kris-kaspersky / jsunpack-n

Automatically exported from code.google.com/p/jsunpack-n
GNU General Public License v2.0
0 stars 0 forks source link

Updated pdf.py to handle object streams. Also added a condition to handle "/Names" tags that may have a custom name. This change allows the reference object number to be displayed when a custom name is used. #21

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
Added code to handle object streams in a pdf document and detect JavaScript 
embedded in the object streams. Previously objects embedded into a object 
stream were missing in the output and if JavaScript was embedded it would not 
be detected. Also if a "/Names" tag was used and it contained a custom name, 
for example "/Names (My Code) 15 0 R", only the text "My Code" would be 
captured and displayed because the parsing function would stop after the right 
parenthesis. I added a condition to an existing "if" statement so the 
"grabmore" variable is one if there was a right parenthesis and the current tag 
was "Names". I tested both changes to several pdf documents and I posted the 
test cases on my security blog 
http://mariomalwareanalysis.blogspot.com/2012/03/jsunpack-fix-for-detecting-pdf.
html. The changes have been helpful for me and hopefully you will find it 
useful as well :-)

Original issue reported on code.google.com by mnoyo...@gmail.com on 27 Mar 2012 at 10:18

Attachments:

GoogleCodeExporter commented 9 years ago
thanks Mario! I'll be reviewing this - Blake

Original comment by urul...@gmail.com on 28 Mar 2012 at 12:11