The main functionalities of peepdf are the following:

Analysis

• Decodings: hexadecimal, octal, name objects
• More used filters
• References in objects and where an object is referenced
• Strings search (including streams)
• Physical structure (offsets)
• Logical tree structure
• Metadata
• Modifications between versions (changelog)
• Compressed objects (object streams)
• Analysis and modification of Javascript (Spidermonkey): unescape, replace, join
• Shellcode analysis (sctest wrapper, Libemu)
• Variables (set command)
• Extraction of old versions of the document

Creation / Modification

• Basic PDF creation
• Creation of PDF with Javascript executed wen the document is opened
• Creation of object streams to compress objects
• Embedded PDFs
• Strings and names obfuscation
• Malformed PDF output: without endobj, garbage in the header, bad header...
• Filters modification
• Objects modification

The available commands in this first version, related to the previous functionalities, are shown in the following image:

PPDF> help

Documented commands (type help <topic>):
========================================
bytes           encrypt  js_analyse        modify     references    set  
changelog       errors   js_code           object     replace       show 
create          exit     js_join           offsets    reset         stream
decode          filters  js_unescape       open       save          tree 
embed           help     log               quit       save_version
encode          info     malformed_output  rawobject  sctest     
encode_strings  js       metadata          rawstream  search 

./peepdf.py -s command_file.txt sample.pdf

If we only want to know the information about objects, streams, vulnerabilities, etc, without executing any commands the correct way of execution would be the following:

./peepdf.py sample.pdf

In all these types of execution it's possible to specify some parameters to ignore errors and continue with the analysis and deal with malformed objects:

• -f: ignores errors and continues with the analysis of the document. It's useful to analyse malicious documents.
• -l: does not search for the endobj tag during the parsing process, so it can be useful when the analysed document is malformed.

I will publish some analysis of malicious PDF files with peepdf to show how to use it. Meanwhile, if you are interested you can take a look to the webpage of the tool. All comments and bugs are welcomed! ;)