Steganography VIII - Hiding Data in Wave Audio Files

• Download source files - 21.7 Kb

Introduction

Now that we have hidden data in bitmaps, MIDI tracks and .NET assemblies, you might miss one important file format. You might miss the files that can hide lots of bytes without becoming larger, and can be generated in a few seconds, so that you don't have to store the original files on your disk. It is time to add Wave Audio to the list.

This article uses code from A full-duplex audio player in C# using the waveIn/waveOut APIs.

The Wave File Format

Have you ever looked at a Wave file in a HEX editor? It starts like that, and continues with unreadable binary data:

Every RIFF file starts with the text "RIFF", followed by the Int32 length of the entire file:

The next fields say that this RIFF file contains Wave data and open the format chunk:

The length of the following format chunk must be 16 for PCM files:

Now the format is being specified by a WAVEFORMATEX structure:

The format chunk can be followed by some extra information. Then the interesting parts begin with the data chunk.

The data chunk contains all the Wave samples. That means the rest of the file is pure audio data. Little changes might be hearable, but won't destroy the file.

Hiding the Message

Hiding a message in Wave samples is very similar to hiding it in the pixels of a bitmap. Again, we use a key stream to skip a number of carrier units (samples/pixels), grab one carrier unit, put one bit of the message into the lowest bit of the carrier unit, and write the changed unit to the destination stream. When the entire message has been hidden like that, we copy the rest of the carrier stream.

public void Hide(Stream messageStream, Stream keyStream){
    
    byte[] waveBuffer = new byte[bytesPerSample];
    byte message, bit, waveByte;
    int messageBuffer; //receives the next byte of the message or -1
    int keyByte; //distance of the next carrier sample
    
    //loop over the message, hide each byte
    while( (messageBuffer=messageStream.ReadByte()) >= 0 ){
        //read one byte of the message stream
        message = (byte)messageBuffer;
        
        //for each bit in [message]
        for(int bitIndex=0; bitIndex<8; bitIndex++){
            
            //read a byte from the key
            keyByte = GetKeyValue(keyStream);
            
            //skip a couple of samples
            for(int n=0; n<keyByte-1; n++){
                //copy one sample from the clean stream to the carrier stream
                sourceStream.Copy(
                    waveBuffer, 0,
                    waveBuffer.Length, destinationStream);
            }

            //read one sample from the wave stream
            sourceStream.Read(waveBuffer, 0, waveBuffer.Length);
            waveByte = waveBuffer[bytesPerSample-1];
            
            //get the next bit from the current message byte...
            bit = (byte)(((message & (byte)(1 << bitIndex)) > 0) ? 1 : 0);
                
            //...place it in the last bit of the sample
            if((bit == 1) && ((waveByte % 2) == 0)){
                waveByte += 1;
            }else if((bit == 0) && ((waveByte % 2) == 1)){
                waveByte -= 1;
            }

            waveBuffer[bytesPerSample-1] = waveByte;

            //write the result to destinationStream
            destinationStream.Write(waveBuffer, 0, bytesPerSample);
        }
    }

    //copy the rest of the wave without changes
    //...
}

Extracting the Message

Again, we use the key stream to locate the right samples, just as we did while hiding the message. Then we read the last bit of the sample and shift it into the current byte of the message. When the byte is complete, we write it into the message stream and continue with the next one.

public void Extract(Stream messageStream, Stream keyStream){

    byte[] waveBuffer = new byte[bytesPerSample];
    byte message, bit, waveByte;
    int messageLength = 0; //expected length of the message
    int keyByte; //distance of the next carrier sample
    
    while( (messageLength==0 || messageStream.Length<messageLength) ){
        //clear the message-byte
        message = 0;
        
        //for each bit in [message]
        for(int bitIndex=0; bitIndex<8; bitIndex++){

            //read a byte from the key
            keyByte = GetKeyValue(keyStream);
            
            //skip a couple of samples
            for(int n=0; n<keyByte; n++){
                //read one sample from the wave stream
                sourceStream.Read(waveBuffer, 0, waveBuffer.Length);
            }
            waveByte = waveBuffer[bytesPerSample-1];
            
            //get the last bit of the sample...
            bit = (byte)(((waveByte % 2) == 0) ? 0 : 1);

            //...write it into the message-byte
            message += (byte)(bit << bitIndex);
        }

        //add the re-constructed byte to the message
        messageStream.WriteByte(message);
        
        if(messageLength==0 && messageStream.Length==4){
            //first 4 bytes contain the message's length
            //...
        }
    }
}

Recording a Wave 

Keeping the original clean carriers can be dangerous. Somebody who has already got a carrier file with a secret message in it, and manages to get the original file without the hidden message, can easily compare the two files, count the distance in bytes between two non-equal samples, and quickly reconstruct the key.

That is why we have to delete and destroy our clean carrier files after we've used them once, or record a wave on the fly. Thanks to Ianier Munoz' WaveInRecorder, it is no problem to record Wave data and hide the message in it before saving anything to a disk. There is no original file, so we do not need to care about one. In the main form, the user can choose between using an existing Wave file or recording a sound right then. If he wants to record a unique, not reproducible sound, he can plug in a microphone and speak/play/... whatever he likes:

if(rdoSrcFile.Checked){
    //use a .wav file as the carrier
    //do not complain later on, you have been warned
    sourceStream = new FileStream(txtSrcFile.Text, FileMode.Open);
}else{
    //record a carrier wave
    frmRecorder recorder = new frmRecorder(countSamplesRequired);
    recorder.ShowDialog(this);
    sourceStream = recorder.RecordedStream;
}

frmRecorder is a small GUI for the WaveIn Recorder that counts the recorded samples and enables a Stop button when the sound is long enough to hide the specified message.

The new sound is stored in a MemoryStream and passed to WaveUtility. From now on, it does not matter where the stream came from, WaveUtility makes no difference between sounds read from a file or recorded on the fly.

WaveUtility utility = new WaveUtility(sourceStream, destinationStream);
utility.Hide(messageStream, keyStream); 

Revisions

• 2012-04-09: Fixed some bugs in WaveUtility and frmRecorder