Skip to content

jesparza/peepdf

Folders and files

NameName
Last commit message
Last commit date
Jul 17, 2012
May 3, 2011
Dec 12, 2011
No commit message
Mar 12, 2012
Jun 9, 2014
No commit message
May 1, 2011
May 1, 2016
May 5, 2016
May 1, 2016
May 1, 2016
May 5, 2016
May 5, 2016
Nov 17, 2016
Nov 17, 2016
No commit message
Jun 9, 2014
Feb 2, 2014
Apr 22, 2012
Feb 9, 2014
Feb 2, 2014
Jul 29, 2013
May 5, 2016

Repository files navigation

peepdf is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher could need in a PDF analysis without using 3 or 4 tools to make all the tasks. With peepdf it's possible to see all the objects in the document showing the suspicious elements, supports all the most used filters and encodings, it can parse different versions of a file, object streams and encrypted files. With the installation of PyV8 and Pylibemu it provides Javascript and shellcode analysis wrappers too. Apart of this it's able to create new PDF files and to modify/obfuscate existent ones.

The main functionalities of peepdf are the following:

Analysis:

  • Decodings: hexadecimal, octal, name objects
  • More used filters
  • References in objects and where an object is referenced
  • Strings search (including streams)
  • Physical structure (offsets)
  • Logical tree structure
  • Metadata
  • Modifications between versions (changelog)
  • Compressed objects (object streams)
  • Analysis and modification of Javascript (PyV8): unescape, replace, join
  • Shellcode analysis (Libemu python wrapper, pylibemu)
  • Variables (set command)
  • Extraction of old versions of the document
  • Easy extraction of objects, Javascript code, shellcodes (>, >>, > , >>)
  • Checking hashes on VirusTotal

Creation/Modification:

  • Basic PDF creation
  • Creation of PDF with Javascript executed wen the document is opened
  • Creation of object streams to compress objects
  • Embedded PDFs
  • Strings and names obfuscation
  • Malformed PDF output: without endobj, garbage in the header, bad header...
  • Filters modification
  • Objects modification

Execution modes:

  • Simple command line execution
  • Powerful interactive console (colorized or not)
  • Batch mode

TODO:

  • Embedded PDFs analysis
  • Improving automatic Javascript analysis
  • GUI

Related articles:

Included in:

You are free to contribute with feedback, bugs, patches, etc. Any help is welcome. Also, if you really enjoy using peepdf, you think it is worth it and you feel really generous today you can donate some bucks to the project ;) Thanks!