In diary entry “Analyzing PDF Streams” I answer a question asked by a student of Xavier: “how can you export all streams of a PDF?”. I explained how to do this with my pdf-parser.py tool.

I recently found another method, using the open-source tool qpdf. Since version 11, you can extract streams with qpdf.

If you want the contents of the streams inside a single JSON object (BASE64 encoded), use this command:

qpdf.exe –json –json-stream-data=inline exampl.pdf

And if you want the contents of the streams in separate files (filename prefix “stream”), use this command:

qpdf.exe –json –json-stream-data=file –json-stream-prefix=stream exampl.pdf

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.