Comments on: PDF Tools http://blog.didierstevens.com (blog 'DidierStevens) Tue, 09 Mar 2010 09:33:38 +0000 http://wordpress.com/ hourly 1 By: mdl4 http://blog.didierstevens.com/programs/pdf-tools/#comment-37765 mdl4 Tue, 02 Mar 2010 11:15:27 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37765 Very cool man, I tried to use PDF tools to unwind a drive-by ZeuS pdf infection. Unfortunately, it gave me some problems because I was using a newer version of Python (and it looks like the El Fiesta Exploit kit might use some kind of different zLib encoding to compress its payloads). Good stuff though! http://www.mdl4.com/2010/02/28/reverse-engineering-zeus/ Very cool man, I tried to use PDF tools to unwind a drive-by ZeuS pdf infection. Unfortunately, it gave me some problems because I was using a newer version of Python (and it looks like the El Fiesta Exploit kit might use some kind of different zLib encoding to compress its payloads). Good stuff though!
http://www.mdl4.com/2010/02/28/reverse-engineering-zeus/

]]> By: Unintended Results » Blog Archive » Analyzing PDF exploits with Pyew http://blog.didierstevens.com/programs/pdf-tools/#comment-37733 Unintended Results » Blog Archive » Analyzing PDF exploits with Pyew Sun, 21 Feb 2010 14:50:28 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37733 [...] we see in Pyew? The output of PDFId (a great tool by Didier Stevens) is shown as well as the hexadecimal output of the first block (512 [...] [...] we see in Pyew? The output of PDFId (a great tool by Didier Stevens) is shown as well as the hexadecimal output of the first block (512 [...]

]]> By: PDF Exploitation & Forensic Resources « MadMark's Blog http://blog.didierstevens.com/programs/pdf-tools/#comment-37710 PDF Exploitation & Forensic Resources « MadMark's Blog Tue, 16 Feb 2010 19:00:08 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37710 [...] Didier Stevens has provided a fantastic resource and tools for analyzing PDF files.  Some of these resources have been incorporated into VirusTotal.    Didier Stevens:  http://blog.didierstevens.com/programs/pdf-tools/ [...] [...] Didier Stevens has provided a fantastic resource and tools for analyzing PDF files.  Some of these resources have been incorporated into VirusTotal.    Didier Stevens:  http://blog.didierstevens.com/programs/pdf-tools/ [...]

]]> By: Didier Stevens http://blog.didierstevens.com/programs/pdf-tools/#comment-37666 Didier Stevens Mon, 08 Feb 2010 20:24:20 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37666 @sheldor: If you can point me to an online PDF document that causes the problem you experience, I'll take a look at it. @sheldor: If you can point me to an online PDF document that causes the problem you experience, I’ll take a look at it.

]]> By: sheldor http://blog.didierstevens.com/programs/pdf-tools/#comment-37665 sheldor Mon, 08 Feb 2010 17:27:10 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37665 I have this issue with PDFs 20MB and up! Well,.. then there must be another reason! Still can't figure it out! Anyhow, thank you! I have this issue with PDFs 20MB and up! Well,.. then there must be another reason! Still can’t figure it out!
Anyhow, thank you!

]]> By: Didier Stevens http://blog.didierstevens.com/programs/pdf-tools/#comment-37664 Didier Stevens Mon, 08 Feb 2010 14:55:42 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37664 @sheldor: No, I didn't code an explicit file size limit. I tried on PDF files up to 41MB without problems. How large is your PDF file? @sheldor: No, I didn’t code an explicit file size limit. I tried on PDF files up to 41MB without problems. How large is your PDF file?

]]> By: sheldor http://blog.didierstevens.com/programs/pdf-tools/#comment-37662 sheldor Mon, 08 Feb 2010 13:50:02 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37662 Is the File Size limited? Everytime i scan larger PDF files i get exceptions like this: ***Error occured*** Traceback (most recent call last): File "C:\PDFtools\pdfid.py", line 363, in PDFiD (bytesHeader, pdfHeader) = FindPDFHeaderRelaxed(oBinaryFile) File "C:\PDFtools\pdfid.py", line 218, in FindPDFHeaderRelaxed bytes = oBinaryFile.bytes(1024) File "C:\PDFtools\pdfid.py", line 70, in bytes inbytes = self.infile.read(size - len(self.ungetted)) IOError: [Errno 9] Bad file descriptor Is the File Size limited? Everytime i scan larger PDF files i get exceptions like this:

***Error occured***
Traceback (most recent call last):
File “C:\PDFtools\pdfid.py”, line 363, in PDFiD
(bytesHeader, pdfHeader) = FindPDFHeaderRelaxed(oBinaryFile)
File “C:\PDFtools\pdfid.py”, line 218, in FindPDFHeaderRelaxed
bytes = oBinaryFile.bytes(1024)
File “C:\PDFtools\pdfid.py”, line 70, in bytes
inbytes = self.infile.read(size – len(self.ungetted))
IOError: [Errno 9] Bad file descriptor

]]> By: sheldor http://blog.didierstevens.com/programs/pdf-tools/#comment-37563 sheldor Sun, 31 Jan 2010 22:36:59 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37563 whow just noticed your quick response! thank you didier! great tool! whow just noticed your quick response! thank you didier! great tool!

]]> By: sheldor http://blog.didierstevens.com/programs/pdf-tools/#comment-37562 sheldor Sun, 31 Jan 2010 22:35:49 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37562 got it!! just read the comments! got it!! just read the comments!

]]> By: Didier Stevens http://blog.didierstevens.com/programs/pdf-tools/#comment-37560 Didier Stevens Sun, 31 Jan 2010 22:20:29 +0000 http://didierstevens.wordpress.com/?page_id=837#comment-37560 Are you using Python 3? Haven't tested PDFiD on Python 3. Use Python 2. Are you using Python 3? Haven’t tested PDFiD on Python 3. Use Python 2.

]]>