> -----Original Message----- > From: Jason Pyeron <[email protected]> > Sent: Sunday, December 1, 2019 10:26 AM > To: [email protected] > Subject: RE: finding dictionary where entry is direct? > > > -----Original Message----- > > From: Tilman Hausherr <[email protected]> > > Sent: Sunday, December 1, 2019 12:02 AM > > To: [email protected] > > Subject: Re: finding dictionary where entry is direct? > > > > Am 30.11.2019 um 23:28 schrieb Jason Pyeron: > > >> From: Tilman Hausherr [mailto:[email protected]] > > >> Sent: Friday, November 29, 2019 11:21 PM > > >> > > >> Hi, > > >> You can see it in PDFDebugger because indirect objects have something > > >> like > > >> [19 0 R] in the tree, and direct objects don't. > > > Yes, got that. > > > > > > The issue is which dictionary contains the non-indirect entry. > > > > I have often used NOTEPAD++ to look into PDFs... If it is direct then it > > is on the left, i.e. without a new object with "19 0 obj". > > Thanks, the instructions should be helpful for future searches, the issue is > I am trying to find where > in PDFBox structures it is.
The sample [https://issues.apache.org/jira/secure/attachment/12987252/pdfbox-4702-signed-PDFBOX-Tilman.pdf] is a DocMDP certification, the issue is with FieldMDP. > > > > > 19 0 obj > > << > > /dic2key <</key2 value2 /key3 /value3>> > > >> > > endobj > > > > "dic2key" here has a value which is a direct object which is a > > dictionary "<</key2 value2 /key3 /value3>>". > > > hexdump.exe -vC test-acrobat.pdf > ... > 00001f10 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a |endstream.endobj| > 00001f20 0d 34 36 20 30 20 6f 62 6a 0d 3c 3c 2f 42 79 74 |.46 0 obj.<</Byt| > 00001f30 65 52 61 6e 67 65 5b 20 30 20 38 30 36 32 20 31 |eRange[ 0 8062 1| > 00001f40 35 35 38 38 20 35 31 39 33 5d 20 20 20 20 20 20 |5588 5193] | > 00001f50 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | | > 00001f60 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | | > 00001f70 20 20 20 20 20 2f 43 6f 6e 74 65 6e 74 73 3c 33 | /Contents<3| > 00001f80 30 38 32 30 62 32 65 30 36 30 39 32 61 38 36 34 |0820b2e06092a864| > 00001f90 38 38 36 66 37 30 64 30 31 30 37 30 32 61 30 38 |886f70d010702a08| > > > Vs > $ hexdump.exe -vC test_signed.pdf | less > ... > 00005060 3e 0a 2f 56 20 3c 3c 0a 2f 54 79 70 65 20 2f 53 |>./V <<./Type /S| > 00005070 69 67 0a 2f 46 69 6c 74 65 72 20 2f 41 64 6f 62 |ig./Filter /Adob| > 00005080 65 2e 50 50 4b 4c 69 74 65 0a 2f 53 75 62 46 69 |e.PPKLite./SubFi| > 00005090 6c 74 65 72 20 2f 61 64 62 65 2e 70 6b 63 73 37 |lter /adbe.pkcs7| > 000050a0 2e 64 65 74 61 63 68 65 64 0a 2f 4e 61 6d 65 20 |.detached./Name | > 000050b0 28 50 59 45 52 4f 4e 2e 4a 41 53 4f 4e 2e 4a 2e |(PYERON.JASON.J.| > 000050c0 31 32 39 31 31 34 37 37 31 39 29 0a 2f 50 72 6f |1291147719)./Pro| > 000050d0 70 5f 42 75 69 6c 64 20 3c 3c 0a 2f 41 70 70 20 |p_Build <<./App | > 000050e0 3c 3c 0a 2f 4e 61 6d 65 20 2f 41 64 6f 62 65 23 |<<./Name /Adobe#| > 000050f0 32 30 41 63 72 6f 62 61 74 23 32 30 52 65 61 64 |20Acrobat#20Read| > 00005100 65 72 23 32 30 44 43 0a 2f 52 20 31 32 35 30 35 |er#20DC./R 12505| > 00005110 36 30 0a 2f 54 72 75 73 74 65 64 4d 6f 64 65 20 |60./TrustedMode | > 00005120 74 72 75 65 0a 2f 52 45 78 20 28 32 30 31 39 2e |true./REx (2019.| > 00005130 30 32 31 2e 32 30 30 35 36 29 0a 2f 4f 53 20 5b |021.20056)./OS [| > 00005140 2f 57 69 6e 5d 0a 3e 3e 0a 2f 46 69 6c 74 65 72 |/Win].>>./Filter| > 00005150 20 3c 3c 0a 2f 44 61 74 65 20 28 4f 63 74 20 31 | <<./Date (Oct 1| > 00005160 31 20 32 30 31 39 20 32 31 3a 30 35 3a 33 34 29 |1 2019 21:05:34)| > 00005170 0a 2f 4e 61 6d 65 20 2f 41 64 6f 62 65 2e 50 50 |./Name /Adobe.PP| > 00005180 4b 4c 69 74 65 0a 2f 52 20 31 33 31 31 30 34 0a |KLite./R 131104.| > 00005190 2f 56 20 32 0a 3e 3e 0a 2f 50 75 62 53 65 63 20 |/V 2.>>./PubSec | > 000051a0 3c 3c 0a 2f 44 61 74 65 20 28 4f 63 74 20 31 31 |<<./Date (Oct 11| > 000051b0 20 32 30 31 39 20 32 31 3a 30 35 3a 33 34 29 0a | 2019 21:05:34).| > 000051c0 2f 4e 6f 6e 45 46 6f 6e 74 4e 6f 57 61 72 6e 20 |/NonEFontNoWarn | > 000051d0 74 72 75 65 0a 2f 52 20 31 33 31 31 30 35 0a 3e |true./R 131105.>| > 000051e0 3e 0a 3e 3e 0a 2f 4d 20 28 44 3a 32 30 31 39 31 |>.>>./M (D:20191| > 000051f0 32 30 31 31 30 30 30 31 34 2d 30 35 27 30 30 27 |201100014-05'00'| > 00005200 29 0a 2f 52 65 66 65 72 65 6e 63 65 20 5b 3c 3c |)./Reference [<<| > 00005210 0a 2f 54 79 70 65 20 2f 53 69 67 52 65 66 0a 2f |./Type /SigRef./| > 00005220 54 72 61 6e 73 66 6f 72 6d 4d 65 74 68 6f 64 20 |TransformMethod | > 00005230 2f 46 69 65 6c 64 4d 44 50 0a 2f 54 72 61 6e 73 |/FieldMDP./Trans| > 00005240 66 6f 72 6d 50 61 72 61 6d 73 20 36 35 20 30 20 |formParams 65 0 | > 00005250 52 0a 2f 44 61 74 61 20 32 31 20 30 20 52 0a 3e |R./Data 21 0 R.>| > 00005260 3e 0a 5d 0a 2f 43 6f 6e 74 65 6e 74 73 20 3c 33 |>.]./Contents <3| > 00005270 30 38 30 30 36 30 39 32 41 38 36 34 38 38 36 46 |08006092A864886F| > 00005280 37 30 44 30 31 30 37 30 32 41 30 38 30 33 30 38 |70D010702A080308| > > > > > Can you share the PDF? I don't understand what you mean with "performing > > a validation fails". > > > > I whipped up a more simple test case: > https://issues.apache.org/jira/secure/attachment/12987244/pdfbox-4702.pdf > > It has a test.pdf - base file, test-acrobat.pdf - signed by acrobat reader > DC, and test_signed.pdf - > signed by PDFBox supported code. > > > Tilman > > > > > > > > > >> Re signatures, there are many things that can go wrong... changes between > > >> direct / indirect in revisions are bad, not handling locked fields is > > >> bad (see > > >> recent answer on stackoverflow) > > >> > > >> Does the file validate with ShowSignature.java? > > > Yes, that is not the issue. It shows as unmodified in Acrobat, but > > > performing a validation fails. > > > > > >> Tilman > > >> > > >> Am 29.11.2019 um 22:16 schrieb Jason Pyeron: > > >>> I am trying to track down differences between Acrobat and PDFBox with > > >> regards to digital signatures. > > >>> I have made much progress in eliminating differences, but I am still > > >>> getting > > >> the dreaded "Bad parameter" when validating the signature. > > >>> While I cannot find the reference to quote right now, I seem to remember > > >> that certain entries must be direct and other certain entries must not be > > >> direct in certain dictionaries. > > >>> I am inspecting the two PDFs signed by PDFBox and Acrobat, and I clearly > > >> see that PDFBox is making Root/AcroForm/Fields/[0]/Kids/[0]/Kids/[16]/V > > >> direct, whereas Acrobat is indirect. My question is what is the best way > > >> to > > >> find which dictionary it is directly stored in? Started with hex editor, > > >> and it is > > >> not fun :( . > > >>> v/r, > > >>> > > >>> Jason Pyeron > > >>> > > >>> -- > > >>> Jason Pyeron | Architect > > >>> PD Inc | > > >>> 10 w 24th St | > > >>> Baltimore, MD | > > >>> > > >>> .com: [email protected] > > >>> tel : 202-741-9397 > > >>> > > >>> > > >>> > > >>> > > >>> --------------------------------------------------------------------- > > >>> To unsubscribe, e-mail: [email protected] For > > >>> additional commands, e-mail: [email protected] > > >>> > > >> > > >> --------------------------------------------------------------------- > > >> To unsubscribe, e-mail: [email protected] For additional > > >> commands, e-mail: [email protected] > > > > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: [email protected] > > > For additional commands, e-mail: [email protected] > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
