Another failed forgery hypothesis

Hermitian tries again and fails

Hermitian: Here is the code that blows your Xerox forger to pieces:

(NBC: I extracted the string from the WH LFBC PDF:)

%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ    
ÿĵw!1AQaq"2B‘¡±Á    #3RðbrÑ
$4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz‚ƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿþYCbCrÿ

So here is the code from the preview version of the WH 7535

%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ    
ÿĵw!1AQaq"2B‘¡±Á    #3RðbrÑ
$4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz‚ƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿþYCbCrÿ

Good luck with another failed forgery hypothesis my friend… Do you ever bother to check your work before making foolish claims?

So let’s explore a bit further…

The JPEG starts with 0xFF 0xD8, which is the start tag, followed by 0xFF 0xDB which is the DQT tag which contains a variable length quantization table(s) the length is 0x00 0x43 in both examples

Let’s compare

WH LFBC PDF

 00 08 0A 0B 0D 0B 09 0E 0D 0C 0D 10 0F 0E 11 16
 24 17 16 14 14 16 2C 20 21 1A 24 34 2E 37 36 33
 2E 32 32 3A 41 53 46 3A 3D 4E 3E 32 32 48 62 49
 4E 56 58 5D 5E 5D 38 45 66 6D 65 5A 6C 53 5B 5D
 59

Xerox 7353

00 08 0A 0B 0D 0B 09 0E 0D 0C 0D 10 0F 0E 11 16 
24 17 16 14 14 16 2C 20 21 1A 24 34 2E 37 36 33 
2E 32 32 3A 41 53 46 3A 3D 4E 3E 32 32 48 62 49 
4E 56 58 5D 5E 5D 38 45 66 6D 65 5A 6C 53 5B 5D 
59

Wow…

There is another DQT table…indicated by 0xFF 0xDB also 0x00 0x43 length . Not surprisingly, they are the same as well.

Then we find a 0xFF 0xC4 tag which indicates a Huffman table (DHT tag) of length 0x00 0x1F for both cases.

WH LFBC

00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 
00 00 01 02 03 04 05 06 07 08 09 0A 0B

Xerox PDF

00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00
00 00 01 02 03 04 05 06 07 08 09 0A 0B

Another Huffman table of length 0x00 0xB5 (181 decimal)

WH LFBC

10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 
7D 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 
07 22 71 14 32 81 91 A1 08 23 42 B1 C1 15 52 D1 
F0 24 33 62 72 82 09 0A 16 17 18 19 1A 25 26 27 
28 29 2A 34 35 36 37 38 39 3A 43 44 45 46 47 48 
49 4A 53 54 55 56 57 58 59 5A 63 64 65 66 67 68 
69 6A 73 74 75 76 77 78 79 7A 83 84 85 86 87 88 
89 8A 92 93 94 95 96 97 98 99 9A A2 A3 A4 A5 A6 
A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 
C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E1 
E2 E3 E4 E5 E6 E7 E8 E9 EA F1 F2 F3 F4 F5 F6 F7 
F8 F9 FA

Xerox

10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 
7D 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 
07 22 71 14 32 81 91 A1 08 23 42 B1 C1 15 52 D1 
F0 24 33 62 72 82 09 0A 16 17 18 19 1A 25 26 27 
28 29 2A 34 35 36 37 38 39 3A 43 44 45 46 47 48 
49 4A 53 54 55 56 57 58 59 5A 63 64 65 66 67 68 
69 6A 73 74 75 76 77 78 79 7A 83 84 85 86 87 88 
89 8A 92 93 94 95 96 97 98 99 9A A2 A3 A4 A5 A6 
A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 
C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E1 
E2 E3 E4 E5 E6 E7 E8 E9 EA F1 F2 F3 F4 F5 F6 F7 
F8 F9 FA

Followed by another Huffman Table and then the YCbCr Comment tag. Well, you get the picture…