A new version of PDFiD (V0.0.10): to deal with PDF samples trying to evade detection by preceding the header with some random bytes, I use less stringent conditions to identify a PDF file. If PDFiD finds keyword %PDF in the first 1024 bytes of a file, it assumes it’s a PDF file and starts analyzing it.
A new version of pdf-parser (v0.3.7):
- added support for filters /LZWDecode and /RunLengthDecode
- added a –dump option to extract the unfiltered data of a stream object (useful when the data is not actually compressed, but a payload)
- testing the Python version before execution
Both can be downloaded on the PDF Tools page.
Didier Stevens 