msoffcrypto-tool icon indicating copy to clipboard operation
msoffcrypto-tool copied to clipboard

Published 20 hours ago • verified publisher icon nolze

Office detects a problem with decrypted ppt files

Open MrCrumbs opened this issue 5 years ago • 5 comments

Thanks for adding support for ppt! Decrypting a simple password-protected ppt file (created by PowerPoint 2013) results in a successful decryption, however when opened by PowerPoint 2013 it launches in Protected View since "Office has detected a problem with this file".

According to Office, one of the reasons to open up in Protected View is: File validation failure - When you see a message in Protected View that says "Office has detected a problem with this file. Editing it may harm your computer. Click for more details.", the file didn’t pass file validation. File validation scans file for security problems that can result from changes in the file structure.

Has anyone seen this? Would it help to add any more info?

MrCrumbs avatar Mar 27 '19 14:03 MrCrumbs

Thank you for reporting!

It seems that there is something wrong with the internal structure of the decrypted file. Unfortunately, as the MS-PPT support is really partial and experimental, there are uncountable possible causes. It is difficult to work on the issue without the file in question for now.

I'll check it if you could you attach the equivalent file (please make sure to remove secrets.) I'd appreciate a fix PR too.

nolze avatar Apr 04 '19 16:04 nolze

Hey, thanks for your reply! I wasn't sure how exactly you wanted me to do the PR, so I forked and added the encrypted/decrypted sample to "tests" folder... hope that's what you meant. The sample is not important, I just hope it helps you to find out the root cause... your library is great and for now PPT decryption is the only thing missing for me :) Thanks so much!

MrCrumbs avatar Apr 07 '19 05:04 MrCrumbs

Thanks! I confirmed the Protected View alert showing up in the lastest PowerPoint for Windows with the provided file. (It is puzzling that the alert does not show up in PowerPoint for Mac and PowerPoint Online.) I'll investigate it further.

nolze avatar Apr 15 '19 01:04 nolze

For testing, what's the password?

fsc-eriker avatar Dec 11 '20 11:12 fsc-eriker

I actually don't remember ;) But you can try with any other encrypted PPT. I uploaded a new sample here (I tried to decrypt it with the same issue). The password, as the filename suggests, is "test". password_is_test.zip

MrCrumbs avatar Dec 13 '20 06:12 MrCrumbs