33

I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to use his PDF decomposing/analyzing tools, even after watching some of his videos. They seem to require significant understanding of the underlying PDF construction, and possibly much more.

For SWF files, the tool SWFScan is the kind I'm looking for: you load the file in question into the tool. From there, you can explore the links, scripts, and images. It even auto-analyses code and shows which parts may have security issues and what the issue is for each one, then gives a webpage reference with more information.

Does anyone know of a good open-source GUI for Windows that can load a PDF and not execute it but extract all the scripts, compiled code, text, links, images, etc.? Ideally, it would show the relation of each, like when you click on a certain image, it would tell you what script(s) are run, which URL it goes to, and let you see the image on its own.

PDF's are so common, next to SWF, that this kind of tool seems like it would already be common. I may have overlooked it/them.

Improve this question
5
  • 3
    Didier Stevens tools are widely used, but you're right, you do need an understanding of the PDF file format if you want to understand it. I have a (somewhat lengthy) blog post that walks through a PDF file line by line to explain the basics of the structure, but none of it uses any GUI tools. Didier also has a template for 010 Editor. 010 has a strong reputation and you can try it free for 30 days
    – amccormack
    Apr 3, 2013 at 3:27
  • @amccormack Great comment, tag edit, and great writeup - I'm reading it now. Interestingly, it's convincing me that the tool I'm looking for should exist - even if only commercially, which I'd pay for if it was good. I used to think great tools usually are text/command-line based, but cases like this make me realize a picture is sometimes worth more than 1,000 words. Even with greater complexity than SWF files, there's still a structure which could benefit from such a tool.
    – Lizz
    Apr 3, 2013 at 3:36
  • 1
    Unmaintained since 2006, but still an interesting tool: multivalent.sourceforge.net
    – Willem Hengeveld
    Nov 17, 2017 at 9:55
  • 2
    Also, github.com/qpdf/qpdf may help, it can convert the pdf to a more human readable format, at the source level.
    – Willem Hengeveld
    Nov 17, 2017 at 9:57
  • 1
    I can no longer access @amccormack's blog post under the link in his comment; I do find it here, with a slightly changed URL: amccormack.net/2012-01-22-anatomy-of-a-pdf-document.html Thank you!
    – michaeljt
    Dec 12, 2018 at 8:48

5 Answers 5

Reset to default
30

Sogeti's Origami framework comes with a GTK based GUI.

What is it?

origami is a Ruby framework designed to parse, analyze, and forge PDF documents. This is NOT a PDF rendering library. It aims at providing a scripting tool to generate and analyze malicious PDF files. As well, it can be used to create on-the-fly customized PDFs, or to inject (evil) code into already existing documents.

Features

  • Create PDF documents from scratch.
  • Parse existing documents, modify them and recompile them.
  • Explore documents at the object level, going deep into the document structure, uncompressing PDF object streams and desobfuscating names and strings.
  • High-level operations, such as encryption/decryption, signature, file attachments...
  • A GTK interface to quickly browse into the document contents.

enter image description here

Here is how I installed it on my Windows 7 system:

  • Ensure you have Ruby v1.9.3 installed for Windows http://rubyinstaller.org/downloads/
  • NOTE: This may work on newer/older Ruby versions, but I've only tested on v1.9.3 on Windows 7. (It does work with ruby v1.8.7 on my Linux system)
  • Next, install origami by opening an ADMIN cmd prompt and running:

gem install origami

  • Next, you will need to install ruby-gtk2. From the same ADMIN cmd prompt as earlier, run:

gem install gtk2

  • Afterwards install pdfwalker, since it was moved to a separate gem:

gem install pdfwalker

Finally, simply run pdfwalker from a cmd prompt.

If this doesn't work for you, I'd suggest trying the above steps from Cygwin, where you can essentially follow instructions for installing on *nix.

If you're installing it on Ubuntu/Debian

Install ruby with the following command:

apt install ruby-full

Afterwards install origami as listed above:

gem install origami

If you want to use the GUI you will probably need to install libgtk2.0-dev and get the rake gem installed for you to be able to install gtk2:

apt install libgtk2.0-dev
gem install rake
gem install gtk2

Since pdfwalker also needs libcanberra, it's a good idea to install it now:

apt install libcanberra-gtk-module

Afterwards install pdfwalker, since it was moved to a separate gem:

gem install pdfwalker

And it should run from the commandline as described above.

Improve this answer
5
  • 1
    This would be great, but I can't seem to get the GUI 'pdfwalker' installed/running. Looking at the webpage, I'm not seeing Windows support. Can you point me to how I can get this app's GUI running on Windows?
    – Lizz
    Apr 4, 2013 at 6:32
  • 2
    I updated my answer with steps to install on Windows. I have it running on my Windows 7 system now.
    – Mick
    Apr 4, 2013 at 13:17
  • Update for Ruby 2.2., gtk2-2.2.5: You need a whole lot of Cygwin packages to make this work. Besides gcc and make, the list of libraries is not obvious and involves running gem install origami and [superuser.com/questions/923190/… the mkmf.log) to see which libraries it fails on. It also requires installing an X server, starting it, export DISPLAY=:0.0 and even I get: /usr/share/rubygems/rubygems/core_ext/kernel_require.rb:54:in require': superclass mismatch for class Date (TypeError)`
    – sshine
    Aug 5, 2015 at 14:43
  • The Origami website seems to no longer exist.
    – Max Barraclough
    May 14, 2021 at 10:57
  • 1
    @MaxBarraclough - update link. web.archive.org/web/20190914234428/esec-lab.sogeti.com/pages/…
    – Mick
    May 16, 2021 at 20:46
8

To extract malicious content mostly, like scripts and exploits, You may look on online tools:

Wepawet - online toolkit for analysis of js\pdf\flash files.

Jsunpack - online toolkit for analysis of files, that may contain packed\encoded JavaScript code, like PDF\HTML\JS. also work with .pcap files

In addition - offline tool for linux (well, not GUI, but good tool) to extract shellcodes and hidden fields:

Pdfextract - An offline command-line tool and library that can extract various areas of text from a PDF.

Improve this answer
0
6

Perhaps PdfStreamDumper is close enough to what you want, but you're still going to need some knowledge of PDF to use it effectively.

Improve this answer
1
  • Please add a short description about the link and/or the relevant matter. Link-only answers are not considered answers.
    – asheeshr
    May 7, 2013 at 14:38
5

I highly recommend Cerbero Profiler!

The Cerbero Profiler is a tool designed primarily for malware and forensic analysis. It supports a huge number of file formats (listed below) on which it performs analysis and lets the user inspect their internal layout. The Profiler is often used to identify 0-day threats and personal information inside of files. However, given of the scale of the project, it has many other uses and we encourage you to visit our blog in order to see the Profiler in action.

You might also want to check out my open source file-dissect tool. I wrote a PDF parser for it, but haven't committed it yet. Sorry, I know that doesn't help much. I will eventually push it up though.

Improve this answer
2

While there is no GUI, I believe it's worth mentioning command lines tools that will help with the in an automated way part of your question. I've personally used the mupdf associated command line tool: mutool.

For example working on the following PDF file, here is what you would do to extract the encapsulated JPX stream:

$ mutool info Bug691816.pdf 
Bug691816.pdf:

PDF-1.5
Info object (49 0 R):
<</ModDate(D:20101122114310-08'00')/CreationDate(D:20101122114251-08'00')/Title(ID1561x.indd)/Creator(Adobe InDesign 1.5.2)/Producer(Adobe PDF Library 4.16)>>
Pages: 1

Retrieving info from pages 1-1...
Mediaboxes (1):
    1   (54 0 R):   [ 0 0 612 792 ]

Images (1):
    1   (54 0 R):   [ JPX ] 300x161 8bpc Idx (58 0 R)

So you simply need to:

$ mutool show -be -o obj58.jp2 Bug691816.pdf 58

You can verify:

$ file obj58.jp2
obj58.jp2: JPEG 2000 Part 1 (JP2)

See documentation:

For PDF/A-3: EmbeddedFile (as in this file) you can even run:

$ mutool portfolio ZUGFeRD_1p0_BASIC_Einfach.pdf x 0 ZUGFeRD-invoice.xml
$ head ZUGFeRD-invoice.xml
<?xml version="1.0" encoding="UTF-8"?>
<!-- 

Nutzungsrechte 
ZUGFeRD Datenformat Version 1.0, 25.6.2014
Beispiel Version 29.09.2014

Zweck des Forums für elektronische Rechnungen bei der AWV e.V („FeRD“) ist u.a. die Schaffung und Spezifizierung 
eines offenen Datenformats für strukturierten elektronischen Datenaustausch auf der Grundlage offener und nicht 
diskriminierender, standardisierter Technologien („ZUGFeRD Datenformat“)

See documentation:

Improve this answer
3
  • OP asks for GUI tool
    – Paweł Łukasik
    Nov 16, 2017 at 14:48
  • Indeed I missed that, this conflicts with in an automated way imho
    – tibar
    Nov 16, 2017 at 14:51
  • 1
    in most cases yes, but doesn't have to
    – Paweł Łukasik
    Nov 17, 2017 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.