Didier Stevens

Tuesday 17 May 2011

Another PDF Puzzle

Filed under: Forensics,PDF,Puzzle — Didier Stevens @ 8:23

As I’m going to give my workshop on analysis of malicious PDFs at HiTB Amsterdam this Thursday, I thought I would share a PDF puzzle/challenge I made for BSidesLondon.

You can download it here.

And as there is write-up for the solution to this puzzle on a blog, I’ll link to this in the comments next week. Since you can just Google the solution, there is no prize this time.

12 Comments »

  1. 130817

    Comment by Enn — Tuesday 17 May 2011 @ 9:05

  2. First of March was a nice evening

    Comment by Thomas — Tuesday 17 May 2011 @ 9:26

  3. [...] Stevens ha pubblicato un altro pdf [...]

    Pingback by PDF Puzzle Solution (anteprima) | Gianni Amato — Tuesday 17 May 2011 @ 10:23

  4. haha got it! I must be learning something after all!

    Comment by Struan — Tuesday 17 May 2011 @ 11:35

  5. I have got the answer. 65408500 , but no Prize :-(

    Comment by Manoj Venugopalan — Tuesday 17 May 2011 @ 13:08

  6. I have got the answer : 65408500, but no prizes :-(

    Comment by vmanojnair — Tuesday 17 May 2011 @ 13:17

  7. var a = [2, 3, 1, 1];
    var b = [2, 5, 131, 2347];
    var c, d;
    var e = Math.floor(20110421111705);
    var f = e;
    for (c = 0; c < a.length; c++)
    for (d = 0; d < a[c]; d++)
    f = f / b[c];

    if (130817 == f)
    alert('The provided code is correct, your answer is: ' + e / b[2] / b[3]);
    else
    alert('The provided code is wrong: ' + f);

    Comment by 0xeb — Tuesday 17 May 2011 @ 13:54

  8. 130817

    Comment by Kiran Bandla — Tuesday 17 May 2011 @ 15:07

  9. 2011/03/01 18:45:00
    65408500 ?

    Comment by Ludo — Tuesday 17 May 2011 @ 16:18

  10. 20110301184500

    Comment by pende — Wednesday 18 May 2011 @ 2:13

  11. answer is 65408500 but the key is proper creation date: 20110301184500

    Comment by Roman — Thursday 19 May 2011 @ 12:34

  12. The solution is:

    If you edit the PDF file (it’s pure ASCII) and replace 20110421111705
    with 20110301184500, and then open the PDF file with a reader that
    supports JavaScript, winning code 65408500 will be displayed.
    You don’t actually need a PDF reader, you can also calculated the
    result manually after having reverse engineered the script.

    Detailed solution:

    https://4armed.wordpress.com/2011/04/15/solving-the-security-bsides-london-challenge-number-2/

    Comment by Didier Stevens — Monday 23 May 2011 @ 21:00


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Rubric Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 236 other followers

%d bloggers like this: