1.3.3.1 XOR Obfuscation

  • Article

XOR obfuscation is performed on portions of Office binary documents. The normal streams (1) contained within the document are modified in place. For more information about how an application can determine whether XOR obfuscation is being used and the placement of the password verifier see [MS-XLS] and [MS-DOC].

There are two methods for performing XOR obfuscation, known as Method 1 and Method 2. Method 1 specifies structures and procedures used by the Excel Binary File Format (.xls) Structure [MS-XLS], and Method 2 specifies structures and procedures used by the Word Binary File Format (.doc) Structure [MS-DOC].