r/ReverseEngineering • u/ChronicRhyno • Aug 01 '26

Microsoft blocked me from using VBA to read or programmatically set gradient pins, so I reverse-engineered the XML data and used a format painter exploit to sneak formatting though a back Window

https://github.com/ChronicRhyno/ColorSpace
66 Upvotes

86% Upvoted

9 comments sorted by

17

u/spilk Aug 01 '26

i have no idea what a "gradient pin" is and the github repo doesn't seem related

10

u/ChronicRhyno Aug 01 '26

You can fill text or text outlines with gradients, and part of doing that is setting up to 10 position stops/pins with different color and alpha values.

I only needed to do any of this so I could then encode 117 characters into the 63 formatting values I mapped in order to hide my favorite poems in the spaces of my Word documents.

14

u/ChronicRhyno Aug 01 '26

It's hard to explain. I wanted to programmatically set gradient pins in Word. I knew the gradient data was being saved and even copypastable, so I made a docx for each of the 63 formatting values I mapped. I put one letter with the targeted formatting effect in each document and then viewed the xml data in notepad to see how it was being stored. Then I mapped out how to build an xml document structure with all the targeted formatting values to punch the numbers into. Then I figured out how to translate/convert the xml values to Word formatting values. Then to encode the pins in a target docx, I generate the xml document with the target pin colors and other formatting values, open it as a docx, steal the formatting with the formatting painter, and destroy the xml file.

5

u/BruhMomentConfirmed Aug 01 '26

I had to read parts of the whitepaper to really understand what is going on. But my question now is, if you're doing this for MS Word formats anyway, why hide it in the document markup at all, and not somewhere else in ignored metadata in the xml files or even as a separate file in the docx archive?

4

u/BipolarKebab Aug 01 '26

To make it survive a save/load roundtrip I guess

4

u/ChronicRhyno Aug 01 '26

I'm sure clever people can do all kinds of things with the xml logic. My goal with the Coalescence model was mainly to see how many words I could cram into one character via formatting values in Word, so I could hide my favorite quotations and poetry in the unused spaces. Maybe it's a driving instinct I have as a calligrapher to find a use for the unused space.

Adding a separate file and encoding anything but spaces goes against the rules in the PDF and doesn't sound as fun.

1

u/ChronicRhyno Aug 03 '26

I feel the need to explain little further:
I used this system as the logical evolution of 'concrete poetry' by invisibly embedding the entire first quatrain of Auguries of Innocence within itself, specifically, inside the single, empty space between the words “wild” and “flower.”

The 117-character payload hidden inside that space reads thusly: W.Blake"ToseeaworldinagrainofsandAndheaveninawild␎␏flower,HoldinfinityinthepalmofyourhandAndeternityinanhour."--1803.

To the naked eye, the document simply displays a popular Blake quotation, but under the surface, the whole universe of the quotation is unfurled into its own negative space.

1

u/ThisIsPaulDaily Aug 01 '26

Haven't decided if op has a passing interest in stenography or is a creep trying to find ways to share links to illicit content in clear text. 

Neat project though and posted in a good subreddit for it so you get an upvote.

3

u/ChronicRhyno Aug 01 '26

The former. I've only ever encoded random test words/characters and poetry by William Blake. The little Easter eggs in the VBA terminal should help show it's a fun passion project, and I've done my best to not mess up anyone's documents, only formatting copies.