-
-
Save averagesecurityguy/ba8d9ed3c59c1deffbd1390dafa5a3c2 to your computer and use it in GitHub Desktop.
| #!/usr/bin/env python3 | |
| # This script is designed to do one thing and one thing only. It will find each | |
| # of the FlateDecode streams in a PDF document using a regular expression, | |
| # unzip them, and print out the unzipped data. You can do the same in any | |
| # programming language you choose. | |
| # | |
| # This is NOT a generic PDF decoder, if you need a generic PDF decoder, please | |
| # take a look at pdf-parser by Didier Stevens, which is included in Kali linux. | |
| # https://tools.kali.org/forensics/pdf-parser. | |
| # | |
| # Any requests to decode a PDF will be ignored. | |
| import re | |
| import zlib | |
| pdf = open("some_doc.pdf", "rb").read() | |
| stream = re.compile(rb'.*?FlateDecode.*?stream(.*?)endstream', re.S) | |
| for s in stream.findall(pdf): | |
| s = s.strip(b'\r\n') | |
| try: | |
| print(zlib.decompress(s)) | |
| print("") | |
| except: | |
| pass |
@BYugandhar
You have posted text
20 0 obj
<</Filter/FlateDecode/Length 299>>stream
H‰\‘ËjÃ0�E÷úŠY&‹ ?ã�Œ!Í�¼èƒ:ý G�
HOWEVER in the PDF those are not text (in common with every computer file on this planet that is a BINARY bitSTREAM.
When we open such a file in a TEXT editor we see the Binary BYTES as characters like ABCDEFG or ������� when not A-Z or other normal ASCII text characters.
When you cut and paste such ANSI text say from MS Notepad to MS Notepad in ANSI mode, most of the characters (EXCEPT [None]) will actually be uncorrupted and thus potentially usable. Here is an ANSI view of such text NOTE there are very few ����
HOWEVER when paste or save as plain text that one missing [none] is critical and all saves are usually corrupted, such that Fonts and Images that depend on that nul and void character fail back to blank leaving pages bare of data. sadly the Equation for PDF is 255/256 NEQ <00>
What can often happen in such cases, MAY BE the decode fails and I often see returns, Rubbish In, Rubbish Out
20 0 obj
<</Length 0>>
stream
endstream
endobj
Add import sys and replace "some_doc.pdf" by sys.argv[1] for a generic pdf flat decode command line tool.
#!/usr/bin/env python3
# This script is designed to do one thing and one thing only. It will find each
# of the FlateDecode streams in a PDF document using a regular expression,
# unzip them, and print out the unzipped data. You can do the same in any
# programming language you choose.
#
# This is NOT a generic PDF decoder, if you need a generic PDF decoder, please
# take a look at pdf-parser by Didier Stevens, which is included in Kali linux.
# https://tools.kali.org/forensics/pdf-parser.
#
# Any requests to decode a PDF will be ignored.
import re
import zlib
import sys
pdf = open(sys.argv[1], "rb").read()
stream = re.compile(rb'.*?FlateDecode.*?stream(.*?)endstream', re.S)
for s in stream.findall(pdf):
s = s.strip(b'\r\n')
try:
print(zlib.decompress(s))
print("")
except:
pass
@Kungergely Thanks for the answer. This PDF is not encrypted ,even i have checked for /U ,/O ,/UE and /UE also not found.Could please suggest me Is there way to decode back to original Text.(In the PDF text content is "Hello" that i need to retrieve back from above stream)