There is another image that denotes the complete structure in a way how we just followed. 1
So you have the header then you have all the objects then you have a cross reference table if you see 2
here the cross-reference tables are basically linked with all the object numbers. 3
And then we have a trailer and then we have the end of file. 4
So end of file basically contains the bytes from where the cross-reference table starts. 5
So it points to basically the cross-reference table and from cross table we start parsing the objects. 6
So this is how the entire structure of a PDF file works. 7
It is a hex representation of PDF files. 8
Load the PDF file into a hex editor. 9
In my case I have loaded it in 0 1 0 editor. 10
You can see the same PDF structure that we just talked about. 11
So the good thing with 0 1 0 editor is that it has a bunch of file parsing templates so it basically 12
helps you in understanding the file formats in much better way. 13
So 0 1 0 editor also has PDF template as well which parses the PDF files and gives you more information 14
about different objects. 15
So if you look here at the bottom, it tells you about the PDF's header then it tells you that there is a 16
white space. 17
Then it tells you that there is an object and its starting position is 10. 18
So if you come back to our presentation you'll see that in the cross-reference table position number 19
10 is basically pointing to the first object. 20
Right. 21
So this is how we can verify that how the PDF file is parsed. 22
What exactly did different locations mean. 23
So you have 10 The first one you have 69 for the second and you are 141 for the third object. 24
If you go back here you can see that they are exactly the same locations. 25
So this helps us in better understanding that cross-reference table and how it has marked different memory 26
locations. 27
So this is all about PDF file structure. 28
Starting next videos we'll start analyzing malicious files using different PDF of analysis tools. 29
Thanks for watching.