View Full Version : Confused by behavior of two pdfs w/permissions passwords, but no open passwords/DRM

12-21-2009, 02:21 PM
1.I have two pdf files w/the following behavior, which I'll call file A and file B.

-These files can be opened on any computer w/any user w/o needing a password (so there is no certificate security or adobe content server type security).

-Since I can open the files w/o a password, that means there is no (Open Password), and they do have (Permissions Passwords) since I cant modify the documents. Also, looking at properties within adobe shows me that the security method is password security and can be opened by adobe 6 or later.

-there does not appear to be any 3rd party encryption.

-file A and file B can be opened and read in adobe acrobat 8 and adobe reader 9. However, when using Foxit 3 to open them, file A looks normal, but file B looks completely blank

2.When I use standard password removal software (eg, PDF password cracker, not using brute-force) on file A, the software claims that password removal is successful.The resulting file can now be modified, and is still readable in Acrobat, Reader, and Foxit.

-When I use standard password removal software on file B, the software claims that password removal is successful. HOWEVER, while the resulting file can now be modified, it is useless every page is blank, whether I use adobe or foxit to open and read it

3.Per instructions in this thread: ,

Both files appear to have Standard - Password Security

Because daesdaemar asked me to....

At the simplest level a PDF file is a collection of numbered objects. The objects themselves will tend to be streams of data ( such as the text run, graphics, or fonts) or dictionaries (structures which contained formatted data that describe the document).

If you look at PDF file you'll tend to see a lot of the following:
1 0 obj ...object data...
2 0 obj ...object data...
3 0 obj ...object data...

The objects themselves are organized by a cross reference table which lists the offsets for the document, and also has a trailer dictionary which list the object numbers important objects. One of those objects is the encryption dictionary, which must exist if the document is encrypted.

So, opening the PDF file in a good text editor (on the Mac I really like BareBones' TextWrangler) search for the string "/Encrypt" which if the file is encrypted should take you to the trailer dictionary which will look something like

<</Size 1910/Root 1426 0 R/Encrypt 1908 0 R/Info 1421 0 R/ID[<5081abdd2bdafc8f4748b307de4c8eff><29c91bdce6e8e5478905ab5d6890c7eb>]>>

If all you want to know is if the PDF file is encrypted, you can stop here - it is encrypted. If you want to know more about how it is encrypted you'll need to find the "Encryption Dictionary", so you'll want to note the object number from the trailer dictionary (1908 in the case above), and search for that object by starting at the beginning of the file and looking for "<object number> 0 obj" (ie "1908 0 obj")

1908 0 obj<</Filter/EBX_HANDLER/V 1/EBX_TITLE(Book Title)/>>

Of the most interest in the encryption dictionary will be the /Filter value, which will tell you which security handler was used to encrypt the file. Common values are:

Standard - Password Security
EBX_HANDLER - Adobe Content Server (aka SecurePDF - most eBooks)
PubSec - Certificate Security

From file A:

712 0 obj<</R 3/Length 80/Filter/Standard/O(+V~z`; *> A
8@<fg\(Rٮ)/P -64/U(\([\n\r %v

From file B:

279 0 obj <</Length 80/CF<</StdCF<</Length 10/AuthEvent/DocOpen/CFM/V2>>>>/Filter/Standard/O(+V~z`; *> A
8@<fg\(Rٮ)/P -64/R 4/U(m\\H%-N

What am I missing here?