Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 1 Jan 2013 01:47:28 +0530
From: Dhiru Kholia <>
Subject: Re: npdf2john

On Tue, Jan 1, 2013 at 1:20 AM, shane Shane
<> wrote:
> I completed a new version of npdf2john in ruby:
> It's a lot smaller about 165 lines of code and easier to understand than
> original perl. I'll port it to python later in the week

Awesome! We could use both Ruby and Python versions. Solar will still
demand a Perl or C version ;)

I will start testing it. I want to get rid of older pdf format as soon
as possible and rename npdf to pdf.

> but there was one part of the output which I
> didn't understand and was
> wondering if anyone could shed light on it.
> "$npdf$4*4*128*-1028*1*16*e03460febe17a04 ....."
> That 1 is the same for every pdf I have passed through the original tool &
> the perl code is a bit  beyond me so I anyone knows and could let me know so I can finish it and
> start the port to python.

This "1" part means metadata is encrypted (This part / flag is called
encrypt_metadata in npdf_fmt_plug.c).

encrypt_metadata flag can be 0 or 1.

> Also if there's anything else to do with document cracking that you want me
> to do just let me know :)

We could use some help on analysis of LastPass database format
(probably requires some reverse engineering).

If this doesn't interest you, see and pick up a task.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.