#13 Unable to use full Latin-1 character set

[Kjetil Kilhavn]

I tried specifying all the displayable characters of Latin-1 - see attachment latin1.txt - as the character set via the -c option. Needless to say it was necessary to escape 'a few' (and maybe I overdid it) characters, so this is the command I ended up with:

pdfcrack -c \ \!\"#\$\%\&\'\(\)\*\+\,\-./0123456789\:\;\<=\>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]\^_\`abcdefghijklmnopqrstuvwxyz\{\|\}\~¡¢£¤¥¦§¨©ª«¬­®¯°±²³\´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ -f filnavn.pdf

In savedstate.sav I get this - so it appears the input has been accepted (although 285 is not the correct length[1]):

Charset(285):  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ

However when I try to load the saved state and continue, using

pdfcrack -l savedstate.sav -f filnavn.pdf

I get an error message:
Error: Not a savefile or savefile is damaged

Operating system: OpenSUSE Leap 15.5 x86_64
Dependency libc.so.6: from Leap's standard update repository package glibc version 2.31-150300.63.1

It should be possible to use any PDF file to recreate the problem, but I'm attaching the file I used just in case the behaviour is odd enough to depend on the PDF file.
It is from a music score purchased by the school's marching band that my kids are now in several years ago. I have found an old email that states the file has been encrypted with the (at-the-time) password used to log in at the seller's site - but instead of making a note of the password someone noted something along the lines of "site password" in the score overview. Not very helpful more than 5 years later.
Your tool is a very good fit with our use case. The school band paid hundreds (of NOK) for this score, and now we can't print copies of it!

[1] I'm assuming that 285 in savedstate.sav is supposed to indicate the length of the character set, since I get this in savedstate.sav when I don't specify a character set

Charset(62): abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

[Henning Noren]

Oh boy, this little project keeps giving still! Thanks for the report!
First of all, you need to be careful that the characters used are actually latin-1 encoded, not just part of the set. In this case the file you provided seems to be UTF-8 so I started by making it latin-1:

$ iconv -f UTF-8 -t ISO-8859-1 latin1.txt > latin1-actually.txt
$ file latin1-actually.txt
latin1-actually.txt: ISO-8859 text
$ wc -c latin1-actually.txt
191 latin1-actually.txt
$ wc -c latin1-actually.txt latin1.txt
191 latin1-actually.txt
285 latin1.txt
$

So now we know it is iso-latin-1 text in there, with 191 characters. Lets try to use that:
$ CHARSET=$(cat latin1-actually.txt); pdfcrack -c "$CHARSET" -q -f filnavn.pdf
^CCaught signal 2!
Trying to save state...
Successfully saved state to savedstate.sav!
$ grep -a '^Charset' savedstate.sav | cut -d':' -f 1
Charset(190)
$

Voila, one character difference, probably there is a newline in the end of that latin1-file:
$ od -c -j 190 ~/Downloads/latin1-actually.txt
0000276 \n
0000277
$

Yep, I think we got it.
To bruteforce with this kind of characterset does seem quite a bit of a task for poor old pdfcrack, I think it would take waaay to long to get anywhere decent. My recommendation would probably to try with wordlists or any clues or permutations of clues that you might find regarding this document instead. But to get to the right charset, or converting wordlists to the right charset, the tricks above should probably help you.

The reason for the strange savedstate.txt you got is because it is actually UTF8 characters that are pasted (most likely) and you see the size difference in the beginning where the 285 bytes seems to have been correctly added to the savedstate.txt.

[Henning Noren]

I totally missed the bug... yeah.. I need to look into that with the savedstate.txt loading and what is going on. Will get back to you regarding that this weekend when I find some time to remove the dust around the code

[Henning Noren]

Actually, had to just do some checks and there is a issue in pdfcrack for loading charsets starting with space. Turns out silly old fscanf was too hard to use for me so I need to look into that, but in the meantime, just move the space from first to second character of the string and you should be fine. I just tested that here.

I will see if I can find a fix for it, but it is old code and I need to remember how to make a new release so no promises.

[Kjetil Kilhavn]

Thank you very much for the quick feedback. I will try that for the next note set.
Late last night I found the password for "Away in a Manger" by educated guessing. It also worked for another note set, but not for the next one - so while I keep thinking about educated guesses and ask the previous chairman of the board for his educated guesses the computer may just as well spend some CPU cycles on attempting to crack it.