Handle signed/unsigned PDF permission P value for all PDF hash-modes

This commit is contained in:
Gabriele Gristina 2023-04-11 21:17:25 +02:00
parent 80fa78374e
commit cf3ab8e2dc
21 changed files with 310 additions and 224 deletions

View File

@ -37,6 +37,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
KERNEL_FQ void FIXED_THREAD_COUNT(FIXED_LOCAL_SIZE) m10400_m04 (KERN_ATTR_RULES_ESALT (pdf_t))

View File

@ -35,6 +35,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
KERNEL_FQ void FIXED_THREAD_COUNT(FIXED_LOCAL_SIZE) m10400_m04 (KERN_ATTR_ESALT (pdf_t))

View File

@ -35,6 +35,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
DECLSPEC void m10400m (LOCAL_AS u32 *S, PRIVATE_AS u32 *w0, PRIVATE_AS u32 *w1, PRIVATE_AS u32 *w2, PRIVATE_AS u32 *w3, const u32 pw_len, KERN_ATTR_FUNC_ESALT (pdf_t))

View File

@ -37,6 +37,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
KERNEL_FQ void FIXED_THREAD_COUNT(FIXED_LOCAL_SIZE) m10410_m04 (KERN_ATTR_RULES_ESALT (pdf_t))

View File

@ -35,6 +35,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
KERNEL_FQ void FIXED_THREAD_COUNT(FIXED_LOCAL_SIZE) m10410_m04 (KERN_ATTR_ESALT (pdf_t))

View File

@ -35,6 +35,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
DECLSPEC void m10410m (LOCAL_AS u32 *S, PRIVATE_AS u32 *w0, PRIVATE_AS u32 *w1, PRIVATE_AS u32 *w2, PRIVATE_AS u32 *w3, const u32 pw_len, KERN_ATTR_FUNC_ESALT (pdf_t))

View File

@ -47,6 +47,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
KERNEL_FQ void m10420_m04 (KERN_ATTR_RULES_ESALT (pdf_t))

View File

@ -45,6 +45,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
KERNEL_FQ void m10420_m04 (KERN_ATTR_ESALT (pdf_t))

View File

@ -45,6 +45,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
DECLSPEC void m10420m (PRIVATE_AS u32 *w0, PRIVATE_AS u32 *w1, PRIVATE_AS u32 *w2, PRIVATE_AS u32 *w3, const u32 pw_len, KERN_ATTR_FUNC_ESALT (pdf_t))

View File

@ -34,6 +34,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf14_tmp

View File

@ -36,6 +36,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf17l8_tmp

View File

@ -42,6 +42,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf17l8_tmp

View File

@ -38,6 +38,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf14_tmp

View File

@ -45,6 +45,7 @@
- Skip chained generated rules that exceed the maximum number of function calls
- Fixed incorrect plaintext check for 25400 and 26610. Increased plaintext check to 32 bytes to prevent false positives.
- Fixed bug in --stdout that caused certain rules to malfunction
- Handle signed/unsigned PDF permission P value for all PDF hash-modes
##
## Technical

View File

@ -61,6 +61,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
static const char *SIGNATURE_PDF = "$pdf$";
@ -214,6 +216,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -291,7 +297,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
{
const pdf_t *pdf = (const pdf_t *) esalt_buf;
const int line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
const int line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
40,

View File

@ -63,6 +63,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
static const char *SIGNATURE_PDF = "$pdf$";
@ -235,6 +237,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -312,7 +318,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
{
const pdf_t *pdf = (const pdf_t *) esalt_buf;
const int line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
const int line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
40,

View File

@ -62,6 +62,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
static const char *SIGNATURE_PDF = "$pdf$";
@ -222,6 +224,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -322,7 +328,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
const u8 *rc4key = (const u8 *) pdf->rc4key;
const int line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x:%02x%02x%02x%02x%02x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x:%02x%02x%02x%02x%02x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x:%02x%02x%02x%02x%02x";
const int line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
40,

View File

@ -62,6 +62,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf14_tmp
@ -245,6 +247,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -379,7 +385,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
if (pdf->id_len == 32)
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,
@ -416,7 +426,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
}
else
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,

View File

@ -69,6 +69,8 @@ typedef struct pdf
u32 rc4key[2];
u32 rc4data[2];
int P_minus;
} pdf_t;
typedef struct pdf14_tmp
@ -354,6 +356,10 @@ int module_hash_decode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
// validate data
pdf->P_minus = 0;
if (P_pos[0] == 0x2d) pdf->P_minus = 1;
const int V = strtol ((const char *) V_pos, NULL, 10);
const int R = strtol ((const char *) R_pos, NULL, 10);
const int P = strtol ((const char *) P_pos, NULL, 10);
@ -568,9 +574,14 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
int line_len = 0;
pdf_t *pdf = (pdf_t *) esalt_buf;
if (pdf->id_len == 32)
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,
@ -608,7 +619,11 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
}
else
{
line_len = snprintf (line_buf, line_size, "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s",
char *line_format = "$pdf$%d*%d*%d*%u*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
if (pdf->P_minus == 1) line_format = "$pdf$%d*%d*%d*%d*%d*%d*%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x*%d*%08x%08x%08x%08x%08x%08x%08x%08x%s";
line_len = snprintf (line_buf, line_size, line_format,
pdf->V,
pdf->R,
128,