(self, data)
Uses pdf-parser to get information for each object.
Uses pdf-parser to get information for each object.
Uses pdf - parser to get information for each object .
def run_pdfparser(self, data):
        """
        Uses pdf-parser to get information for each object.
        """        
        oPDFParser = pdfparser.cPDFParser(data)
        done = False
        found_objects = {}

        #Walk the PDF and inspect PDF objects
        found_objects = self.object_search(data)

        while done == False:
            try:
                pdf_object = oPDFParser.GetObject()
            except Exception as e:
                pdf_object = None

            if pdf_object != None:
                if pdf_object.type in [pdfparser.PDF_ELEMENT_INDIRECT_OBJECT]:
                    #Get general information for this PDF object
                    rawContent = pdfparser.FormatOutput(pdf_object.content, True)
                    section_md5_digest = hashlib.md5(rawContent).hexdigest()
                    section_entropy = self.H(rawContent)
                    object_type = pdf_object.GetType()

                    #Access data associated with this PDF object
                    if pdf_object.ContainsStream():
                        object_stream = True
                        try:
                            #decompress stream using codec
                            streamContent = pdf_object.Stream() 
                        except Exception as e:
                            streamContent = "decompress failed."

                        if "decompress failed." in streamContent[:50]:
                            #Provide raw stream data
                            streamContent = pdf_object.Stream('')

                        #Stream returns list of object tags (not actual stream data)
                        if type(streamContent) == list:
                            streamContent = pdfparser.FormatOutput(pdf_object.content, True)
                            #Inspect pdf_object.content and extract raw stream
                            stream_start = streamContent.find('stream') + len('stream')
                            stream_end = streamContent.rfind('endstream')
                            if stream_start >= 0 and stream_end > 0:
                                streamContent = streamContent[stream_start:stream_end]

                        stream_md5_digest = hashlib.md5(streamContent).hexdigest()
                    else:
                        object_stream = False
                        stream_md5_digest = ''

                    #Collect references between this object and others
                    object_references = []
                    for reference in pdf_object.GetReferences():
                        object_references.append(reference[0])
                    object_references = ','.join(object_references)

                    #Get results from the object searching
                    object_content = []
                    if found_objects.get('js'):
                        if str(pdf_object.id) in found_objects.get('js'):
                            object_content.append('JavaScript')
                    if found_objects.get('file'):
                        if str(pdf_object.id) in found_objects.get('file'):
                            object_content.append('EmbeddedFile')

                    result = {
                            "obj_id":           pdf_object.id,
                            "obj_version":      pdf_object.version,
                            "size":             len(rawContent),
                            "type":             object_type,
                            "entropy":          section_entropy,
                            "content":          ','.join(object_content),
                            "x_refs":           object_references,
                            "stream":           object_stream,
                            "stream_md5":       stream_md5_digest,
                    }
                    self._add_result('pdf_parser', section_md5_digest, result)
            else:
                done = True
def run_pdfparser ( self , data ) : oPDFParser = pdfparser . cPDFParser ( data ) done = False found_objects = { } #Walk the PDF and inspect PDF objects found_objects = self . object_search ( data ) while done == False : try : pdf_object = oPDFParser . GetObject ( ) except Exception as e : pdf_object = None if pdf_object != None : if pdf_object . type in [ pdfparser . PDF_ELEMENT_INDIRECT_OBJECT ] : #Get general information for this PDF object rawContent = pdfparser . FormatOutput ( pdf_object . content , True ) section_md5_digest = hashlib . md5 ( rawContent ) . hexdigest ( ) section_entropy = self . H ( rawContent ) object_type = pdf_object . GetType ( ) #Access data associated with this PDF object if pdf_object . ContainsStream ( ) : object_stream = True try : #decompress stream using codec streamContent = pdf_object . Stream ( ) except Exception as e : streamContent = "decompress failed." if "decompress failed." in streamContent [ : 50 ] : #Provide raw stream data streamContent = pdf_object . Stream ( '' ) #Stream returns list of object tags (not actual stream data) if type ( streamContent ) == list : streamContent = pdfparser . FormatOutput ( pdf_object . content , True ) #Inspect pdf_object.content and extract raw stream stream_start = streamContent . find ( 'stream' ) + len ( 'stream' ) stream_end = streamContent . rfind ( 'endstream' ) if stream_start >= 0 and stream_end > 0 : streamContent = streamContent [ stream_start : stream_end ] stream_md5_digest = hashlib . md5 ( streamContent ) . hexdigest ( ) else : object_stream = False stream_md5_digest = '' #Collect references between this object and others object_references = [ ] for reference in pdf_object . GetReferences ( ) : object_references . append ( reference [ 0 ] ) object_references = ',' . join ( object_references ) #Get results from the object searching object_content = [ ] if found_objects . get ( 'js' ) : if str ( pdf_object . id ) in found_objects . get ( 'js' ) : object_content . append ( 'JavaScript' ) if found_objects . get ( 'file' ) : if str ( pdf_object . id ) in found_objects . get ( 'file' ) : object_content . append ( 'EmbeddedFile' ) result = { "obj_id" : pdf_object . id , "obj_version" : pdf_object . version , "size" : len ( rawContent ) , "type" : object_type , "entropy" : section_entropy , "content" : ',' . join ( object_content ) , "x_refs" : object_references , "stream" : object_stream , "stream_md5" : stream_md5_digest , } self . _add_result ( 'pdf_parser' , section_md5_digest , result ) else : done = True