Packages and Binaries:
snowdrop
Plain text watermarking and watermark recovery
Snowdrop provides reliable, difficult to remove steganographic watermarking of
text documents (internal memos, draft research papers, advisories and other
writing) and C sources (limited distribution software, licensed software,
or freely available code) so that:
(1) leaks can be identified if the data goes public.
(2) original source can be determined and demonstrated if part of the
document is claimed by somebody else, copied without permission, etc.
Snowdrop uses redundant steganography using four different logical
channels, and should be proof to many modifications, including reformatting,
spell checking and so on.
This package is useful in forensic investigations and security actions. It provides three commands: sd-eng, sd-engf and sd-c. sd-eng and sd-engf provide watermarking for draft-quality and fine-quality English language text documents, respectively, whereas sd-c provides experimental C source code watermarking.
Warning: Snowdrop is currently in beta, and may produce bad or corrupted results, especially when run on C source code.
Installed size: 203 KB
How to install: sudo apt install snowdrop
Dependencies:
- libc6
- libssl3t64
sd-c
Text watermarking and watermark recovery
root@kali:~# man sd-c
SNOWDROP(1) General Commands Manual SNOWDROP(1)
NAME
sd-eng, sd-engf, sd-c - text watermarking and watermark recovery
SYNOPSIS
sd-eng [-6] -i origfile newfile "Recipient" ["Comment"]
sd-eng [-6] -e origfile newfile
sd-eng [-6] -l
DESCRIPTION
snowdrop is a steganographic text watermarking and watermark recovery
system. It is composed of three programs:
sd-eng Watermark normal English text.
sd-engf
Watermark fine quality English text, yielding higher quality out-
put but encoding less information.
sd-c Watermark C code.
The three programs operate similarly, with the same parameters and us-
age. The watermark is encoded in using a number of techniques, such as
whitespace reformatting, typo insertation, word substitutions, punctua-
tion changes, and for C code, logic reordering, variable name mangling,
etc.
The watermark is a md5sum, which is retrievable from as little as 5 or
10 lines of the watermarked document. Even large changes to a medium
sized document should not obscure the watermark, as it is stored redun-
dantly in multiple independent channels.
The three usage modes are adding a watermark, checking for the presence
of a watermark, and listing the contents of your database of watermarks.
Note that to later check a watermark, you must retain a copy of the
original, un-watermarked file.
OPTIONS
-i Inject a watermark into a file. You must pass it the original
file, the filename to output the watermarked version to, informa-
tion about who you intend the watermarked file for, and an op-
tional comment.
-e Extract a watermark from a file. Needs the original file and the
new file that you suspect bears the watermark.
-l Lists the contents of the watermark database. Each of the three
programs will have a different list.
-6 Enable 64 bit watermarking. The default is a weak 32 bit water-
mark.
ENVIRONMENT
SD_SYNONYMS
This variable can be used to point snowdrop at a customized syn-
onyms file.
FILES
~/.snowdrop/database
Database of watermarked files.
SEE ALSO
/usr/share/doc/snowdrop/README.gz
Explain snowdrop in more depth, its limitations, and how to write
additional watermarking modules for other types of files.
AUTHOR
Michal Zalewski <[email protected]>
SNOWDROP(1)
sd-eng
Text watermarking and watermark recovery
root@kali:~# man sd-eng
SNOWDROP(1) General Commands Manual SNOWDROP(1)
NAME
sd-eng, sd-engf, sd-c - text watermarking and watermark recovery
SYNOPSIS
sd-eng [-6] -i origfile newfile "Recipient" ["Comment"]
sd-eng [-6] -e origfile newfile
sd-eng [-6] -l
DESCRIPTION
snowdrop is a steganographic text watermarking and watermark recovery
system. It is composed of three programs:
sd-eng Watermark normal English text.
sd-engf
Watermark fine quality English text, yielding higher quality out-
put but encoding less information.
sd-c Watermark C code.
The three programs operate similarly, with the same parameters and us-
age. The watermark is encoded in using a number of techniques, such as
whitespace reformatting, typo insertation, word substitutions, punctua-
tion changes, and for C code, logic reordering, variable name mangling,
etc.
The watermark is a md5sum, which is retrievable from as little as 5 or
10 lines of the watermarked document. Even large changes to a medium
sized document should not obscure the watermark, as it is stored redun-
dantly in multiple independent channels.
The three usage modes are adding a watermark, checking for the presence
of a watermark, and listing the contents of your database of watermarks.
Note that to later check a watermark, you must retain a copy of the
original, un-watermarked file.
OPTIONS
-i Inject a watermark into a file. You must pass it the original
file, the filename to output the watermarked version to, informa-
tion about who you intend the watermarked file for, and an op-
tional comment.
-e Extract a watermark from a file. Needs the original file and the
new file that you suspect bears the watermark.
-l Lists the contents of the watermark database. Each of the three
programs will have a different list.
-6 Enable 64 bit watermarking. The default is a weak 32 bit water-
mark.
ENVIRONMENT
SD_SYNONYMS
This variable can be used to point snowdrop at a customized syn-
onyms file.
FILES
~/.snowdrop/database
Database of watermarked files.
SEE ALSO
/usr/share/doc/snowdrop/README.gz
Explain snowdrop in more depth, its limitations, and how to write
additional watermarking modules for other types of files.
AUTHOR
Michal Zalewski <[email protected]>
SNOWDROP(1)
sd-engf
Text watermarking and watermark recovery
root@kali:~# man sd-engf
SNOWDROP(1) General Commands Manual SNOWDROP(1)
NAME
sd-eng, sd-engf, sd-c - text watermarking and watermark recovery
SYNOPSIS
sd-eng [-6] -i origfile newfile "Recipient" ["Comment"]
sd-eng [-6] -e origfile newfile
sd-eng [-6] -l
DESCRIPTION
snowdrop is a steganographic text watermarking and watermark recovery
system. It is composed of three programs:
sd-eng Watermark normal English text.
sd-engf
Watermark fine quality English text, yielding higher quality out-
put but encoding less information.
sd-c Watermark C code.
The three programs operate similarly, with the same parameters and us-
age. The watermark is encoded in using a number of techniques, such as
whitespace reformatting, typo insertation, word substitutions, punctua-
tion changes, and for C code, logic reordering, variable name mangling,
etc.
The watermark is a md5sum, which is retrievable from as little as 5 or
10 lines of the watermarked document. Even large changes to a medium
sized document should not obscure the watermark, as it is stored redun-
dantly in multiple independent channels.
The three usage modes are adding a watermark, checking for the presence
of a watermark, and listing the contents of your database of watermarks.
Note that to later check a watermark, you must retain a copy of the
original, un-watermarked file.
OPTIONS
-i Inject a watermark into a file. You must pass it the original
file, the filename to output the watermarked version to, informa-
tion about who you intend the watermarked file for, and an op-
tional comment.
-e Extract a watermark from a file. Needs the original file and the
new file that you suspect bears the watermark.
-l Lists the contents of the watermark database. Each of the three
programs will have a different list.
-6 Enable 64 bit watermarking. The default is a weak 32 bit water-
mark.
ENVIRONMENT
SD_SYNONYMS
This variable can be used to point snowdrop at a customized syn-
onyms file.
FILES
~/.snowdrop/database
Database of watermarked files.
SEE ALSO
/usr/share/doc/snowdrop/README.gz
Explain snowdrop in more depth, its limitations, and how to write
additional watermarking modules for other types of files.
AUTHOR
Michal Zalewski <[email protected]>
SNOWDROP(1)
Updated on: 2026-Mar-13