Didier Stevens

Saturday 31 October 2026

Quickpost: Ghost USB-C

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

You’ve probably encountered devices that are powered via a USB-C connector, but that don’t work when you connect them to a USB-C charger or powerbank. They only work with a USB-A to USB-C cable, not with a USB-C to USB-C cable.

I used to encounter such devices regularly a couple of years ago, but far less nowadays. Until we went on holiday this summer, and my wife used a small portable fan. She connected it to her USB-C charger, and it didn’t work. So I fixed this with a USB-A to USB-C cable plugged into a charger with USB-A connector.

But this got me thinking: surely, there must be a small USB-C adapter that solves this problem? The problem occurs because in the USB-C standard, a power source doesn’t put 5 Volts on VBUS, until it detects there is a device connected that requires power. It detects the presence of such a device because of current flowing between the CC pins and GND. This happens because the device has resistors between the CC lines and GND. And some devices, like this fan, lack these resistors, and thus no power is present on VBUS. While with USB-A, there is always power on VBUS, whether a device is connected or not.

I did find such an adapter:

I has a female and male USB-C connector, and it contains two 5.1 kΩ resistors, one between line CC1 and GND, and the other between line CC2 and GND. This instructs the power source to deliver 5V between the VBUS lines and GND.

The result is that with this adapter, I can power these non-compliant devices with a classic USB-C power source and a classic USB-C cable.

With USB-A, it is clear from the difference in physical connectors, which device is a power source and which device is a power sink. With USB-C, that physical difference is gone. Both connectors on a USB-C cable are physically identical. Furthermore, with USB-C, the same device can adopt the role of a power source or the role of a power sink. For example, a laptop can be charged via its USB-C port (power sink role), and the same laptop can charge your phone via the same USB-C port (not simultaneously, of course). That’s the power source role.

Thus, with USB-C, a device must announce that it requires power before it receives power from a device that can act as a power source. And this fan doesn’t do this.

Be sure to only use this adapter between a power source and a power sink that is not compliant. If you would use this adapter to connect two power sources together, both power sources would energize the VBUS lines and one of the power sources would start to sink power. Power sources are not designed to sink power. Although this adapter turns a non-compliant device into a compliant device, the adapter itself is non-compliant.


Quickpost info

Friday 30 October 2026

“A Ring Tone That I Cannot Hear” – Twenty Years Later

Filed under: Uncategorized — Didier Stevens @ 13:50

My first post for this blog was in June 2006, 20 years ago: A Ring Tone That I Cannot Hear.

Back then, I tested my hearing with Audacity, and I could hear a tone up to 14 kHz.

20 years later, I do the test again, and I can hear a tone up to 8 kHz.

It’s no surprise that my hearing declined over the years, that happens to everybody.

What did surprise me, or better said, what impressed me, is that a free and open-source tool like Audacity still exists after 20 years, and that I can just issue the exact same commands as 20 years ago!

Wednesday 28 October 2026

Quickpost: Uranium Glass

Filed under: Hardware — Didier Stevens @ 17:03

I got the opportunity to measure the radiation emitted by uranium glass. Uranium glass is glass with uranium added to the glass mix for coloration.

My Bosean FS-5000 meter did not detect any radiation from the uranium glass. The counts per second (CPS) value was around the same on the uranium glass and away from it.

I know it is proper uranium glass (bought at a flea market), because it glows green under ultraviolet light.

My meter uses a Geiger–Müller tube, so the tube must not be sensitive enough to detect the radiation from the uranium glass.

I also have another meter to measure radiation, a Radiacode 103 meter. It looks like this:

It reads out a spot value of 9,57 CPS in the above picture: this is the amount of background radiation in that location, since no radioactive sources were nearby.

And here is my Radiacode 103 meter inside a glass made out of uranium glass:

The CPS value is 13,5, that’s noticeably higher than the background value of 9,57. Thus the glass is emitting some radiation that this meter is picking up. Strictly speaking, that doesn’t prove it’s uranium glass, because it could be another element that is the source of radiation.

But this meter is not only more sensitive, it can also differentiate between sources of radiation.

When my Bosean and my Radiacode meters give me a CPS value, for example 10, it means that they detected 10 ionization events per second (average). An ionization event is caused by ionization radiation: a ray or a particle.

My Bosean meter uses a Geiger–Müller tube, and such a tube can only measure the presence of ionization events. It can not measure the energy of the radiation or particle. It’s a binary measure.

While my Radiacode meter uses a scintillation crystal to measure ionization events. This crystal does not only detect ionization events (like a GM tube does), but it also measures the energy of the ionizing radiation that caused the ionization events. This amount of energy can be expressed in Joules, but since the values are so small, this amount is typically expressed in keV (kiloelectonvolt).

The Radiacode meter comes with an app that can display a chart like this one:

What you see here are CPS values set out per keV values. I let my meter run for 3 hours (3:02:21 exactly, see top-right corner of the image) while it was sitting inside the glass. For every ionization event, it measures the energy and builds a table of CPS per energy level. On the vertical axis, you have CPS, and on the horizontal axis, you have energy (keV). You can see a couple of peaks in this spectrum. The app has a library of spectra, and you can match that with your spectrum. That’s what I did here: the vertical purple lines come from a spectrum out of the library that I selected, and that is typical for Uranium (see top of image). The first 3 lines match a peak, the last 2 lines don’t match a peak.

Here is the info displayed by the app for the Uranium chain spectrum:

With the Radiacode meter, when I perform measurements over a long period, I can build up a spectrum of the energy of the ionizing radiations emitted by the sample, and then I can compare that with the app’s library, and when I have a good match, I have identified the element with a good probability.

This glass that I was able to test has a very high probability of being uranium glass: it has the appearance of uranium glass, it glows under UV light, it emits radiation and its radiation spectrum matches the uranium chain spectrum.

For reference, here is a spectrum of background radiation:

In the EU, uranium glass can be bought and sold freely (for example at flea markets). It contains radioactive material, but it is exempt from radiation regulations.


Quickpost info

Monday 12 October 2026

Update: onedump.py Version 0.0.3

Filed under: My Software,Update — Didier Stevens @ 15:48

I releasing a new version of my beta tool onedump.py to list files embedded inside OneNote files (.one). I had to extract all the embedded files out of a set of .one files. This update adds option –jsonoutput that helps with this problem.

Running command “onedump.py –jsonoutput *.one” will create a JSON document containing all embedded files inside all *.one files. I can then write these files to disk with my myjson-filter.py tool, like this:

onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir

Thursday 1 October 2026

Overview of Content Published in September

Filed under: Announcement — Didier Stevens @ 18:45
Here is an overview of content I published in September:

Blog posts:
SANS ISC Diary entries:

Wednesday 30 September 2026

Update: search-for-compression.py Version 0.0.8

Filed under: My Software,Update — Didier Stevens @ 7:33

I’ve noticed when a zlib compressed chunk of data is followed by other data, search-for-compression.py will not always be able to detect the compressed chunk. This is caused by the fact that the other data generates a decompression error, and the complete chunk is disregarded.

I’ve added a new option to try to solve this: -S

Option -S takes a value, a positive number. It’s the size of the decompression buffer. By default, its value is 0.

When you try -S 100 for example, search-for-compression.py will try to decompress up to 100 bytes. If that succeeds, then we assume that we found compressed data, and search-for-compression.py will try to decompress the remainder of the data until either a decompression error occurs, or there is no more data. But when an error occurs, search-for-compression.py will revert to the last decompression without error, and report that.

search-for-compression.py is still in my beta repository.

Tuesday 1 September 2026

Overview of Content Published in August

Filed under: Announcement — Didier Stevens @ 8:33
Here is an overview of content I published in August:

Blog posts:
SANS ISC Diary entries:

Sunday 23 August 2026

Update: base64dump.py Version 0.0.31

Filed under: My Software,Update — Didier Stevens @ 17:44

More info on this update: “zipdump.py: Metadata Encoding“.

base64dump_V0_0_31.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

Saturday 1 August 2026

Overview of Content Published in July

Filed under: Uncategorized — Didier Stevens @ 10:44
Here is an overview of content I published in July:

SANS ISC Diary entries:

Wednesday 1 July 2026

Overview of Content Published in June

Filed under: Announcement — Didier Stevens @ 9:04
Here is an overview of content I published in June:

Blog posts:
SANS ISC Diary entries:

Next Page »

Blog at WordPress.com.