embedd

embedd

The embedd utility is used to embed a file into a block device (or just other file). It may be used to hide secret data on disks. For instance, you can utilize a USB flash drive and create a "normal" file system like NTFS or FAT where already stored some data. Then, at the end of the physical space of the USB drive, you can store secret data.

To embed secret data:

echo 'my secret data' | aespipe -e AES256 -H sha512 > ./secret.aes
# aespipe -e AES256 -H sha512 < ./my_photos.tar.xz > ./secret.aes

./.bin/embedd p -o -512 ./secret.aes /dev/sdd1

tail -c 512 file | huxd
#   0    01 10 35 fd 26 e2 3e 1b  b4 17 f0 5b ae 93 ff a8
#  10    ca 3e 00 00 00 00 00 00  00 00 00 00 00 00 00 00

This command will write the header + file to /dev/sdd1 at an offset of 512 from the end.

To extract the embedded data back, you need to know the offset where you embedded it before:

./.bin/embedd x -o -512 ./extracted.aes /dev/sdd1

cmp ./extracted.aes ./secret.aes; echo $?
# 0

WARNING: Attempting to use all disk space on the USB flash drive may corrupt the embedded file. Also, embedding a file at an offset where the actual file system already stores data will result in file system corruption.

This works similar to how Veracrypt's hidden volume works.

usage

# ./.bin/embedd -h
./.bin/embedd: embed file to device

Usage: ./.bin/embedd [-hf] [-l <level>]

-h: print this help text
-l <level>: set log level (NONE, CRITICAL, ERROR, WARNING, [INFO], DEBUG)
-f: increase force, 1 to not ask basic quesions, 3 to not ask before writing to device

Subcommands:
  x: extract file to `out-file` from `device`
  p: put `input-file` to `device`



# ./.bin/embedd x -h
x: extract file to `out-file` from `device`

Usage: x [-h] [-o <offset>] out-file device

-h: print this help text
-o <offset>: offset from start (negative to offset from end)



# ./.bin/embedd p -h
p: put `input-file` to `device`

Usage: p [-h] [-o <offset>] input-file device

-h: print this help text
-o <offset>: offset from start (negative to offset from end)

how to build

to build this you need hare, it is super small, simple and fast so you can compile it with single make:

make -C .hare

and to build embedd with hare

make RELEASE=1
# ls -l .bin/embedd

final executable will be in .bin

header format

• 1 byte: size_len (value from 1 to 8)
• size_len bytes (big-endian unsigned integer): file_size (actual file size)
• file_size bytes: actual file

For example, to store a size from 1 to 255, only 1 byte is needed. So, the header for a file size of 123 will look like this: 01 7b. For sizes from 255 to 65536, 2 bytes are needed (size: 567, header 02 02 37), and so on. ```