PDF Stream Dumper

This is a free tool for the analysis of malicious PDF documents. This tool has been made possible through the use of a mountain of open source code. Thank you to all of the authors involved. Has specialized tools for dealing with obsfuscated javascript, low level pdf headers and objects, and shellcode. In terms of shellcode analysis, it has an integrated interface for libemu sctest, an updated build of iDefense sclog, and a shellcode_2_exe feature.

• supported filters: FlateDecode, RunLengthDecode, ASCIIHEXDecode, ASCII85Decode, LZWDecode, JBIG2, CCITTFaxDecode, DecodePredictors
• Integrated shellcode tools:
  • sclog gui (Shellcode Analysis tool I wrote at iDefense)
  • scdbg libemu based Shellcode analysis tool
  • Shellcode_2_Exe functionality
  • Export unescaped bytes to file
• supports filter chaining (ie multiple filters applied to same stream)
• supports unescaping encoded pdf headers
• scriptable interface to process multiple files and generate reports
• view all pdf objects
• view deflated streams
• view stream details such as file offsets, header, etc
• save raw and deflated data
• search streams for strings
• scan for functions which contain pdf exploits (dumb scan)
• format javascript using js beautifier (see credits in readme)
• view streams as hex dumps
• zlib compress/decompress arbitrary files
• replace/update pdf streams with your own data
• basic javascript interface so you can run parts of embedded scripts + support for using MS Script Debugger
• PdfDecryptor w/source - uses iTextSharp and requires .Net Framework 2.0
• Basic Javascript de-obsfuscator
• can hide: header only streams, duplicate streams, selected streams
• js ui also has access to a toolbox class to
  • simplify fragmented strings
  • read/write files
  • do hexdumps
  • do unicode safe unescapes
  • disassembler engine
  • replicate some common Adobe API (new)

• csv_stats.vbs - Builds csv file with results from lower status bar for all files in a directory
• pdfbox_extract.vbs - use pdfbox to extract all images and text from current file
• string_scan.vbs - scan all decompressed streams in all files in a directory for a string you enter
• unsupported_filters.vbs - scan a directory and build list of all pdfs which have unsupported filters
• filter_chains.vbs - recursivly scans parent dir for pdfs that use multiple encoding filters on a stream.
• obsfuscated_headers.vbs - recursivly scans parent dir for pdfs that have obsfuscated object headers
• pdfbox_extract_text_page_by_page.vbs - uses pdfbox to extract page data into individual files
  
  

• Build_DB.dll - Search and sort data inside multiple samples, move and organize files
• obj_browser.dll - view layout and data inside pdf in text form

Credits:
---------------------------
stream parser was written by VBboy136 - 12/9/2008
http://www.codeproject.com/KB/DLL/PDF2TXTVB.aspx
	
Scintilla by Neil Hodgson [neilh@scintilla.org] 
http://www.scintilla.org/

ScintillaVB by Stu Collier
http://www.ceditmx.com/software/scintilla-vb/

AS3 Sorcerer Trial provided courtesy of Manitu Group. 
http://www.as3sorcerer.com/

JS Beautify by Einar Lielmanis, _
conversion to Javascript code by Vital, 
http://jsbeautifier.org/
	
zlib.dll by Jean-loup Gailly and Mark Adler
http://www.zlib.net/
	
CRC32 code by Steve McMahon
http://www.vbaccelerator.com/home/vb/code/libraries/CRC32/article.asp
	
iTextDecode/iTextFilters use iTextSharp by Bruno Lowagie and Paulo Soares
http://itextpdf.com/terms-of-use/index.php
	
olly.dll GPL code Copyright (C) 2001 Oleh Yuschuk.
http://home.t-online.de/home/Ollydbg/
http://sandsprite.com/CodeStuff/olly_dll.html
	
MuPDF is released under GPL and Copyright 2006-2012 Artifex Software, Inc.
http://www.mupdf.com/

CCTIFaxDecoder copyright Sun MicroSystems and intarsys consulting GmbH.
http://java.net/projects/pdf-renderer/
  
libemu written by Paul Baecher and Markus Koetter 2007.	
http://libemu.carnivore.it/about.html

scdbg homepage
http://sandsprite.com/blogs/index.php?uid=7&pid=152
	
sclog is a tool i wrote back at iDefense (no longer available on their site)
https://github.com/dzzie/sclog

Interface by dzzie@yahoo.com 
http://sandsprite.com
	
WinGraphViz OOD Tsen oodtsen@gmail.com
http://wingraphviz.sourceforge.net/wingraphviz/index.htm

GraphViz - AT&T Labs
http://graphviz.org/

Other thanks to Didier Stevens for the info on his blog on tags and encodings.
http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways

Comments: (17)