Adobe ADEPT DRM for PDF circumvented

[joblack]

Originally Posted by JohnTheRipper

Hi joblack,

I was debugging the script, and found that the error was because of the lenght of the book session key in line 1196 (v3 of the script). Maybe there's something wrong in RSA decrypting so that the decryption of the streams does not work.

The RSA decryption is based in the AES key generated by ineptkey script. Maybe is not an AES CBC_MODE key for PDF older versions. i♥cabbages said that uses AES in CBC mode with a random IV... or maybe is not RSA with PKCS#1 v1.5 padding, who knows?

All of these questions influence the dump method, because my "decrypted" PDF has the correct structure.

Hey John

Perhaps that could be one solution for the problem

Bug fixes of pycrypto:
==========
2.1.0beta1


* Modified RSA.generate() to ensure that e is coprime to p-1 and q-1.
Apparently, RSA.generate was capable of generating unusable keys.
==========

Try it with a newer py crypto version.
---
It complains because the first item in the array isn't equal 02. I don't know why it compares it because in the PDF Reference nothing is mentioned about the 2 as a check value.

I haven't checked out the length but if the length is wrong as well (should be 16 Bytes) then something else got wrong.

A good idea from you ...

The Adobe PDF Reference reads a little bit cryptic so in the worst case someone has to dive into the assembly code of ADE (like ILC did).

You only use RSA for decrypting the main decryption key for the symmetric RC4 or AES decryption method who is doing the main work. Only using RSA would be too slow in processing (especially for ebook readers).

[imeagor]

to joblack, I have met a pdf file with drm decryption, however it can not be deprotected using present method given above. I have sent you a message about this, you can try.

[JohnTheRipper]

Hi joblack,

Bad news. I've compiled new version from pycrypto, as you posted, and even pdfminer but no luck. I've regenerated the key using ineptkey and put it into ineptpdf but same error ocurred.

I'll try to keep searching a solution for decryption (maybe it's not a problem of an update but a research of the decryption algorithm for older versions)...

[joblack]

Originally Posted by JohnTheRipper

Hi joblack,

Bad news. I've compiled new version from pycrypto, as you posted, and even pdfminer but no luck. I've regenerated the key using ineptkey and put it into ineptpdf but same error ocurred.

I'll try to keep searching a solution for decryption (maybe it's not a problem of an update but a research of the decryption algorithm for older versions)...

That's great news because you just eliminated an option.

See it that way, the Titanic needed several hours to sink to the ground and you can't expect to solve such a complex situation with a simple fix.

Delayed gratification and patience will bring us the solution - sooner or later.

[tagtog]

For informations:
The ebooks which have EBX_HANDLER V.3 128 byte have the problem "book key error"
And the ebooks which have EBX_HANDLER V.4 128 byte are decrypted fine.

[joblack]

Originally Posted by tagtog

For informations:
The ebooks which have EBX_HANDLER V.3 128 byte have the problem "book key error"
And the ebooks which have EBX_HANDLER V.4 128 byte are decrypted fine.

Good to know - I hope the 128 Bit decrypt algorithm isn't different from the 48 Bit one ... I will check that.

Btw. the plural of information is still information (it's different compared to the German language).

[joblack]

# ineptpdf5.pyw, version 5
(...)
# 5 - removing small bug with V3 ebooks (anon)
(...)

It can be found at the usual places .

Might most probably solve the book session key error. Might not solve the bookkey error (if not report in the forum). And it most probably won't solve the problem where the pdfs are decrypted correctly (without error message) but then can't be opened (this is a pdf creation problem).

[joblack]

Originally Posted by JohnTheRipper

Hi joblack,

I was debugging the script, and found that the error was because of the lenght of the book session key in line 1196 (v3 of the script). Maybe there's something wrong in RSA decrypting so that the decryption of the streams does not work.

The RSA decryption is based in the AES key generated by ineptkey script. Maybe is not an AES CBC_MODE key for PDF older versions. i♥cabbages said that uses AES in CBC mode with a random IV... or maybe is not RSA with PKCS#1 v1.5 padding, who knows?

All of these questions influence the dump method, because my "decrypted" PDF has the correct structure.

The book session key problem is (most probably) solved. The Bookkey error could be still a problem.

IMHO this error only occures if you have registered and activated your ADE on a website where they gave you a RC4, DES, Tripple DES or RC2 instead of an AES with CBC.

see at:

The algorithms that shall be used to encrypt the enveloped data in the PKCS#7 object are: RC4 with key lengths up to 256-bits, DES, Triple DES, RC2 with key lengths up to 128 bits, 128-bit AES in Cipher Block Chaining (CBC) mode, 192-bit AES in CBC mode, 256-bit AES in CBC mode. The PKCS#7 specification is in Internet RFC 2315, PKCS #7: Cryptographic Message Syntax, Version 1.5 (see the Bibliography).

Anyway, only time will show if the bookkey error will be resistant (I never had one in my bought ebooks - if you still have one after trying out the new version drop me a line).

[tagtog]

Originally Posted by joblack

# ineptpdf5.pyw, version 5
(...)
# 5 - removing small bug with V3 ebooks (anon)
(...)

It can be found at the usual places .

Might most probably solve the book session key error. Might not solve the bookkey error (if not report in the forum). And it most probably won't solve the problem where the pdfs are decrypted correctly (without error message) but then can't be opened (this is a pdf creation problem).

Wawwwwwwwwwwww
Its WOOOooOOOrK,
Thank you Joblack;

Now we can Read And Print our ebooks; Which bought them at prices expensive.
Thank you Joblack for this release.

[krischik]

Originally Posted by joblack

It can be found at the usual places .

The usual search engines did not put anything up - are there any hints on where those "usual places" are?

Martin

[chorpler]

Originally Posted by krischik

The usual search engines did not put anything up - are there any hints on where those "usual places" are?

Martin

People usually post things at pastebin.com. You can search for things like "ineptpdf" there.

[JohnTheRipper]

Thank you very much joblack. I've seen changes from version 4, and these are changesin v5 (if ebx_V == 3: V = 3). I couldn't imagine such a change would make this script work.

Thanks joblack

[joblack]

Originally Posted by JohnTheRipper

Thank you very much joblack. I've seen changes from version 4, and these are changesin v5 (if ebx_V == 3: V = 3). I couldn't imagine such a change would make this script work.

Yes the actual change was really small but the 'overhead' to understand what's really going wrong is another story. Of course if you already have the solution it immediately gets crystal clear (at least if you have studied the script for a while).

[tagtog]

Now we can Automated The script "ineptpdf_auto_version5.pyw version 5"

Thank you Joblack

[joblack]

Originally Posted by tagtog

Now we can Automated The script "ineptpdf_auto_version5.pyw version 5"

Thank you Joblack

I want to wait until enough feedback is available (especially for the bookkey error).