Auto corrupting your PDF files

Posted by Tariq • Tuesday, June 30. 2009 • Category: Tidbits

A few weeks ago I came across a blog post which showed you how to corrupt your own pdf files. That post was in response to the interweb ate my homework post from Bruce Schneier.

Anyhows, Didier's method is fairly simple -- there are many other ways todo this like truncating the file or inserting some randomness using dd and /dev/urandom. So lets automate it.

He corrupts a reference to the Root object in the pdf file to throw pdf viewers off the scent. You can see this in a file like so:

xxd YOUR.pdf | grep -A2 Root



0000350: 666f 2031 3420 3020 5220 0d2f 526f 6f74  fo 14 0 R ./Root

0000360: 2031 3720 3020 5220 0d2f 5072 6576 2036   17 0 R ./Prev 6

0000370: 3634 3531 200d 2f49 445b 3c64 3234 3936  6451 ./ID[

* might not always work.

You can use sed to help you corrupt easily! Here we go:

sed s/\.\\/Root.../\.\\/Rootsie/g YOUR.pdf > YOUR_CORRUPT.PDF

Here we tell sed to find ./Root followed by three bytes. We replace this with ./Rootsie. If all goes well you should end up with a corrupt pdf and a file which has the following somewhere:

xxd YOUR_CORRUPT.PDF | grep -A2 Root



0000350: 666f 2031 3420 3020 5220 2e2f 526f 6f74  fo 14 0 R ./Root

0000360: 7369 6520 3020 5220 0d2f 5072 6576 2036  sie 0 R ./Prev 6

0000370: 3634 3531 200d 2f49 445b 3c64 3234 3936  6451 ./ID[