Whitespace Steganography Extractor

It reads files made by the Whitespace Steganography Hider. Auto-detect tries each of the four methods for a "WSST" header (magic bytes, method, flags, a 16-bit length of at most 65,535 bytes and a CRC-8). A header with a valid CRC-8 is accepted, and the Extractor then reads the number of bytes it states. A CRC-8 is a checksum against accidental changes: it does not authenticate the header and does not cover the message, so if the whitespace was altered after the header, the bytes can come back wrong even though the header passed. Only an AES-encrypted message is checked end to end, by AES-GCM itself.

If no header is found, Auto-detect tries the SNOW-style raw format, then reads Trailing Space/Tab (space = 0, tab = 1), Inter-Word, Line Ending and Tab Indentation bits without a header. It looks only at the first 512 bytes and keeps the longest candidate whose readability score is above 0.5 and that passes one of three checks: a PDF, ZIP, PNG or JPEG signature, a flag shape such as CTF{...}, or at least 10 readable characters at the start. That last step is a heuristic, labelled a guess in the result, not proof that anything is hidden: the longest candidate is not necessarily the right one, and ordinary whitespace patterns can occasionally pass. In our test (300 synthetic texts of 80 lines with random single or double spaces, trailing spaces or tabs and stray carriage returns, each read five ways: Auto-detect and the four methods one by one) nothing was reported as hidden data in 1,500 readings. That describes that test set, not real-world texts, and is not a guarantee. A hidden file's name is restored only when the Hider stored it (files, not typed text, in the WSST format, flag bit 5).

This extractor was not built to read files made by the real SNOW program, which has its own bit packing and cipher; none was tested here. If your puzzle came from the real snow program, use that program (snow -C file) on a desktop. For other puzzles built on spaces, tabs or line endings, Manual mode with each method in turn sometimes finds readable text.

Work down this list. (1) Is it the original file? Copy-paste through a browser, editor or chat app often trims trailing whitespace or collapses spaces; upload the .txt file instead. (2) Was the file truncated? A header that promises more bytes than the text holds is reported as truncated rather than as a result. (3) Is it encrypted? Enter the password. (4) Try Manual mode with each method. (5) The text may simply have ordinary trailing spaces — compare with 'Show whitespace' before concluding anything is hidden.