Peepdf disappeared

[geeksailor]

Hello devs,
New week new issues noted. First I ran an update this morning with no issues so that's a good start. But I'm testing some files (mainly pdfs) and for some reason peepdf has disappeared. Not sure if I inadvertently removed it or something else might have by accident. The update didn't seem to reinstall it. Grepping the results of my saltstack log file for peepdf-3 results in the following:

pip_|-remnux-tools-peepdf-3-source_|-git+https://github.com/digitalsleuth/peepdf-3.git_|-installed:
id: remnux-tools-peepdf-3-source
run_num: 416
sls: remnux.python3-packages.peepdf-3
changes:
git+https://github.com/digitalsleuth/peepdf-3.git==???: Installed
comment: All packages were successfully installed
duration: 4737.991
name: git+https://github.com/digitalsleuth/peepdf-3.git
result: true
start_time: '09:21:46.205236'

I've ran find / -type d -name peepdf 2> /dev/null but the only thing it can find is peepdf in the /usr/local/lib/python3.8/dist-packages directory. I can't seem to find the git it is supposed to grab anywhere which seems odd. I'm not sure where it is supposed to be be dropping that git. I also noticed that the salt also removes the original peepdf for Python2. Could it be removing the old and incorrectly installing the new?
Thanks!

Also, I've noted some errors with Origami trying to run some of the programs in their suite. It doesn't break it but does output some gem issues. I took a look at their git this error has been noted back in 2022 (gdelugre/origami#83). It is also mentioned there that their git may be unmaintained and/or abandoned. I'm not sure if this suite will eventually break but thought it might be something to keep an eye on.

/var/lib/gems/2.7.0/gems/origami-2.1.0/lib/origami/string.rb:416: warning: Using the last argument as keyword parameters is deprecated; maybe ** should be added to the call
/var/lib/gems/2.7.0/gems/origami-2.1.0/lib/origami/string.rb:373: warning: The called method `initialize' is defined here

[digitalsleuth]

Hi @geeksailor , peepdf hasn't been removed, but it has been updated. The new version is now in Python 3 vice Python 2. It may have failed from your previous installation attempt and didn't get repaired properly.
The "git" itself doesn't get downloaded, the package is installed from the online repo, which is why you can't see the actual location on disk for the git repo.

Can you run the following:
sudo python3 -m pip list | grep peepdf and see if that returns anything? If not, you can run the following:
sudo python3 -m pip install git+https://github.com/digitalsleuth/peepdf-3.git and it will install.

As for Origami, can you open a new issue for that so we can keep the peepdf issue separate?

[geeksailor]

@digitalsleuth
sudo python3 -m pip list | grep peepdf

peepdf 1.0.6

sudo python2 -m pip list | grep peepdf

peepdf 1.0.6

Took out Py2's version. ran peepdf

bash: /usr/bin/peepdf: No such file or directory

whereis peepdf (and version versions of that command) resulted in nothing. Could the git be installing to somewhere not pathed or not adding a link to /usr/local/bin?

As for the Origami part, I'll make a post now.

[digitalsleuth]

There should have been no peepdf for Python 2, especially at version 1.0.6. Could you please run python2 -V? Did you perhaps try to install peepdf using the git url with python2 instead of python3?

The missing version is because you had two versions in there somehow. I can confirm that on a clean install, and an upgraded install, that there is no peepdf installation for python2, so I'm not sure how that happened. To fix the No such file issue, you can run:
sudo python3 -m pip install --force-reinstall git+https://github.com/digitalsleuth/peepdf-3 and that should fix the issue.

[geeksailor]

@digitalsleuth python2 -V returns >Python 2.7.18

I think I might have tried to run an install initially using python rather than python3 which installed it on Python2 rather than 3.
Running the re-install looked good to start and pulled a bunch of programs then ran into this

is the source of the following dependency conflicts.
launchpadlib 1.10.13 requires testresources, which is not installed.
chepy 5.1.0 requires pyjwt==1.7.1, but you have pyjwt 2.0.1 which is incompatible.
python-fx 0.2.0 requires pillow==9.2.0; python_version >= "3.7", but you have pillow 10.0.1 which is incompatible.
python-fx 0.2.0 requires pyyaml==6.0; python_version >= "3.6", but you have pyyaml 6.0.1 which is incompatible.
qiling 1.4.6 requires unicorn>=2.0.1, but you have unicorn 1.0.2 which is incompatible.
stix2-patterns 2.0.0 requires antlr4-python3-runtime~=4.9.0, but you have antlr4-python3-runtime 4.8 which is incompatible.
thug 5.6 requires pillow==10.0.0, but you have pillow 10.0.1 which is incompatible.
Successfully installed Pillow-10.0.1 colorama-0.4.6 editorconfig-0.12.3 jsbeautifier-1.14.9 lxml-4.9.3 peepdf-1.0.6 pylibemu-0.8 pythonaes-1.0 six-1.16.0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv

About to step out to grab some lunch then troubleshoot it after I get back to my desk

[digitalsleuth]

@geeksailor , those dependency conflicts can be safely ignored for the time being, as they do not impact the function of the installed applications. Attempting to fix those will cause some packages to break.

[geeksailor]

@digitalsleuth OK had to close out my terminals to get peepdf to be register. Tried running it on a file and told me to look at the error file (well send it to the original creator, jesparza, not you. I just got that btw that is your project). Cat the err output file and it gives me:

Traceback (most recent call last):
File "/usr/local/lib/python3.8/dist-packages/peepdf/main.py", line 553, in main
ret, pdf = pdfParser.parse(
File "/usr/local/lib/python3.8/dist-packages/peepdf/PDFCore.py", line 7681, in parse
ret = body.updateObjects()
File "/usr/local/lib/python3.8/dist-packages/peepdf/PDFCore.py", line 4571, in updateObjects
object.resolveReferences()
File "/usr/local/lib/python3.8/dist-packages/peepdf/PDFCore.py", line 3523, in resolveReferences
ret = PDFParser.readObject(objectsSection[offset:])
TypeError: readObject() missing 1 required positional argument: 'content'

Does peepdf-3 still have code referencing the original maintainer rather than your git? Because I also see references back to the original maintainer in the main.py. Either that or something didn't install properly and I have some old version on my system. If that is the case, maybe I'll try a sudo python3 -m pip uninstall peepdf then the command you recommended to do a force re-install.

EDIT: ok I found references to your branch of it in main as well so that's a good sign.

[digitalsleuth]

@geeksailor Yes I left the original creators info in there for the time being as a point of reference to the original project, but I will be updating that shortly. With regards to the errors you're receiving, you can open an Issue in the peepdf-3 Issues section of the repo and I can address that problem there.

[geeksailor]

@digitalsleuth Sounds good, I'll move this issue over to there and close this issue on here.
Thanks for the help!