Adobe ADEPT DRM for PDF circumvented

[JohnTheRipper]

The problem is that the PDF is limited to a unique whole print of the book. How can I use Nuance printer if I already print the ebook?

[RobbieClarken]

Originally Posted by JohnTheRipper

The problem is that the PDF is limited to a unique whole print of the book. How can I use Nuance printer if I already print the ebook?

Sorry, I haven't encountered this restriction so I'm not sure if it's possible to get around it.

[JohnTheRipper]

Unfortunately for me:

V number (Optional but strongly recommended) A code specifying the algorithm to be used in encrypting
and decrypting the document:
0 An algorithm that is undocumented and no longer supported, and whose use is
strongly discouraged.
1 Algorithm 3.1 on page 73, with an encryption key length of 40 bits; see below.
2 (PDF 1.4) Algorithm 3.1 on page 73, but allowing encryption key lengths greater
than 40 bits.
3 (PDF 1.4) An unpublished algorithm allowing encryption key lengths ranging
from 40 to 128 bits. (This algorithm is unpublished as an export requirement of
the U.S. Department of Commerce.)

[joblack]

Originally Posted by JohnTheRipper

Unfortunately for me:

V number (Optional but strongly recommended) A code specifying the algorithm to be used in encrypting
and decrypting the document:
0 An algorithm that is undocumented and no longer supported, and whose use is
strongly discouraged.
1 Algorithm 3.1 on page 73, with an encryption key length of 40 bits; see below.
2 (PDF 1.4) Algorithm 3.1 on page 73, but allowing encryption key lengths greater
than 40 bits.
3 (PDF 1.4) An unpublished algorithm allowing encryption key lengths ranging
from 40 to 128 bits. (This algorithm is unpublished as an export requirement of
the U.S. Department of Commerce.)

V0 - V4 should work ...

[JohnTheRipper]

I have an PDF-1.4, EBX_HANDLER V 3 ebook and the ineptkey says "error decrypting book session key".

The text above is extracted from PDF Reference third edition Adobe Portable Document Format Version 1.4 (2001)

[joblack]

Perhaps you have a not working (e.g. some bugs) script ... try the vanilla version.

Also check out if you have a root element at the end ... if it is moved the an xref stream reference the script doesn't work but that is pdf 1.5 feature.

[JohnTheRipper]

This is the end of the file:


trailer
<</Size 1356/Root 1302 0 R/Encrypt 1354 0 R/Info 1300 0 R/ID[<21D9A1B03A6F84B90B439BF28D576856> <6C4C007A2C6F2D42B79A6DC58FF67A68>]/Prev 1561662>>
startxref
1591735
%%EOF

is this what you mean?

[JohnTheRipper]

And the beginning:

%PDF-1.4
%âãÏÓ

1 0 obj<</Contents 3 0 R/Type/Page/Parent 1259 0 R/Rotate 0/MediaBox[0 0 493 703]/CropBox[0 0 493 703]/Resources 2 0 R>>
endobj
2 0 obj<</ColorSpace<</Cs8 1167 0 R/Cs6 1166 0 R>>/Font<</F1 1170 0 R>>/ProcSet[/PDF/Text]/ExtGState<</GS2 1175 0 R>>>>
endobj
3 0 obj<</Length 283/Filter/FlateDecode>>stream

|›ÛêóžÈÑÐ^ïA\]AÙ©*·�úжúHa´.Òc©^÷ºt«iߣL¤êu
Ûk&
$yL´¬ÎÂ}ÄÆ7³“Š½l¿«Ý8mM«NAdæ73›M¥‹�jŠñY›º

[reader22]

Thank you so much for this. I've just converted all the pdf's with this. The ones ADE was willing to read anyway..

[joblack]

Originally Posted by JohnTheRipper

This is the end of the file:


trailer
<</Size 1356/Root 1302 0 R/Encrypt 1354 0 R/Info 1300 0 R/ID[<21D9A1B03A6F84B90B439BF28D576856> <6C4C007A2C6F2D42B79A6DC58FF67A68>]/Prev 1561662>>
startxref
1591735
%%EOF

is this what you mean?

Yes - the script has also sometimes parser errors. You need to be an absolute pdf expert to understand what is pdf conform and what isn't ...

[JohnTheRipper]

And what should I do? debug the script to see what is wrong?

It's supposed to decrypt the ADEPT_LICENSE>encryptedKey, and therefore all the streams...

[joblack]

Originally Posted by JohnTheRipper

And what should I do? debug the script to see what is wrong?

It's supposed to decrypt the ADEPT_LICENSE>encryptedKey, and therefore all the streams...

Sure but the structure at the end can be different in dependence of the pdf level. As newer levels aren't supported some modifications have to be made. I myself am not a pdf expert so I could fiddle with the dump method but that wouldn't actually create a conform pdf in all cases ...

[JohnTheRipper]

But the problem is that the dump method is never reached ('cos the ADEPTException), and the question is that the key is 127 bit long when it's RSA decrypted, that's wrong if I debug another PDF correctly decrypted which bookkey is 128-bit long...

PDFParser does his job correctly.

[joblack]

Originally Posted by JohnTheRipper

But the problem is that the dump method is never reached ('cos the ADEPTException), and the question is that the key is 127 bit long when it's RSA decrypted, that's wrong if I debug another PDF correctly decrypted which bookkey is 128-bit long...

PDFParser does his job correctly.

The problem is that the parser under some circumstances read some garbage data as the key. That's the reason why the script stops.

I would be interested to communicate with a pdf expert. I've got the knowledge over the script and he/she would have deep pdf format knowledge.

But I suppose that won't be happening so the only possible solution is to get more pdf knowledge and do it yourself.

Anyway, I have to say that ILC has made a very good job - there is a lot of deep knowledge in the script. I suppose he was/is in a pdf related job anyway.

[JohnTheRipper]

This is the encrypted key:

<encryptedKey>PDN/JFFoDC6XKdI1SOeOA3uLtgbaRmvGPf9gSwQOVOMvq3YQS/yDnTnx+oQoXR9lZF+V/pbGZ
g6UktG8iGSKG/6HrgyHIfnDo+6G4jqeX/0EEUunPS6O+h3SP56cvThtyaxVv0ayXhserM9cFY89KTTxcK0U bso0H4cqirlWR1c=</encryptedKey>

taken from the base64-decoded rights of the uncompressed ADEPT_LICENSE's xml. Then it applies an rsa decrypt, but it seems not to be correct. The ebx_V and ebx_type seems to be get ok (3 and 6). Actually, ineptpdf v2 decrypts but streams seems to be corrupted (i.e. not correctly decrypted) so I can see pages like in ADE.

Sure ILC has made a extremely good job, but part of the script is based on PDFParser from pdfminer..

I have no time now to reverse-engineer what ADE does when opens a DRM, it uses CRYPT32.DLL and CryptUnprotectData...

----------------

PDFMiner v20090824.
dumppdf said:

raise PDFEncryptionError('Unknown filter: param=%r' % param)
pdfminer.pdfparser.PDFEncryptionError: Unknown filter: param={'EBX_SELLER_URL': '', ...
... , 'Filter': /EBX_HANDLER, 'Length': 128, 'EBX_PUBLISHER_URL': '', 'V': 3}