Printer Tracking (Серийный номер принтера)
Printer Tracking (Серийный номер принтера)
Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-22 | Status: Solved Techniques: DEDA toolkit for printer dot decoding, Machine Identification Code (MIC) extraction, PDF to image conversion for forensic analysis, Yellow tracking dots analysis
Summary
Task: Find the serial number of a printer from a printed document. Solution: Extract Machine Identification Code (MIC) yellow tracking dots from PDF using DEDA toolkit to decode Epson printer serial number.
Printer Tracking — hackerlab.pro
Description
Мы нашли улики преступления - распечатанные листы данного документа. Цель - узнать серийный номер принтера, на котором он был распечатан.
(We found evidence of a crime - printed sheets of this document. The goal is to find the serial number of the printer on which it was printed.)
Analysis
This task relates to printer forensics — a field studying hidden marks that color laser printers leave on every printed page.
Machine Identification Code (MIC)
Most color laser printers (Canon, Epson, HP, Xerox, etc.) print invisible yellow dots on every page. These dots encode:
- Printer serial number
- Print date and time
- Sometimes — other identifying information
The dots are practically invisible to the naked eye but can be detected:
- Under blue light (UV)
- When scanning at high resolution
- With specialized analysis tools
Dot Patterns
Several patterns exist:
- Pattern 1-3: Various manufacturers
- Pattern 4: Epson (most common)
- Pattern 5: Xerox
Solution
Step 1: Converting PDF to Images
bash read-only • copy allowed# Download task.zip, extract unzip task.zip # Get Steganography.pdf (8 pages, A4) # Convert PDF to PNG at high resolution (300 DPI) pdftoppm -png -r 300 Steganography.pdf page # Result: page-1.png, page-2.png, ... page-8.png
Important: 300 DPI resolution is necessary for correct detection of small yellow dots.
Step 2: Installing DEDA Toolkit
DEDA (Dots Extraction, Decoding and Anonymisation) — a tool for analyzing printer dots.
bash read-only • copy allowed# Create virtual environment python3 -m venv deda_env source deda_env/bin/activate # Install DEDA pip install deda # Or from source: git clone https://github.com/dfd-tud/deda.git cd deda pip install .
Step 3: Image Analysis
python read-only • copy allowed#!/usr/bin/env python3 from libdeda.print_parser import PrintParser # Analyze first page pp = PrintParser('page-1.png') # Check detected pattern print(f"Pattern: {pp.pattern}") # Pattern 4 (Epson) # Decode TDM (Tracking Dot Matrix) decoded = pp.tdm.decode() print(decoded)
Decoding result:
python read-only • copy allowed{ 'serial': '-989898-', 'printer': '00989898', 'manufacturer': 'Epson', 'timestamp': datetime(2030, 12, 31, 23, 55), # ... other fields }
Alternative Method: CLI
bash read-only • copy allowed# Use DEDA command line deda_parse_print page-1.png # Output: # Pattern 4 detected # Manufacturer: Epson # Serial: 00989898 # Date: 2030-12-31 23:55
Step 4: Extracting Serial Number
From decoded data:
- Manufacturer: Epson
- Serial number: 989898 (stored as 00989898)
- Print timestamp: 2030-12-31 23:55 (possibly misconfigured printer clock)
Theory
How Yellow Dots Work
- Placement: Dots form a regular grid across the entire page
- Size: ~0.1 mm in diameter
- Color: Yellow (nearly invisible on white paper)
- Encoding: Dot positions in the matrix encode data
Pattern 4 (Epson)
8x16 dot matrix, repeating across the page:
- Columns 1-7: Serial number (BCD)
- Columns 8-14: Date/time
- Columns 15-16: Check bits
Ethical Aspects
MIC technology raises privacy concerns:
- Pro: Helps track counterfeiters and document leaks
- Con: Violates printing anonymity, surveillance potential
DEDA also includes tools for anonymizing documents (adding noise to dots).
Useful Resources
- DEDA GitHub
- EFF Yellow Dots
- Seeing Yellow (research)
Full Solution Script
python read-only • copy allowed#!/usr/bin/env python3 """ Printer Tracking Dots Decoder Extracts serial number from Machine Identification Code (MIC) """ import subprocess import sys from pathlib import Path def convert_pdf_to_png(pdf_path, dpi=300): """Convert PDF to PNG images using pdftoppm""" output_prefix = Path(pdf_path).stem subprocess.run([ 'pdftoppm', '-png', '-r', str(dpi), pdf_path, output_prefix ], check=True) return list(Path('.').glob(f'{output_prefix}-*.png')) def analyze_tracking_dots(image_path): """Analyze yellow tracking dots using DEDA""" try: from libdeda.print_parser import PrintParser pp = PrintParser(str(image_path)) if pp.pattern is None: print(f"No pattern detected in {image_path}") return None print(f"Pattern {pp.pattern} detected") decoded = pp.tdm.decode() return decoded except ImportError: print("DEDA not installed. Install with: pip install deda") sys.exit(1) def main(): # Convert PDF to images pdf_file = "Steganography.pdf" print(f"Converting {pdf_file} to PNG...") images = convert_pdf_to_png(pdf_file) if not images: print("No images generated!") return # Analyze first page print(f"\nAnalyzing {images[0]}...") result = analyze_tracking_dots(images[0]) if result: print("\n=== Decoded Information ===") print(f"Manufacturer: {result.get('manufacturer', 'Unknown')}") print(f"Serial Number: {result.get('printer', 'Unknown')}") print(f"Timestamp: {result.get('timestamp', 'Unknown')}") # Extract serial for flag serial = result.get('printer', '').lstrip('0') if serial: print(f"\n=== FLAG ===") print(f"CODEBY{{{serial}}}") if __name__ == "__main__": main()
Conclusion
Printer steganography is a unique forensics field. Yellow dots (MIC) allow identifying a printer from any printed document. The DEDA tool automates extraction and decoding of these hidden marks.