Steganography VIII - Hiding Data in Wave Audio Files






4.44/5 (34 votes)
How to hide data of any kind inside a sound.
Introduction
Now that we have hidden data in bitmaps, MIDI tracks and .NET assemblies, you might miss one important file format. You might miss the files that can hide lots of bytes without becoming larger, and can be generated in a few seconds, so that you don't have to store the original files on your disk. It is time to add Wave Audio to the list.
This article uses code from A full-duplex audio player in C# using the waveIn/waveOut APIs.
The Wave File Format
Have you ever looked at a Wave file in a HEX editor? It starts like that, and continues with unreadable binary data:
Every RIFF file starts with the text "RIFF", followed by the Int32
length of the entire file:
The next fields say that this RIFF file contains Wave data and open the format chunk:
The length of the following format chunk must be 16 for PCM files:
Now the format is being specified by a WAVEFORMATEX
structure:
The format chunk can be followed by some extra information. Then the interesting parts begin with the data
chunk.
The data
chunk contains all the Wave samples. That means the rest of the file is pure audio data. Little changes might be hearable, but won't destroy the file.
Hiding the Message
Hiding a message in Wave samples is very similar to hiding it in the pixels of a bitmap. Again, we use a key stream to skip a number of carrier units (samples/pixels), grab one carrier unit, put one bit of the message into the lowest bit of the carrier unit, and write the changed unit to the destination stream. When the entire message has been hidden like that, we copy the rest of the carrier stream.
public void Hide(Stream messageStream, Stream keyStream){
byte[] waveBuffer = new byte[bytesPerSample];
byte message, bit, waveByte;
int messageBuffer; //receives the next byte of the message or -1
int keyByte; //distance of the next carrier sample
//loop over the message, hide each byte
while( (messageBuffer=messageStream.ReadByte()) >= 0 ){
//read one byte of the message stream
message = (byte)messageBuffer;
//for each bit in [message]
for(int bitIndex=0; bitIndex<8; bitIndex++){
//read a byte from the key
keyByte = GetKeyValue(keyStream);
//skip a couple of samples
for(int n=0; n<keyByte-1; n++){
//copy one sample from the clean stream to the carrier stream
sourceStream.Copy(
waveBuffer, 0,
waveBuffer.Length, destinationStream);
}
//read one sample from the wave stream
sourceStream.Read(waveBuffer, 0, waveBuffer.Length);
waveByte = waveBuffer[bytesPerSample-1];
//get the next bit from the current message byte...
bit = (byte)(((message & (byte)(1 << bitIndex)) > 0) ? 1 : 0);
//...place it in the last bit of the sample
if((bit == 1) && ((waveByte % 2) == 0)){
waveByte += 1;
}else if((bit == 0) && ((waveByte % 2) == 1)){
waveByte -= 1;
}
waveBuffer[bytesPerSample-1] = waveByte;
//write the result to destinationStream
destinationStream.Write(waveBuffer, 0, bytesPerSample);
}
}
//copy the rest of the wave without changes
//...
}
Extracting the Message
Again, we use the key stream to locate the right samples, just as we did while hiding the message. Then we read the last bit of the sample and shift it into the current byte of the message. When the byte is complete, we write it into the message stream and continue with the next one.
public void Extract(Stream messageStream, Stream keyStream){
byte[] waveBuffer = new byte[bytesPerSample];
byte message, bit, waveByte;
int messageLength = 0; //expected length of the message
int keyByte; //distance of the next carrier sample
while( (messageLength==0 || messageStream.Length<messageLength) ){
//clear the message-byte
message = 0;
//for each bit in [message]
for(int bitIndex=0; bitIndex<8; bitIndex++){
//read a byte from the key
keyByte = GetKeyValue(keyStream);
//skip a couple of samples
for(int n=0; n<keyByte; n++){
//read one sample from the wave stream
sourceStream.Read(waveBuffer, 0, waveBuffer.Length);
}
waveByte = waveBuffer[bytesPerSample-1];
//get the last bit of the sample...
bit = (byte)(((waveByte % 2) == 0) ? 0 : 1);
//...write it into the message-byte
message += (byte)(bit << bitIndex);
}
//add the re-constructed byte to the message
messageStream.WriteByte(message);
if(messageLength==0 && messageStream.Length==4){
//first 4 bytes contain the message's length
//...
}
}
}
Recording a Wave
Keeping the original clean carriers can be dangerous. Somebody who has already got a carrier file with a secret message in it, and manages to get the original file without the hidden message, can easily compare the two files, count the distance in bytes between two non-equal samples, and quickly reconstruct the key.
That is why we have to delete and destroy our clean carrier files after we've used them once, or record a wave on the fly. Thanks to Ianier Munoz' WaveInRecorder, it is no problem to record Wave data and hide the message in it before saving anything to a disk. There is no original file, so we do not need to care about one. In the main form, the user can choose between using an existing Wave file or recording a sound right then. If he wants to record a unique, not reproducible sound, he can plug in a microphone and speak/play/... whatever he likes:
if(rdoSrcFile.Checked){ //use a .wav file as the carrier //do not complain later on, you have been warned sourceStream = new FileStream(txtSrcFile.Text, FileMode.Open); }else{ //record a carrier wave frmRecorder recorder = new frmRecorder(countSamplesRequired); recorder.ShowDialog(this); sourceStream = recorder.RecordedStream; }
frmRecorder
is a small GUI for the WaveIn Recorder that counts the recorded samples and enables a Stop button when the sound is long enough to hide the specified message.
The new sound is stored in a MemoryStream
and passed to WaveUtility
. From now on, it does not matter where the stream came from, WaveUtility
makes no difference between sounds read from a file or recorded on the fly.
WaveUtility utility = new WaveUtility(sourceStream, destinationStream);
utility.Hide(messageStream, keyStream);
Revisions
- 2012-04-09: Fixed some bugs in WaveUtility and frmRecorder