@binjo ‘s tweet made me realize PDF filter abbreviations do apply to stream objects too, although the PDF reference document only defines them for inline images. Here are the abbreviations:
- ASCIIHexDecode -> AHx
- ASCII85Decode -> A85
- LZWDecode -> LZW
- FlateDecode -> Fl
- RunLengthDecode -> RL
- CCITTFaxDecode -> CCF
- DCTDecode -> DCT
This means that, for example, a flatedecode filter for a stream object can not only be specified as /Filter /FlateDecode, but also as /Filter /Fl.
I updated my PDF-tools to support this.
And jprosco e-mailed me an update to my pdf-parser tool to support ASCIIHexDecode, because he had to analyze some malicious PDF documents that used it to encode the JavaScript.
Didier Stevens 
Leave a Reply (comments are moderated)