Recent changes to bugs

#14 Fails to build with GCC 15

Henning Noren — Sun, 14 Sep 2025 13:51:38 -0000

pdfcrack-0.21 has been released with a fix for this issue.

#14 Fails to build with GCC 15

Joao ERIBERTO Mota Filho — Mon, 08 Sep 2025 21:01:50 -0000

Hi Henning! Thanks a lot for your nice work.

#14 Fails to build with GCC 15

Henning Noren — Mon, 08 Sep 2025 20:14:25 -0000

11 years of Debian maintenance of my 19 year old toy, and still going strong Eriberto!
How can I not release a fix? :-)
I shall have a release out before Sunday with this and the FreeBSD patch.

Kind Regards,
Henning Norén

Fails to build with GCC 15

Joao ERIBERTO Mota Filho — Mon, 08 Sep 2025 00:59:48 -0000

Dear developer,

pdfcrack fails to build on Debian with GCC 15. The following errors are shown:

cc -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/PKGS/pdfcrack/pdfcrack-0.20=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall -Wextra -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -O3 -g -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -c -o benchmark.o benchmark.c
md5.c: In function ‘md5_50_init’:
md5.c:327:20: error: assignment to ‘void (*)(void)’ from incompatible pointer type ‘void (*)(uint8_t *, const unsigned int)’ {aka ‘void (*)(unsigned char *, const unsigned int)’} [-Wincompatible-pointer-types]
  327 |     md5_50_variant = &md5_50f;
      |                    ^
md5.c:207:1: note: ‘md5_50f’ declared here
  207 | md5_50f(uint8_t *msg, const unsigned int msgLen __attribute__((unused))) {
      | ^~~~~~~
md5.c:329:20: error: assignment to ‘void (*)(void)’ from incompatible pointer type ‘void (*)(uint8_t *, const unsigned int)’ {aka ‘void (*)(unsigned char *, const unsigned int)’} [-Wincompatible-pointer-types]
  329 |     md5_50_variant = &md5_50s;
      |                    ^
md5.c:200:1: note: ‘md5_50s’ declared here
  200 | md5_50s(uint8_t *msg, const unsigned int msgLen) {
      | ^~~~~~~
md5.c: In function ‘md5_50’:
md5.c:334:3: error: too many arguments to function ‘md5_50_variant’; expected 0, have 2
  334 |   md5_50_variant(msg, msgLen);
      |   ^~~~~~~~~~~~~~ ~~~
make[1]: *** [Makefile:19: md5.o] Error 1
make[1]: *** Waiting for unfinished jobs....
main.c: In function ‘main’:
main.c:311:21: error: assignment to ‘__sighandler_t’ {aka ‘void (*)(int)’} from incompatible pointer type ‘void (*)(void)’ [-Wincompatible-pointer-types]
  311 |     act1.sa_handler = alarmInterrupt;
      |                     ^
main.c:40:1: note: ‘alarmInterrupt’ declared here
   40 | alarmInterrupt() {
      | ^~~~~~~~~~~~~~
In file included from main.c:23:
/usr/include/signal.h:72:16: note: ‘__sighandler_t’ declared here
   72 | typedef void (*__sighandler_t) (int);
      |                ^~~~~~~~~~~~~~
make[1]: *** [Makefile:19: main.o] Error 1
benchmark.c: In function ‘runBenchmark’:
benchmark.c:313:18: error: assignment to ‘__sighandler_t’ {aka ‘void (*)(int)’} from incompatible pointer type ‘void (*)(void)’ [-Wincompatible-pointer-types]
  313 |   act.sa_handler = interruptBench;
      |                  ^
benchmark.c:43:1: note: ‘interruptBench’ declared here
   43 | interruptBench() {
      | ^~~~~~~~~~~~~~
In file included from benchmark.c:21:
/usr/include/signal.h:72:16: note: ‘__sighandler_t’ declared here
   72 | typedef void (*__sighandler_t) (int);
      |                ^~~~~~~~~~~~~~
make[1]: *** [Makefile:19: benchmark.o] Error 1

Regards,

Eriberto

#13 Unable to use full Latin-1 character set

Kjetil Kilhavn — Fri, 08 Dec 2023 05:59:39 -0000

Thank you very much for the quick feedback. I will try that for the next note set.
Late last night I found the password for "Away in a Manger" by educated guessing. It also worked for another note set, but not for the next one - so while I keep thinking about educated guesses and ask the previous chairman of the board for his educated guesses the computer may just as well spend some CPU cycles on attempting to crack it.

#13 Unable to use full Latin-1 character set

Henning Noren — Thu, 07 Dec 2023 23:26:48 -0000

Actually, had to just do some checks and there is a issue in pdfcrack for loading charsets starting with space. Turns out silly old fscanf was too hard to use for me so I need to look into that, but in the meantime, just move the space from first to second character of the string and you should be fine. I just tested that here.

I will see if I can find a fix for it, but it is old code and I need to remember how to make a new release so no promises.

#13 Unable to use full Latin-1 character set

Henning Noren — Thu, 07 Dec 2023 22:55:49 -0000

I totally missed the bug... yeah.. I need to look into that with the savedstate.txt loading and what is going on. Will get back to you regarding that this weekend when I find some time to remove the dust around the code

#13 Unable to use full Latin-1 character set

Henning Noren — Thu, 07 Dec 2023 22:40:58 -0000

Oh boy, this little project keeps giving still! Thanks for the report!
First of all, you need to be careful that the characters used are actually latin-1 encoded, not just part of the set. In this case the file you provided seems to be UTF-8 so I started by making it latin-1:

$ iconv -f UTF-8 -t ISO-8859-1 latin1.txt > latin1-actually.txt
$ file latin1-actually.txt
latin1-actually.txt: ISO-8859 text
$ wc -c latin1-actually.txt
191 latin1-actually.txt
$ wc -c latin1-actually.txt latin1.txt
191 latin1-actually.txt
285 latin1.txt
$

So now we know it is iso-latin-1 text in there, with 191 characters. Lets try to use that:
$ CHARSET=$(cat latin1-actually.txt); pdfcrack -c "$CHARSET" -q -f filnavn.pdf
^CCaught signal 2!
Trying to save state...
Successfully saved state to savedstate.sav!
$ grep -a '^Charset' savedstate.sav | cut -d':' -f 1
Charset(190)
$

Voila, one character difference, probably there is a newline in the end of that latin1-file:
$ od -c -j 190 ~/Downloads/latin1-actually.txt
0000276 \n
0000277
$

Yep, I think we got it.
To bruteforce with this kind of characterset does seem quite a bit of a task for poor old pdfcrack, I think it would take waaay to long to get anywhere decent. My recommendation would probably to try with wordlists or any clues or permutations of clues that you might find regarding this document instead. But to get to the right charset, or converting wordlists to the right charset, the tricks above should probably help you.

The reason for the strange savedstate.txt you got is because it is actually UTF8 characters that are pasted (most likely) and you see the size difference in the beginning where the 285 bytes seems to have been correctly added to the savedstate.txt.

Unable to use full Latin-1 character set

Kjetil Kilhavn — Thu, 07 Dec 2023 21:52:11 -0000

I tried specifying all the displayable characters of Latin-1 - see attachment latin1.txt - as the character set via the -c option. Needless to say it was necessary to escape 'a few' (and maybe I overdid it) characters, so this is the command I ended up with:

pdfcrack -c \ \!\"#\$\%\&\'\(\)\*\+\,\-./0123456789\:\;\<=\>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]\^_\`abcdefghijklmnopqrstuvwxyz\{\|\}\~¡¢£¤¥¦§¨©ª«¬®¯°±²³\´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ -f filnavn.pdf

In savedstate.sav I get this - so it appears the input has been accepted (although 285 is not the correct length[1]):

Charset(285):  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ

However when I try to load the saved state and continue, using

pdfcrack -l savedstate.sav -f filnavn.pdf

I get an error message:
Error: Not a savefile or savefile is damaged

Operating system: OpenSUSE Leap 15.5 x86_64
Dependency libc.so.6: from Leap's standard update repository package glibc version 2.31-150300.63.1

It should be possible to use any PDF file to recreate the problem, but I'm attaching the file I used just in case the behaviour is odd enough to depend on the PDF file.
It is from a music score purchased by the school's marching band that my kids are now in several years ago. I have found an old email that states the file has been encrypted with the (at-the-time) password used to log in at the seller's site - but instead of making a note of the password someone noted something along the lines of "site password" in the score overview. Not very helpful more than 5 years later.
Your tool is a very good fit with our use case. The school band paid hundreds (of NOK) for this score, and now we can't print copies of it!

[1] I'm assuming that 285 in savedstate.sav is supposed to indicate the length of the character set, since I get this in savedstate.sav when I don't specify a character set

Charset(62): abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

#12 stack-buffer-overflow

Henning Noren — Fri, 24 Apr 2020 16:09:33 -0000

status: open --> closed