Comments on: A Little PDF Puzzle http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/ (blog 'DidierStevens) Tue, 09 Mar 2010 09:33:38 +0000 http://wordpress.com/ hourly 1 By: Solving a Little PDF Puzzle « Didier Stevens http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32257 Solving a Little PDF Puzzle « Didier Stevens Wed, 07 May 2008 08:22:13 +0000 http://didierstevens.wordpress.com/?p=385#comment-32257 [...] PDF — Didier Stevens @ 8:22 I’m quite pleased with the feedback I received for my Little PDF Puzzle, thanks [...] [...] PDF — Didier Stevens @ 8:22 I’m quite pleased with the feedback I received for my Little PDF Puzzle, thanks [...]

]]> By: PDF Puzzle - Trova la passphrase | Andrea Lazzari's blog http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32236 PDF Puzzle - Trova la passphrase | Andrea Lazzari's blog Tue, 06 May 2008 16:18:41 +0000 http://didierstevens.wordpress.com/?p=385#comment-32236 [...] Qui il link dove prendere altre info Lo citerò solo quando avrete trovato la soluzione [↩] Tags: [...] [...] Qui il link dove prendere altre info Lo citerò solo quando avrete trovato la soluzione [↩] Tags: [...]

]]> By: Some minutes of fun with pdf file « My infected computer http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32232 Some minutes of fun with pdf file « My infected computer Tue, 06 May 2008 12:41:24 +0000 http://didierstevens.wordpress.com/?p=385#comment-32232 [...] by zairon under Cryptography, General, Reverse Engineering   There was a challenge today at Didier Stevens’s blog . It’s a pdf puzzle, the goal is to find out the passphrase hidden inside the [...] [...] by zairon under Cryptography, General, Reverse Engineering   There was a challenge today at Didier Stevens’s blog . It’s a pdf puzzle, the goal is to find out the passphrase hidden inside the [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32231 Didier Stevens Tue, 06 May 2008 10:31:11 +0000 http://didierstevens.wordpress.com/?p=385#comment-32231 Excellent zairon. Delete everything after the first occurence of %%EOF, and you've recovered the previous version of the PDF document. And this version contains the passphrase. Excellent zairon. Delete everything after the first occurence of %%EOF, and you’ve recovered the previous version of the PDF document. And this version contains the passphrase.

]]> By: zairon http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32230 zairon Tue, 06 May 2008 10:19:20 +0000 http://didierstevens.wordpress.com/?p=385#comment-32230 No, we don't need an ascii85 decoder. Look at the file: - there are two Cross Reference tables - there are two streams - a pdf reader is able to show one stream only The encoded strings are similar, the initial part are the same. The initial part is used to specify some text's option (i.e. where to put the text). Second stream (text with xxx) will be written over the first one (text with password). In the end, to see the right text I removed some bytes from the end of the file. These are the bytes I did cut: 5 0 obj <> stream 6GQ(+?(u.+B2ko-rakk+E1b1F)Yf5@<6!&BlbD!=BJ[-=BJ[-=BJ[-=BJ[-=BI!p endstream endobj xref 0 1 0000000000 65535 f 5 1 0000000935 00000 n trailer <> startxref 1110 %%EOF No, we don’t need an ascii85 decoder.

Look at the file:
- there are two Cross Reference tables
- there are two streams
- a pdf reader is able to show one stream only

The encoded strings are similar, the initial part are the same. The initial part is used to specify some text’s option (i.e. where to put the text). Second stream (text with xxx) will be written over the first one (text with password).
In the end, to see the right text I removed some bytes from the end of the file. These are the bytes I did cut:

5 0 obj
<>
stream
6GQ(+?(u.+B2ko-rakk+E1b1F)Yf5@<6!&BlbD!=BJ[-=BJ[-=BJ[-=BJ[-=BI!p
endstream
endobj

xref
0 1
0000000000 65535 f
5 1
0000000935 00000 n
trailer
<>
startxref
1110
%%EOF

]]> By: Didier Stevens http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32229 Didier Stevens Tue, 06 May 2008 10:10:27 +0000 http://didierstevens.wordpress.com/?p=385#comment-32229 Congrats to all, the passphrase is indeed "Incremental Updates". "Incremental Updates" is a feature of the PDF language I want to highlight in a new post tomorrow. Now, which one of you didn't use an ASCII85 decoder (except for the one in your PDF reader)? You still have till tomorrow (GMT+2) to post a solution without using an external ASCII85 decoder (I suppose none of you can read ASCII85 :-) ). Congrats to all, the passphrase is indeed “Incremental Updates”. “Incremental Updates” is a feature of the PDF language I want to highlight in a new post tomorrow.

Now, which one of you didn’t use an ASCII85 decoder (except for the one in your PDF reader)? You still have till tomorrow (GMT+2) to post a solution without using an external ASCII85 decoder (I suppose none of you can read ASCII85 :-) ).

]]> By: Daniel Radu http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32227 Daniel Radu Tue, 06 May 2008 09:21:29 +0000 http://didierstevens.wordpress.com/?p=385#comment-32227 Hei, "The passphrase is Incremental Updates" :) Nice puzzle and hope to see more of these soon. Regards, Daniel Hei,

“The passphrase is Incremental Updates” :)

Nice puzzle and hope to see more of these soon.

Regards,
Daniel

]]> By: Roys http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32226 Roys Tue, 06 May 2008 09:13:22 +0000 http://didierstevens.wordpress.com/?p=385#comment-32226 Open the PDF and there's a part which says filter used for decoding the steam is ASCII85Decode. Use an online ASCII85 decoder to decode both streams in the PDF gives you the 20 character password :) Open the PDF and there’s a part which says filter used for decoding the steam is ASCII85Decode.

Use an online ASCII85 decoder to decode both streams in the PDF gives you the 20 character password :)

]]> By: pdp http://blog.didierstevens.com/2008/05/06/a-little-pdf-puzzle/#comment-32225 pdp Tue, 06 May 2008 09:12:51 +0000 http://didierstevens.wordpress.com/?p=385#comment-32225 <code>5 0 obj << /Length 89 /Filter /ASCII85Decode >> stream 6<#'\7PQ#@1a#b0+>GQ(+?(u.+B2ko-rakk+E1b1F)Yf5@<6!&BlbCgDI[]uD.RU,@;I&dE+EC!ATK:C<,*OE;u~> endstream endobj</code> which reads: The passphrase is Incremental Updates is that it? 5 0 obj
<<
/Length 89
/Filter /ASCII85Decode
>>
stream
6<#'\7PQ#@1a#b0+>GQ(+?(u.+B2ko-rakk+E1b1F)Yf5@<6!&BlbCgDI[]uD.RU,@;I&dE+EC!ATK:C<,*OE;u~>
endstream
endobj

which reads:
The passphrase is Incremental Updates

is that it?

]]>