> -----Original Message-----
> From: Jason Pyeron <[email protected]>
> Sent: Sunday, December 1, 2019 10:26 AM
> To: [email protected]
> Subject: RE: finding dictionary where entry is direct?
> 
> > -----Original Message-----
> > From: Tilman Hausherr <[email protected]>
> > Sent: Sunday, December 1, 2019 12:02 AM
> > To: [email protected]
> > Subject: Re: finding dictionary where entry is direct?
> >
> > Am 30.11.2019 um 23:28 schrieb Jason Pyeron:
> > >> From: Tilman Hausherr [mailto:[email protected]]
> > >> Sent: Friday, November 29, 2019 11:21 PM
> > >>
> > >> Hi,
> > >> You can see it in PDFDebugger because indirect objects have something 
> > >> like
> > >> [19 0 R] in the tree, and direct objects don't.
> > > Yes, got that.
> > >
> > > The issue is which dictionary contains the non-indirect entry.
> >
> > I have often used NOTEPAD++ to look into PDFs... If it is direct then it
> > is on the left, i.e. without a new object with "19 0 obj".
> 
> Thanks, the instructions should be helpful for future searches, the issue is 
> I am trying to find where
> in PDFBox structures it is.

The sample 
[https://issues.apache.org/jira/secure/attachment/12987252/pdfbox-4702-signed-PDFBOX-Tilman.pdf]
 is a DocMDP certification, the issue is with FieldMDP.

> 
> >
> > 19 0 obj
> > <<
> > /dic2key <</key2 value2 /key3 /value3>>
> >  >>
> > endobj
> >
> > "dic2key" here has a value which is a direct object which is a
> > dictionary "<</key2 value2 /key3 /value3>>".
> 
> 
> hexdump.exe -vC test-acrobat.pdf
> ...
> 00001f10  65 6e 64 73 74 72 65 61  6d 0d 65 6e 64 6f 62 6a  |endstream.endobj|
> 00001f20  0d 34 36 20 30 20 6f 62  6a 0d 3c 3c 2f 42 79 74  |.46 0 obj.<</Byt|
> 00001f30  65 52 61 6e 67 65 5b 20  30 20 38 30 36 32 20 31  |eRange[ 0 8062 1|
> 00001f40  35 35 38 38 20 35 31 39  33 5d 20 20 20 20 20 20  |5588 5193]      |
> 00001f50  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20  |                |
> 00001f60  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20  |                |
> 00001f70  20 20 20 20 20 2f 43 6f  6e 74 65 6e 74 73 3c 33  |     /Contents<3|
> 00001f80  30 38 32 30 62 32 65 30  36 30 39 32 61 38 36 34  |0820b2e06092a864|
> 00001f90  38 38 36 66 37 30 64 30  31 30 37 30 32 61 30 38  |886f70d010702a08|
> 
> 
> Vs
> $ hexdump.exe -vC test_signed.pdf | less
> ...
> 00005060  3e 0a 2f 56 20 3c 3c 0a  2f 54 79 70 65 20 2f 53  |>./V <<./Type /S|
> 00005070  69 67 0a 2f 46 69 6c 74  65 72 20 2f 41 64 6f 62  |ig./Filter /Adob|
> 00005080  65 2e 50 50 4b 4c 69 74  65 0a 2f 53 75 62 46 69  |e.PPKLite./SubFi|
> 00005090  6c 74 65 72 20 2f 61 64  62 65 2e 70 6b 63 73 37  |lter /adbe.pkcs7|
> 000050a0  2e 64 65 74 61 63 68 65  64 0a 2f 4e 61 6d 65 20  |.detached./Name |
> 000050b0  28 50 59 45 52 4f 4e 2e  4a 41 53 4f 4e 2e 4a 2e  |(PYERON.JASON.J.|
> 000050c0  31 32 39 31 31 34 37 37  31 39 29 0a 2f 50 72 6f  |1291147719)./Pro|
> 000050d0  70 5f 42 75 69 6c 64 20  3c 3c 0a 2f 41 70 70 20  |p_Build <<./App |
> 000050e0  3c 3c 0a 2f 4e 61 6d 65  20 2f 41 64 6f 62 65 23  |<<./Name /Adobe#|
> 000050f0  32 30 41 63 72 6f 62 61  74 23 32 30 52 65 61 64  |20Acrobat#20Read|
> 00005100  65 72 23 32 30 44 43 0a  2f 52 20 31 32 35 30 35  |er#20DC./R 12505|
> 00005110  36 30 0a 2f 54 72 75 73  74 65 64 4d 6f 64 65 20  |60./TrustedMode |
> 00005120  74 72 75 65 0a 2f 52 45  78 20 28 32 30 31 39 2e  |true./REx (2019.|
> 00005130  30 32 31 2e 32 30 30 35  36 29 0a 2f 4f 53 20 5b  |021.20056)./OS [|
> 00005140  2f 57 69 6e 5d 0a 3e 3e  0a 2f 46 69 6c 74 65 72  |/Win].>>./Filter|
> 00005150  20 3c 3c 0a 2f 44 61 74  65 20 28 4f 63 74 20 31  | <<./Date (Oct 1|
> 00005160  31 20 32 30 31 39 20 32  31 3a 30 35 3a 33 34 29  |1 2019 21:05:34)|
> 00005170  0a 2f 4e 61 6d 65 20 2f  41 64 6f 62 65 2e 50 50  |./Name /Adobe.PP|
> 00005180  4b 4c 69 74 65 0a 2f 52  20 31 33 31 31 30 34 0a  |KLite./R 131104.|
> 00005190  2f 56 20 32 0a 3e 3e 0a  2f 50 75 62 53 65 63 20  |/V 2.>>./PubSec |
> 000051a0  3c 3c 0a 2f 44 61 74 65  20 28 4f 63 74 20 31 31  |<<./Date (Oct 11|
> 000051b0  20 32 30 31 39 20 32 31  3a 30 35 3a 33 34 29 0a  | 2019 21:05:34).|
> 000051c0  2f 4e 6f 6e 45 46 6f 6e  74 4e 6f 57 61 72 6e 20  |/NonEFontNoWarn |
> 000051d0  74 72 75 65 0a 2f 52 20  31 33 31 31 30 35 0a 3e  |true./R 131105.>|
> 000051e0  3e 0a 3e 3e 0a 2f 4d 20  28 44 3a 32 30 31 39 31  |>.>>./M (D:20191|
> 000051f0  32 30 31 31 30 30 30 31  34 2d 30 35 27 30 30 27  |201100014-05'00'|
> 00005200  29 0a 2f 52 65 66 65 72  65 6e 63 65 20 5b 3c 3c  |)./Reference [<<|
> 00005210  0a 2f 54 79 70 65 20 2f  53 69 67 52 65 66 0a 2f  |./Type /SigRef./|
> 00005220  54 72 61 6e 73 66 6f 72  6d 4d 65 74 68 6f 64 20  |TransformMethod |
> 00005230  2f 46 69 65 6c 64 4d 44  50 0a 2f 54 72 61 6e 73  |/FieldMDP./Trans|
> 00005240  66 6f 72 6d 50 61 72 61  6d 73 20 36 35 20 30 20  |formParams 65 0 |
> 00005250  52 0a 2f 44 61 74 61 20  32 31 20 30 20 52 0a 3e  |R./Data 21 0 R.>|
> 00005260  3e 0a 5d 0a 2f 43 6f 6e  74 65 6e 74 73 20 3c 33  |>.]./Contents <3|
> 00005270  30 38 30 30 36 30 39 32  41 38 36 34 38 38 36 46  |08006092A864886F|
> 00005280  37 30 44 30 31 30 37 30  32 41 30 38 30 33 30 38  |70D010702A080308|
> 
> >
> > Can you share the PDF? I don't understand what you mean with "performing
> > a validation fails".
> >
> 
> I whipped up a more simple test case:
> https://issues.apache.org/jira/secure/attachment/12987244/pdfbox-4702.pdf
> 
> It has a test.pdf - base file, test-acrobat.pdf - signed by acrobat reader 
> DC, and test_signed.pdf -
> signed by PDFBox supported code.
> 
> > Tilman
> >
> >
> > >
> > >> Re signatures, there are many things that can go wrong... changes between
> > >> direct / indirect in revisions are bad, not handling locked fields is 
> > >> bad (see
> > >> recent answer on stackoverflow)
> > >>
> > >> Does the file validate with ShowSignature.java?
> > > Yes, that is not the issue. It shows as unmodified in Acrobat, but 
> > > performing a validation fails.
> > >
> > >> Tilman
> > >>
> > >> Am 29.11.2019 um 22:16 schrieb Jason Pyeron:
> > >>> I am trying to track down differences between Acrobat and PDFBox with
> > >> regards to digital signatures.
> > >>> I have made much progress in eliminating differences, but I am still 
> > >>> getting
> > >> the dreaded "Bad parameter" when validating the signature.
> > >>> While I cannot find the reference to quote right now, I seem to remember
> > >> that certain entries must be direct and other certain entries must not be
> > >> direct in certain dictionaries.
> > >>> I am inspecting the two PDFs signed by PDFBox and Acrobat, and I clearly
> > >> see that PDFBox is making Root/AcroForm/Fields/[0]/Kids/[0]/Kids/[16]/V
> > >> direct, whereas Acrobat is indirect. My question is what is the best way 
> > >> to
> > >> find which dictionary it is directly stored in? Started with hex editor, 
> > >> and it is
> > >> not fun :( .
> > >>> v/r,
> > >>>
> > >>> Jason Pyeron
> > >>>
> > >>> --
> > >>> Jason Pyeron  | Architect
> > >>> PD Inc        |
> > >>> 10 w 24th St  |
> > >>> Baltimore, MD |
> > >>>
> > >>> .com: [email protected]
> > >>> tel : 202-741-9397
> > >>>
> > >>>
> > >>>
> > >>>
> > >>> ---------------------------------------------------------------------
> > >>> To unsubscribe, e-mail: [email protected] For
> > >>> additional commands, e-mail: [email protected]
> > >>>
> > >>
> > >> ---------------------------------------------------------------------
> > >> To unsubscribe, e-mail: [email protected] For additional
> > >> commands, e-mail: [email protected]
> > >
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: [email protected]
> > > For additional commands, e-mail: [email protected]
> > >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [email protected]
> > For additional commands, e-mail: [email protected]
> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]



---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to