Top all-time · #2875
Didier Stevens
Personal blog · blog.didierstevens.comsecurityprogramming
Didier Stevens's personal blog at blog.didierstevens.com covers security and programming. Since 2010, 27 different Hacker News readers have linked it 32 times, most often “Malicious PDF Document Analysis with pdf-parser.py”. It is still writing: the last post was on 2026-11-01, and you can follow it by feed.
Too few sampled comments (21) to say how often HN recommends it.?
Why HN links it
HN readers link Didier Stevens' blog for his PDF tools page and posts on PDF malware, escape-from-pdf and file-format analysis. Comments mostly cite these as sources rather than judging the writing.
Summarised by Claude from a sample of 21 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
(blog 'DidierStevens)
Most-linked posts?
- Malicious PDF Document Analysis with pdf-parser.py6 people · 7 mentions · first linked 2017-10-07
- Escape from PDF3 people · 3 mentions · first linked 2010-03-31
What Hacker News says?
For analysis, I’ve used Didier’s tools. If you just want a safe way to open it, upload it to a cloud storage provider which destructively renders the pdf. Box or Google drive should work. https://blog.didierstevens.com/programs/pdf-tools/
Comment linking /programs/pdf-tools/
on “Making a PDF that's larger than Germany”Submitted Cracking Encrypted PDFs as a story · 140 points
HN discussionWhat is the MIME type of a .tar file; and what are the MIME types of the constituent concatenated files within an archive format like e.g. tar? hachoir/subfile/main.py: https://github.com/vstinner/hachoir/blob/main/hachoir/subfil... File signature: https://en.wikipedia.org/wiki/File_signature PhotoRec: https://en.wikipedia.org/wiki/PhotoRec "File Format Gallery for Kaitai Struct"; 185+ binary file format specificati…
Comment linking /2017/07/14/clamav-sigtool-decode-sigs/
on “Magika: AI powered fast and efficient file type identification”Submitted XORSearch and XORStrings – Reverse engineering files as a story · 36 points
HN discussionThank you for your input. I forgot the mention in the original post that there is a tool called pdf-parser.py [1] which claims to be able to do that but it produces a broken output. I don’t know anything about Python or PDF internals to hack on it. Posting it here and hoping that the HN crowds could point me in the correct direction. [1]: https://blog.didierstevens.com/programs/pdf-tools/
Comment linking /programs/pdf-tools/
on “Horrifying PDF Experiments”Submitted Escape from PDF as a story · 7 points
HN discussionAlternatively it's also possible to disable ASLR in the executable itself by removing the flag 0x40 (opt-in flag for ASLR) in the DllCharacteristics field of the header. There's a neat little tool called SetDllCharacteristics[0] which can do that. [0] https://blog.didierstevens.com/2010/10/17/setdllcharacterist...
Comment linking /2010/10/17/setdllcharacteristics/
on “Debugging memory corruption: who the hell writes “2” into my stack? (2016)”Submitted LockIfNotHot Uses Temperature Sensor to Lock Your PC When You Leave Your Chair as a story · 5 points
HN discussionI though Swiss Army knife for PDF are Didier Stevens PDF tools: https://blog.didierstevens.com/programs/pdf-tools/
Comment linking /programs/pdf-tools/
on “Spotlight on pdfly, the Swiss Army knife for PDF files”Submitted Analysis – ExifTool, Ole Files and FlashPix Files as a story · 2 points
HN discussionMore information on analysis of PDF malware: http://blog.didierstevens.com/programs/pdf-tools/ PDF malware can be used for economic espionage targeting commercial research. What would help is a single open registry which has: bibliographic metadata + hash of known-good PDF for each paper.
Comment linking /programs/pdf-tools/
on “Announcing Calibre 2.0”Submitted That Is Not My Child Process as a story · 2 points
HN discussionThis should do: > In the first demo, I just select the PDF document with one click. This is enough to exploit the vulnerability, because the PDF document is implicitly read to gather extra information. > In the second demo, I change the view to Thumbnails view. In a thumbnail view, the first page of a PDF document is rendered to be displayed in a thumbnail. Rendering the first page implies reading the PDF document,…
Comment linking /2009/03/04/quickpost-jbig2decode-trigger-trio/
on “Linux ransomware in the wild”Submitted 1768 K as a story · 1 points
HN discussionDidier Stevens has some great cli tools https://blog.didierstevens.com/programs/pdf-tools/
Comment linking /programs/pdf-tools/
on “What’s Hiding in Your PDF?”Submitted Embedding and Hiding Files in PDF Documents as a story · 1 points
HN discussionDidier Stevens has some great cli tools https://blog.didierstevens.com/programs/pdf-tools/
Comment linking /programs/pdf-tools/
on “What’s Hiding in Your PDF?”Submitted New Tool: What Is New? as a story · 1 points
HN discussionAs one of the comments there mention, the Origin client is only enumerating the list of recently run applications. The app name in that list is ROT13-"encrypted" by explorer.exe for some odd reason; see: http://blog.didierstevens.com/2006/07/24/rot13-is-used-in-wi...
Comment linking /2006/07/24/rot13-is-used-in-windows-you%E2%80%99re-joking/
on “EA is File Snooping with the Origin Client”Submitted Malicious PDF Document Analysis with pdf-parser.py as a story · 1 points
HN discussionYou have to essentially render the document yourself in order to figure out what the order of chunks is. Then you might be able to extract content from the chunks you're interested in - or not. A given zipped chunk might be literally anything. Didier Stevens is the best expert of PDFs that I know of: https://blog.didierstevens.com/programs/pdf-tools/
Comment linking /programs/pdf-tools/
on “Gov.uk content should be published in HTML and not PDF (2018)”Submitted TaskManager.xls - a simple task manager implemented in Excel/VBA as a story · 1 points
HN discussionNo, but depending on what program you open it with it may be able to do far worse than execute javascript in a browser sandbox. [0][1] [0]: https://blog.didierstevens.com/2010/03/29/escape-from-pdf/ [1]: https://thestack.com/security/2016/06/09/pdf-exploit-found-i...
Comment linking /2010/03/29/escape-from-pdf/
on “HEIST: HTTP Encrypted Information Can Be Stolen Through TCP-Windows [pdf]”PDF is also a minefield, for how many ways there are to mess with the format: https://blog.didierstevens.com/2008/04/29/pdf-let-me-count-t...
Comment linking /2008/04/29/pdf-let-me-count-the-ways/
on “Pure: A static analysis file format checker”svchost.exe is literally what the name implies. It's a generic service host. You pass it a dll and an entrypoint (via command line arguments and registry keys) and it runs it. You should look at which thing it's actually running to see what's using all your CPU. Some articles detailing what it does and how it works: [1] https://nasbench.medium.com/demystifying-the-svchost-exe-pro... [2] https://pusha.be/index.php/20…
Comment linking /2019/10/29/quickpost-running-a-service-dll/
on “Intel Previews Sierra Forest with 288 E-Cores, Announces Granite Rapids-D”Anyone worth their grain of salt would download and analyze in a vm before executing on their own personal machine... I know I would. Didier Stevens[0] has a ton of tools for static analysis of these file types. [0] https://blog.didierstevens.com/
Comment linking /
on “Dutch MoD appoints 72 citizens to cyber-military reserve force”- ay · 2010-04-01
But given a sufficiently complex code, you can execute from unexpected places. Sometimes even without any bugs involved: http://blog.didierstevens.com/2010/03/29/escape-from-pdf/
Comment linking /2010/03/29/escape-from-pdf/
on “Twitter, Curse your sudden but inevitable betrayal” This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently. SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/2006121923…
Comment linking /2008/06/25/bpmtk-bypassing-srp-with-dll-restrictions/
on “Lockdown.exe: Block unknown apps via Windows software restriction policy”I'd never use the words PDF and goodness in the same sentence. I doubt Didier Stevens ( http://blog.didierstevens.com/ ) would either. Don't get me wrong, I like Chrome (in fact I'm using it now) but it's a browser. I don't want a document viewer, I just want to surf the Internet.
Comment linking /
on “PDF goodness in Chrome”Foxit has had some pretty blatant security vulnerabilities -- straight up unprompted local code execution: http://blog.didierstevens.com/2010/03/29/escape-from-pdf/ It does a mediocre job of rendering, and isn't faster than Acrobat if you strip out all of Adobe's lame plugins ( we put plugins in your plugins so you can extend while you embrace! )
Comment linking /2010/03/29/escape-from-pdf/
on “Why doesn't Windows include native PDF reader support?”
