Analysis tools and exploit sample scripts for Adobe Reader 10/11 and Acrobat Reader DC
Python JavaScript
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.

Pwning the Reader with XFA

This git repo contains the material from my Adobe (Acrobat) Reader (10/11/DC) XFA research. The provided material consists of:

  • Idapython analysis scripts for symbol recovery
  • PDBs for Acroform.api of versions AR 10/11/DC to simplify the debugging process
  • Exploit samples to showcase the effectiveness and reliablity of the jfCache flink exploitation method
  • Slidedecks from my SyScan360 and Infiltrate 2016 presentations

The README will be updated during the next days to make the usage of the various scripts easier to understand. Stay tuned!


  • Idapython script to collect most important symbolic information from Acroform.api (AR for Solaris v9.4.1) -> gives you dictionary 'XFAdb_v941.json' which is needed for script and
  • Idapython script collecting jfCacheManager functions and a debugging func via reliable heuristics (tested on AR 10/11/DC) and adding them to your IDB
  • Idapython script to parse moScriptTable structures of all the objects found via (most XFA* and jf* objects). Finds entrypoints for scripting methods as well as for property getters and setters and adds them to your IDB
  • Very crude implementation for dumping the symbols which were found via and to PDBs. Useable, but definitely alpha status ;)
  • tpl_XXX.pdb: PDB template files
  • analysis\PDBs: Acroform.api PDB files for all AR 10/11/DC versions (english versions only!)


  • sample_exploit_0write.js: Javascript code exploiting the 0-DWORD write as described @ SyScan360. The exploit needs to be run with (winappdbg-based) or (pykd-based)
  • winappdbg script which triggers the vulnerable 0-DWORD write
  • pykd script which triggers the vulnerable 0-DWORD write
  • Infiltrate_Template.pdf: Sample PDF which contains 'sample_exploit_0write.js' and executes it when the PDF is opened. Use it together with
  • xfa_js_helper.pdf: PDF which facilitates the execution of JS within XFA context


  • Infiltrate_2016_-_Pwning_Adobe_Reader_with_XFA.pdf/pptx
  • SyScan360_2016_-_Pwning_Adobe_Reader_with_XFA.pdf/pptx