Colliding password protected MS office 97-2003 documents

[epixoip]

?b?b?b?b?b is not for the collision, but for cracking the RC4 key. Once you know the RC4 key, you have the first five bytes of the MD5|SHA1 hash. You then collide that hash to find a password that works.

Note the last step is not strictly necessary. You could simply use the RC4 key to decrypt the document without the password.