title: How to decode a PDF stream?
body: <p>I want to analyze a stream object in a PDF file which is encoded using <code>/FlateDecode</code>.</p>
  
  <p>Are there any tools which allow one to decode such encoding (ASCII85decode, LZWDecode, RunlenghtDecode etc.) used in PDFs?</p>
  
  <p>The stream content is most likely a PE file structure, which the PDF probably will use later in the exploit.</p>
  
  <p>Also, there are two <code>xref</code> tables in the PDF, that is alright but also two %%EOF which follow the <code>xref</code>. </p>
  
  <p>Is the presence of these allright? (Note: The second <code>xref</code> points to the 1st <code>xref</code> using the <code>/prev</code> name.</p>
  
  <p><strong>this <code>xref</code> refers to the second <code>xref</code>:</strong></p>
  
  <pre>
  xref 
  5 6
  0000000618 00000 n
  0000000658 00000 n
  0000000701 00000 n
  0000000798 00000 n
  0000045112 00000 n
  0000045219 00000 n
  1 1
  0000045753 00000 n
  3 1
  0000045838 00000 n
  trailer
  >
  startxref
  46090
  %%EOF
  </pre>
  
  <hr>
  
  <p><strong>the second <code>xref</code>:</strong></p>
  
  <pre>
  xref
  0 5
  0000000000 65535 f
  0000000010 00000 n
  0000000067 00000 n
  0000000136 00000 n
  0000000373 00000 n
  trailer
  >
  startxref
  429
  %%EOF
  </pre>