The repository for this seems to indicate this only works in Chrome and a few other PDF readers[0]. Perhaps the title should be updated to reflect this.
"Granted, most PDF readers (besides Adobe Reader) don't implement most of this stuff. But Chrome does implement JavaScript! If you open a PDF file like this one in Chrome, it will run the scripts."
I wish I could remember where I read this line, but it's lost on me. "We want to hire someone who rewrote Quake to render it's graphics in ASCII, just for the fun of it." (I'm sure I mangled the quote, too.)
aaquake, with aalib. It existed, but it squinted your eyes.
Aatv on higher terminal resolutions was almost usable, but once fbtv worked no one cared about that. Ditto with mplayer with fbdev output.
What, you don't want arbitrary javascript payloads executing on that important legal contract with all your personal details on it? Look, I'm sure whatever underpaid secretary found that contract on the internet definitely audited any and all JS on it.
Why would PDF support CSS? It's a printing format; your PDF is defined over fixed-size pages. There isn't supposed to be any dynamic layout. You make it the way you want it to look, and then that's what it looks like.
Even more fun: As I recall (I could be wrong here), there are two different versions of SpiderMonkey in Adobe Reader: the one used here and a version for XFA [1].
In PoC||GTFO [1], there are a lot of playful file tricks where a PDF is a ZIP file, or an ecrypted volume is a PDF file, etc...
I bought the Bible-looking softcovers (Vol. 1 and 2) from No Starch press at B&N, but the PDFs are available online if you want to check them out. Lots of fun! It reminds me of the late 80s reading 2600 magazine in some ways.
I can consistently get the page to crash by quickly scrolling halfway down the first page so that the playing area is just offscreen. Interesting and hard to debug (no console errors). Anyone else able to reproduce? I'm on latest Chrome on OSX 10.13
It's no different from Microsoft Word. 90% of Word's use could be fulfilled by WordPad. I would expect that fewer than 10% of users use 90% of Word's functionality.
Since we're on the topic of PDFs, what tools or libraries do people use for inspecting and modifying em? I have a large collection of PDFs from which I want to extract all the data in order to put it up online and make their information more accessible, but maneuvering the ecosystem has been just a huge headache.
I have some experience in this field. Typically I try to convert it to as many formats as possible and let the search engines take their pick. What is your PDF data about? Feel free to PM.
Is there any decent alternative standard to PDF that can express the small subset of PDF that normal people care about and expect, and isn’t capable of all this insecure dynamic junk?
"... custom Adobe JavaScript API has an absolutely gigantic surface area. Scripts can supposedly do things like make arbitrary database connections, detect attached monitors, import external resources, and manipulate 3D objects."
This is horrifying. Why would you ever want to cover this functionality in a read-only document format specification...
Regarding the game itself: since the reflection angle is strictly determined, instead of varying with the place of reflection, the ball path seems to be is fully determined by the initial position and angle of the ball launch (aside from a paddle miss, of course). Specifically, a situation is possible where you bounce the ball in a cyclic path that doesn't strike the last block(s).
The history of Breakout is worth knowing, Steve Wozniak built the game. It was not his concept but by doing the actual hard work of implementing the game in a reduced chipset he 'made' the game and thrashed out some of the finer points of gameplay.
Atari sought him out for this as Steve Wozniak had made a viable version of Pong by reducing the chip count. Although he did a splendid job of getting the chip count minimised for Breakout this design was not good for production so Atari did their own board design but the game played the same, as per Steve Wozniak's version:
I wonder if the Steve Wozniak version has better gameplay than this JS in PDF hack?
Either way it is in the same spirit, the point of Breakout is more about optimising the game to available resources - 'hacking' - than playing the game.
The story I've heard is that it was Steve Jobs that was working for Atari, and he "subcontracted" the work of reducing the chip count to something affordable to his pal Woz, and pocketed 90% of the bonus for accomplishing it.
57 comments
[ 2.3 ms ] story [ 82.3 ms ] thread(Though probably it probably is a security hole)
0. https://github.com/osnr/horrifying-pdf-experiments
Great write up though. Appreciated.
"Granted, most PDF readers (besides Adobe Reader) don't implement most of this stuff. But Chrome does implement JavaScript! If you open a PDF file like this one in Chrome, it will run the scripts."
https://github.com/osnr/horrifying-pdf-experiments
Doesn't work in Firefox for me. Try in Chrome if this is all you see on the first page.
I love this, it's hacking for hacking's sake.
but out of all of the weird stuff in the pdf spec (which is terrible) javascript has got to be the worst.
even the attempts at restricting stuff to make a saner version (PDF/a) eventually devolve into allowing all the crud back in.
Read in browser: "Party agrees to pay twenty dollars for blues lessons."
Printed version: "Party agrees to pay HIS ETERNAL SOUL to learn to play the blues HAHAHA"
No, it's not. I mean, print fidelity is where it excels, but that's not all it does. PDF Reflow, for instance, is a designed-in feature.
I am thinking about the difference when rendered ("distilled") into PDF. Hmm. I should test this...
I have the acrobat/JavaScript API Ref open right now. [0]
[0]https://www.adobe.com/content/dam/acom/en/devnet/acrobat/pdf... for those interested.
[1]: https://en.wikipedia.org/wiki/XFA
https://github.com/jlsutherland/doc2text
http://khkonsulting.com/2016/06/getting-serial-number-form-u...
Basically, the backend is a SOAP server and the PDF is the client.
So, xml and wsdl, no json.
This is horrifying. Why would you ever want to cover this functionality in a read-only document format specification...
http://www.math.uakron.edu/~dpstory/acrotex.html
including Battleship:
http://www.math.uakron.edu/~dpstory/tutorial/games/navbat.pd...
and Tic-Tac-Toe:
http://www.math.uakron.edu/~dpstory/tutorial/games/ttt.pdf
What grinds my gears is that the game is broken. Lives go negative, boundary check only checks for zero.. such stuff.
Atari sought him out for this as Steve Wozniak had made a viable version of Pong by reducing the chip count. Although he did a splendid job of getting the chip count minimised for Breakout this design was not good for production so Atari did their own board design but the game played the same, as per Steve Wozniak's version:
https://en.wikipedia.org/wiki/Breakout_(video_game)
I wonder if the Steve Wozniak version has better gameplay than this JS in PDF hack?
Either way it is in the same spirit, the point of Breakout is more about optimising the game to available resources - 'hacking' - than playing the game.