3 Replies Latest reply on Jun 2, 2016 5:15 PM by George_Johnson

    pdf xref table


      HI All:


      I am currently working on pdf files for security research purpose. I manually try some pdf samples, and found that I can change some field in pdf files, and the pdf file can still be rendered normally. I modify the the number before %EOF, which I believe is the offset for XREF table. I also modify the last two entries within the XREF table.


      The modified version may look like this (number in red is the modified one):

           Screen Shot 2016-06-02 at 上午9.54.53.png

      When I try to open the modify the pdf file, the file can be normally rendered. I try this test on Ubuntu-14.04/PDF-1.4/Adobe-9  and WIN7-64/PDF-1.4/Adobe-8.1. 

      On Ubuntu, I just see one warning beforehand: "The file is damaged but is being repaired.", and the pdf file is normally rendered.  And for WIN7 case, the modified pdf is just normally rendered.  I am curious how does it happen? Is this due to repair mechanism built in adobe reader? If this is the case, will pdf files (with corrupted XREF table or without XREF table) be rendered normally?