Execute the Python program to create the PDF file: embedded.py embedded.pdf.Use pdf-parser like this (in this example, the data stream you want to decompress is in object 5 of PDF file sample.pdf): pdf-parser.py –generateembedded 5 sample.pdf > embedded.py Create a Python program that generates the PDF document with embedded file.With pdf-parser, you can use this method as follows: Crafting this PDF document with embedded file manually requires many manipulations and calculations, and is thus a very good candidate for automation.įigure: this PDF embeds a file called vbanner2.jpg The embedded file is stored as an object with a stream, and the compression can be any method supported by the PDF application. For example, if you have a PDF document explaining a financial method, you can include a spreadsheet in the PDF document as an embedded file. The detailed method: when you need to decompress a stream for which you have no decompressor (or no decompressor identical to the target application), you create a new PDF document into which you include the object with the stream as an embedded file. The method: you create a new PDF document with the stream as embedded file, and then save the embedded file using the PDF application. The solution: you use the PDF application to decompress the stream. The problem: you need to decompress a stream and you have no decompression algorithm. pdf-parser supports a couple of filters, but not all, because the implementation of some of them (mostly the lossy ones) differs between vendors and PDF applications.Ī recent article published by Virus Bulletin on JavaScript stored inside a lossy stream gave me the opportunity to implement a method I had worked out manually. You have all kinds of filters, for example ZLIB DEFLATE, but also lossy compressions like JPEG. In PDF jargon, streams are compressed using filters. You select the object that contains the stream (example object 5: -o 5) and you “filter” the content of the stream (-f ). A couple of months before, I had started developing my pdf-parser tool, and Maarten’s diary entry motivated me to continue adding features to pdf-parser.Įxtracting and decompressing a stream (for example containing a JavaScript script) is easy with pdf-parser. Maarten Van Horenbeeck posted a diary entry (July 2008) explaining how scripts and data are stored in PDF documents (using streams), and demonstrated a Perl script to decompress streams. I provide 2 days of Hacking PDF training at HITB Amsterdam.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |