Results 1 to 6 of 6

Thread: How can I check quickly if a pdf is decrypted right?

  1. #1

    How can I check quickly if a pdf is decrypted right?

    Of course I can open it but software like Elcomsoft pdf cracker seems to determine very fast if it's the right key.

    Any idea?

  2. #2

    read the specs

    In the specs (check the Adobe site) there is a description of how to detect the correct password, with a complete algorithm. Essentially, the password is transformed to a key (using a document specific salt, mostly, via hashing) and then a known plaintext (16 or 32 bytes, depending on the document for recent variants, there are more ways to encrypt) is encrypted with that key, and the result is stored in the encrypted PDF. The check for a password checks that the result is that known/ computed plaintext.

  3. #3
    There must be some kind of mechanism with a password protected pdf but we need the (non-'Standard') Security handler protection. For that I haven't found a mechanism for it. You might check if strings are in an allowed threshold but with unicode and chinese characters that doesn't have to work .

  4. #4

    What handler?

    Don't most security handlers also have some checkdata like normal password protected (via the standard methods) have? What security handler are you talking about?
    I do believe all must have such a check, for the reasons you described.

    Otherwise you could decompress a compressed part (after decryption), and then watch for errors.

  5. #5
    Quote Originally Posted by sikke View Post
    Otherwise you could decompress a compressed part (after decryption), and then watch for errors.
    Of course you can see it if you manually open it but how can you deterministically automate this?

  6. #6

    Again, what handler?

    Quote Originally Posted by joblack View Post
    Of course you can see it if you manually open it but how can you deterministically automate this?
    Please provide details of the handler in question. I'm convinced there is an easy check somewhere.

    Do you know how to decrypt it (programmatically) when you have the correct password?
    If so, you could try to decrypt and then decompress (e.g. using Deflate, using zlib) some object.
    If you get an error, you have the wrong password.

Similar Threads

  1. How is this guy stepping through Olly so quickly?
    By Sunk in forum The Newbie Forum
    Replies: 6
    Last Post: December 22nd, 2011, 07:04
  2. Delphi RE for obtain decrypted data
    By zgrp in forum The Newbie Forum
    Replies: 5
    Last Post: December 1st, 2004, 19:30
  3. CRC check
    By SilSaLaMaTa in forum Malware Analysis and Unpacking Forum
    Replies: 18
    Last Post: March 5th, 2004, 14:01
  4. How to get IDA sig files quickly for lots of Delphi units
    By Solomon in forum Tools of Our Trade (TOT) Messageboard
    Replies: 4
    Last Post: April 25th, 2003, 15:37
  5. CRC check reversing -- Please Help !!!
    By Clandestiny in forum Malware Analysis and Unpacking Forum
    Replies: 8
    Last Post: October 14th, 2001, 06:01

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •