The rendering step side-by-side

The next step is to compare the rendering instructions in the WH LFBC PDF and the Xerox 7355 PDF saved with preview. Finally I show how an upside down scanned document after being rotated in Preview matches the WH LFBC.

All cm’s have the following structure

0 a b 0 0 tx ty

  • For the 7535 document  a is positive b is negative tx > ty, ty negative
  • For the WHLFBC         a is negative b is positive tx < ty, tx negative
  • For the Upside Down    a is negative b is postive, tx < ty, tx negative

Note how the Upside Down rotated image matches the WH LFBC. Which is why I have concluded that the reason preview was used was to rotate an upside down scan.

However I noticed a new issue… The Clipping Path does not match… Never a boring moment. I believe it is related to ‘scale to fit’. Yes, that seems to make sense. I’ll leave it as a riddle for Hermitian.

 wh-lfbc-scanned-xerox-7535-wcpreview.pdf  birth-certificate-long-form.pdf USDWH7655rotated.pdf

q
Q
q
12 12 588 768 re W n
q
0 798.72 -614.4 0 613.2 -3.36 cm /Im1 Do
Q
/Cs1\ncs 0.0824 0.1333 0.098 sc
q
0 336.72 -419.76 0 516.48 236.64 cm /Im2 Do
Q
\n0.2039 0.3216 0.2902 sc
q
0 47.04 -166.56 0 484.08 71.52 cm /Im3 Do
Q
0.1765\n0.2863 0.2392 sc
q
0 10.32 -63.36 0 238.8 88.8 cm /Im4 Do
Q
/Cs2 cs 0.9843\nsc
q
0 124.08 -113.76 0 488.88 369.12 cm /Im5 Do
Q
/Cs1 cs 0.1137 0.2392 0.1804\nsc
q
0 28.8 -51.36 0 486 248.16 cm /Im6 Do
Q
0.1765 0.3451 0.2667 sc
q
0 12.24 -49.68 0 159.84 246.24\ncm /Im7 Do
Q
0.7804 0.8549 0.7765 sc
q
0 31.92 -83.76 0 167.04 280.8 cm /Im8\nDo
Q
/Cs2 cs 0.9804 sc
q
0 66.96 -42.96 0 473.76 246.24 cm /Im9 Do
Q
/Cs1\ncs 0.1216 0.2275 0.1922 sc
q
0 7.68 -21.84 0 368.16 315.36 cm /Im10 Do
Q
/Cs2\ncs 0.9882 sc
q
0 31.44 -88.56 0 267.84 444 cm /Im11 Do
Q
0.9804 sc
q
0 25.92 -54.72 0 166.8 449.76\ncm /Im12 Do
Q
/Cs1 cs 0.8 0.9059 0.7686 sc
q
0 22.8 -31.2 0 354.48 739.68\ncm /Im13 Do
Q
0.8118 0.9137 0.8 sc
q
0 24.96 -17.04 0 501.6 737.76 cm /Im14\nDo
Q
0.8118 0.9216 0.8314 sc
q
0 41.28 -8.16 0 498.48 687.84 cm /Im15 Do
Q
\n0.9804 0.9961 1 sc
q
0 26.16 -50.4 0 250.8 488.16 cm /Im16 Do
Q
0.8196 0.9176\n0.8039 sc
q
0 18.96 -12 0 310.32 735.84 cm /Im17 Do
QQ

q
Q
q
18 14.40002 576 763.2 re W n
q
0 -792.96 612.48 0 -0.24 792.48 cm /Im1 Do
Q
/Cs1 cs 0.1059 0.17650 0.1216 sc
q
0 -348.96 436.56 0 89.28 581.28 cm /Im2 Do
Q
0.34510 0.3922 0.3529 sc
q
0 -47.76 186.72 0 304.56 108.96 cm /Im3 Do
Q
0.302 0.34510 0.3216 sc
q
0 -10.08 65.76 0 170.16 89.76 cm /Im4 Do
Q
0.2549 0.3373 0.2627 sc
q
0 -29.52 54.72 0 440.4 274.08 cm /Im5 Do
Q
0.3412 0.4353 0.3412 sc
q
0 -11.28 51.84 0 103.44 254.88 cm /Im6 Do
Q
0.2549 0.3373 0.2627 sc
q
0 -8.16 16.8 0 349.68 322.08 cm /Im7 Do
Q
0.9412 0.9725 0.9216 sc
q
0 -58.32 52.08 0 176.16 185.76 cm /Im8 Do
Q
/Cs2 cs 0.9647 sc
q
0 -31.68 34.08 0 251.76 784.8 cm /Im9 Do
QQ

q
Q
q
12 12 588 768 re W n
q
0 -794.88 614.4 0 -1.2 793.44 cm /Im1 Do
Q
/Cs1 cs 0.0863 0.1255 0.1294 sc
q
0 -336.96 425.28 0 97.68 580.32 cm /Im2 Do
Q
0.1059 0.1451 0.1529 sc
q
0 -46.08 181.2 0 305.28 123.36 cm /Im3 Do
Q
0.8824\n0.9529 0.9608 sc
q
0 -39.12 54.24 0 205.68 292.32 cm /Im4 Do
Q
Q

17 thoughts on “The rendering step side-by-side

  1. NBC


    The next step is to compare the rendering instructions in the WH LFBC PDF and the Xerox 7355 PDF saved with preview. Finally I show how an upside down scanned document after being rotated in Preview matches the WH LFBC.

    All cm’s have the following structure

    0 a b 0 0 tx ty

    HHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

    The six-vectors that I extracted from the WH LFCOLB PDF by means of Adobe Acrobat XI Pro Preflight do NOT have seven elements and three zeros !

    And you forgot the brackets for the generic form..

    [a b c d e f].

    The generic form which applies to all the six-vectors for the WH LFCOLB is:

    [0 b c 0 e f]

    You must be using Preview again to analyze PDF files.

    I warned you that Apple is known for mangling PDF files and embedding Postscript stuff in PDFs.

    The first thing that I query with PreFlight is to search for embedded Postscript. If Preview returns any hits then I trash the PDF.

    Time to fork over the Preview files Dude!

    Your stuff is in shambles !

  2. NBC

    “However I noticed a new issue… The Clipping Path does not match… Never a boring moment. I believe it is related to ‘scale to fit’. Yes, that seems to make sense. I’ll leave it as a riddle for Hermitian.”

    HHHHHHHHHHHHHHHHHHHHHHHHHHHHH

    So do I !

    I noticed your three lists don’t include your two weird object labels anymore.

    Why not? Are you hiding the creator of the PDFs ?

    The answer to your riddle is that Preview doesn’t do staggered sub-object clipping paths.

    I have some files that would blow Preview’s circuits.

  3. NBC

    The readers might have noticed that NBC is not answering some very focussed questions that I have posed to him which are specific to his PDF file content.

    1. Where are the lines of code where Xerox changed the PDF default unit for length from points (1/72 in.) to 1/150 in. and then to 1/300 in.

    2. Or where are the lines of PDF code where Xerox changes the image resolution from 72 PPI to 150 PPI and then to 300PPI ?

    3. And where are the Xerox lines of code where Xerox scales the PDF default size of 1 in. x 1 in. for all embedded bitmap images to their final larger size?

    3. Without these lines of code, how did NBC determine the size and pixel resolution of each bitmap image?

    You don’t suppose that he extracted all that information from the final embedded bitmap images do you? We do know that he was looking for his YCbCr “smoking gun” in the JPEG.

    No way !!!

    I’m sure he wouldn’t have cheated by extracting the final embedded bitmap images and then taking a peek at each one ?

    It’s odd but every time that I extract bitmap images that are embedded in a PDF file my graphic tools always ask ME to specify the file format.

    So if NBC had not selected JPEG format but instead had selected Photoshop PSD or Postscript format would the YCbCr label have even popped up? Or what if he had selected JPEG2000 ?

    Now I’m not accusing NBC of “cherry picking” but I for one would like to personally check this out.

  4. Hermitian,
    I have been reading NBC’s posts for while now. None of these posts seem to address or answer any of the probems with Obama’s BC that the CCP has uncovered. It’s really just a bunch technical mishmosh that just confuses the average reader. Even assuming NBC is right that the Xerox printer was the technology used, it still does answer any of the problems. NBC has been to show some approximations to the anomolies and problems with Obama’s BC by the CCP but in no way comes closes to actually representing the concerns on Obama’s BC. The problems shown by the CCP are stunning to say the least when you watch some the CCP videos and NBC has yet to produce any of that. Again, some approxmination but no where near stunning as what is potrayed in the videos.

  5. If NBC really wants to get his point across, it might be better to put his experimentation in videos where we can see NBC’s so called replication of the problems instead trying to write up confusing technobabble posts.

  6. NBC

    NBC is expecting his readers to blindly accept all results produced by his freeware tools. For those readers who are inclined to gage the wisdom of this you can check out the Didier Stevens web page.

    http://blog.didierstevens.com/programs/pdf-tools/

    Stevens wrote the code for his pdf-parser.py and other PDF tools.

    This is what he has to say about his own work.

    “pdf-parser.py

    This tool will parse a PDF document to identify the fundamental elements used in the analyzed file. It will not render a PDF document. The code of the parser is quick-and-dirty, I’m not recommending this as text book case for PDF parsers, but it gets the job done.

    You can see the parser in action in this screencast.”

    Now I see where NBC got his “you’ve got to get down in the dirt and look at the lines of code” comment from. So the author of this code thinks that it is a “quick-and-dirty” PDF tool.

    Steven’s “will not render a PDF document” comment means that his tool doesn’t do bitmap graphics. So when using his tool you are stuck with watching lines of text race by in a DOS window. Have you ever needed to get those first few code lines back and you scroll up in the DOS window until you reach the screen buffer setting? Then you have to open the folder where the file was saved to get to the lines of code that you needed to see.

    So NBC chose another Didlier creation to extract, screen and print the bitmaps.

  7. John | July 27, 2013 at 14:51

    Hermitian,

    I have been reading NBC’s posts for while now. None of these posts seem to address or answer any of the probems with Obama’s BC that the CCP has uncovered. It’s really just a bunch technical mishmosh that just confuses the average reader. Even assuming NBC is right that the Xerox printer was the technology used, it still does answer any of the problems. NBC has been to show some approximations to the anomolies and problems with Obama’s BC by the CCP but in no way comes closes to actually representing the concerns on Obama’s BC. The problems shown by the CCP are stunning to say the least when you watch some the CCP videos and NBC has yet to produce any of that. Again, some approxmination but no where near stunning as what is potrayed in the videos.

    HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

    Right ! My heading is spinning over the NBC’s “down and dirty” detailed lists of PDF stuff.

    I have also watched all of the Arpaio / CCP briefing videos. They get right to the bottom line.

    I also share many of the same concerns as you.

  8. Now I see where NBC got his “you’ve got to get down in the dirt and look at the lines of code” comment from. So the author of this code thinks that it is a “quick-and-dirty” PDF tool.

    Now you are complaining about the tools I am using… Hilarious… Yes, the pdf-parser is not the end of end all of tools. Indeed it fails to extract images, however that is not a real problem as any can use a hex editor to extract the JPEG or PPM code or use other tools to do so.

    Uh… Has it not occurred to you that I am using a Mac🙂 And surely you too have heard of ‘redirecting’ output to a text file?

    Furthermore I adapted the –dump to output to a file as well.

    Initiative it’s called I believe.

    I understand why some people have concerns using these basic tools as they are far more comfortable with a GUI. Fine, whatever works best. But without a clear understanding of the low level PDF, one misses out on countless details.

    So rather than poopoo my tools, why do you not show me where I went wrong…

    The problem with that is that you can’t…

    As a diligent researcher I continue to double and triple check my findings. Thus when I found the JPEG comment, I took alternative steps to make sure that it was not the jpeg extraction tool that created this.

    Once I am satisfied that I can recreate something I feel confident to report on it. Sometimes, I make predictions based on my findings and continue to be amazed how they all line up so nicely.

    It’s a delight to a researcher to have found a simple yet consistent work flow that explains most all if not all the artifacts found in the WH LFBC

    Very satisfying..

  9. All cm’s have the following structure

    0 a b 0 0 tx ty

    HHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

    The six-vectors that I extracted from the WH LFCOLB PDF by means of Adobe Acrobat XI Pro Preflight do NOT have seven elements and three zeros !

    And you forgot the brackets for the generic form..

    [a b c d e f].

    I knew that you would make an issue of this and expose your limited math abilities. These are just names. I can name them whatever I want, as long as I adjust the equations…

    The generic form which applies to all the six-vectors for the WH LFCOLB is:

    [0 b c 0 e f]

    You must be using Preview again to analyze PDF files.
    </blockquote

    Nope, pdf-parser.py. Noone would rely in high level tools…

    I warned you that Apple is known for mangling PDF files and embedding Postscript stuff in PDFs.

    Which makes applying the preview step even more relevant. But to lay to rest your concerns: No postrscript stuff embedded as far as I can tell but you do raise a good point:

    You have to look at the PDF output after preview has been applied…

    The first thing that I query with PreFlight is to search for embedded Postscript. If Preview returns any hits then I trash the PDF.

    Good for you. But again, irrelevant to the issue.

    Time to fork over the Preview files Dude!

    Your stuff is in shambles !

    ROTFL… You mean you still cannot rebut my claims…

    This is so funny. Here we have someone who is using Xerox created output to compare to a preview created output to claim that the two don’t match..

    Duh…

    I have shown you what the data look like after preview has touched the PDF…

    If you have any rebuttals then please present them.

    Surely a diligent researcher like you should be able to recreate the intermediate files and the final file yourself? One should never rely on the analysis of the other. Remember, you take so much pride in analyzing it all yourself…

    Now is the time to do so

  10. noticed your three lists don’t include your two weird object labels anymore.

    Why not? Are you hiding the creator of the PDFs ?

    The answer to your riddle is that Preview doesn’t do staggered sub-object clipping paths.

    I have no idea what you are talking about here. What weird objects? You mean the ones with all dots? They are just like the other Objects ‘monochrome bitmaps’ and no they do not show up in the Xerox scanned versions. But that’s not too surprising.

    I will add the objects that point to the metadata…

    As to preview not doing staggered sub-object clipping masks, I fail to see its relevance here?

    Hint, the clipping mask is the top most object…

  11. The readers might have noticed that NBC is not answering some very focussed questions that I have posed to him which are specific to his PDF file content.

    As I have said, I welcome questions. So let’s see if I can help you.

    1. Where are the lines of code where Xerox changed the PDF default unit for length from points (1/72 in.) to 1/150 in. and then to 1/300 in.

    There are none. So let me help Hermitian understand what happens here. If you take an object and scale it by 24%, such as the foreground bitmaps, the pixel density of the object increases accordingly, this can be observed trivially when noticing that the foreground objects have twice the pixels per inch compared to the JPEG.
    Let’s see 72 /0.24 = 300 and 72/0.48 is 150 DPI. In other words,, the individual pixels in the bitmaps are mapped one by one onto the 72 DPI canvas, and you will notice how these pixels are much smaller than 72 DPI. This way, you can render the image in any final DPI and still retain the details from the original bitmaps.

    This is not too hard to understand…

    Let’s look at an object

    obj 9 0
     Type: /XObject
     Referencing: 10 0 R
     Contains stream
    
      <>
    

    The object has 1403×1749 pixels.

    and is defined to be

    /Im2 9 0 R

    /Im2 receives the following scaling

    0 336.72 -419.76 0 516.48 236.64 cm /Im2

    336.72 points wide originally 1403 pixels scaled 24%
    419.76 pixels high originally 1749 pixels scaled 24%
    90 degrees rotation

    In other words, the cm transform compresses the 1749×1403 pixels into something 0.24 its original size/ These are now rendered as 72 DPI, the original size was 72/0.24 or 300 DPI. Alternatively the box has the following size

    336.72 /72= 4.67”
    419.76 = 5.83”

    Take the original bitmap of 1749×1403 and map them to the box

    1749/5.83 =300
    1403/4.677=300

    This is how typically MRC behaves. The foreground is subsampled to 300 DPI (from the original 600) and th background to 150 DPI (from the original 600)

    2. Or where are the lines of PDF code where Xerox changes the image resolution from 72 PPI to 150 PPI and then to 300PPI ?

    Nowhere to be found.

    3. And where are the Xerox lines of code where Xerox scales the PDF default size of 1 in. x 1 in. for all embedded bitmap images to their final larger size?

    Actually the default size is not 1 in. x 1. in but rather the coordinates run from 0…1 and 0…1 not inches per say but rather internal coordinates. They are subsequently scaled to map onto the 612×792 canvas or an approximation thereof because the system has to take into consideration some artifacts. In the end you end up with exactly the document you see.

    3. Without these lines of code, how did NBC determine the size and pixel resolution of each bitmap image?

    A little bit of math and a lot of logic… Yes I understand that the information is not directly visible and requires some investigative methods. I apologize for assuming that this was obvious.

    You can do the same through visual inspection as well.

  12. So if NBC had not selected JPEG format but instead had selected Photoshop PSD or Postscript format would the YCbCr label have even popped up? Or what if he had selected JPEG2000 ?

    I fail to see the relevance. The label is clearly visible in the JPEG format.

    Checkout Obj 7

    obj 7 0
     Type: /XObject
     Referencing: 8 0 R, 11 0 R
     Contains stream
    
      <>
    

    I will include a part of its datastream

    \xe5\xe6\xe7\xe8\xe9\xea\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xff\xfe\x00\x07YCbCr\xff\xc0\

    \xff\xfe indicates an embedded JPEG comment
    \x00\x07 indicates a length 7
    YCbCr is a 5 byte long string with 2 bytes for length

    Check out the JPEG standard…

    I will quote from Wikipedia

    A JPEG image consists of a sequence of segments, each beginning with a marker, each of which begins with a 0xFF byte followed by a byte indicating what kind of marker it is.

    0xff followed by 0xfe so what does 0xfe represent?

    COM 	0xFF, Comment	variable size Contains a text comment.
            	 0xFE    
    

    Variable size…

    Some markers consist of just those two bytes; others are followed by two bytes indicating the length of marker-specific payload data that follows. (The length includes the two bytes for the length, but not the two bytes for the marker.)

    Does this help

  13. I’m sure he wouldn’t have cheated by extracting the final embedded bitmap images and then taking a peek at each one ?

    It’s odd but every time that I extract bitmap images that are embedded in a PDF file my graphic tools always ask ME to specify the file format.

    Exactly why one should not use highlevel tools

    The pdf-parser.py does not decode DCTDecode objects but you can inspect their binary code.

    A hex editor allows you to extract the JPEG bytes and save them as a xxx.jpg file and open up.

    A pdfimages tool extracts images and -j extracts dctdecode to jpeg

    Since I do not trust any particular tool I inspected the string through a variety of methods, all showed the string.

    I can imagine that when you extract it using Adobe it may add adobe metadata, I am not sure. Would make for a good experiment for Hermitian to perform but it is irrelevant to this discussion.

    If you believe that I ‘cheated’ then show me… I have invited you to rebut my findings, claiming your own inability to extract these images as evidence of me cheating is what is called an ‘argument from ignorance’ my friend, and somewhat ad hominem.

    Show me that you too can analyze PDF data correctly.

  14. Now I’m not accusing NBC of “cherry picking” but I for one would like to personally check this out.

    Then do the necessary work to check it out…

    1. Open Xerox PDF in preview
    2. print to pdf
    3. Examine new PDF

    Or in case of the jpeg, just extract it from the xerox document, I have told you that I checked that Preview does not touch the embedded image objects, which is why they remain stored in their original, sideways/landscape direction.

    Let me know if you still have not figured out why it is landscape…

  15. If NBC really wants to get his point across, it might be better to put his experimentation in videos where we can see NBC’s so called replication of the problems instead trying to write up confusing technobabble posts.

    I could of course step down to John’s level of comprehension but most of the details would be lost. If John has a hard time reading and understanding this then I am concerned why he and others still believe that the PDF was forged…

    Any investigation into a PDF includes this ‘techno babble’

    But while I am not in the mood for a video, I surely intend to write it up step by step, in simple enough language that even John should be able to comprehend. If that fails, I may have to enlist characters from Sesame Street

  16. Hermitian has submitted 5 comments in which he lays out his ‘forgery findings’. I have combined them into a single posting for fairness sakes.

    I will be adding my comments in red over time to see how his explanations hold up given the identified Xerox Workflow.

  17. NBC

    “As to preview not doing staggered sub-object clipping masks, I fail to see its relevance here?

    Hint, the clipping mask is the top most object…”

    HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

    The hierarchy of the WH LFCOLB PDF image is

    /Clip Group

    /_____Clipping Path

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    /_____Clip Group

    /__________Clipping Path

    /__________Image

    Thre are a total of 30 Layers in the Layers Panel including the primary Layer 1.

    There are a total of nine Links in the Links Panel.

    All of the nine links are embedded bitmap images.

Comments are closed.