{"id":13474771,"url":"https://github.com/jesparza/peepdf","last_synced_at":"2025-03-26T22:31:14.559Z","repository":{"id":30340747,"uuid":"33893135","full_name":"jesparza/peepdf","owner":"jesparza","description":"Powerful Python tool to analyze PDF documents","archived":false,"fork":false,"pushed_at":"2024-08-19T14:03:04.000Z","size":1687,"stargazers_count":1303,"open_issues_count":50,"forks_count":240,"subscribers_count":59,"default_branch":"master","last_synced_at":"2024-10-30T08:49:30.716Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://peepdf.eternal-todo.com","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jesparza.png","metadata":{"files":{"readme":"README","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-04-13T20:47:46.000Z","updated_at":"2024-10-24T21:06:17.000Z","dependencies_parsed_at":"2022-08-07T15:15:13.989Z","dependency_job_id":null,"html_url":"https://github.com/jesparza/peepdf","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jesparza%2Fpeepdf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jesparza%2Fpeepdf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jesparza%2Fpeepdf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jesparza%2Fpeepdf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jesparza","download_url":"https://codeload.github.com/jesparza/peepdf/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245747639,"owners_count":20665830,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T16:01:14.694Z","updated_at":"2025-03-26T22:31:14.058Z","avatar_url":"https://github.com/jesparza.png","language":"Python","funding_links":[],"categories":["Uncategorized","Python","Tools","Malware Reversing","Honeypots","Forensics"],"sub_categories":["Uncategorized","Analysis / Gathering tool (Know your ennemies)","Static Analysis","PDF"],"readme":"** Home page **\n\nhttp://peepdf.eternal-todo.com\nhttp://twitter.com/peepdf\n\n\n** Dependencies **\n\n- In order to analyse Javascript code \"PyV8\" is needed:\n\n    https://github.com/buffer/pyv8\n\n    git clone https://github.com/buffer/pyv8.git\n    cd pyv8\n    python setup.py build\n    sudo python setup.py install\n    cd ..\n    rm -rf pyv8\n\n\n- The \"sctest\" command is a wrapper of \"sctest\" (libemu). Besides libemu pylibemu is used and must be installed:\n\n    https://github.com/buffer/libemu\n    https://github.com/buffer/pylibemu\n\n    git clone https://github.com/buffer/libemu.git\n    autoreconf -v -i\n    ./configure --prefix=/opt/libemu\n    sudo make install\n    sudo pip install pylibemu\n\n\n- To support XML output \"lxml\" is needed:\n\n    http://lxml.de/installation.html\n    \n\n- Included modules: lzw, colorama, jsbeautifier, ccitt, pythonaes (Thanks to all the developers!!)\n\n\n\n** Installation **\n\nNo installation is needed apart of the commented dependencies, just execute it!\n\n\n\n** Execution **\n\nThere are two important options when peepdf is executed:\n\n-f: Ignores the parsing errors. Analysing malicious files propably leads to parsing errors, so this parameter should be set.\n-l: Sets the loose mode, so does not search for the endobj tag because it's not obligatory. Helpful with malformed files.\n\n\n* Simple execution\n\nShows the statistics of the file after being decoded/decrypted and analysed:\n\n    python peepdf.py [options] pdf_file\n\n\n* Interactive console\n\nExecutes the interactive console to let play with the PDF file:\n\n    python peepdf.py -i [options] pdf_file\n\nIf no PDF file is specified it's possible to use the decode/encode/js*/sctest commands and create a new PDF file:\n\n    python peepdf.py -i\n\n\n* Batch execution\n\nIt's possible to use a commands file to specify the commands to be executed in the batch mode. This type of execution is good to automatise analysis of several files:\n\n    python peepdf.py [options] -s commands_file pdf_file\n\n\n\n** Updating **\n\nJust type this and you will be updated to the latest version from the repository:\n\n    python peepdf.py -u\n\n\n\n** Some hints **\n\nIf the information shown when a PDF file is parsed is not enough to know if it's harmful or not, the following commands can help to do it:\n\n* tree\n\nShows the tree graph of the file or specified version. Here we can see suspicious elements.\n\n\n* offsets \n\nShows the physical map of the file or the specified version of the document. This is helpful to see unusual big objects or big spaces between objects.\n\n\n* search\n\nSearch the specified string or hexadecimal string in the objects (decoded and encrypted streams included).\n\n\n* object/rawobject\n\nShows the (raw) content of the object.\n\n\n* stream/rawstream\n\nShows the (raw) content of the stream.\n\n\n* The rest of commands, of course\n\n\u003e help\n\n\n\n** Bugs **\n\nSend me bugs and comments, please!! ;) You can do it via mail (jesparza AT eternal-todo.com) or through Github (https://github.com/jesparza/peepdf/issues).\n\nThanks!!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjesparza%2Fpeepdf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjesparza%2Fpeepdf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjesparza%2Fpeepdf/lists"}