-
Notifications
You must be signed in to change notification settings - Fork 59
/
Copy pathForm1.frm
3731 lines (3094 loc) · 112 KB
/
Form1.frm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
VERSION 5.00
Object = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}#1.0#0"; "msscript.ocx"
Object = "{3B7C8863-D78F-101B-B9B5-04021C009402}#1.2#0"; "RICHTX32.OCX"
Object = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}#2.0#0"; "mscomctl.ocx"
Object = "{9A143468-B450-48DD-930D-925078198E4D}#1.0#0"; "hexed.ocx"
Begin VB.Form Form1
Caption = "PDF Stream Dumper - http://sandsprite.com"
ClientHeight = 9195
ClientLeft = 165
ClientTop = 735
ClientWidth = 14100
BeginProperty Font
Name = "Courier New"
Size = 9.75
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
Icon = "Form1.frx":0000
LinkTopic = "Form1"
ScaleHeight = 9195
ScaleWidth = 14100
StartUpPosition = 3 'Windows Default
Begin VB.Frame fraPictViewer
Caption = "Picture Viewer "
Height = 2685
Left = 8160
TabIndex = 20
Top = 2520
Visible = 0 'False
Width = 3915
Begin VB.PictureBox Picture1
AutoRedraw = -1 'True
AutoSize = -1 'True
Height = 1875
Left = 150
ScaleHeight = 1815
ScaleWidth = 3585
TabIndex = 21
Top = 390
Width = 3645
End
Begin VB.Label lblClosePictViewer
Caption = "Close"
BeginProperty Font
Name = "Courier New"
Size = 9.75
Charset = 0
Weight = 400
Underline = -1 'True
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
ForeColor = &H00C00000&
Height = 255
Left = 4170
TabIndex = 22
Top = 60
Width = 645
End
End
Begin rhexed.HexEd he
Height = 1575
Left = 2130
TabIndex = 19
Top = 60
Visible = 0 'False
Width = 10665
_ExtentX = 18812
_ExtentY = 2778
End
Begin PDFStreamDumper.ucAsyncDownload ucAsyncDownload1
Height = 615
Left = 12870
TabIndex = 18
Top = 810
Visible = 0 'False
Width = 795
_ExtentX = 1402
_ExtentY = 1085
End
Begin RichTextLib.RichTextBox txtDetails
Height = 3435
Left = 3600
TabIndex = 17
Top = 2040
Visible = 0 'False
Width = 8775
_ExtentX = 15478
_ExtentY = 6059
_Version = 393217
ScrollBars = 2
TextRTF = $"Form1.frx":1142
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 12
Charset = 0
Weight = 700
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
End
Begin VB.Frame fraLower
BorderStyle = 0 'None
Height = 1860
Left = 2115
TabIndex = 12
Top = 6525
Width = 11625
Begin MSComctlLib.ListView lvDebug
Height = 1455
Left = 1200
TabIndex = 13
Top = 0
Visible = 0 'False
Width = 8475
_ExtentX = 14949
_ExtentY = 2566
View = 3
LabelEdit = 1
LabelWrap = -1 'True
HideSelection = 0 'False
_Version = 393217
ForeColor = -2147483640
BackColor = -2147483643
BorderStyle = 1
Appearance = 1
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 8.25
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
NumItems = 1
BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628}
Text = "Message"
Object.Width = 2540
EndProperty
End
Begin MSComctlLib.ListView lvSearch
Height = 1455
Left = 360
TabIndex = 14
Top = 0
Visible = 0 'False
Width = 9900
_ExtentX = 17463
_ExtentY = 2566
View = 3
LabelEdit = 1
LabelWrap = -1 'True
HideSelection = 0 'False
_Version = 393217
ForeColor = -2147483640
BackColor = -2147483643
BorderStyle = 1
Appearance = 1
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 8.25
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
NumItems = 1
BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628}
Text = "Search Results"
Object.Width = 2540
EndProperty
End
Begin MSComctlLib.ListView lv2
Height = 1455
Left = 0
TabIndex = 15
Top = 0
Width = 11265
_ExtentX = 19870
_ExtentY = 2566
View = 3
LabelEdit = 1
LabelWrap = -1 'True
HideSelection = 0 'False
_Version = 393217
ForeColor = -2147483640
BackColor = -2147483643
BorderStyle = 1
Appearance = 1
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 8.25
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
NumItems = 1
BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628}
Text = "Errors"
Object.Width = 2540
EndProperty
End
Begin MSComctlLib.TabStrip TabStrip1
Height = 1815
Left = 30
TabIndex = 16
Top = 0
Width = 11600
_ExtentX = 20452
_ExtentY = 3201
MultiRow = -1 'True
Placement = 1
TabStyle = 1
_Version = 393216
BeginProperty Tabs {1EFB6598-857C-11D1-B16A-00C0F0283628}
NumTabs = 3
BeginProperty Tab1 {1EFB659A-857C-11D1-B16A-00C0F0283628}
Caption = "Errors"
ImageVarType = 2
EndProperty
BeginProperty Tab2 {1EFB659A-857C-11D1-B16A-00C0F0283628}
Caption = "Search"
ImageVarType = 2
EndProperty
BeginProperty Tab3 {1EFB659A-857C-11D1-B16A-00C0F0283628}
Caption = "Debug"
ImageVarType = 2
EndProperty
EndProperty
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 9.75
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
End
End
Begin VB.Frame fraControls
BorderStyle = 0 'None
Height = 465
Left = 45
TabIndex = 5
Top = 8370
Width = 13815
Begin VB.TextBox txtPDFPath
BeginProperty Font
Name = "Courier New"
Size = 9.75
Charset = 0
Weight = 700
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
Height = 315
Left = 2040
OLEDropMode = 1 'Manual
TabIndex = 10
Text = "Drag and drop pdf file here"
Top = 90
Width = 8535
End
Begin VB.CommandButton cmdDecode
Caption = "Load"
BeginProperty Font
Name = "Courier New"
Size = 9.75
Charset = 0
Weight = 700
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
Height = 375
Left = 11250
TabIndex = 9
Top = 45
Width = 1335
End
Begin VB.CommandButton cmdBrowse
Caption = "..."
BeginProperty Font
Name = "System"
Size = 9.75
Charset = 0
Weight = 700
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
Height = 375
Left = 10665
TabIndex = 8
Top = 45
Width = 615
End
Begin VB.CommandButton Command1
Caption = "Shell"
Enabled = 0 'False
Height = 375
Left = 0
TabIndex = 7
Top = 75
Width = 855
End
Begin VB.CommandButton cmdAbortProcessing
Caption = "Abort"
Height = 375
Left = 12600
TabIndex = 6
Top = 45
Width = 1005
End
Begin VB.Label Label1
Alignment = 1 'Right Justify
Caption = "PDF Path"
BeginProperty Font
Name = "Courier New"
Size = 9.75
Charset = 0
Weight = 700
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
Height = 255
Left = 840
TabIndex = 11
Top = 120
Width = 1095
End
End
Begin MSComctlLib.ProgressBar pb
Height = 285
Left = 5805
TabIndex = 4
Top = 6165
Width = 7710
_ExtentX = 13600
_ExtentY = 503
_Version = 393216
Appearance = 1
End
Begin MSScriptControlCtl.ScriptControl scAuto
Left = 12240
Top = 120
_ExtentX = 1005
_ExtentY = 1005
Timeout = 100000
End
Begin MSScriptControlCtl.ScriptControl sc
Left = 12960
Top = 120
_ExtentX = 1005
_ExtentY = 1005
Language = "jscript"
End
Begin MSComctlLib.StatusBar StatusBar
Align = 2 'Align Bottom
Height = 300
Left = 0
TabIndex = 3
Top = 8895
Width = 14100
_ExtentX = 24871
_ExtentY = 529
_Version = 393216
BeginProperty Panels {8E3867A5-8586-11D1-B16A-00C0F0283628}
NumPanels = 10
BeginProperty Panel1 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel2 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel3 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel4 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel5 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel6 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel7 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel8 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel9 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
BeginProperty Panel10 {8E3867AB-8586-11D1-B16A-00C0F0283628}
EndProperty
EndProperty
End
Begin RichTextLib.RichTextBox txtUncompressed
Height = 4095
Left = 3120
TabIndex = 0
Top = 1620
Width = 9855
_ExtentX = 17383
_ExtentY = 7223
_Version = 393217
Enabled = -1 'True
HideSelection = 0 'False
ScrollBars = 2
TextRTF = $"Form1.frx":11C4
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 12
Charset = 0
Weight = 700
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
End
Begin MSComctlLib.ListView lv
Height = 8295
Left = 0
TabIndex = 1
Top = 0
Width = 2055
_ExtentX = 3625
_ExtentY = 14631
View = 3
LabelEdit = 1
MultiSelect = -1 'True
LabelWrap = -1 'True
HideSelection = 0 'False
_Version = 393217
ForeColor = -2147483640
BackColor = -2147483643
BorderStyle = 1
Appearance = 1
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 8.25
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
NumItems = 1
BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628}
Text = "Objects"
Object.Width = 2540
EndProperty
End
Begin MSComctlLib.TabStrip ts
Height = 6495
Left = 2040
TabIndex = 2
Top = 0
Width = 11910
_ExtentX = 21008
_ExtentY = 11456
MultiRow = -1 'True
Placement = 1
TabStyle = 1
_Version = 393216
BeginProperty Tabs {1EFB6598-857C-11D1-B16A-00C0F0283628}
NumTabs = 3
BeginProperty Tab1 {1EFB659A-857C-11D1-B16A-00C0F0283628}
Caption = "Text"
ImageVarType = 2
EndProperty
BeginProperty Tab2 {1EFB659A-857C-11D1-B16A-00C0F0283628}
Caption = "HexDump"
ImageVarType = 2
EndProperty
BeginProperty Tab3 {1EFB659A-857C-11D1-B16A-00C0F0283628}
Caption = "Stream Details"
ImageVarType = 2
EndProperty
EndProperty
BeginProperty Font {0BE35203-8F91-11CE-9DE3-00AA004BB851}
Name = "Courier New"
Size = 9.75
Charset = 0
Weight = 400
Underline = 0 'False
Italic = 0 'False
Strikethrough = 0 'False
EndProperty
End
Begin VB.Menu mnuLoadTop
Caption = "Load"
Begin VB.Menu mnuLoadFile
Caption = "Pdf File"
End
Begin VB.Menu muLoadShellcode
Caption = "Shellcode File"
End
Begin VB.Menu mnuLoadJSFile
Caption = "Javascript File"
End
Begin VB.Menu mnuPlugin
Caption = "Run Plugin"
Begin VB.Menu mnuPluginList
Caption = "Automation Script"
Index = 0
End
End
End
Begin VB.Menu mnuExploitScan
Caption = "Exploits_Scan"
End
Begin VB.Menu mnuFormatJS
Caption = "Format_Javascript"
Visible = 0 'False
End
Begin VB.Menu mnuJavascriptUI
Caption = "Javascript_UI"
End
Begin VB.Menu mnuUnescape
Caption = "Unescape_Selection"
End
Begin VB.Menu mnuManualEscapes
Caption = "Manual_Escapes"
Begin VB.Menu mnuManualEscape
Caption = "HexString Unescape (Preserve White Space)"
Index = 0
End
Begin VB.Menu mnuManualEscape
Caption = "HexString Unescape (Strip White Space)"
Index = 1
End
Begin VB.Menu mnuManualEscape
Caption = "% Unescape"
Index = 2
End
Begin VB.Menu mnuManualEscape
Caption = "\x Unescape"
Index = 3
End
Begin VB.Menu mnuManualEscape
Caption = "\n Unescape"
Index = 4
End
Begin VB.Menu mnuManualEscape
Caption = "# Unescape"
Index = 5
End
Begin VB.Menu mnuManualEscape
Caption = "Octal UnEscape"
Index = 6
End
Begin VB.Menu mnuManualEscape
Caption = "Escape and Format Headers"
Index = 7
End
Begin VB.Menu mnuManualEscape
Caption = "Strip CRLF and WhiteSpace"
Index = 8
End
Begin VB.Menu mnuManualEscape
Caption = "Extract Valid Hex Chars from Blob"
Index = 9
End
Begin VB.Menu mnuManualEscape
Caption = "Extract Valid Hex from blob + u -> %u"
Index = 10
End
Begin VB.Menu mnuManualEscape
Caption = "Add % to HexString"
Index = 11
End
Begin VB.Menu mnuExtractHexFromParan
Caption = "Extract Data From () Page Data"
End
Begin VB.Menu mnuExtractHexDump
Caption = "Extract Hex From HexDump"
Enabled = 0 'False
Visible = 0 'False
End
End
Begin VB.Menu mnuUpdateCurrent
Caption = "Update_Current_Stream"
End
Begin VB.Menu mnuGotoObject
Caption = "Goto_Object"
End
Begin VB.Menu mnuSearchFor
Caption = "Search_For"
Begin VB.Menu mnuSearch
Caption = "Search Strings"
End
Begin VB.Menu mnuSearchFilter
Caption = "Javascript"
Index = 0
End
Begin VB.Menu mnuSearchFilter
Caption = "Flash Objects"
Index = 1
End
Begin VB.Menu mnuSearchFilter
Caption = "U3D Objects"
Index = 2
End
Begin VB.Menu mnuSearchFilter
Caption = "TTF Fonts"
Index = 3
End
Begin VB.Menu mnuSearchFilter
Caption = "Action Tags"
Index = 4
End
Begin VB.Menu mnuSearchFilter
Caption = "Obsfuscated Headers "
Index = 5
End
Begin VB.Menu mnuSearchFilter
Caption = "PRC Files"
Index = 6
End
Begin VB.Menu mnuSearchFilter
Caption = "XML Streams"
Index = 7
End
Begin VB.Menu mnuSearchFilter
Caption = "Filter Chains"
Index = 8
End
Begin VB.Menu mnuExtractURI
Caption = "Extract URLs"
End
End
Begin VB.Menu mnuFindReplace
Caption = "Find/Replace"
End
Begin VB.Menu mnuTools
Caption = "Tools"
Begin VB.Menu mnuZlibBrute
Caption = "Zlib Brute Forcer"
End
Begin VB.Menu mnuDecompress
Caption = "Zlib Decompress_File"
End
Begin VB.Menu mnuCompress
Caption = "Zlib Compress_File"
End
Begin VB.Menu mnuSpacer22
Caption = "-"
End
Begin VB.Menu mnuB64Clipboard
Caption = "Base64 Decode Clipboard"
End
Begin VB.Menu mn_b64EncClip
Caption = "Base64 Encode Clipboard"
End
Begin VB.Menu mnub64decode
Caption = "Base64 Decode File"
End
Begin VB.Menu mnub64Encode
Caption = "Base64 Encode File"
End
Begin VB.Menu mnuSpacer44
Caption = "-"
End
Begin VB.Menu mnuDecompileFlashTools
Caption = "Decompile Flash w/ AS3 Sorcerer"
End
Begin VB.Menu mnuDecompressSWC
Caption = "Decompress Flash (CWS Header)"
End
Begin VB.Menu mnuDecrypt
Caption = "Decrypt PDF (Force)"
End
Begin VB.Menu mnuSpacer77
Caption = "-"
End
Begin VB.Menu mnuSecureDownload
Caption = "Download URL"
End
Begin VB.Menu mnuFilters
Caption = "Manual_Filters"
End
Begin VB.Menu mnuFilterVisualizer
Caption = "Filter Visualizer"
End
Begin VB.Menu mnuHexEditor
Caption = "View PDF in Hexeditor"
End
Begin VB.Menu mnuNewHexEditorWin
Caption = "New Hexeditor Window"
End
Begin VB.Menu mnuSpacer4
Caption = "-"
End
Begin VB.Menu mnuViewExploitDetections
Caption = "View Exploit Detections"
End
Begin VB.Menu mnuoptions
Caption = "Options"
Begin VB.Menu mnuAutoEscapeHeaders
Caption = "Auto Escape Headers"
End
Begin VB.Menu mnuVisualFormatHeaders
Caption = "Visually Format Headers"
End
Begin VB.Menu mnuEnableShellButton
Caption = "Enable Shell Button"
End
Begin VB.Menu mnuHideHeaderStreams
Caption = "Hide Header Only Objects"
End
Begin VB.Menu mnuHideDups
Caption = "Hide Duplicate Streams"
End
Begin VB.Menu mnuAlwaysUseZlib
Caption = "Always use Zlib for FlateDecode"
Visible = 0 'False
End
Begin VB.Menu mnuDisableiText
Caption = "Disable iText Decompressors"
Visible = 0 'False
End
Begin VB.Menu mnuDisableDecomp
Caption = "Disable All Decompressors"
End
Begin VB.Menu mnuOpenLastAtStart
Caption = "Open Last PDF on Startup"
End
Begin VB.Menu mnuDisableDecryption
Caption = "Disable Decryption Support"
End
Begin VB.Menu mnuEnableJBIG2
Caption = "Enable JBIG2 Decoding Support"
End
Begin VB.Menu mnuUseInternalHexeditor
Caption = "Use Internal HexEditor"
End
Begin VB.Menu mnuAutoSwitchTabs
Caption = "AutoSwitch Tabs for Binary Data"
End
End
Begin VB.Menu mnuAbout
Caption = "About"
End
Begin VB.Menu mnuAboutLvColors
Caption = "About Listview Colors"
End
Begin VB.Menu mnuDebugBreakAtStream
Caption = "Debug> Break At Stream"
End
Begin VB.Menu mnuBrowseHomeDir
Caption = "Browse Home Directory"
End
End
Begin VB.Menu mnuPopup
Caption = "mnuPopup"
Visible = 0 'False
Begin VB.Menu mnuShowRawHeader
Caption = "Show Raw Header"
End
Begin VB.Menu mnuSHowRawObject
Caption = "Show Raw Object"
End
Begin VB.Menu mnuDecompileFlash
Caption = "Decompile Flash w/ AS3 Sorcerer"
End
Begin VB.Menu mnuSpacer99
Caption = "-"
End
Begin VB.Menu mnuWipeStream
Caption = "Wipe Object"
End
Begin VB.Menu mnuMarkStream
Caption = "Mark Stream"
End
Begin VB.Menu mnuReplaceStream
Caption = "Replace Stream"
End
Begin VB.Menu mnuHideSelected
Caption = "Hide Selected Streams"
End
Begin VB.Menu mnuHideUnselected
Caption = "Hide Unselected Streams"
End
Begin VB.Menu mnuLoadAsImage2
Caption = "Load As Image"
End
Begin VB.Menu mnuSpacer2
Caption = "-"
End
Begin VB.Menu mnuSaveStream
Caption = "Save Decompressed Stream"
End
Begin VB.Menu mnuSaveAllStreams
Caption = "Save All Decompressed Streams"
End
Begin VB.Menu mnuSpacer1
Caption = "-"
End
Begin VB.Menu mnusSaveRawStream
Caption = "Save Raw Stream"
End
Begin VB.Menu mnuSaveAllRaw
Caption = "Save All Raw Streams"
End
End
Begin VB.Menu mnuPopup2
Caption = "mnuPopup2"
Visible = 0 'False
Begin VB.Menu mnuErrorSaveRaw
Caption = "Save Raw Stream"
End
Begin VB.Menu mnuSHowRawObject2
Caption = "Show Raw Object"
End
Begin VB.Menu mnuLoadAsImage
Caption = "Load As Image"
End
End
Begin VB.Menu mnuHelpTop
Caption = "Help_Videos"
Begin VB.Menu mnuHelp
Caption = "-"
Index = 0
End
End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
'you can download some malicous pdfs from here:
'http://jsunpack.jeek.org/dec/go?report=03d8f2450f56a7bc8eb8b2b59ca53f7818126da6
'changelog
' 9-2-10
' fixed bug with replace in js ui
' fixed bug in stream parser now handles nested tags <<start <<another>> end of org>>stream blahblah>>data
' 9-8-10 - added the js refactoring code (big pita!!)
' - added find/find next to replace form
' - possible new bugs related to changing this forms lv to multiselect
' - added support for /Filter /ASCIIHexDecode (01 00 04 02 00 01 01) (kind of a hack)
' - added toolbox.disasm() function utilizing olly.dll to quick check if byte buffers are shellcode
' - search now searchs headers too not just stream content
' - added error handling in all CScript functions
' 9-9-10 - added more listview colors and detections for things.
' 12-10-10 - added support for objend (instead of endobj)
' - added support for Filter Fl abbreviation (instead of full FlateDecode)
' - made obj,endobj,stream,endstream marker searchs case insensitive.
' - force all flateDecode through zlib now, iText could crash sometimes on long automated runs
' - added a little more err handling to cmddecode_click, scripts could not get their DecodeComplete Event sometimes.
' 12-12-10 - added support for plugins and added database plugin
' 12-13-10 - js_ui added this and app objects, so if(app), if(this.app), app.eval() etc all work now.
' - js_ui added app.doc, app.collab and function collab.geticon , collab.collectemailinfo, app.eval
' - js_ui, on js error, now it scrolls to and highlights the line with teh error on it
' - js_ui, txtOut.Text not auto cleared on script start so you can use it to hold a variable if need be.
' - js_ui tb.lv now refers to js form listview so you can pull variables from it in your scripts.
' 12-27-10 - big change to how js_ui executes code, now all wrapped in myMain() function to support this. seems stable.
' - header _CHR(0)_ replaced with empty now (seems only to cause bug) also replaced py in header with empty
' - added progress bar and doevents me.refresh to keep ui from freezing on big files
Private Declare Function ShellExecute Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpszOp As String, ByVal lpszFile As String, ByVal lpszParams As String, ByVal LpszDir As String, ByVal FsShowCmd As Long) As Long
Private Declare Function GetTickCount Lib "kernel32" () As Long
Private Declare Function InitCommonControls Lib "comctl32.dll" () As Long
Dim WithEvents parser As CPdfParser
Attribute parser.VB_VarHelpID = -1
Dim plugins() As Object
Option Explicit
Public Enum statss
stNotLoaded = 0
stProcessing = 1
stComplete = 2
End Enum
Public selli As ListItem
Public dlg As New clsCmnDlg
Public AutomatationRun As Boolean
Public Status As statss
Public LoadTime As Long
Public isEncrypted As Boolean
Dim exploits()
Dim flash_exploits()
Dim help_vids()
Dim streamCount As Long
Dim jsCount As Long
Dim EmbeddedFilesCount As Long
Dim pageCount As Long
Dim ttfCount As Long
Dim U3DCount As Long
Dim flashCount As Long
Dim unspFilterCount As Long
Dim ActionCount As Long
Dim PRCCount As Long
Dim surpressHideWarnings As Boolean
Dim startup_complete As Boolean
'Dim defaultLCID As Long
Dim DownloadPath As String
'COMMAND LINE OPTIONS:
Dim ExtractToFolder As String 'command line ex: pdfstreamdumper "c:\file.pdf" /extract "c:\folder" (extracts objects only (flash, fonts, prc, u3d))
Sub LoadPlugins()
Dim tmp() As String, i As Integer, progid As String
Dim wsc() As String
On Error Resume Next
If Not fso.FolderExists(App.path & "\plugins") Then
lvDebug.ListItems.Add "Plugins folder not found"
Exit Sub
End If
tmp() = fso.GetFolderFiles(App.path & "\plugins", "*dll")
If AryIsEmpty(tmp) Then Exit Sub
'for the demo, we will just let the user register this way if they want
'If MsgBox("Did you register all of the dlls & the wsc file with regsvr32 already?", vbYesNo) = vbNo Then
' For i = 0 To UBound(tmp)
' Shell "regsvr32 """ & tmp(i) & """", vbNormalFocus
' Next
'End If
ReDim plugins(0)
For i = 0 To UBound(tmp)
ReDim Preserve plugins(i)
progid = GetBaseName(tmp(i)) & ".plugin"
Set plugins(i) = CreateObject(progid)
If Err.Number = 429 Then 'ActiveX component can't create object
If MsgBox(progid & " not registered yet, register now?", vbYesNo) = vbYes Then
Shell "regsvr32 """ & App.path & "\plugins\" & tmp(i) & """", vbNormalFocus
Sleep 2000
End If
End If
Set plugins(i) = CreateObject(progid)
plugins(i).sethost Me
Next
Exit Sub
hell: MsgBox tmp(i) & " - " & Err.Description
Resume Next
End Sub
Function RegisterPlugin(intMenu As Integer, strMenuName As String, intStartupArgument As Integer)
'here right after sethost in loadplugins sub
Dim i As Integer
'If intMenu = 0 Then
i = mnuPluginList.Count
Load mnuPluginList(i)
mnuPluginList(i).Caption = strMenuName
mnuPluginList(i).Visible = True
mnuPluginList(i).tag = UBound(plugins) & "." & intStartupArgument
'Else
'same thing to some other menu
End Function
Private Sub cmdAbortProcessing_Click()
On Error Resume Next
parser.abort = True
ucAsyncDownload1.AbortDownload
pb.Value = 0
End Sub
Private Sub Form_Initialize()
InitCommonControls
End Sub
Private Sub lblClosePictViewer_Click()
fraPictViewer.Visible = False
End Sub
Private Sub mn_b64EncClip_Click()
On Error Resume Next
Dim x As String
x = Clipboard.GetText
x = b64.EncodeString(x)
Clipboard.Clear
Clipboard.SetText x
MsgBox "Clipboard text encoded (not binary safe)", vbInformation