Didier Stevens

Thursday 3 June 2010

A Win7 Puzzle…

Filed under: Puzzle — Didier Stevens @ 20:15

I’m presenting you a little puzzle…

The prize is a Windows 7 Ultimate license. Unless you don’t care for Windows, then you get a sticker ;-)

The puzzle contains a text. Find it and post it in a comment to this post. You don’t have to be the first with the correct text to win. This challenge will run for a week, and I’m randomly selecting a winner from all the correct entries.

Comments are moderated and will not appear as long as the challenge is on.

Download the puzzle and find the text.

117 Comments »

  1. De Ultieme Hallucinatie

    Comment by @regnil — Thursday 3 June 2010 @ 20:37

  2. /Type /Action

    /S /Launch

    /Win /F (cmd.exe)

    Comment by Bharat Jogi — Thursday 3 June 2010 @ 20:50

  3. De Ultieme Hallucinatie

    Comment by cketti — Thursday 3 June 2010 @ 21:00

  4. The text contained in the PDF is:

    DeUltiemeHallucinatie

    Damn, that was fun. Very evil to hide this in 101Mb of nothing ;).

    Cheers and see you at BruCON,

    Patrick

    Comment by courts — Thursday 3 June 2010 @ 21:46

  5. Text is “De Ultieme Hallucinatie”

    http://pastebin.com/Qyw6NKZg

    Comment by Dominic — Thursday 3 June 2010 @ 22:30

  6. DeUltiemeHallucinatie

    neat! I don’t need to be drawn ;)

    Comment by jindroush — Thursday 3 June 2010 @ 22:41

  7. allucinatie

    Comment by boss.ssg — Thursday 3 June 2010 @ 22:50

  8. “De Ultieme Hallucinatie” (I decided to trim surrounding whitespace.)

    Comment by Nagy Ferenc László — Thursday 3 June 2010 @ 23:07

  9. De Ultieme Hallucinatie

    Comment by apolkosnik — Thursday 3 June 2010 @ 23:46

  10. De Ultieme Hallucinatie

    Comment by Dion — Friday 4 June 2010 @ 0:13

  11. I think the string is ‘De Ultieme Hallucinatie’, embedded at offset 0xCED522 in a twice-compressed stream (which, when fully decompressed, is 100mb in length) inside the pdf, a stream which otherwise consisted entirely of whitespace. Thanks for the puzzle, I enjoyed it :).

    Comment by Fiach Antaw — Friday 4 June 2010 @ 0:34

  12. fear:0:w7p$ cat deflate.rb
    #!/usr/bin/env ruby
    require ‘zlib’
    data = File.open(“win7-puzzle.pdf”, “rb”) { |fd| fd.read }[0x273, 0x18d]
    2.times {
    data = Zlib::Inflate.inflate(data)
    }
    puts data.strip
    fear:0:w7p$ ./deflate.rb
    De Ultieme Hallucinatie
    fear:0:w7p$

    What does this have to do with Windows 7?

    Comment by jduck — Friday 4 June 2010 @ 1:51

  13. [...] View full post on Didier Stevens [...]

    Pingback by A Win7 Puzzle… | Computer Security Articles — Friday 4 June 2010 @ 2:30

  14. “De Ultieme Hallucinatie” or translated to English as “The Ultimate Hallucination”. Is that what your looking for? ;)

    Comment by Jeremy — Friday 4 June 2010 @ 3:29

  15. UseDogEars
    :)

    Comment by Dillon Beresford — Friday 4 June 2010 @ 4:01

  16. if that was a T-Shirt I’d probably jump to see what’s happening in Brussel, Koningsstraat 316 but for Win7.. pche ;)

    Comment by Roman — Friday 4 June 2010 @ 6:25

  17. DeUltiemeHallucinatie

    Comment by Kiran Bandla — Friday 4 June 2010 @ 6:55

  18. De Ultieme Hallucinatie

    Twice zlib-decompression, but we get a pretty big file….
    BTW, xpdf spills the beans in the error messages…

    Comment by Henno Brandsma — Friday 4 June 2010 @ 7:08

  19. I think it is double compressed text:
    “De Ultieme Hallucinatie”

    Uncle Google says it is the name of restaurants in Brussel…

    Best Regards,
    Anton Todorov

    Comment by Anton Todorov — Friday 4 June 2010 @ 7:23

  20. 100mb file with hex ’20′ – space

    lemme know if I’ve got it right ;) Not sure if there’s any text :S Couple of flatedecode’s decoded and all I get is 100mb file with spaces….

    Comment by binaryhax0r — Friday 4 June 2010 @ 7:39

  21. De Ultieme Hallucinatie

    Comment by JC Sirot — Friday 4 June 2010 @ 7:42

  22. DeUltiemeHallucinatie

    Method used to extract the string:
    - Have a look at the file using a text editor
    - Use hex editor to save the stream of obj 5 to a binary file
    - Open file with Python and decompress with zlib.decompress()
    - Run zlib.decompress() again on the result. This gives 104857623 bytes of data
    - Have a look at the file contents. Only whitespace visible.
    - Run .replace(” “, “”) on the resulting string
    - Result is ‘DeUltiemeHallucinatie\n’

    Comment by Dirk Loss — Friday 4 June 2010 @ 7:58

  23. De Ultieme Hallucinatie

    Comment by Ange — Friday 4 June 2010 @ 8:11

  24. De Ultieme Hallucinatie

    Comment by lofi — Friday 4 June 2010 @ 8:16

  25. We believe this was not intended to be a serious challenge – rather some sort of statistics check out. Still, from the point of view of person who have only tidbits of format knowledge and have never actually picked inside any pdf structure before (and who’s here mainly to be in touch with another category of security trends), that puzzle was quite intresting.
    Oh, and the hidden text is “De Ultieme Hallucinatie”, name of the restaurant in Belgium as Google suggests. Well, unless there’s something else out there, that’s it ;)

    Comment by Anonymous — Friday 4 June 2010 @ 8:22

  26. cinatie – I think I was sleeping – “I Taw, I Taw a Putty Tat”

    Comment by binaryhax0r — Friday 4 June 2010 @ 8:24

  27. blank!

    Comment by Frank Peacock — Friday 4 June 2010 @ 8:36

  28. De Ultieme Hallucinatie

    Extracted stream out of PDF with Hex editor and saved to test.zip. Didn’t found good PDF decoder for Python 3.

    Python 3 code to decode test.zip ;-).

    {{
    import zlib

    fp = open(‘c:\\test.zip’,’rb’)
    data = fp.read();
    fp.close()

    print (“compressed message:”, repr(data))

    decompressed_message = zlib.decompress(data,15,397)
    decompressed_message2 = zlib.decompress(decompressed_message,15,397)

    string_data = decompressed_message2.decode()
    stripped_data = string_data.strip()

    fp = open(‘c:\\test.out’,’wb’)
    fp.write(stripped_data.encode());
    fp.close()

    }}

    Comment by DDT — Friday 4 June 2010 @ 8:47

  29. DeUltiemeHallucinatie

    Comment by Elias Bachaalany — Friday 4 June 2010 @ 8:52

  30. “De Ultieme Hallucinatie”

    PDF is missing “endobj” tag for object 5, making pdf-parser.py to fail. You can add the missing tag or use hex editor to extract the stream to another file and feed it to zlib twice. You’ll get output file 100 megabytes of spaces and the string “De Ultieme Hallucinatie” at offset 0×3200000.

    Comment by kao — Friday 4 June 2010 @ 8:56

  31. Or more correctly: De Ultieme Hallucinatie

    Comment by Elias Bachaalany — Friday 4 June 2010 @ 8:58

  32. I solved it after Elias (who did it manually with python) with my PDF Insider (to test my tool). With a tool it’s very easy, takes only 1 minute.

    Solution is: De Ultieme Hallucinatie

    Comment by Daniel Pistelli — Friday 4 June 2010 @ 9:02

  33. DeUltiemeHallucinatie

    Comment by Kevin — Friday 4 June 2010 @ 9:06

  34. Hi,

    After downloading the challenge file, I opened it with a Hex viewer to check the actual contents matches the extension.

    The PDF appears valid, pages are defined in object 3 0, with the actual page description in object 4 0. From this description we notice the indirect reference to the contents in object 5 0, and that it uses a standard built-in font with no character transpositions (object 6 0).

    The page contents itself is in a stream in object 5 0, with a double (!) Flate filter. Actual stream data starts at file offset 627, and has a length of 397 bytes.

    Armed with this knowledge, a simple PHP script has been written to extract this stream data and decompress it. Finally, it outputs the resulting message both on screen and writes the entire decompressed stream into a file.

    The text hidden in the PDF file is this: De Ultieme Hallucinatie

    The script used to process the PDF file can be found below:

    <?
    /*
    
    Object of interest:
    
    5 0 obj
    <>
    
    */
    	define('FILE_NAME', 'win7-puzzle.pdf');
    	define('STREAM_OFFSET', 627);
    	define('STREAM_LENGTH', 397);
    	define('FILE_STREAM_OUT', 'stream_data.dat');
    	define('FILE_STREAM_OUT_DEC', 'stream_data.dat.dec');
    	
    	/* Get only the binary data from the stream object 5 0 */
    	$f = fopen(FILE_NAME, 'r');
    	fseek($f, STREAM_OFFSET);
    	$stream = fread($f, STREAM_LENGTH);
    	fclose($f);
    
    	/* Output the compressed data stream */
    	//file_put_contents(FILE_STREAM_OUT, $stream);
    
    	/* Double Flate. Output the decompressed data stream. The output is big(!) */
    	$stream = gzuncompress(gzuncompress($stream), 300000000);
    	file_put_contents(FILE_STREAM_OUT_DEC, $stream);
    
    	/* Delete the ton of spaces and print the resulting message: "De Ultieme Hallucinatie" */
    	$stream = htmlentities(trim($stream));
    	echo $stream;
    ?>
    

    Comment by Catalin Ionescu — Friday 4 June 2010 @ 10:03

  35. Answer: De Ultieme Hallucinatie

    Missing endobj on obj #05
    Result of: pdf-parser.py -f is 100 MB pdf, looking at 50% and found answer :)

    Comment by Radosław Kotowicz — Friday 4 June 2010 @ 10:08

  36. My “shell” solution:
    $ od -tx1 -v -j0x273 win7-puzzle.pdf|cut -b9-|xxd -r -ps |zpipe -d > qq
    $ zpipe -d qq2
    $ tr -d ‘ ‘ < qq2
    DeUltiemeHallucinatie

    0×41414141.com has a very nice set of similar puzzles, I recommend it if you haven't tried it yet.

    Regards,
    rz

    Comment by rz — Friday 4 June 2010 @ 10:19

  37. De Ultieme Hallucinatie, as far as I can see. Actually, quite an interesting steganography.

    Comment by Stefano Taschini — Friday 4 June 2010 @ 11:37

  38. contentOfObject5 = zlib.decompress(contentOfObject5)
    contentOfObject5 = zlib.decompress(contentOfObject5)
    paddingChar = ‘ ‘
    sys.stdout.write(‘text is [')
    dataLen = len(contentOfObject5);
    for i in range(dataLen):
    if contentOfObject5[i] != paddingChar:
    sys.stdout.write(contentOfObject5[i])
    # print spaces inside string
    elif i != 0 and i != dataLen – 1 and contentOfObject5[i - 1] != paddingChar and contentOfObject5[i + 1] != paddingChar:
    sys.stdout.write(contentOfObject5[i])
    sys.stdout.write(‘]\n’)

    outputs: text is [De Ultieme Hallucinatie]

    Comment by stratinian — Friday 4 June 2010 @ 11:46

  39. desperately wanna sticker :)

    Comment by stratinian — Friday 4 June 2010 @ 11:57

  40. Either I am dumb or the Foxit Reader can’t read the PDF.. :P Unless the puzzle is to read it .. :P

    Comment by olszak — Friday 4 June 2010 @ 12:26

  41. ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************

    Comment by vizzdoom — Friday 4 June 2010 @ 12:30

  42. The hidden text is “De Ultieme Hallucinatie”

    Comment by unknow — Friday 4 June 2010 @ 12:31

  43. De Ultieme Hallucinatie

    Comment by adzinok — Friday 4 June 2010 @ 12:31

  44. ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************
    ********************<<**************************

    ************************************************************************

    Comment by voldy — Friday 4 June 2010 @ 12:33

  45. De Ultieme Hallucinatie

    Easy ;>

    Comment by clondike — Friday 4 June 2010 @ 13:00

  46. ” ” – I’ve discovered sth like this.

    Comment by rxmeister — Friday 4 June 2010 @ 13:08

  47. (spaces with 260 chars length)

    Comment by rxmeister — Friday 4 June 2010 @ 13:08

  48. De Ultieme Hallucinatie

    Comment by Slaweck — Friday 4 June 2010 @ 13:40

  49. trailer

    Comment by PSZEMKOWSKi — Friday 4 June 2010 @ 13:53

  50. De Ultieme Hallucinatie

    I found it fun :)
    And I learnt some things while having fun! :)

    Comment by evilteq — Friday 4 June 2010 @ 13:57

  51. DeUltiemeHallucinatie

    Comment by Rainer Kleinrensing — Friday 4 June 2010 @ 15:22

  52. Hi,

    Thanks but no thanks ;-)

    Strange PDF’s, ummm I wonder what that might do to my PC? :-)

    Kind Regards

    Simon

    Comment by Simon Zerafa — Friday 4 June 2010 @ 16:13

  53. DeUltiemeHallucinatie

    Comment by maceip — Friday 4 June 2010 @ 17:03

  54. De Ultieme Hallucinatie

    Comment by Paul Baccas — Friday 4 June 2010 @ 17:06

  55. De Ultieme Hallucinatie
    or The Ultimate Hallucination
    That was pretty tricky making it so that your own tools don’t work on it. Very nice puzzle!

    Comment by Tommy — Friday 4 June 2010 @ 17:31

  56. #give me my sticker
    import zlib
    pdf = file(‘win7-puzzle.pdf’,’r’).read()
    stream = pdf[pdf.find('stream')+8:pdf.find('endstream')-1]
    print zlib.decompress(zlib.decompress(stream)).strip()

    Comment by feliam — Friday 4 June 2010 @ 19:01

  57. text in pdf – ‘De Ultieme Hallucinatie’

    Comment by Tadeusz Deker — Friday 4 June 2010 @ 19:13

  58. The text is just a lot of spaces, 100Mb spaces.

    Comment by Anton Scheffer — Friday 4 June 2010 @ 19:31

  59. btw. greetings from Poznan (Poland) :)

    Comment by Tadeusz Deker — Friday 4 June 2010 @ 19:35

  60. a sticker for me is OK.

    Comment by DDT — Friday 4 June 2010 @ 19:39

  61. De Ultieme Hallucinatie

    Comment by Anton Scheffer — Friday 4 June 2010 @ 20:35

  62. Any hints? Is it a word or a whole sentence?

    Comment by Mike — Friday 4 June 2010 @ 20:52

  63. Your puzzle acts very strange on a Windows XP box…

    Open your file with Notepad and go to this spot:

    5 0 obj
    <>

    Change it to this (add another /FlateDecode):

    5 0 obj
    <>

    Now save the document and watch the file disappear. For some reason, I’m not able to save the document after make that change. If I remove one character from /FlateDecode then I can save the document. I’ll have to investigate more but I thought I would share.

    Comment by Darryl — Friday 4 June 2010 @ 21:02

  64. Is it “De Ultieme Hallucinatie” ?

    Comment by Tyler — Friday 4 June 2010 @ 21:07

  65. De Ultieme Hallucinatie

    Comment by TheShade — Friday 4 June 2010 @ 22:32

  66. Salut Didier,

    “De Ultieme Hallucinatie”
    2 minutes avec Origami ;)

    A+

    Comment by Guillaume Delugré — Saturday 5 June 2010 @ 0:35

  67. Found the text “De Ultieme Hallucinatie” among a whole lot of spaces

    Comment by Andrew McRae — Saturday 5 June 2010 @ 4:09

  68. “De Ultieme Hallucinatie”

    Comment by Justin Prosco — Saturday 5 June 2010 @ 5:10

  69. “N/A “

    Comment by jim — Saturday 5 June 2010 @ 8:02

  70. I can’t get it to work/start.
    Foxit PDF reader just hangs and a online PDF viewer wont show it ether.

    Other than that, Thanks for a great blog.

    Comment by Mikael — Saturday 5 June 2010 @ 14:54

  71. At first sight there seems to be a zlib blob, I will research a little bit more.

    Comment by Knyghte — Saturday 5 June 2010 @ 19:28

  72. Ok, to be more precise, it should of course be:

    De Ultieme Hallucinatie

    mind the spaces ;).

    Cheers, Patrick

    Comment by courts — Saturday 5 June 2010 @ 20:21

  73. De Ultieme Hallucinatie

    Comment by Hal — Saturday 5 June 2010 @ 22:33

  74. it’s a bit scary to open PDF’s from you :)
    BTW is this a hidden ad of Win7??

    Comment by NA — Sunday 6 June 2010 @ 10:56

  75. Hi Didier,
    that’s “De Ultieme Hallucinatie”, isn’t it?
    Nice puzzle, a missing endobj to fool your pdf-parser + a zip of death with 100MB of spaces. ;-)
    I used an editor and a few lines of python to solve it:

    First extract the stream from object 5 to a file.
    Then inflate it twice, and remove extra spaces:

    import sys, zlib
    data = open(sys.argv[1]).read()
    data2 = zlib.decompress(data)
    print zlib.decompress(data2).replace(‘ ‘, ”)

    Comment by decalage — Sunday 6 June 2010 @ 11:31

  76. My code got mixed up when posting my previous comment, here’s a fixed version:

    import sys, zlib
    data = open(sys.argv[1]).read()
    data2 = zlib.decompress(data)
    print zlib.decompress(data2).replace(“\x20\x20″, “”)

    Comment by decalage — Sunday 6 June 2010 @ 11:35

  77. Didier,

    The answer is:
    DeUltiemeHallucinatie

    The puzzle file poses two challenges, format irregularities that foil off-the-shelf PDF readers. The 5th object stream does not have an “endstream” where expected, and it has two /FlateDecode entries in the /Filter array. Ignoring the endstream, and inflate-decoding twice, yields about 100MB of uncompressed data, most of which is spaces. Filtering the spaces out yields the answer.

    Thanks for the enjoyable puzzle. By the way, the parser I used was originally inspired by the your python tools for manipulating PDF attachments.

    Comment by Leo Dorrendorf — Sunday 6 June 2010 @ 15:04

  78. De Ultieme Hallucinatie

    Comment by Dany — Sunday 6 June 2010 @ 16:44

  79. Hello Didier,

    after a double inflate I get the following text:

    De Ultieme Hallucinatie

    I’m afraid I’m late to visit it, since I’ve not been to Brussels yet. Is it going to be opened again?

    Nice blog!
    ramandi

    Comment by ramandi — Sunday 6 June 2010 @ 16:55

  80. DeUltiemeHallucinatie

    Comment by stig — Sunday 6 June 2010 @ 21:43

  81. Answer: DeUltiemeHallucinatie

    Solution: pretty easy, inflate two times (/Filter [/FlateDecode /FlateDecode]) the Flate’d data from pdf, and filter out spaces.
    Looking forward to a real tough pdf puzzle :)

    Comment by vos — Sunday 6 June 2010 @ 21:46

  82. DeUltiemeHallucinatie

    Comment by Paul Lowen — Sunday 6 June 2010 @ 21:58

  83. Hi there!

    The text I’ve found is ‘De Ultieme Hallucinatie’…

    Cheers!

    Comment by Jose — Monday 7 June 2010 @ 7:07

  84. De Ultieme Hallucinatie

    (using pdftk and a bit of emacs)

    Comment by Jasper Spaans — Monday 7 June 2010 @ 8:28

  85. “De Ultieme Hallucinatie”

    But I cheated, I haven’t figured out how to fix the mangled PDF yet…

    Comment by olle — Monday 7 June 2010 @ 8:40

  86. De Ultieme Hallucinatie

    Comment by Lukasz Juszczyk — Monday 7 June 2010 @ 9:10

  87. De Ultieme Hallucinatie

    Nice restaurant btw ;)

    Comment by Demarche — Monday 7 June 2010 @ 11:21

  88. De Ultieme Hallucinatie

    Comment by Demarche — Monday 7 June 2010 @ 11:22

  89. “De Ultieme Hallucinatie” :)

    Comment by Jaromir Veber — Monday 7 June 2010 @ 11:56

  90. Hi Didier Stevens, I love your blog!
    I think about the sticker but the license of Win7 Ultimate is also ok.

    The hidden text is: DeUltiemeHallucinatie.

    Comment by nauj27 — Monday 7 June 2010 @ 13:11

  91. So, how about this?
    52428800 spaces followed by “De Ultieme Hallucinatie” then followed by 52428800 spaces?

    Comment by apolkosnik — Monday 7 June 2010 @ 14:57

  92. De Ultieme Hallucinatie

    Comment by Opikanoba — Monday 7 June 2010 @ 15:55

  93. De Ultieme Hallucinatie

    Comment by Chris Bumgarner — Monday 7 June 2010 @ 18:27

  94. d.ToUR[@{P

    Comment by Jason — Monday 7 June 2010 @ 18:51

  95. x·m\=K[a·Gac···/q·E··8YPE·]$·b’·
    qn]\:6·AFJw
    u·\+·[>@6L···El]··C&%Vs·N·d>.i·sMC/~rW:
    L~i····^·=H····!Wh~··y~··Wo?l····Cnwfz<=

    8Y\{y5z:~pw9oA···U;j···
    ··
    @(·······`····D”·····A·····@,·······`···
    ·Dr\o5·O··v`zj”····Z·#k·-5′g>Q·

    Comment by Jason — Monday 7 June 2010 @ 18:54

  96. i··{/·Gs·····d.ToUR[@{P·

    Comment by Jason — Monday 7 June 2010 @ 18:58

  97. Hello,

    It may not be the correct answer, but here is the text I found in your puzzle:
    “De Ultieme Hallucinatie”

    If I am wrong, I have at least heard about a good hôtel/restaurant in Brussels :)

    Comment by Vincent — Monday 7 June 2010 @ 21:37

  98. :) ‘De Ultieme Hallucinatie’

    Comment by Anonymous — Tuesday 8 June 2010 @ 9:27

  99. ‘De Ultieme Hallucinatie’

    Comment by wg5 — Tuesday 8 June 2010 @ 9:28

  100. De Ultieme Hallucinatie

    Comment by Tom Daniels — Tuesday 8 June 2010 @ 16:49

  101. De Ultieme Hallucinatie

    :]

    Comment by lordparody — Tuesday 8 June 2010 @ 17:51

  102. De Ultieme Hallucinatie

    Double FlateDecoded, used PHP gzinflate() and “trim”ed out the whitespace to keep my mac from crashing…So much whitespace.

    Comment by Tyler McLeod — Wednesday 9 June 2010 @ 18:20

  103. De Ultieme Hallucinatie

    Comment by pierrezero — Wednesday 9 June 2010 @ 19:19

  104. De Ultieme Hallucinatie

    A famous Art Nouvau café in Brussels? Translate – ultimate hallucination?

    Comment by bill mcgowan — Wednesday 9 June 2010 @ 19:34

  105. De Ultieme Hallucinatie – I didn’t post the complete answer earlier :P

    import zlib
    import sys

    __doc__ = “””

    Tested with Python version 2.6.4
    Rip the encoded data with your favorite editor and use this script to decode

    “””

    args = sys.argv

    if len(args) != 3:
    print(“Usage python.exe “+args[0]+” “)
    exit(0)

    input = args[1]
    output = args[2]

    file_read = open(input,’r’)
    buffer = file_read.read()
    decomp = zlib.decompress(buffer)
    file_write = open(output,’w’)
    file_write.write(decomp)

    Comment by binaryhax0r — Thursday 10 June 2010 @ 11:41

  106. and who won than license? :)

    Comment by T. — Thursday 10 June 2010 @ 13:45

  107. @T I e-mailed the winner, will disclose details when I get a reply.

    Comment by Didier Stevens — Thursday 10 June 2010 @ 14:20

  108. Vincent (comment 97) is the winner.

    Comment by Didier Stevens — Thursday 10 June 2010 @ 17:32

  109. Next time please put a sheep ascii art in there… It’ll make the day for the defcon ctf playing crowd.

    Comment by apolkosnik — Thursday 10 June 2010 @ 18:24

  110. What’s wrong with my answer? In challenges, all methods are good ways, I do not understand why my answer is not valid.

    I opened the pdf with okular, the KDE pdf reader, and the result was:

    [n0p@soukee tmp]$ okular win7-puzzle.pdf
    okular(3076)/kdecore (KConfigSkeleton) KCoreConfigSkeleton::writeConfig:
    okular(3076)/kdecore (KConfigSkeleton) KCoreConfigSkeleton::writeConfig:
    okular(3076)/kdecore (KConfigSkeleton) KCoreConfigSkeleton::writeConfig:
    Error (909): Unknown operator ‘De’
    Error: Unknown operator ‘Ultieme’
    Error: Unknown operator ‘Hallucinatie’
    Error (909): Unknown operator ‘De’
    Error: Unknown operator ‘Ultieme’
    Error: Unknown operator ‘Hallucinatie’
    Error (909): Unknown operator ‘De’
    Error: Unknown operator ‘Ultieme’
    Error: Unknown operator ‘Hallucinatie’

    solution: De Ultieme Hallucinatie

    Comment by n0p — Friday 11 June 2010 @ 8:57

  111. @n0p There’s nothing wrong with your solution, who says it’s wrong?

    Comment by Didier Stevens — Friday 11 June 2010 @ 9:03

  112. ok, I was thinking my answer was not considered as valid because I don’t see the comment I posted last week with it.

    Comment by n0p — Friday 11 June 2010 @ 12:56

  113. ok Didier, I think there is a problem with my comments (maybe the antispam?) because my answer posted last week is not published, and my other message posted some hours ago is not posted either. Which is why I thought my answer was not considered as valid.

    Comment by n0p — Friday 11 June 2010 @ 22:46

  114. Thank you Didier for giving us this puzzle. It gives us another opportunity to learn this type of puzzle.
    Indeed the output is De Ultieme Hallucinatie

    Thanks to the tool pdftk.

    More puzzles to come.

    Comment by Yaggi — Thursday 17 June 2010 @ 0:48

  115. azizan@xps:/opt$ ruby pdf_content.rb ~/Desktop/win7-puzzle.pdf
    “De Ultieme Hallucinatie”
    azizan@xps:/opt$

    Comment by azizan — Friday 18 June 2010 @ 4:42

  116. [...] the Win7 Puzzle Filed under: PDF,Puzzle — Didier Stevens @ 9:39 The Win7 puzzle is actually a “PDF bomb”, something I’ve hinted at long ago but I hadn’t [...]

    Pingback by Solving the Win7 Puzzle « Didier Stevens — Friday 25 June 2010 @ 9:39

  117. pdftotext win7-puzzle.pdf
    Error (902): Unknown operator ‘De’
    Error: Unknown operator ‘Ultieme’
    Error: Unknown operator ‘Hallucinatie’

    Comment by Anonymous — Friday 10 September 2010 @ 12:26


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Rubric Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 221 other followers

%d bloggers like this: