PDF Permissions value is treated as an unsigned integer in PDF2John

Recently, when trying to extract a PDF's hash with pdf2john.pl or pdf2john.py; I came across a PDF whose hash extraction seemingly worked fine:

$ pdf2john.pl document.pdf
document.pdf:$pdf$2*3*128*4294967292*1*16*[redacted]

However, loading this hash in john or hashcat failed:

$ john --format=pdf pdf.john 
Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

So I started to investigate this issue. The PDF seemed fine since I could open it in my PDF viewer and enter the password (which I already knew) to decrypt it.

After analyzing this issue, it seems that the problem was with the /P entry in the PDF encryption dictionary:

$ strings crackthing.pdf | head -n 10
%PDF-1.4
1 0 obj
/Filter/Standard
/V 2
/R 3
/P 4294967292
/Length 128
/O [redacted]
/U [redacted]
endobj

/P is a 32-bit permissions value, but it is treated as a signed 32-bit integer, and thus the value 4294967292 is the unsigned representation of -4. Looking at the hash format generated by pdf2john tools, these do not appear to convert this value back to a signed integer, before printing the hash:

Current pdf2john output:
document.pdf:$pdf$2*3*128*4294967292*1*16*[redacted]

Expected output (this hash works):
document.pdf:$pdf$2*3*128*-4*1*16*[redacted]

Start in pdf2john.pl and pdf2john.py, where the PDF /P permissions value is read and included in the generated hash. Check how the 32-bit value is formatted before printing, then verify that a value such as 4294967292 produces -4 and that the resulting hash loads in john or hashcat.