PPT Slide

Obtaining encryption key from PDF viewer

http://www.elcomsoft.com

• MD5_Update function resides not far from MD5_Init function, which uses constants 0x67452301, 0xEFCDAB89, 0x98BADCFE and 0x10325476

• MD5_Update often called just after call to MD5_Init function

• MD5_Update or some function called from MD5_Update uses 64 constants defined in MD5 specification

Anti reverse-engineering measures in PDF viewers

How to find code of MD5 functions

Previous slide

Next slide

Back to first slide

View graphic version