Just An Application

August 23, 2014

Anatomy Of A PDF: Part One — Enter A PDF Stage Left

Filed under: Document Format, PDF — Tags: , , — Simon Lewis @ 6:11 am

Some nice people have just sent me a PDF file.

I didn’t ask them to but they sent it nonetheless.

Its a shame they cannot spell the word ‘invoice’ properly but it’s the thought that counts isn’t it ?

Since I once made the mistake of finding out how PDFs ‘work’ so to speak, you really don’t want to know but I am going to tell you anyway, I was curious as to what exactly my unsolicited PDF file might contain instead of an ‘inovice’ and what would have happened had I been unwise enough to attempt to open it using, I would assume, acrobat reader running on windows.

Here’s the edited output of

    hexdump -c

run on my little, its only 14KB, PDF.


    0000000   %   P   D   F   -   1   .   5  \n   %  [.] [.] [.] [.] \n   1
    0000010       0       o   b   j  \n   <   <   /   F   i   l   t   e   r
    0000020       [   /   F   l       /   F   l   ]       /   L   e   n   g
    0000030   t   h       1   3   1   7   8       >   >  \n   s   t   r   e

    ...
    
    00033c0   d   s   t   r   e   a   m  \n   e   n   d   o   b   j  \n   2
    00033d0       0       o   b   j  \n   <   <   /   X   F   A       1
    00033e0   0       R       >   >  \n   e   n   d   o   b   j  \n   3
    00033f0   0       o   b   j  \n   <   <   /   E   x   t   e   n   s   i
    0003400   o   n   s       <   <   /   A   D   B   E       <   <   /   E
    0003410   x   t   e   n   s   i   o   n   L   e   v   e   l       3
    0003420   /   B   a   s   e   V   e   r   s   i   o   n       /   1   .
    0003430   7       >   >       >   >       /   A   c   r   o   F   o   r
    0003440   m       2       0       R       /   T   y   p   e       /   C
    0003450   a   t   a   l   o   g       /   P   a   g   e   s       4
    0003460   0       R       /   N   e   e   d   s   R   e   n   d   e   r
    0003470   i   n   g       t   r   u   e       >   >  \n   e   n   d   o
    0003480   b   j  \n   4       0       o   b   j  \n   <   <   /   C   o
    0003490   u   n   t       1       /   K   i   d   s       [   5       0
    00034a0       R   ]       /   T   y   p   e       /   P   a   g   e   s
    00034b0       >   >  \n   e   n   d   o   b   j  \n   5       0       o
    00034c0   b   j  \n   <   <   /   P   a   r   e   n   t       4       0
    00034d0       R       /   T   y   p   e       /   P   a   g   e       /
    00034e0   C   o   n   t   e   n   t   s       6       0       R       /
    00034f0   R   e   s   o   u   r   c   e   s       <   <   /   F   o   n
    0003500   t       <   <   /   F   1       <   <   /   B   a   s   e   F
    0003510   o   n   t       /   H   e   l   v   e   t   i   c   a       /
    0003520   S   u   b   t   y   p   e       /   T   y   p   e   1       /
    0003530   N   a   m   e       /   F   1       >   >       >   >       >
    0003540   >       >   >  \n   e   n   d   o   b   j  \n   6       0
    0003550   o   b   j  \n   <   <   /   L   e   n   g   t   h       2   3
    0003560       >   >  \n   s   t   r   e   a   m  \n   B   T       /   F
    0003570   1       2   4       T   f       1   0   0       1   0   0
    0003580   T   d  \n   e   n   d   s   t   r   e   a   m  \n   e   n   d
    0003590   o   b   j  \n   x   r   e   f  \n   0       7  \n   0   0   0
    00035a0   0   0   0   0   0   0   0       6   5   5   3   5       f
    00035b0  \n   0   0   0   0   0   0   0   0   1   5       0   0   0   0
    00035c0   0       n      \n   0   0   0   0   0   1   3   2   6   3
    00035d0   0   0   0   0   0       n      \n   0   0   0   0   0   1   3
    00035e0   2   9   4       0   0   0   0   0       n      \n   0   0   0
    00035f0   0   0   1   3   4   4   3       0   0   0   0   0       n
    0003600  \n   0   0   0   0   0   1   3   4   9   9       0   0   0   0
    0003610   0       n      \n   0   0   0   0   0   1   3   6   4   4
    0003620   0   0   0   0   0       n      \n   t   r   a   i   l   e   r
    0003630  \n   <   <   /   R   o   o   t       3       0       R       /
    0003640   S   i   z   e       7       >   >  \n   s   t   a   r   t   x
    0003650   r   e   f  \n   1   3   7   1   6  \n   %   %   E   O   F
    000365f


I’ve chopped out the bit in the middle because, as we will see, in its current format its not very interesting at all.

You can tell its a PDF because it says so at the front.


Copyright (c) 2014 By Simon Lewis. All Rights Reserved.

Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and owner Simon Lewis is strictly prohibited.

Excerpts and links may be used, provided that full and clear credit is given to Simon Lewis and justanapplication.wordpress.com with appropriate and specific direction to the original content.

Advertisements

1 Comment »

  1. […] of booby trapped PDFs masquerading as invoices seem to have been exhausted. The same is true of .EXE’s concealed in […]

    Pingback by Swift vs The Compound File Binary File Format (aka OLE/COM): Part One — First Open Your File | Just An Application — November 13, 2014 @ 10:59 am


RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Create a free website or blog at WordPress.com.

%d bloggers like this: