research tool for the analysis of malicious pdf documents. make sure to run the installer first to get all of the 3rd party dlls installed correctly.
Visual Basic C C# C++ JavaScript Inno Setup
Switch branches/tags
Nothing to show
Permalink
Failed to load latest commit information.
AS3_WebInstall js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
dependancies bugfix: save all decompressed streams (new character in list bad path) Mar 7, 2017
husk js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
iTextFilters koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
libemu js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
mupdf js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
plugins js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
scripts js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
unused moving to scivb_lite for bugfixes Feb 22, 2014
xor_bruteforcer js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
.gitattributes js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
.gitignore koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
.todo.txt eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
CApplyFilters.cls koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
CDisassembler.cls initial commit Mar 31, 2011
CFunc.cls eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
CGraph.cls jsui: copy rename map, graph xrefs from (wingraphviz) May 27, 2015
CInstruction.cls initial commit Mar 31, 2011
CNode.cls graph topmost checkbox, bugfix: graphfrom, loc May 31, 2015
CPDFStream.cls frmJS.lvFuncs.SequentialRename right click, updated scivb and hexed May 31, 2014
CPdfParser.cls frmJS.lvFuncs.SequentialRename right click, updated scivb and hexed May 31, 2014
CScriptFunctions.cls koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
CSharpFilters.cls better message if no .NET version found Nov 7, 2013
Form1.frm bugfix: save all decompressed streams (new character in list bad path) Mar 7, 2017
Form1.frx uses hexed.ocx now, added dependancies, bugfix in fso.bas May 31, 2012
Form2.frm eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
Form2.frx updated scivb_lite & lexer. FirstLine bugfix, highlight word on dblclick Feb 25, 2014
JS_UI_Readme.txt added msscript decoder to jsui, scivb update, vbs option to strip inl… Feb 26, 2016
Module4.bas + flash cve scan, bugfix as processor, bugfix jsui rename function Jun 26, 2015
PDFStreamDumper.exe eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
Project1.vbw js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
Readme.txt added msscript decoder to jsui, scivb update, vbs option to strip inl… Feb 26, 2016
_Project1.vbp eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
_Project1.vbw eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
_min_install_script.iss koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
b64.bas jsui: xrefs to graph, lvfunc loc, func start line # bugfix (used in e… May 30, 2015
beautify.js initial commit Mar 31, 2011
clsCmnDlg.cls moving to scivb_lite for bugfixes Feb 22, 2014
clsRegistry2.cls scan xx=function(), JS Debug, mnuUniAsciiToHex, Replace Hex Ascii Str… Jul 13, 2015
frmAbout.frm added msscript decoder to jsui, scivb update, vbs option to strip inl… Feb 26, 2016
frmAbout.frx beta support for JBIG2 and FaxDecode now integrated (bulk testing req… Apr 27, 2012
frmAryReplace.frm CScript added b64 decode method, update scivb2.ocx, ary replace \n bu… Jun 28, 2016
frmBruteZLib.frm + flash cve scan, bugfix as processor, bugfix jsui rename function Jun 26, 2015
frmBruteZLib.frx added quick zlib bruteforcer Dec 17, 2011
frmEvalSelection.frm eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
frmFilterVisualizer.frm Main UI Cleanup code (thanks Darren!), CCTIFaxDecode now defaults to … May 18, 2012
frmFuncGraph.frm jsui: deobs tools added actionscript processor (as3 sourcer input for… Jun 13, 2015
frmFuncGraph.frx jsui: xrefs to graph, lvfunc loc, func start line # bugfix (used in e… May 30, 2015
frmInlineDecoderCalls.frm eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
frmInlineDecoderCalls.frx js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
frmManualFilters.frm koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
frmManualFilters.frx initial commit Mar 31, 2011
frmProcessScript.frm eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
frmRefactor.frm eval selection form, process script form, refactor: var00, override f… Jun 17, 2017
frmReplace.frm added msscript decoder to jsui, scivb update, vbs option to strip inl… Feb 26, 2016
frmScTest.frm added msscript decoder to jsui, scivb update, vbs option to strip inl… Feb 26, 2016
frmSclog.frm koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
frmSclog.frx initial commit Mar 31, 2011
husk.dat misc fixes, ignores, line endings Dec 4, 2013
husk.exe tweaked new_husk, drag and drop to some sc file fields, update sclog/… Aug 30, 2012
iTextFilters.dll koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
iTextFilters.tlb misc fixes, ignores, line endings Dec 4, 2013
iTextSharp.dll koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
java.hilighter moving to scivb_lite for bugfixes Feb 22, 2014
js_api.txt moving to scivb_lite for bugfixes Feb 22, 2014
lzma.bas tools - flash decompress lzma (ZWS Header) Aug 29, 2014
lzma.exe tools - flash decompress lzma (ZWS Header) Aug 29, 2014
modActionScript.bas js: mnuFunctionScan, ExtractFunction fixed to handle funcs within fun… Jan 5, 2016
modCrc.bas initial commit Mar 31, 2011
modEscapes.bas moving to scivb_lite for bugfixes Feb 22, 2014
mupdf.bas view as image menu item, C# CCTIFaxDecode (from sun), simplified Appl… May 1, 2012
mupdf.dll fixed mem leak in jbig dll (my error), misc tweaks and bulk testing May 1, 2012
myMain.js initial commit Mar 31, 2011
sclog.exe Now AV 0 detections: shellcode2exe now opens web page, sclog download… Feb 12, 2014
sclog_README.txt updated to new sclog Sep 17, 2012
scrdec12.exe added msscript decoder to jsui, scivb update, vbs option to strip inl… Feb 26, 2016
simple-fso..bas added msscript decoder to jsui, scivb update, vbs option to strip inl… Feb 26, 2016
simple_husk.dat uses hexed.ocx now, added dependancies, bugfix in fso.bas May 31, 2012
userLib.js koji patch: RunLengthDecode, AsciiHexDecode >, sclog file path, txtOut Nov 30, 2016
zlib.dll added version of zlib.dll which is compatiable with win2k+ (previous … Jan 20, 2012

Readme.txt


           PdfStream Dumper v.9.3xx

Developer: David Zimmer <dzzie@yahoo.com>
Homepage:  http://sandsprite.com/blogs/index.php?uid=7&pid=57

Capabilities
--------------------------------------

	This tool is designed to allow you to parse and analyze PDF files in their raw format.
	It includes allot of features like being able to:
	
	- view all pdf objects
	- view deflated streams
	- view stream details such as file offsets, header, etc
	- save raw and deflated data
	- decompile Flash ActionScript 3 files with AS3 Sorcerer (Trial included) 
	- supports filters: FlateDecode, RunLengthDecode, ASCIIHEXDecode, 
                            ASCII85Decode, LZWDecode, FaxDecode, JBIG2Decode
        - supports filter chaining (ie multiple filters applied to same stream)
        - supports unescaping encoded pdf headers
	- search streams for strings
	- perform various types of manual escapes on selected data portions.
	- scan for functions which contain pdf exploits (dumb scan)
	- format javascript using js beautifier (see credits at end)
	- view streams as hex dumps
	- zlib compress/decompress arbitrary files
	- replace/update pdf streams with your own data
	- basic javascript interface so you can execute parts of embedded scripts
	- integrated UI for sclog shellcode analysis tool from idefense. (seperate install)
	- integrated UI for sctest shellcode analysis tool using libemu. (included in install)
	- js ui also has access to a toolbox class to do a bunch of things (dump to file etc)
	- decrypt encrypted pdf files (uses iTextSharp)
	- basic ability to rename obsfuscated javascript functions, arguments, and variables
	- can hide: header only streams, duplicate streams (by crc), selected streams
	
	This tool is useful for many things, it is free and open source.
	
	It does not parse pdfs fully, it basically just extracts obj streams and headers.
	
	I dont want to try to make it to smart, few assumptions means fewer places
	to try to break its analysis by malicious pdfs. Even if this means you have
	to manuallly apply more smarts when looking at it. 
	
	I am trying to keep this tool pretty raw so you can see their tricks yet
	still have the tools on hand to bypass them. 
	
	Decryption app is in C# using iTextSharp. It copies the contents of the owner
	password protected pdf into a new file and unencrypts it as it does so. 


Notes:
-----------------------------------------

	Some filters and the pdf decrypt features are optional
	they require .NET 2.0 (or above) installed. The app should run fine without
        them, just wont support these extra features.
	
	sclog (iDefense) and scdbg (libemu) shellcode analysis tools are included with the installer.
	
	 -----> sclog runs LIVE SHELLCODE so    <----
	 -----> ONLY USE IT ON A TEST MACHINE ! <---- (duh)
	
	scdbg is powered by libemu and analyzes shellcode in an emulation envirnoment
	so should be safe(r).

	If you find a pdf which pdfstreamdumper cant deal with, feel free to mail
	it in a password protected zip file to me at dzzie@yahoo.com


Command line options:
--------------------------------------------
	PdfStreamDumper currently only supports one command line option which is /extract

	usage: pdfstreamdumper "c:\blah blah\bad.pdf" /extract "c:\some folder"

        When run in this mode, it will load the pdf file (interface visible) extract all of
        of the streams it could process without error to the folder specified and then exit.

	The folder need not exist, it will build the path to it if it can. The files will be 
	named stream_x.ext where ext is the relevant file type extension if it can be determined.


Hot Keys and other Behaviors:
---------------------------

	main form left hand listview supports coloring based on stream types, use mouseover to
	see tooltip, or use Tools->About lv Colors to see color map info.
	
	this listview also supports some hot keys. 
	Ctrl-a = select all
	ctrl-n = select none
	ctrl-d = deleted selected (no changes are made to the pdf)
	ctrl-i = invert selection
	
	these are useful with the listview right click menu options to save streams because these
	menu items work on all streams in the listview itself.
	
	also the Search menu item will auto select all the matches it finds in this main listview too
	in case you want to select all fonts and then save them the streams you are only a couple clicks
	away regardless of how many are in the file. 
	
	once you trim out the list, you can reload it anytime by clicking the load button again.
	
	also check out the Tools->options menu where you can auto hide duplicate streams, and header only
	streams. (you probably wan to view headers by default)
	
	Example: 
	--------------------
	  How do I extract all of the unique fonts in a decompressed format from a 
	  pdf quickly if the pdf has hundreds of objects?
	
	  1) make sure the tools->options->hide duplicate streams option is set
	  2) click the search_for->TTF Fonts This will select all fonts in main list.
	  3) right click on one of the selected fonts in the main list (on left) 
	      and choose the menu option to hide unselected
	  4) right click on main list (which only contains the fonts now) and choose
	      save all decompressed streams
	
	  To reload all of the streams again, just click the load button to start over.


Source Code and projects
---------------------------------------

	Source code is included with this installer. 
	You will find a \source directory on the start menu entry with the
	project files. 
	
	latest source can always be pulled from github:

	pdfstreamdumper https://github.com/dzzie/pdfstreamdumper
        sclog           https://github.com/dzzie/sclog
	scdbg
	 - vc/win32     https://github.com/dzzie/VS_LIBEMU
         - gcc/*nix     https://github.com/dzzie/SCDBG

Credits:
---------------------------

	Original stream parser was written by by VBboy136 - 12/9/2008
	http://www.codeproject.com/KB/DLL/PDF2TXTVB.aspx
	
	Scintilla by Neil Hodgson [neilh@scintilla.org] 
        http://www.scintilla.org/

        ScintillaVB by Stu Collier
        http://www.ceditmx.com/software/scintilla-vb/

	AS3 Sorcerer Trial provided courtesy of Manitu Group. 
	http://www.as3sorcerer.com/

	JS Beautify by Einar Lielmanis, <einar@jsbeautifier.org>_
	conversion to Javascript code by Vital, <vital76@gmail.com>
	http://jsbeautifier.org/
	
	zlib.dll by Jean-loup Gailly and Mark Adler
	http://www.zlib.net/
	
	CRC32 code by Steve McMahon
	http://www.vbaccelerator.com/home/vb/code/libraries/CRC32/article.asp
	
	iTextDecode/iTextFilters use iTextSharp by Bruno Lowagie and Paulo Soares
	http://itextpdf.com/terms-of-use/index.php
	
	olly.dll GPL code Copyright (C) 2001 Oleh Yuschuk.
	http://home.t-online.de/home/Ollydbg/
        http://sandsprite.com/CodeStuff/olly_dll.html
	
	MuPDF is released under GPL and Copyright 2006-2012 Artifex Software, Inc.
	http://www.mupdf.com/

        CCTIFaxDecoder copyright Sun MicroSystems and intarsys consulting GmbH.
	http://java.net/projects/pdf-renderer/
  
	libemu written by Paul Baecher and Markus Koetter 2007.	
	http://libemu.carnivore.it/about.html

	scdbg homepage
	http://sandsprite.com/blogs/index.php?uid=7&pid=152
	
        sclog is a tool i wrote back at iDefense (no longer available on their site)
        https://github.com/dzzie/sclog

	Interface by dzzie@yahoo.com 
	http://sandsprite.com
	
        WinGraphViz OOD Tsen oodtsen@gmail.com
        http://wingraphviz.sourceforge.net/wingraphviz/index.htm

        GraphViz - AT&T Labs
        http://graphviz.org/

	Other thanks to Didier Stevens for the info on his blog on tags and encodings.
	http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways

        HexEd hexeditor control codebase by Rang3r
        http://www.Planet-Source-Code.com/vb/scripts/ShowCode.asp?txtCodeId=34729&lngWId=1

        Microsoft Script Decoder (c)2000/2001 MrBrownstone
        http://www.virtualconspiracy.com/scrdec.html