Fix URL preservation in obfuscation and add test results

- Fix obfuscation to only encode URLs in /URI actions, not FileSpec /F
  entries (which need literal URLs for network requests)
- Add obfuscation test results to README showing all levels work
  against both Acrobat DC and vulnerable PDF.js

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jonaslejon

README.md

@@ -138,6 +138,26 @@ Only the **Thread action** (test31) produced a callback on the latest Adobe Acro
 
 PDF.js v5.6.205 blocks all callback vectors. The CVE-2024-4367 FontMatrix injection (test29) is patched since v4.2.67.
 
+### Obfuscation Levels vs Adobe Acrobat DC v26.001.21367 — test31 (Thread action)
+
+| Level | Techniques Applied | Callback? |
+|-------|--------------------|-----------|
+| 0 | None | **YES** |
+| 1 | PDF name hex encoding + string octal/hex | **YES** |
+| 2 | + JS bracket notation + javascript: URI case variation | **YES** |
+| 3 | + FlateDecode stream compression | **YES** |
+
+### Obfuscation Levels vs PDF.js v4.1.392 (vulnerable) — test29 (CVE-2024-4367)
+
+| Level | Techniques Applied | Callback? |
+|-------|--------------------|-----------|
+| 0 | None | **YES** |
+| 1 | PDF name hex encoding + string octal/hex | **YES** |
+| 2 | + JS bracket notation + javascript: URI case variation | **YES** |
+| 3 | + FlateDecode stream compression | **YES** |
+
+All obfuscation levels produce callbacks on both viewers. The obfuscation only changes the PDF structural layer (name tokens, string encoding, stream compression) without affecting the actual exploit payloads.
+
 ## Todo / Won't implement
 - ~~CVE-2023-26369 - Adobe Acrobat TTF font heap OOB write~~ — Requires binary exploitation (heap spray, ROP chains, shellcode). No public PoC. Cannot produce a simple callback.
 - ~~CVE-2021-28550 - Adobe Acrobat Use-After-Free~~ — Requires binary exploitation chain + sandbox escape (CVE-2021-31199/31201). No public PoC. Cannot produce a simple callback.

malicious-pdf.py

@@ -215,17 +215,17 @@ def _obf_js_content(m):
         data = re.sub(rb'/JS\s*\(', lambda m: _name_to_hex(b'/JS') + b' (', data)
         data = re.sub(rb'/AA\s*<', lambda m: _name_to_hex(b'/AA') + b' <', data)
 
-        # Obfuscate URL strings - find (http...) and (\\...) patterns
-        # Convert ~50% of literal strings containing URLs to hex strings
+        # Obfuscate URL strings in /URI actions only (not FileSpec /F which needs literal URLs)
+        # FileSpec URLs must stay literal for the viewer to make network requests
         def _maybe_hex_string(m):
             if random.random() < 0.5:
                 return _string_to_hex(m)
             return _string_to_octal(m)
 
-        # Match strings containing http/https URLs (but not JS code which has nested parens)
+        # Only match URLs in /URI context (not preceded by /F or /FileSpec)
         data = re.sub(
-            rb'\((https?://[^()]*)\)',
-            _maybe_hex_string,
+            rb'(/URI\s*)\((https?://[^()]*)\)',
+            lambda m: m.group(1) + _maybe_hex_string(re.match(rb'\((.*)\)', b'(' + m.group(2) + b')')),
             data
         )