1

Here is a quick question. Someone told me that I can reverse engineering a pdf file, extracting and analyzing the underlying XML files, and figure out the creator's name for this pdf.

However, I googled such approach for a while, and cannot figure out a feasible solution. Could anyone shed some light on this point..? Thank you in advance!

  • by "creator", do you mean the human author of the document or the program which produced the PDF? please clarify. – Igor Skochinsky Feb 20 '17 at 17:21
  • @IgorSkochinsky, thank you for your reply. "creator" I mean the author of the document. – lllllllllllll Feb 20 '17 at 19:57
  • @IgorSkochinsky, the "human author" – lllllllllllll Feb 20 '17 at 19:58
  • 3
    There is no underlying XML file per se. You can, however, get at the metadata of the document. Manually, you would do that in Acrobat/Reader and display the document properties. Programmatically, you would look out for a tool which can extract the metadata … I think even ExifTool is capable to get metadata out. However, you will get the author only if there is actually an entry in that according field. – Max Wyss Feb 20 '17 at 23:49
  • @MaxWyss I see. Thank you, I tried to open with Acrobat and check the metadata info; however, there is no authorship entry. I guess such information is not embedded in the pdf I am testing. Thank you! – lllllllllllll Feb 21 '17 at 22:27
3

The PDF format is not based on XML but uses a PostScript-inspired dictionary format for its "objects" and streams for other data such as images. There are following places where document metadata is stored:

  • the /Info dictionary containing keys such as "Author" , "Producer", "Title" etc.
  • the /Metadata dictionary which may contain an XML stream with additional information.

Here's an example of retrieving this information using the low-level PDF parsing tool by Didier Stevens:

First, display the "trailer" (something like table of contents of the PDF):

pdf-parser.py -e t Excite_Project_ZN.pdf

trailer
  <<
    /Size 3373
    /Root 1 0 R
    /Info 219 0 R
    /ID [<3572219E83326040B0789EBEAE24A285><3572219E83326040B0789EBEAE24A285>]
  >>

trailer
  <<
    /Size 3373
    /Root 1 0 R
    /Info 219 0 R
    /ID [<3572219E83326040B0789EBEAE24A285><3572219E83326040B0789EBEAE24A285>]
    /Prev 2126182
    /XRefStm 2119246
  >>

Now let's check the /Info object (number 219):

pdf-parser.py -o 219 Excite_Project_ZN.pdf

obj 219 0
 Type:
 Referencing:

  <<
    /Title ()
    /Author (Alex Matrosov)
    /Keywords (CTPClassification=CTP_PUBLIC:VisualMarkings=)
    /CreationDate "(D:20161121224130-08'00')"
    /ModDate "(D:20161121224130-08'00')"
    /Producer '(\xfe\xff\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00\xae\x00 \x00P\x00o\x00w\x00e\x00r\x00P\x00o\x00i\x00n\x00t\x00\xae\x00 \x002\x000\x001\x006)'
    /Creator '(\xfe\xff\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00\xae\x00\x00P\x00o\x00w\x00e\x00r\x00P\x00o\x00i\x00n\x00t\x00\xae\x00 \x002\x000\x001\x006)'
  >>

So here we have the tile and the author. But there is more. If we check the Root object (number 1):

>pdf-parser.py -o 1 Excite_Project_ZN.pdf

obj 1 0
 Type: /Catalog
 Referencing: 2 0 R, 220 0 R, 3370 0 R, 3371 0 R

  <<
    /Type /Catalog
    /Pages 2 0 R
    /Lang (en-US)
    /StructTreeRoot 220 0 R
    /MarkInfo
      <<
        /Marked true
      >>
    /Metadata 3370 0 R
    /ViewerPreferences 3371 0 R
  >>

We can see the reference to /Metadata. Let's check it:

>pdf-parser.py -o 3370 Excite_Project_ZN.pdf

obj 3370 0
 Type: /Metadata
 Referencing:
 Contains stream

  <<
    /Type /Metadata
    /Subtype /XML
    /Length 3230
  >>

This is a stream which needs to be extracted:

>pdf-parser.py -o 3370 -x metadata.xml Excite_Project_ZN.pdf 

The output is this XML:

<?xml version="1.0"?>
<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta x:xmptk="3.1-701" xmlns:x="adobe:ns:meta/">
<?xpacket end="w"?>
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description xmlns:pdf="http://ns.adobe.com/pdf/1.3/" rdf:about="">
<pdf:Producer>Microsoft® PowerPoint® 2016</pdf:Producer>
<pdf:Keywords>CTPClassification=CTP_PUBLIC:VisualMarkings=</pdf:Keywords>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:title>
<rdf:Alt>
<rdf:li xml:lang="x-default"/>
</rdf:Alt>
</dc:title>
<dc:creator>
<rdf:Seq>
<rdf:li>Alex Matrosov</rdf:li>
</rdf:Seq>
</dc:creator>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/">
<xmp:CreatorTool>Microsoft® PowerPoint® 2016</xmp:CreatorTool>
<xmp:CreateDate>2016-11-21T22:41:30-08:00</xmp:CreateDate>
<xmp:ModifyDate>2016-11-21T22:41:30-08:00</xmp:ModifyDate>
</rdf:Description>    

<rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">    
<xmpMM:DocumentID>uuid:9E217235-3283-4060-B078-9EBEAE24A285</xmpMM:DocumentID>    
<xmpMM:InstanceID>uuid:9E217235-3283-4060-B078-9EBEAE24A285</xmpMM:InstanceID>    
</rdf:Description>    
</rdf:RDF>

</x:xmpmeta>
  • Thank you Igor, this is exactly what I am looking for. Fantastic. – lllllllllllll Feb 23 '17 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.