Feature: extract hashes from edit-protected PDFs

Feature Request

Make pdf2john.pl work for edit-protected PDFs.

Situation

I have a PDF that I can read without a password, but to edit it, I need a password. When I run

JohnTheRipper-bleeding-jumbo/run/pdf2john.pl ~/example.pdf

it tells me,

~/example.pdf: not encrypted!

To be sure, I'm not trying to decrypt example.pdf, I'm trying to remove it's edit protection. My guess is that pdf2john.pl is looking for view-protection hashes but not edit-protection hashes. I've confirmed that pdf2john.pl does produce hashes for PDFs that are view-protected by a password.

Disclaimer

I know I'm new here, and I haven't given a ton of detail. I just want you to be aware that this functionality appears to be missing. I'm guessing that adding it is just a matter of looking in a different field for a hash. My apologies if this isn't enough information to go on.

Environment

I'm running an uncompiled ZIP from this Github repo downloaded 15 minutes ago (Fri 6 Dec 2019), so I can't run your system config scripts with it. I needed the source to access pdf2john.pl. However, here are the results of those scripts from by Brew-based install:

 ~ john --list=build-info
Version: 1.9.0-jumbo-1
Build: darwin18.6.0 64-bit x86_64 SSE4.2 AC
SIMD: SSE4.1, interleaving: MD4:4 MD5:5 SHA1:2 SHA256:1 SHA512:1
System-wide exec: /usr/local/Cellar/john-jumbo/1.9.0/share/john
System-wide home: /usr/local/Cellar/john-jumbo/1.9.0/share/john
Private home: ~/.john
CPU tests: SSE4.2
$JOHN is /usr/local/Cellar/john-jumbo/1.9.0/share/john/
Format interface version: 14
Max. number of reported tunable costs: 4
Rec file version: REC4
Charset file version: CHR3
CHARSET_MIN: 1 (0x01)
CHARSET_MAX: 255 (0xff)
CHARSET_LENGTH: 24
SALT_HASH_SIZE: 1048576
SINGLE_IDX_MAX: 2147483648
SINGLE_BUF_MAX: 4294967295
Effective limit: Number of salts vs. SingleMaxBufferSize
Max. Markov mode level: 400
Max. Markov mode password length: 30
clang version: 10.0.1 (clang-1001.0.46.4) (gcc 4.2.1 compatibility)
OpenCL headers version: 1.2
Crypto library: OpenSSL
OpenSSL library version: 01010104f
OpenSSL 1.1.1d  10 Sep 2019
GMP library version: 6.1.2
File locking: fcntl()
fseek(): fseek
ftell(): ftell
fopen(): fopen
memmem(): System's

~ john --list=opencl-devices
Platform #0 name: Apple, version: OpenCL 1.2 (Feb 22 2019 20:16:07)
    Device #0 (1) name:     Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz
    Device vendor:          Intel
    Device type:            CPU (LE)
    Device version:         OpenCL 1.2
    Driver version:         1.1
    Native vector widths:   char 16, short 8, int 4, long 2
    Preferred vector width: char 16, short 8, int 4, long 2
    Global Memory:          16 GB
    Global Memory Cache:    64 B
    Local Memory:           32 KB (Global)
    Constant Buffer size:   64 KB
    Max memory alloc. size: 4 GB
    Max clock (MHz):        2800
    Profiling timer res.:   1 ns
    Max Work Group Size:    1024
    Parallel compute cores: 8
    Speed index:            44800

    Device #1 (2) name:     Iris Pro
    Device vendor:          Intel
    Device type:            GPU (LE)
    Device version:         OpenCL 1.2
    Driver version:         1.2(Mar 11 2019 21:25:37)
    Native vector widths:   char 1, short 1, int 1, long 1
    Preferred vector width: char 1, short 1, int 1, long 1
    Global Memory:          1536 MB
    Local Memory:           64 KB (Local)
    Constant Buffer size:   64 KB
    Max memory alloc. size: 384 MB
    Max clock (MHz):        1300
    Profiling timer res.:   80 ns
    Max Work Group Size:    512
    Parallel compute cores: 40
    Stream processors:      320  (40 x 8)
    Speed index:            416000

    Device #2 (3) name:     AMD Radeon R9 M370X Compute Engine
    Device vendor:          AMD
    Device type:            GPU (LE)
    Device version:         OpenCL 1.2
    Driver version:         1.2 (Mar 11 2019 21:14:43)
    Native vector widths:   char 4, short 2, int 1, long 1
    Preferred vector width: char 4, short 2, int 1, long 1
    Global Memory:          2 GB
    Local Memory:           32 KB (Local)
    Constant Buffer size:   64 KB
    Max memory alloc. size: 512 MB
    Max clock (MHz):        300
    Profiling timer res.:   37 ns
    Max Work Group Size:    256
    Parallel compute cores: 10
    Stream processors:      640  (10 x 64)
    Speed index:            192000

Not sure if that helps 🤷🏻‍♂️

Sadly, I can't share an example of a file that's edit-protected because the only one I have is confidential to me. I also don't have the software to create my own.

Start with pdf2john.pl and compare its handling of a view-protected PDF with the reported edit-protected case. Identify the PDF protection data it currently recognizes; done means an edit-protected, readable PDF produces a usable hash instead of the “not encrypted” message.