+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: PDF 1.1 - 1.3 no ID part (/thread-10697.html)
PDF 1.1 - 1.3 no ID part - _maddog_ - 03-31-2022
Could it be that the ID part is empty?
Okay from the beginning:
pdf2john.py => File not encrypted
pdf2john.pl => $pdf$1*2*40*4294967239*1*0**32* ....
pdfinfo => $pdf$1*2*40*-57*1*0**32* ....
hashcat -a 3 -m 10400 '$pdf$1*2*40*-57*1*0**32*...'
=> Token length exception
Regarding the source code module_10400.c
token.len_min[6] = 2;
token.len_max[6] = 2;
token.len_min[7] = 32;
token.len_max[7] = 32;
Is that a failure inside the source code? What would be the salt if this is correct?
hashcat -a 3 -m 10400 '$pdf$1*2*40*-57*1*00*00000000000000000000000000000000*32*....'
=> Salt value exception
hashcat -a 3 -m 10400 '$pdf$1*2*40*-57*1*16*00000000000000000000000000000000*32*....'
=> is currently running. If this is intended should the "module_10[467][012]0.c" be modified or pdf2john?
I know the user_pw if it helps.