Tool / Command for decrypting in source code of a PDF file?

Question

I am using the qpdf command to view the raw code (source code) of PDF files. Specifically I am using the command:

 qpdf  --qdf  original.pdf  unpacked.pdf

However a lot of PDF metadata is encrypted in this unpacked file and has a lot of unprintable ASCII charactars. I am interested in some data of pdf files which is actually encrypted. Assuming that I have the password for the pdf file (say pwd="passwd"), how can I get an output similar to the output of the qpdf command, but where data has been decrypted?

Edit:

An example file is attached in the link. Please check lines 1841 - 3258. Specifically, in the whole file I am not able to find the TransformParams dictionary, although I have added permissions. I believe it may be inside this encrypted text.

Link:

https://www.mediafire.com/file/b7rf383zxdevgmx/unpacked.txt/file

@mkl I did. It doesn't seem to be decrypting anything though. — Anon, Apr 20 '21 at 20:56
In that case those *unprintable* characters probably aren't encrypted at all but merely encoded in a way that surprises you. Please share an example file and point exactly to some data you perceive as encrypted. — mkl, Apr 20 '21 at 21:39

score 2 · Accepted Answer · answered Apr 21 '21 at 07:54

As already assumed in a comment to the question, the PDF file is not encrypted at all.

Please check lines 1841 - 3258

The lines 1841 - 3258 are part of a stream from line 1739 (OTTO...) to 3258 and contain an embedded OpenType font, compare the preceding stream dictionary

57 0 obj
<<
  /Subtype /OpenType
  /Length 58 0 R
>>

and the font descriptor referring to it:

<<
  /Ascent 952
  /CapHeight 674
  /CharSet (/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quotesingle/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/grave/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/bullet/Euro/bullet/quotesinglbase/florin/quotedblbase/ellipsis/dagger/daggerdbl/circumflex/perthousand/Scaron/guilsinglleft/OE/bullet/Zcaron/bullet/bullet/quoteleft/quoteright/quotedblleft/quotedblright/bullet/endash/emdash/tilde/trademark/scaron/guilsinglright/oe/bullet/zcaron/Ydieresis/space/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/hyphen/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis)
  /Descent -250
  /Flags 32
  /FontBBox [
    -157
    -250
    1126
    952
  ]
  /FontFamily (Myriad Pro)
  /FontFile3 57 0 R
  /FontName /MyriadPro-Regular
  /FontStretch /Normal
  /FontWeight 400
  /ItalicAngle 0
  /StemV 88
  /Type /FontDescriptor
  /XHeight 484
>>

Specifically, in the whole file I am not able to find the TransformParams dictionary, although I have added permissions.

Well, the shared version of the file neither is encrypted (so no permissions have to be applied) nor is it digitally signed (so in particular there are no signature transform methods applied, so no TransformParams are there).

Maybe the information you search have been removed by uncompressing the PDF with qpdf, maybe they weren't there to start with. Thus, you probably should analyze the original file instead. Or you may want to explain your expectations more thoroughly, maybe there is an error in them.

Yes the mistake I made was that I thought that an electronic sign and a digital sign were the same thing... so the document wasn't actually digitally signed. It works for a digitally signed pdf with qpdf now. Thanks. — Anon, Apr 21 '21 at 17:34
Yes. Beware, though, this differentiation *electronic signature* vs. *digital signature* is not yet canon (even though it is common). So, when dealing with such signatures one often still has to clarify what exactly is meant. — mkl, Apr 21 '21 at 18:00
I had another question on pdf's here: https://stackoverflow.com/questions/67207153/how-do-pdf-readers-validate-form-fields Could you maybe take a look (I'm not sure if the pdf community at stack overflow is big enough to take note of my question). — Anon, Apr 22 '21 at 05:19
I'll take a look. Just a hint, though: there apparently are some misconceptions to clear up. — mkl, Apr 22 '21 at 07:41

Tool / Command for decrypting in source code of a PDF file?

1 Answers1