pdfalyzer 1.16.9__tar.gz → 1.16.10__tar.gz

pdfalyzer-1.16.10/.pdfalyzer.example

@@ -0,0 +1,66 @@
+# If you place a filed called '.pdfalyzer' in your home dir or the current dir environment variables specified
+# in that .pdfalyzer file will be added to the environment each time pdfalyzer is invoked. (See the `dotenv`
+# package for more details.) This file contains environment variables you can place in .pdfalyzer to configure
+# the application above and beyond providing command line options.  Useful if you want to permanently
+# configure options you tend to reuse (e.g. '--maximize-width') so you can stop remembering to type them.
+#
+# Almost all of the yaralyzer (yes, you read that right - The Pdfalyzer uses The Yaralyzer for all
+# kinds of backend functionality) command line options can be configured in this file by capitalizing them and
+# prefixing 'YARALYZER'. e.g. to configure the --maximize-width option for every invocation, you would set:
+# YARALYZER_MAXIMIZE_WIDTH=True
+#
+# Note that many of these options are actually configuring the yaralyzer, which is a separate tool leveraged
+# by the Pdfalyzer to actually do the work of finding patterns. More info can be found at
+# https://github.com/michelcrypt4d4mus/yaralyzer
+
+
+
+# Expand the width of the output to the fit the display window (same as the --maximize-width options)
+#    YARALYZER_MAXIMIZE_WIDTH=True
+
+# yara-python internal options passed through to yara.set_config() as the stack_size and max_match_data arguments
+#    YARALYZER_STACK_SIZE=10485760
+#    YARALYZER_MAX_MATCH_LENGTH=10737418240
+
+# Suppress all PDF binary regex matching/scanning/etc
+#    YARALYZER_SUPPRESS_DECODES_TABLE=False
+
+# Suppress the display of the table showing the the encoding assessments given by `chardet.detect()`
+# about a particular chunk of binary data. (The most important data in the chardet confidence table is
+# redunandant anyways. Only the low likelihood encodings are hidden from the usef)
+#    YARALYZER_SUPPRESS_CHARDET_TABLE=False
+# Minimum confidence to display an encoding in the chardet results table
+#    YARALYZER_MIN_CHARDET_CONFIDENCE=2.0
+
+# Configure how many bytes before and after any binary data should be included in scans and visualizations
+#    YARALYZER_SURROUNDING_BYTES=64
+
+# Size thresholds (in bytes) under/over which pdfalyzer will NOT make attempts to decode a match.
+# Longer byte sequences are for obvious reasons slower to decode by force.
+# It may feel counterintuitive but larger chunks of random binary are also harder to examine and
+# (in my experience) less likely to be maningful. Consider it - two frontslash characters 20,000 lines apart
+# are more likely to be random than those same frontslashes when placed nearer to each other and
+# in the vicinity of lot of computerized sigils of internet power like `.', `+bacd*?`,. and other regexes.*
+# Keeping the max value number low will do more to affect the speed of the app than ay anything else you
+# can easily configure..
+#
+#    YARALYZER_MIN_DECODE_LENGTH=1
+#    YARALYZER_MAX_DECODE_LENGTH=256
+
+# Directory to write application logs to. Must be an absolute path, not a relative one.
+# These logs are not normally written to a file and the default log level means that the standard behavior
+# is to more or less discard them. Be aware that if you configure this variable a few things will change:
+#
+#   1. Logs WILL NOT be written to STDOUT. They will stream ONLY to files in the configured directory.
+#      This is true even with the -D option.
+#   2. The default log_level will be decreased from WARN (extremely spartan) to INFO (fairly verbose).
+#      The -D option, which sets the log level to DEBUG, will be respected whether or not
+#      YARALYZER_LOG_DIR is configured.
+#
+#     YARALYZER_LOG_DIR=/path/to/pdfalyzer/log_dir/
+
+# Log level
+#     YARALYZER_LOG_LEVEL='INFO'
+
+# Path to directory containing Didier Stevens's pdf-parser.py. Only required for extracting binary streams to files.
+#     PDFALYZER_PDF_PARSER_PY_PATH=/path/to/pdfparserdotpy/

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/CHANGELOG.md

@@ -1,5 +1,9 @@
 # NEXT RELEASE
 
+### 1.16.10
+* Add `Environment :: Console` and `Programming Language :: Python` to pypi classifiers
+* Add `.pdfalyzer.example` to PyPi package
+
 ### 1.16.9
 * Add `Development Status :: 5 - Production/Stable` to pypi classifiers
 

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pdfalyzer
-Version: 1.16.9
+Version: 1.16.10
 Summary: A PDF analysis toolkit. Scan a PDF with relevant YARA rules, visualize its inner tree-like data structure in living color (lots of colors), force decodes of suspicious font binaries, and more.
 Home-page: https://github.com/michelcrypt4d4mus/pdfalyzer
 License: GPL-3.0-or-later
@@ -9,8 +9,10 @@ Author: Michel de Cryptadamus
 Author-email: michel@cryptadamus.com
 Requires-Python: >=3.9.2,<4.0.0
 Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
 Classifier: Intended Audience :: Information Technology
 Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
+Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
@@ -304,12 +306,6 @@ These are the naming conventions at play in The Pdfalyzer code base:
 * [`PyPDF` documentation](https://pypdf.readthedocs.io/en/stable/) (latest is 4.x or something so these are the relevant docs for `pdfalyze`)
 
 
-# TODO
-* Highlight decodes with a lot of Javascript keywords
-* https://github.com/mandiant/flare-floss (https://github.com/mandiant/flare-floss/releases/download/v2.1.0/floss-v2.1.0-linux.zip)
-* https://github.com/1Project/Scanr/blob/master/emulator/emulator.py
-
-
 [^1]: The official Adobe PDF specification calls this tree the PDF's "logical structure", which is a good example of nomenclature that does not help those who see it understand anything about what is being described. I can forgive them given that they named this thing back in the 80s, though it's a good example of why picking good names for things at the beginning is so important.
 
 [^2]: An exception will be raised if there's any issue placing a node while parsing or if there are any nodes not reachable from the root of the tree at the end of parsing. If there are no exceptions then all internal PDF objects are guaranteed to exist in the tree except in these situations when warnings will be printed:

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/README.md

@@ -277,12 +277,6 @@ These are the naming conventions at play in The Pdfalyzer code base:
 * [`PyPDF` documentation](https://pypdf.readthedocs.io/en/stable/) (latest is 4.x or something so these are the relevant docs for `pdfalyze`)
 
 
-# TODO
-* Highlight decodes with a lot of Javascript keywords
-* https://github.com/mandiant/flare-floss (https://github.com/mandiant/flare-floss/releases/download/v2.1.0/floss-v2.1.0-linux.zip)
-* https://github.com/1Project/Scanr/blob/master/emulator/emulator.py
-
-
 [^1]: The official Adobe PDF specification calls this tree the PDF's "logical structure", which is a good example of nomenclature that does not help those who see it understand anything about what is being described. I can forgive them given that they named this thing back in the 80s, though it's a good example of why picking good names for things at the beginning is so important.
 
 [^2]: An exception will be raised if there's any issue placing a node while parsing or if there are any nodes not reachable from the root of the tree at the end of parsing. If there are no exceptions then all internal PDF objects are guaranteed to exist in the tree except in these situations when warnings will be printed:

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/config.py

@@ -1,3 +1,7 @@
+"""
+PdfalyzerConfig object holds the unification of configuration options parsed from the command line
+as well as those set by environment variables and/or a .pdfalyzer file.
+"""
 import importlib.resources
 from argparse import Namespace
 from os import environ, pardir, path

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/font_info.py

@@ -2,7 +2,6 @@
 Unify font information spread across a bunch of PdfObjects (Font, FontDescriptor,
 and FontFile) into a single class.
 """
-
 from pypdf._cmap import build_char_map, prepare_cm
 from pypdf.generic import IndirectObject, PdfObject
 from rich.text import Text
@@ -11,9 +10,9 @@ from yaralyzer.util.logging import log
 
 from pdfalyzer.binary.binary_scanner import BinaryScanner
 from pdfalyzer.output.character_mapping import print_character_mapping, print_prepared_charmap
-from pdfalyzer.output.tables.font_summary_table import font_summary_table
 from pdfalyzer.output.layout import print_section_subheader
 from pdfalyzer.output.styles.node_colors import get_label_style
+from pdfalyzer.output.tables.font_summary_table import font_summary_table
 from pdfalyzer.util.adobe_strings import (FONT, FONT_DESCRIPTOR, FONT_FILE, FONT_LENGTHS, RESOURCES,
      SUBTYPE, TO_UNICODE, TYPE, W, WIDTHS)
 

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/helpers/pdf_object_helper.py

@@ -20,6 +20,7 @@ def does_list_have_any_references(_list) -> bool:
 
 
 def _sort_pdf_object_refs(refs: List[PdfObjectRelationship]) -> List[PdfObjectRelationship]:
+    """Sort a list of PdfObjectRelationship objects by their to_obj's idnum. Only used by pytest."""
     return sorted(refs, key=lambda ref: ref.to_obj.idnum)
 
 

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/helpers/rich_text_helper.py

@@ -1,13 +1,11 @@
 """
-Functions for miscellaneous Rich text/string operations.
+Functions for miscellaneous Rich text/string pretty printing operations.
 """
 from typing import List, Union
 
 from pypdf.generic import PdfObject
 from rich.console import Console
-from rich.highlighter import RegexHighlighter, JSONHighlighter
 from rich.text import Text
-from yaralyzer.output.rich_console import console
 
 from pdfalyzer.helpers.pdf_object_helper import pypdf_class_name
 from pdfalyzer.output.styles.node_colors import get_label_style, get_class_style_italic

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/output/layout.py

@@ -1,5 +1,5 @@
 """
-Methods to help with the design of the output
+Methods to help with the formatting of the output tables, headers, panels, etc.
 """
 from rich import box
 from rich.padding import Padding

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/output/pdfalyzer_presenter.py

@@ -23,9 +23,9 @@ from pdfalyzer.detection.yaralyzer_helper import get_bytes_yaralyzer, get_file_y
 from pdfalyzer.helpers.string_helper import pp
 from pdfalyzer.output.layout import (print_fatal_error_panel, print_section_header, print_section_subheader,
      print_section_sub_subheader)
+from pdfalyzer.output.tables.decoding_stats_table import build_decoding_stats_table
 from pdfalyzer.output.tables.pdf_node_rich_table import generate_rich_tree, get_symlink_representation
 from pdfalyzer.output.tables.stream_objects_table import stream_objects_table
-from pdfalyzer.output.tables.decoding_stats_table import build_decoding_stats_table
 from pdfalyzer.pdfalyzer import Pdfalyzer
 from pdfalyzer.util.adobe_strings import *
 
@@ -91,7 +91,6 @@ class PdfalyzerPresenter:
           2. Check for (and force decode) dangerous PDF instructions like /JavaScript and /OpenAction
           3. Check for (and force decode) any BOMs (byte order marks)
           4. Check for (and force decode) any sequences of bytes between quotes
-
         """
         print_section_header(f'Binary Stream Analysis / Extraction')
         console.print(self._stream_objects_table())
@@ -109,6 +108,7 @@ class PdfalyzerPresenter:
                 log.warning(msg)
                 node_stream_bytes = node_stream_bytes.encode()
 
+            console.line()
             print_section_subheader(f"{escape(str(node))} Summary and Analysis", style=f"{BYTES_HIGHLIGHT} reverse")
             binary_scanner = BinaryScanner(node_stream_bytes, node)
             console.print(bytes_hashes_table(binary_scanner.bytes))

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/output/tables/decoding_stats_table.py

@@ -1,3 +1,6 @@
+"""
+Helper functions for building a table that summarizes the decoding attempts made on binary data.
+"""
 from numbers import Number
 
 from rich.table import Table
@@ -13,6 +16,7 @@ NOT_FOUND_MSG = Text('(not found)', style='grey.dark_italic')
 REGEX_SUBTABLE_COLS = ['Metric', 'Value']
 DECODES_SUBTABLE_COLS = ['Encoding', '#', 'Decoded', '#', 'Forced', '#', 'Failed']
 
+
 def build_decoding_stats_table(scanner: 'BinaryScanner') -> Table:
     """Diplay aggregate results on the decoding attempts we made on subsets of scanner.bytes"""
     stats_table = _new_decoding_stats_table(scanner.label.plain if scanner.label else '')

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/output/tables/stream_objects_table.py

@@ -1,7 +1,6 @@
 """
 Build a rich table to show the sizes of embedded streams.
 """
-
 from typing import List
 
 from rich.table import Table

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/util/adobe_strings.py

@@ -1,7 +1,6 @@
 """
 String constants specified in the Adobe specs for PDFs, fonts, etc.
 """
-
 from pypdf.constants import (CatalogDictionary, ImageAttributes, PageAttributes,
      PagesAttributes, Resources)
 

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/util/argument_parser.py

@@ -1,5 +1,8 @@
+"""
+Parse command line arguments for pdfalyzer and construct the PdfalyzerConfig object.
+"""
 import sys
-from argparse import ArgumentError, ArgumentParser, Namespace
+from argparse import ArgumentParser, Namespace
 from collections import namedtuple
 from functools import partial, update_wrapper
 from importlib.metadata import version

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pdfalyzer"
-version = "1.16.9"
+version = "1.16.10"
 description = "A PDF analysis toolkit. Scan a PDF with relevant YARA rules, visualize its inner tree-like data structure in living color (lots of colors), force decodes of suspicious font binaries, and more."
 authors = ["Michel de Cryptadamus <michel@cryptadamus.com>"]
 license = "GPL-3.0-or-later"
@@ -32,8 +32,10 @@ keywords = [
 
 classifiers = [
     "Development Status :: 5 - Production/Stable",
+    "Environment :: Console",
     "Intended Audience :: Information Technology",
     "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
+    "Programming Language :: Python",
     "Topic :: Artistic Software",
     "Topic :: Security",
     "Topic :: Scientific/Engineering :: Visualization",
@@ -41,40 +43,47 @@ classifiers = [
 
 include = [
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    ".pdfalyzer.example"
 ]
 
 packages = [
     { include = "pdfalyzer" }
 ]
 
-[tool.poetry.urls]
-Changelog = "https://github.com/michelcrypt4d4mus/pdfalyzer/blob/master/CHANGELOG.md"
-
-
-[tool.poetry.scripts]
-combine_pdfs = 'pdfalyzer:combine_pdfs'
-pdfalyze = 'pdfalyzer:pdfalyze'
-pdfalyzer_show_color_theme = 'pdfalyzer:pdfalyzer_show_color_theme'
-
 
+# Dependencies
 [tool.poetry.dependencies]
 python = "^3.9.2"
 anytree = "~=2.13"
 pypdf = "^5.9.0"
 yaralyzer = "^1.0.4"
 
-
+# Dev dependencies
 [tool.poetry.group.dev.dependencies]
 pytest = "^7.1.2"
 pytest-skip-slow = "^0.0.3"
 
 
+# Scripts
+[tool.poetry.scripts]
+combine_pdfs = 'pdfalyzer:combine_pdfs'
+pdfalyze = 'pdfalyzer:pdfalyze'
+pdfalyzer_show_color_theme = 'pdfalyzer:pdfalyzer_show_color_theme'
+
+
+# URLs for PyPi page
+[tool.poetry.urls]
+Changelog = "https://github.com/michelcrypt4d4mus/pdfalyzer/blob/master/CHANGELOG.md"
+
+
+# Poetry build system
 [build-system]
 requires = ["poetry-core>=1.0.0"]
 build-backend = "poetry.core.masonry.api"
 
 
+# Pytest configuration
 [tool.pytest.ini_options]
 addopts = [
     "--import-mode=importlib",

{pdfalyzer-1.16.9 → pdfalyzer-1.16.10}/pdfalyzer/binary/binary_scanner.py

@@ -12,8 +12,8 @@ from yaralyzer.decoding.bytes_decoder import BytesDecoder
 from yaralyzer.encoding_detection.character_encodings import BOMS
 from yaralyzer.helpers.bytes_helper import hex_string, print_bytes
 from yaralyzer.helpers.string_helper import escape_yara_pattern
-from yaralyzer.output.rich_console import BYTES_NO_DIM, console, console_width
 from yaralyzer.output.regex_match_metrics import RegexMatchMetrics
+from yaralyzer.output.rich_console import BYTES_NO_DIM, console, console_width
 from yaralyzer.yara.yara_rule_builder import HEX, REGEX, safe_label
 from yaralyzer.yaralyzer import Yaralyzer
 from yaralyzer.util.logging import log