Updated pdf.py to handle object streams. Also added a condition to handle "/Names" tags that may have a custom name. This change allows the reference object number to be displayed when a custom name is used.

[GoogleCodeExporter]

Added code to handle object streams in a pdf document and detect JavaScript 
embedded in the object streams. Previously objects embedded into a object 
stream were missing in the output and if JavaScript was embedded it would not 
be detected. Also if a "/Names" tag was used and it contained a custom name, 
for example "/Names (My Code) 15 0 R", only the text "My Code" would be 
captured and displayed because the parsing function would stop after the right 
parenthesis. I added a condition to an existing "if" statement so the 
"grabmore" variable is one if there was a right parenthesis and the current tag 
was "Names". I tested both changes to several pdf documents and I posted the 
test cases on my security blog 
http://mariomalwareanalysis.blogspot.com/2012/03/jsunpack-fix-for-detecting-pdf.
html. The changes have been helpful for me and hopefully you will find it 
useful as well :-)

Original issue reported on code.google.com by mnoyo...@gmail.com on 27 Mar 2012 at 10:18

Attachments:

• pdf.py.patch

[GoogleCodeExporter]

thanks Mario! I'll be reviewing this - Blake

Original comment by urul...@gmail.com on 28 Mar 2012 at 12:11

• Added labels: ****
• Removed labels: ****