# Didier Stevens

## Tuesday 17 May 2011

### Another PDF Puzzle

Filed under: Forensics,PDF,Puzzle — Didier Stevens @ 8:23

As I’m going to give my workshop on analysis of malicious PDFs at HiTB Amsterdam this Thursday, I thought I would share a PDF puzzle/challenge I made for BSidesLondon.

And as there is write-up for the solution to this puzzle on a blog, I’ll link to this in the comments next week. Since you can just Google the solution, there is no prize this time.

## 12 Comments »

1. 130817

Comment by Enn — Tuesday 17 May 2011 @ 9:05

2. First of March was a nice evening

Comment by Thomas — Tuesday 17 May 2011 @ 9:26

3. […] Stevens ha pubblicato un altro pdf […]

Pingback by PDF Puzzle Solution (anteprima) | Gianni Amato — Tuesday 17 May 2011 @ 10:23

4. haha got it! I must be learning something after all!

Comment by Struan — Tuesday 17 May 2011 @ 11:35

5. I have got the answer. 65408500 , but no Prize :-(

Comment by Manoj Venugopalan — Tuesday 17 May 2011 @ 13:08

6. I have got the answer : 65408500, but no prizes :-(

Comment by vmanojnair — Tuesday 17 May 2011 @ 13:17

7. var a = [2, 3, 1, 1];
var b = [2, 5, 131, 2347];
var c, d;
var e = Math.floor(20110421111705);
var f = e;
for (c = 0; c < a.length; c++)
for (d = 0; d < a[c]; d++)
f = f / b[c];

if (130817 == f)
alert('The provided code is correct, your answer is: ' + e / b[2] / b[3]);
else
alert('The provided code is wrong: ' + f);

Comment by 0xeb — Tuesday 17 May 2011 @ 13:54

8. 130817

Comment by Kiran Bandla — Tuesday 17 May 2011 @ 15:07

9. 2011/03/01 18:45:00
65408500 ?

Comment by Ludo — Tuesday 17 May 2011 @ 16:18

10. 20110301184500

Comment by pende — Wednesday 18 May 2011 @ 2:13

11. answer is 65408500 but the key is proper creation date: 20110301184500

Comment by Roman — Thursday 19 May 2011 @ 12:34

12. The solution is:

If you edit the PDF file (it’s pure ASCII) and replace 20110421111705
with 20110301184500, and then open the PDF file with a reader that
supports JavaScript, winning code 65408500 will be displayed.
You don’t actually need a PDF reader, you can also calculated the
result manually after having reverse engineered the script.

Comment by Didier Stevens — Monday 23 May 2011 @ 21:00

The Rubric Theme. Blog at WordPress.com.