DIY-Bugfix for 'This file is protected'

[_cw2k_]

Yesterday I stumbled about this in error message in PDFEdit:
This file is protected
The copyrights owner prohibits modification of this document.
Foxit PDF Editor will not allow you to print any modification.

Man what a crap.A notice is okay but isn't that cute little poggie called PDF >EDITOR< - but to edit something without being able to save, doesn't make much sence. Well I made a bugfix for that problem I'd like to share with you.
So here we go:

Do not apply - information are obsoleted ! - See Post #4 for actual ones!
1. Open PDFEdit.exe in ya favourite Hexeditor

2. Goto file offset: 000BD320

3. There you should find the following values:
8B 49 2C 85 C9 (incase you don't use Foxit Editor Build v2.0 Build 1011 ignore the offset and just try a search for these values)
Change them to
83 61 2C 00 90

4. Save and close the Hexeditor

5. Enjoy :)

__________________________________________________ _______________



Well I confess I haven't brought 'Foxit PDF Editor' yet but for sure it's worth
to buy.(Much cheaper and also much better than giving ya money to Adobe - making that poor 'dobe ppl
even more greepy.)

I the old days I patched my Acrobat - so I don't need to make use of the hard stuff (like 'ElcomSoft Advance PDF Recovery') just because a pdf requires some 'cosmetical' bugfix.
With Foxit opening pdfs makes fun again. While Acrobat 8 needs 12 sec to open
the doc, FoxIT do the job in 3Sec. And when I look a the consumed memory Acrobat 8 needs 40MB of RAM,
while FoxIT just needs 4MB ! (Measured with ProcessExplorer-Sysinternal; Processes:Private Bytes.)
Okay enough offtopic for now !


Some more background infos about the patch.
The name of the function patched was probably something like PDF::getSecurityFlagsOwner().
This function will check if there is a PDF-OwnerSecurity object in the current pdf. If there was no PDF-OwnerSecurity set it will return -1 which means something like SECURITY_OWNER_ALLOW_EVERYTHING.
If there is a PDF-OwnerSecurity object the '::GetAllowFlag()' methode so called.

The Patch will make this function to clean(set the point to 0) the PDF-OwnerSecurity object
each time it is called + return -1 (=SECURITY_OWNER_ALLOW_EVERYTHING).

A now for all da ollydebugger out there and those like me how are maybe curious what's 'behind' those cute little hexbytes you just wrote in there with ya Hexeditor.

Before the patch:004BD320 > 8B49 2C MOV ECX, [ECX+2C]
004BD323 85C9 TEST ECX, ECX
004BD325 75 04 JNZ SHORT 004BD32B
004BD327 83C8 FF OR EAX, FFFFFFFF
004BD32A C3 RETN
004BD32B 8B01 MOV EAX, [ECX]
004BD32D FF60 08 JMP [EAX+8]After the patch:004BD320 > 8361 2C 00 AND [DWORD ECX+2C], 0
004BD324 90 NOP
004BD325 75 04 JNZ SHORT 004BD32B
004BD327 83C8 FF OR EAX, FFFFFFFF
004BD32A C3 RETN

Ah well and incase you like to edit the file 'incognito' - by being able to save the file but as well keep the PDF-OwnerSecureObject(with all its password and allow/disallow flags), just use this search'n'replace pattern:

Search for:
8B 49 2C 85 C9 75 04
Replace with:
8B 49 2C 85 C9 75 00


So that's it.

Happy new year 2009!

[agiangone]

This would be great if it worked but in my case, after the fix I get a blank page when I open the document. The second tip for 8B 49 2C 85 C9 75 04 cannot be applied because it does not exist. The version I have is 2.0 1011
but I have not purchased a key yet.
Am I doing something wrong?

[_cw2k_]

I can confirm this behavior. After the patch the PDF Editor just shows white pages with no text or pictures. (Well I guest it probably needs the security object when opening the file to read encryption settings to successfully decrypt the content)

So in meanwhile use this
Search for
0C5D20 8B 41 3C C3 90 90 90 90 90 90
Replace with
0C5D20 8B 41 3C 83 C8 FF 89 41 3C C3
it will change the allow setting to SECURITY_OWNER_ALLOW_EVERYTHING and so you can edit the file.
But if you save and open the pdf in Acrobat - security is still there.
I'll try to find a better way.

Well here is Asm that is behide the Hex004C5D20 8B41 3C MOV EAX, [ECX+3C]
004C5D23 83C8 FF OR EAX, FFFFFFFF
004C5D26 8941 3C MOV [ECX+3C], EAX
004C5D29 C3 RETN
004C5D2A 90 NOP

[_cw2k_]

Okay now it's done :)
I splitted the whole thing up into 2 patches.
The first patch allows you to modify locked PDFs while the second cleans the PDF-Security setting when you save the file.


Patch one.
This allows you to edit locked PDFs.

1. Open PDFEdit.exe in ya favorite Hex editor

2. Goto file offset: 00BB090
There you should find the following values:
8B 49 4C 85 C9 75 04 (incase you don't use Foxit Editor Build v2.0 Build 1011 ignore the offset and just try a search for these values)
Change them to
33 C9 90 85 C9 75 04

3. Save and close the Hexeditor



Patch two
Clear the Pdf-Security setting(password + restriction) when you save it.
This requires Patch one - else this that is of not much use because PDFEdit will not allow you to invoke the File\Save Pdf.

1. Open PDFEdit.exe in ya favourite Hexeditor

2. Goto file offset: 00C4889
There you should find the following values:
8B 40 4C 89 4E 0C
Replace them with
33 C0 90 89 4E 0C

3. Save and close the Hexeditor

__________________________________________________ ______________

Background info's

Patch one.
Search'n'Replace Pattern
00BB090
8B 49 4C 85 C9 75 04
33 C9 90 85 C9 75 04
Before the Patch:
004BB090 8B49 4C MOV ECX, [ECX+4C]
004BB093 85C9 TEST ECX, ECX
004BB095 75 04 JNZ SHORT 004BB09B
004BB097 83C8 FF OR EAX, FFFFFFFF
004BB09A C3 RETN
004BB09B 8B01 MOV EAX, [ECX]
004BB09D FF60 18 JMP [EAX+18]
After the Patch004BB090 33C9 XOR ECX, ECX
004BB092 90 NOP
004BB093 85C9 TEST ECX, ECX
004BB095 75 04 JNZ SHORT 004BB09B
004BB097 83C8 FF OR EAX, FFFFFFFF
...Well there is not much new to say will make PDF::getSecuritySetting to retrun always SECURITY_OWNER_ALLOW_EVERYTHING (what is -1 or 0xFFFFFFFF)



Patch two.
Search'n'Replace Pattern:
00C4889
8B 40 4C 89 4E 0C
33 C0 90 89 4E 0C
Before the Patch:004C4889 8B40 4C MOV EAX, [EAX+4C]
004C488C 894E 0C MOV [ESI+C], ECX
004C4889 33C0 XOR EAX, EAX
004C488B 90 NOP
004C488C 894E 0C MOV [ESI+C], ECXAvoid that PDFEdit read the current securityobject() when creating the new securityobject for the new pdf that should be saved to disk.

Wow that new IDA is amazing...
(...sorry in advanced for posting too much or this nerd-suff.)

Decompiled Procedure as c-pseudo code (Tool: IDA52 + HexRays + some edits)
NewPdf* PDFWriter__HandleSecurity(DWORD *this, DWORD Arg2)
{

NewPDF_Obj = (NewPdf *)this;
PDF_Obj = Arg2;
NewPDF_Obj->Parent_04 = Arg2;
//------------ T h e P a t c h -----------------------------
// PDF_SecuObj = (PDF_Obj + 0x4C);
// ... is change to:
//
PDF_SecuObj = 0;
//---------------------------------------------------------------
NewPDF_Obj->SecuObj_08 = PDF_SecuObj;
NewPDF_Obj->SecuSupported_0C = 1;

if ( PDF_SecuObj )
{
NewPDF_Obj->SecuOwner_10 = PDF_SecuObj->field_2C;
NewPDF_Obj->SecuDoc_14 = PDF_SecuObj->GetDocSecu + 5();
}
else
{
NewPDF_Obj->SecuOwner_10 = 0;
NewPDF_Obj->SecuDoc_14 = 0;
}
NewPDF_Obj->pSecuOwner_18 = NewPDF_Obj->SecuOwner_10;
NewPDF_Obj->pSecuDoc_1C = NewPDF_Obj->SecuDoc_14;

return NewPDF_Obj;
}


c-pseudo code + Hex/Asm

...
004C487D B9 01000000 MOV ECX, 1
004C4882 8946 04 MOV [ESI+4], EAX
004C4885 884C24 10 MOV [ESP+10], CL

// The Line with the Patch !!!
PDF_SecuObj = (PDF_Obj + 0x4C);
004C4889 8B40 4C MOV EAX, [EAX+4C]
004C488C 894E 0C MOV [ESI+C], ECX
004C488F 8BC8 MOV ECX, EAX
NewPDF_Obj->SecuObj_08 = PDF_SecuObj;
004C4891 8946 08 MOV [ESI+8], EAX

if ( PDF_SecuObj )
004C4894 85C9 TEST ECX, ECX
004C4896 74 10 JE SHORT <noSec>
NewPDF_Obj->SecuOwner_10 = PDF_SecuObj->field_2C;
004C4898 8B51 2C MOV EDX, [ECX+2C]
004C489B 8956 10 MOV [ESI+10], EDX
NewPDF_Obj->SecuDoc_14 = PDF_SecuObj->GetDocSecu + 5();
004C489E 8B01 MOV EAX, [ECX]
004C48A0 FF50 14 CALL [EAX+14]
004C48A3 8946 14 MOV [ESI+14], EAX
else
004C48A6 EB 0E JMP SHORT 004C48B6

NewPDF_Obj->SecuOwner_10 = 0;
004C48A8 C746 10 00000>MOV [DWORD ESI+10], 0

NewPDF_Obj->SecuDoc_14 = 0;
004C48AF C746 14 00000>MOV [DWORD ESI+14], 0
}

NewPDF_Obj->pSecuOwner_18 = NewPDF_Obj->SecuOwner_10;
NewPDF_Obj->pSecuDoc_1C = NewPDF_Obj->SecuDoc_14;
004C48B6 8B4E 10 MOV ECX, [ESI+10]
004C48B9 8B56 14 MOV EDX, [ESI+14]
004C48BC 894E 18 MOV [ESI+18], ECX
004C48BF 8B4C24 08 MOV ECX, [ESP+8]
004C48C3 8956 1C MOV [ESI+1C], EDX

return NewPDF_Obj;
004C48C6 8BC6 MOV EAX, ESI
004C48D3 C2 0400 RETN 4

So that's it.



P.s. I just tried. These pattern also work for 'Foxit Reader.exe' (Version 3.0.2008.1222)