{"id":38020107,"url":"https://github.com/ansemjo/truepolyglot","last_synced_at":"2026-01-16T19:28:18.213Z","repository":{"id":122757441,"uuid":"196159119","full_name":"ansemjo/truepolyglot","owner":"ansemjo","description":"Create polyglot files, which are valid PDF and ZIP simultaneously. See POC||GTFO 07. (forked from git.hackade.org)","archived":false,"fork":false,"pushed_at":"2025-10-23T20:09:49.000Z","size":14892,"stargazers_count":72,"open_issues_count":1,"forks_count":12,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-10-23T22:11:30.515Z","etag":null,"topics":["file-format","gtfo","pdf","poc","polyglot","zip"],"latest_commit_sha":null,"homepage":"https://truepolyglot.hackade.org/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ansemjo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-07-10T07:54:44.000Z","updated_at":"2025-10-23T20:09:53.000Z","dependencies_parsed_at":null,"dependency_job_id":"b48a9571-75f9-4a3a-871c-09f383a29bd1","html_url":"https://github.com/ansemjo/truepolyglot","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/ansemjo/truepolyglot","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ansemjo%2Ftruepolyglot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ansemjo%2Ftruepolyglot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ansemjo%2Ftruepolyglot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ansemjo%2Ftruepolyglot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ansemjo","download_url":"https://codeload.github.com/ansemjo/truepolyglot/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ansemjo%2Ftruepolyglot/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28481726,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T11:59:17.896Z","status":"ssl_error","status_checked_at":"2026-01-16T11:55:55.838Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["file-format","gtfo","pdf","poc","polyglot","zip"],"created_at":"2026-01-16T19:28:17.434Z","updated_at":"2026-01-16T19:28:18.184Z","avatar_url":"https://github.com/ansemjo.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# truepolyglot\n\nTruepolyglot is polyglot file generator project. It means  the generated file is composed of several file formats. The same file can be opened as a ZIP file and as a PDF file for example. The idea of this project comes from the work of [Ange Albertini](https://github.com/corkami), [International Journal of Proof-of-Concept or Get The Fuck Out](https://www.alchemistowl.org/pocorgtfo/pocorgtfo07.pdf) and [Julia Wolf](https://www.troopers.de/wp-content/uploads/2011/04/TR11_Wolf_OMG_PDF.pdf) that explain how we can build a polyglot file.\\\nPolyglot file can be boring to build, even more if you want to respect the file format correctly.\\\nThat's why I decided to build a tool to generate them.\\\nMy main motivation was the technical challenge.\n\n## :warning: FORKED\n\nThis repository is forked from [truepolyglot.hackade.org][hackade] and includes a few commits to\nprovide a `setup.py` for `pip`-installations along with a number of [other opinionated changes][history].\n\nYou can install this version from `master` with:\n\n    pip install git+https://github.com/ansemjo/truepolyglot\n\nNotably, this fork uses PyPDF2's `cloneReaderDocumentRoot`, which may hiccup on malformed PDFs more easily but\ncopies the entire document including cross-references and section labels. The `setup.py` also installs a command\n`pdfzip`, which only creates polyglot files of this particular format since I believe this to be the most useful\noutput format:\n\n    pdfzip -p document.pdf -z archive.zip polyglot.zip.pdf\n\n[hackade]: https://truepolyglot.hackade.org/\n[history]: https://github.com/ansemjo/truepolyglot/compare/1.6.2...master\n\nBelow you find the rest of the *original* README. Parts of it may be outdated and may not apply to this fork.\nFor example I did not test compatability beyond Firefox and Evince.\n\n## Features and versions ##\n\n| Description | Version |\n| ----------- | ------- |\n| Build a polyglot file valid as PDF and ZIP format and that can be opened with 7Zip and Windows Explorer | POC |\n| Add a stream object in the PDF part | POC |\n| Polyglot file checked without warning with [pdftocairo](https://poppler.freedesktop.org/) | \u003e= 1.0 |\n| Polyglot file checked without warning with [caradoc](https://github.com/ANSSI-FR/caradoc) | \u003e= 1.0 |\n| Rebuild the PDF Xref Table | \u003e= 1.0 |\n| Stream object with the correct length header value | \u003e= 1.0 |\n| Add the format \"zippdf\", file without offset after the Zip data | \u003e= 1.1 |\n| Polyglot file keeps the original PDF version | \u003e= 1.1.1 |\n| Add the \"szippdf\" format without offset before and after the Zip data | \u003e= 1.2 |\n| Fix /Length stream object value and the PDF offset for the szippdf format | \u003e= 1.2.1 |\n| PDF object numbers reorder after insertion | \u003e= 1.3 |\n| Add the format \"pdfany\" a valid PDF with custom payload content in the first and the last objet | \u003e= 1.5.2 |\n| Add \"acrobat-compatibility\" option to allow szippdf to be read with Acrobat Reader (thanks Ange Albertini)| \u003e= 1.5.3 |\n| Add the format \"zipany\" a valid ZIP with custom payload content at the start and between LHF and CD | \u003e= 1.6 |\n\n## Polyglot file compatibility ##\n\n| Software | Formats | status |\n| -------- | ------- | ------ |\n| Acrobat Reader | pdfzip, zippdf, szippdf, pdfany | OK |\n| Sumatra PDF | pdfzip, zippdf, szippdf, pdfany | OK |\n| Foxit PDF Reader | pdfzip, zippdf, szippdf, pdfany | OK |\n| Edge | pdfzip, zippdf, szippdf, pdfany | OK |\n| Firefox | pdfzip, zippdf, szippdf, pdfany | OK |\n| 7zip | pdfzip, zippdf, zipany | OK with warning |\n| 7zip | szippdf | OK |\n| Explorer Windows | pdfzip, zippdf, szippdf, pdfany, zipany | OK |\n| Info-ZIP (unzip) | pdfzip, zippdf, szippdf, pdfany, zipany | OK |\n| Evince | pdfzip, zippdf, szippdf, pdfany | OK |\n| pdftocairo -pdf | pdfzip, zippdf, szippdf, pdfany | OK |\n| caradoc stats | pdfzip, pdfany | OK |\n| java -jar | szippdf | OK |\n\n## Examples ##\n\n| First input file | Second input file | Format | Polyglot | Comment |\n| ---------------- | ----------------- | ------ | -------- | ------- |\n| [doc.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc1/doc.pdf) | [archive.zip](https://truepolyglot.hackade.org/samples/pdfzip/poc1/archive.zip) | pdfzip | [polyglot.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc1/polyglot.pdf) | PDF/ZIP polyglot - 122 Ko | \n| [orwell\\_1984.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc2/orwell_1984.pdf) | [file-FILE5\\_32.zip](https://truepolyglot.hackade.org/samples/pdfzip/poc2/file-FILE5_32.zip) | pdfzip | [polyglot.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc2/polyglot.pdf) | PDF/ZIP polyglot - 1.3 Mo |\n| [x86asm.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc3/x86asm.pdf) | [fasmw17304.zip](https://truepolyglot.hackade.org/samples/pdfzip/poc3/fasmw17304.zip) | pdfzip | [polyglot.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc3/polyglot.pdf) | PDF/ZIP polyglot - 1.8 Mo |\n| [doc.pdf](/samples/zippdf/poc4/doc.pdf) | [archive.zip](/samples/zippdf/poc4/archive.zip) | zippdf | [polyglot.pdf](/samples/zippdf/poc4/polyglot.pdf) | PDF/ZIP polyglot - 112 Ko |\n| [electronics.pdf](https://truepolyglot.hackade.org/samples/szippdf/poc5/electronics.pdf) | [hello\\_world.jar](https://truepolyglot.hackade.org/samples/szippdf/poc5/hello_world.jar) | szippdf | [polyglot.pdf](https://truepolyglot.hackade.org/samples/szippdf/poc5/polyglot.pdf) | PDF/JAR polyglot - 778 Ko |\n| [hexinator.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc6/hexinator.pdf) | [eicar.zip](https://truepolyglot.hackade.org/samples/pdfzip/poc6/eicar.zip) ([scan virustotal.com](https://www.virustotal.com/#/file/2174e17e6b03bb398666c128e6ab0a27d4ad6f7d7922127fe828e07aa94ab79d/detection)) | pdfzip | [polyglot.pdf](https://truepolyglot.hackade.org/samples/pdfzip/poc6/polyglot.pdf) ([scan virustotal.com](https://www.virustotal.com/#/file/f6fef31e3b03164bb3bdf35af0521f9fc0c518a9e0f1aa9f8b60ac936201591a/detection)) | PDF/ZIP polyglot with the Eicar test in Zip - 2.9 Mo |\n| [doc.pdf](https://truepolyglot.hackade.org/samples/pdfany/poc7/doc.pdf) | [page.html](https://truepolyglot.hackade.org/samples/pdfany/poc7/page.html) | pdfany | [polyglot.pdf](https://truepolyglot.hackade.org/samples/pdfany/poc7/polyglot.pdf) | PDF/HTML polyglot - 26 Ko |\n| [logo.zip](https://truepolyglot.hackade.org/samples/zipany/poc8/logo.zip) | [nc.exe](https://truepolyglot.hackade.org/samples/zipany/poc8/nc.exe) | zipany | [polyglot.zip](https://truepolyglot.hackade.org/samples/zipany/poc8/polyglot.zip) | PDF/PE polyglot - 96 Ko |\n\n## Usage ##\n\n```\nusage: truepolyglot format [options] output-file\n\nGenerate a polyglot file.\n\nFormats availables:\n* pdfzip: Generate a file valid as PDF and ZIP. The format is closest to PDF.\n* zippdf: Generate a file valid as ZIP and PDF. The format is closest to ZIP.\n* szippdf: Generate a file valid as ZIP and PDF. The format is strictly a ZIP. Archive is modified.\n* pdfany: Generate a valid PDF file with payload1 file content as the first object or/and payload2 file content as the last object.\n* zipany: Generate a valid ZIP file with payload1 file content at the start of the file or/and payload2 file content between LFH and CD.\n\npositional arguments:       {pdfzip,zippdf,szippdf,pdfany,zipany}\nOutput polyglot format\noutput_file           Output polyglot file path\n\noptional arguments:\n-h, --help            show this help message and exit\n--pdffile PDFFILE     PDF input file\n--zipfile ZIPFILE     ZIP input file       \n--payload1file PAYLOAD1FILE Payload 1 input file       \n--payload2file PAYLOAD2FILE Payload 2 input file \n--acrobat-compatibility Add a byte at the start for Acrobat Reader compatibility with the szippdf format       \n--verbose {none,error,info,debug} Verbosity level  (default: info)\n\nTruePolyglot v1.6.2\n```\n\n## Code ##\n\n```\ngit clone https://git.hackade.org/truepolyglot.git/\n```\n\nor download [truepolyglot-1.6.2.tar.gz](https://git.hackade.org/truepolyglot.git/snapshot/truepolyglot-1.6.2.tar.gz)\n\n## How to detect a polyglot file ? ##\n\nYou can use [binwalk](https://github.com/ReFirmLabs/binwalk) on a file to see if composed of multiple files.\n\n## Contact ##\n\n[truepolyglot@hackade.org](mailto:truepolyglot@hackade.org)\n\n## Credits ##\n\nCopyright © 2018-2019 ben@hackade.org\n\nTruePolyglot is released under [Unlicence](https://unlicense.org/) except for the following libraries:\n\n* [PyPDF2](https://github.com/mstamy2/PyPDF2/blob/master/LICENSE)\n* [zipfile.py (cpython)](https://github.com/python/cpython/blob/master/LICENSE)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fansemjo%2Ftruepolyglot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fansemjo%2Ftruepolyglot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fansemjo%2Ftruepolyglot/lists"}