Home page

http://peepdf.eternal-todo.com http://twitter.com/peepdf

Dependencies

• In order to analyse Javascript code "PyV8" is needed:

  http://code.google.com/p/pyv8/

• The "sctest" command is a wrapper of "sctest" (libemu). Besides libemu pylibemu is used and must be installed:

  http://libemu.carnivore.it (latest version from git repository, Sourceforge package is outdated) https://github.com/buffer/pylibemu

• To support XML output "lxml" is needed:

  http://lxml.de/installation.html

• Included modules: lzw, colorama, jsbeautifier, ccitt, pythonaes (Thanks to all the developers!!)

Installation

No installation is needed apart of the commented dependencies, just execute it!

Execution

There are two important options when peepdf is executed:

-f: Ignores the parsing errors. Analysing malicious files propably leads to parsing errors, so this parameter should be set. -l: Sets the loose mode, so does not search for the endobj tag because it's not obligatory. Helpful with malformed files.

• Simple execution

Shows the statistics of the file after being decoded/decrypted and analysed:

python peepdf.py [options] pdf_file

• Interactive console

Executes the interactive console to let play with the PDF file:

python peepdf.py -i [options] pdf_file

If no PDF file is specified it's possible to use the decode/encode/js*/sctest commands and create a new PDF file:

python peepdf.py -i

• Batch execution

It's possible to use a commands file to specify the commands to be executed in the batch mode. This type of execution is good to automatise analysis of several files:

python peepdf.py [options] -s commands_file pdf_file

Updating

Just type this and you will be updated to the latest version from the repository:

python peepdf.py -u

Some hints

If the information shown when a PDF file is parsed is not enough to know if it's harmful or not, the following commands can help to do it:

• tree

Shows the tree graph of the file or specified version. Here we can see suspicious elements.

• offsets

Shows the physical map of the file or the specified version of the document. This is helpful to see unusual big objects or big spaces between objects.

• search

Search the specified string or hexadecimal string in the objects (decoded and encrypted streams included).

• object/rawobject

Shows the (raw) content of the object.

• stream/rawstream

Shows the (raw) content of the stream.

• The rest of commands, of course

help

Bugs

Send me bugs and comments, please!! ;) You can do it via mail (jesparza AT eternal-todo.com) or through Google Code (http://peepdf.googlecode.com).

Thanks!!