PDF object and stream analyzer
Walk PDF objects, decompress streams, extract embedded files and JavaScript, and find text hidden under redaction boxes.
Open in ctfpalA PDF is a graph of numbered objects, many of which hold compressed streams. What you see rendered is the result of executing drawing instructions - which means anything that was ever in the document may still be present even if it is not visible.
Failed redaction is the classic
Drawing a black rectangle over text hides it visually and changes nothing about the text objects underneath. Extracting the text content of the page returns the supposedly redacted words in full. This has happened in real court filings repeatedly, and it is a staple of forensics challenges.
- Object streams - most content is Flate-compressed; decompress before searching.
- `/EmbeddedFile` - PDFs can carry arbitrary attachments.
- `/JavaScript` and `/OpenAction` - executable content, usually the point in a malware-analysis challenge.
- Incremental updates - PDFs are appended to when edited, so earlier versions of the document often remain in the file.
Related tools
Office macro and OLE extractor
Extract VBA macros from DOCM, XLSM, and legacy OLE documents, and deobfuscate the string-concatenation tricks they hide behind.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.
Hex viewer and hexdump
Inspect any file byte by byte with a side-by-side hex and ASCII view, offsets, and structure highlighting.