08108C THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)0x2105710D THash_Square (DigestSize: 16, BlockSize: 16)0x26894FD9 THash_SHA256 (DigestSize: 32, BlockSize: 64)0x3C2C79AB THash_Sapphire (DigestSize: 64, BlockSize: 1)0x40C75841 THash_SHA512 (DigestSize: 64, BlockSize: 128, default)0x553F1430 THash_RipeMD256 (DigestSize: 32, BlockSize: 64)0x5B59FD9D THash_Snefru128 (DigestSize: 16, BlockSize: 48)0x625A8C56 THash_Haval160 (DigestSize: 20, BlockSize: 128)0x6BCE92E7 THash_MD2 (DigestSize: 16, BlockSize: 16)0x7CEB3A8F THash_SHA384 (DigestSize: 48, BlockSize: 128)0x82AD37D2 THash_MD4 (DigestSize: 16, BlockSize: 64)0x8A5E8E38 THash_Panama (DigestSize: 32, BlockSize: 32)0x95375C9F THash_RipeMD160 (DigestSize: 20, BlockSize: 64)0xA252C4F9 THash_Haval256 (DigestSize: 32, BlockSize: 128)0xB663E0D0 THash_Tiger (DigestSize: 24, BlockSize: 64)0xC34FE49B THash_SHA1 (DigestSize: 20, BlockSize: 64)0xE4A5A1FA THash_Whirlpool (DigestSize: 64, BlockSize: 64)0xF1E6F804 THash_Snefru256 (DigestSize: 32, BlockSize: 32)0xF2DF4DF5 THash_RipeMD320 (DigestSize: 40, BlockSize: 64)0xF5AA0744 THash_MD5 (DigestSize: 16, BlockSize: 64)0xFF8011A9 THash_RipeMD128 (DigestSize: 16, BlockSize: 64)Byte 1 Size of seed (default: 32 byte = 0x20)Binary 0-255 Seed (Random data)Binary var With DEC 5.1c encrypted data (read until file end minus the size of the checksum and the file terminus)Encryption-Password = Hash->KDfx(User-Password, Seed); KDFx is proprietary to DECNote that the password is treated as ANSIBinary var Secured checksum of the data before encryption= Hash(Hash(Original Data) & Seed & Hash(Seed & Hash(Seed & User-Password)))Size dependend on the hash algorithm (DigestSize).The algorithms of DEC give out a hash with the length 16-64.Note that the password is treated as ANSIBinary 8 DC4-Terminus; Hardcoded value: 63 F3 DF 89 B7 27 20 EA---------------------------------------------------------------------------------------------------[5.0] DC4 STANDARD 4 USED BY (DE)CODER 5.0==========================================This file format is used by (De)Coder 5.0. The file-name extension can be dc4 or dc5.---------------------------------------------------------------------------------------------------Offset Type Size Content/Description---------------------------------------------------------------------------------------------------00h Binary 31 Magic Sequence; Hardcoded value: "[1.3.6.1.4.1.37476.2.2.1.4.4]" + CRLFThis is the OID { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) 37476 products(2) decoder(2) fileformat(1) dc4(4) std4(4) }1Fh Byte 1 FlagsBit 0/LSB: [Ver1+] Is 7zip-packed folder (1) or a regular file (0)?Bit 1: [Ver2+] Additionally ZLib compressed (1) or not ZLib compressed (0)?Bit 2: ReservedBit 3: ReservedBit 4: ReservedBit 5: ReservedBit 6: ReservedBit 7/MSB: Reserved20h Byte 1 Size of the filename that follows21h Binary var Original file name, UTF-8 Encoded; possible values:- Original name in its entirety (example "foobar.txt")- Just its extension (example "*.txt")- Redacted (empty string "", default)Int64LE 8 Original File Size in Bytes, little endian. -1 if redacted (default).Int64LE 8 Original File Date/Time, little endian. Unix Timestamp or -1 if redacted (default).Int32BE 4 DEC 6.5 Cipher idendity, big endian. Identify is calculated by DEC 6.5 with identity base 0x1259D82A:0x0005E9C6 TCipher_2DDES (KeySize: 16, BlockSize: 16, BufferSize: 16)0x03676321 TCipher_RC4 (KeySize: 256, BlockSize: 1, BufferSize: 16)0x067B1B39 TCipher_2DES (KeySize: 16, BlockSize: 8, BufferSize: 8)0x1282B983 TCipher_AES256 (KeySize: 32, BlockSize: 16, BufferSize: 16)0x14CEB4D7 TCipher_1DES (KeySize: 8, BlockSize: 8, BufferSize: 8)0x1E9E700C TCipher_TEAN (KeySize: 16, BlockSize: 8, BufferSize: 8)0x238839FE TCipher_Misty (KeySize: 16, BlockSize: 8, BufferSize: 8)0x241E4D6F TCipher_3Way (KeySize: 12, BlockSize: 12, BufferSize: 12)0x242D1EEF TCipher_Blowfish (KeySize: 56, BlockSize: 8, BufferSize: 8)0x2E2D64C2 TCipher_NewDES (KeySize: 15, BlockSize: 8, BufferSize: 8)0x323E180B TCipher_Sapphire (KeySize: 1024, BlockSize: 1, BufferSize: 32)0x366FED8E TCipher_Mars (KeySize: 56, BlockSize: 16, BufferSize: 16)0x3706BE67 TCipher_Cast256 (KeySize: 32, BlockSize: 16, BufferSize: 16)0x3D65C076 TCipher_3DDES (KeySize: 24, BlockSize: 16, BufferSize: 16)0x49FC4DEC TCipher_IDEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0x59907F62 TCipher_Square (KeySize: 16, BlockSize: 16, BufferSize: 16)0x66BC7BE6 TCipher_Null (KeySize: 0, BlockSize: 1, BufferSize: 8)0x6D7C97E9 TCipher_3TDES (KeySize: 24, BlockSize: 24, BufferSize: 24)0x71DF3DA6 TCipher_TEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0x746053B7 TCipher_RC5 (KeySize: 256, BlockSize: 8, BufferSize: 8)0x988B2D75 TCipher_AES (KeySize: 32, BlockSize: 16, BufferSize: 16, default)0x9DB9BBFE TCipher_Cast128 (KeySize: 16, BlockSize: 8, BufferSize: 8)0xA2EC8332 TCipher_Skipjack (KeySize: 10, BlockSize: 8, BufferSize: 8)0xB83DBC1A TCipher_AES128 (KeySize: 16, BlockSize: 16, BufferSize: 16)0xBB1C8CCF TCipher_AES192 (KeySize: 24, BlockSize: 16, BufferSize: 16)0xBD7FDE66 TCipher_XTEA (KeySize: 16, BlockSize: 8, BufferSize: 8)0xBEC77C5C TCipher_3DES (KeySize: 24, BlockSize: 8, BufferSize: 8)0xC34E0F9D TCipher_Twofish (KeySize: 32, BlockSize: 16, BufferSize: 16)0xC7CCBE8E TCipher_Q128 (KeySize: 16, BlockSize: 16, BufferSize: 16)0xD4338402 TCipher_Gost (KeySize: 32, BlockSize: 8, BufferSize: 8)0xE34824EA TCipher_SCOP (KeySize: 48, BlockSize: 4, BufferSize: 32)0xE70AA3F1 TCipher_SAFER (KeySize: 16, BlockSize: 8, BufferSize: 8)0xEA04C614 TCipher_RC2 (KeySize: 128, BlockSize: 8, BufferSize: 8)0xED69020D TCipher_RC6 (KeySize: 256, BlockSize: 16, BufferSize: 16)0xFEA5D6A8 TCipher_Shark (KeySize: 16, BlockSize: 8, BufferSize: 8)Byte 1 DEC 6.5 Cipher mode0x00 CTSx double CBC, with CFS8 padding of truncated final block (default, proprietary to DEC)0x01 CBCx Cipher Block Chainung, with CFB8 padding of truncated final block0x02 CFB8 8bit Cipher Feedback mode0x03 CFBx CFB on Blocksize of Cipher0x04 OFB8 8bit Output Feedback mode0x05 OFBx OFB on Blocksize bytes0x06 CFS8 8Bit CFS, double CFB0x07 CFSx CFS on Blocksize bytes0x08 ECBx Electronic Code Book0x09 GCM Galois Counter Mode0x0A CTS3 double CBC, with less secure padding of truncated final block (deprecated)Int32BE 4 DEC 6.5 Hash idendity, big endian. Identify is calculated by DEC 6.5 with identity base 0x1259D82A:0x01DCD639 THash_SHA3_256 (DigestSize: 32, BlockSize: 136)0x0BE5E708 THash_SHA1 (DigestSize: 20, BlockSize: 64)0x2F5EA7BA THash_Keccak_224 (DigestSize: 28, BlockSize: 144)0x372A123A THash_RipeMD128 (DigestSize: 16, BlockSize: 64)0x394CFB97 THash_Snefru256 (DigestSize: 32, BlockSize: 32)0x3A754E66 THash_RipeMD320 (DigestSize: 40, BlockSize: 64)0x3D0004D7 THash_MD5 (DigestSize: 16, BlockSize: 64)0x42F48DAB THash_Panama (DigestSize: 32, BlockSize: 32)0x4A073441 THash_MD4 (DigestSize: 16, BlockSize: 64)0x4F6CBBA1 THash_SHA224 (DigestSize: 28, BlockSize: 64)0x5BBEA36F THash_SHA3_384 (DigestSize: 48, BlockSize: 104)0x5D65CF55 THash_Shake128 (DigestSize: 0, BlockSize: 168)0x5D9D5F0C THash_RipeMD160 (DigestSize: 20, BlockSize: 64)0x6792C1A1 THash_SHA3_512 (DigestSize: 64, BlockSize: 72, default)0x6AF8C76A THash_Haval256 (DigestSize: 32, BlockSize: 128)0x7CE2D79E THash_SHA0 (DigestSize: 20, BlockSize: 64)0x7EC9E343 THash_Tiger (DigestSize: 24, BlockSize: 64)0x886D5BD2 THash_SHA512 (DigestSize: 64, BlockSize: 128)0x8E115051 THash_Keccak_256 (DigestSize: 32, BlockSize: 136)0x93F3FE0E THash_Snefru128 (DigestSize: 16, BlockSize: 48)0x9D9517A3 THash_RipeMD256 (DigestSize: 32, BlockSize: 64)0xA09321D2 THash_SHA3_224 (DigestSize: 28, BlockSize: 144)0xA2A52389 THash_Whirlpool0 (DigestSize: 64, BlockSize: 64)0xA3649174 THash_MD2 (DigestSize: 16, BlockSize: 16)0xAAF08FC5 THash_Haval160 (DigestSize: 20, BlockSize: 128)0xB441391C THash_SHA384 (DigestSize: 48, BlockSize: 128)0xC047C2F3 THash_Haval128 (DigestSize: 16, BlockSize: 128)0xC366F226 THash_Haval192 (DigestSize: 24, BlockSize: 128)0xCBB73081 THash_Haval224 (DigestSize: 28, BlockSize: 128)0xD4732507 THash_Keccak_384 (DigestSize: 48, BlockSize: 104)0xD5A2131F THash_Whirlpool1 (DigestSize: 64, BlockSize: 64)0xE85F47C9 THash_Keccak_512 (DigestSize: 64, BlockSize: 72)0xE87A86C8 THash_WhirlpoolT (DigestSize: 64, BlockSize: 64)0xE9AF729E THash_Square (DigestSize: 16, BlockSize: 16)0xEC61EF43 THash_BCrypt (DigestSize: 23, BlockSize: 8)0xEE234C4A THash_SHA256 (DigestSize: 32, BlockSize: 64)0xF4867A38 THash_Sapphire (DigestSize: 64, BlockSize: 1)0xF7DACACC THash_Shake256 (DigestSize: 0, BlockSize: 136)Byte 1 IV Size (default: 16 = 0x10)Binary var IV (Random Data)Byte 1 IV filler byte (default: 0xFF)Byte 1 Blocking filling mode (default: 0x00), currently not used by DEC0x00 Byte filling modeByte 1 Size of seed (default 32 = 0x20)Binary 0-255 Seed (Random data)Byte 1 KDF version0x01 KDF10x02 KDF20x03 KDF30x04 KDFx (default, proprietary to DEC)0x05 PBKDF2Int32LE 0-4 PBKDF iterations (ONLY present if KDF Version = 0x05), little endianByte 0-1 Size of GCM Auth Tag in bytes (only present if cipher mode is GCM)Usual lengths are:0x04 32 bits (not recommended)0x08 64 bits (not recommended)0x0c 96 bits0x0d 104 bits0x0e 112 bits0x0f 120 bits0x10 128 bits (default)Binary var With DEC 6.5 encrypted data (read until file end minus the size of the checksum)Encryption-Password = Hash->KDf<Version>(User-Password, Seed)Note that the password is treated as UTF-8Binary 0-255 DEC's "CalcMAC"; This is a C-MAC which is the encryption of the last block concatention feedback.NOT present if cipher mode is ECB. Size is one cipher block.Binary 0-255 GCM Auth Tag. Size as specified before.ONLY present if cipher mode is GCM).Binary var HMAC checksum (Encrypt-then-HMAC)= HMAC(HMacKey, Whole encrypted file except HMAC part)with Key = Encryption-PasswordSize dependend on the hash algorithm (DigestSize).The algorithms of DEC give out a hash with the length 16-64.Note that the password is treated as UTF-8---------------------------------------------------------------------------------------------------== [APPENDIX A] Links to websites ==Latest version of this specification:https://github.com/danielmarschall/decoder/blob/master/Decoder50/Private/DC4-Format-Specification.txtSource code and program "(De)Coder" at GitHub:https://github.com/danielmarschall/decoder/OID which describes this file format:https://hosted.oidplus.com/viathinksoft/?goto=oid%3A1.3.6.1.4.1.37476.2.2.1.4Delphi Encryption Compendium (DEC) at GitHub:https://github.com/MHumm/DelphiEncryptionCompendium