Didier Stevens

Wednesday 28 October 2026

Quickpost: Uranium Glass

Filed under: Hardware — Didier Stevens @ 17:03

I got the opportunity to measure the radiation emitted by uranium glass. Uranium glass is glass with uranium added to the glass mix for coloration.

My Bosean FS-5000 meter did not detect any radiation from the uranium glass. The counts per second (CPS) value was around the same on the uranium glass and away from it.

I know it is proper uranium glass (bought at a flea market), because it glows green under ultraviolet light.

My meter uses a Geiger–Müller tube, so the tube must not be sensitive enough to detect the radiation from the uranium glass.

I also have another meter to measure radiation, a Radiacode 103 meter. It looks like this:

It reads out a spot value of 9,57 CPS in the above picture: this is the amount of background radiation in that location, since no radioactive sources were nearby.

And here is my Radiacode 103 meter inside a glass made out of uranium glass:

The CPS value is 13,5, that’s noticeably higher than the background value of 9,57. Thus the glass is emitting some radiation that this meter is picking up. Strictly speaking, that doesn’t prove it’s uranium glass, because it could be another element that is the source of radiation.

But this meter is not only more sensitive, it can also differentiate between sources of radiation.

When my Bosean and my Radiacode meters give me a CPS value, for example 10, it means that they detected 10 ionization events per second (average). An ionization event is caused by ionization radiation: a ray or a particle.

My Bosean meter uses a Geiger–Müller tube, and such a tube can only measure the presence of ionization events. It can not measure the energy of the radiation or particle. It’s a binary measure.

While my Radiacode meter uses a scintillation crystal to measure ionization events. This crystal does not only detect ionization events (like a GM tube does), but it also measures the energy of the ionizing radiation that caused the ionization events. This amount of energy can be expressed in Joules, but since the values are so small, this amount is typically expressed in keV (kiloelectonvolt).

The Radiacode meter comes with an app that can display a chart like this one:

What you see here are CPS values set out per keV values. I let my meter run for 3 hours (3:02:21 exactly, see top-right corner of the image) while it was sitting inside the glass. For every ionization event, it measures the energy and builds a table of CPS per energy level. On the vertical axis, you have CPS, and on the horizontal axis, you have energy (keV). You can see a couple of peaks in this spectrum. The app has a library of spectra, and you can match that with your spectrum. That’s what I did here: the vertical purple lines come from a spectrum out of the library that I selected, and that is typical for Uranium (see top of image). The first 3 lines match a peak, the last 2 lines don’t match a peak.

Here is the info displayed by the app for the Uranium chain spectrum:

With the Radiacode meter, when I perform measurements over a long period, I can build up a spectrum of the energy of the ionizing radiations emitted by the sample, and then I can compare that with the app’s library, and when I have a good match, I have identified the element with a good probability.

This glass that I was able to test has a very high probability of being uranium glass: it has the appearance of uranium glass, it glows under UV light, it emits radiation and its radiation spectrum matches the uranium chain spectrum.

For reference, here is a spectrum of background radiation:

In the EU, uranium glass can be bought and sold freely (for example at flea markets). It contains radioactive material, but it is exempt from radiation regulations.


Quickpost info

Monday 12 October 2026

Update: onedump.py Version 0.0.3

Filed under: My Software,Update — Didier Stevens @ 15:48

I releasing a new version of my beta tool onedump.py to list files embedded inside OneNote files (.one). I had to extract all the embedded files out of a set of .one files. This update adds option –jsonoutput that helps with this problem.

Running command “onedump.py –jsonoutput *.one” will create a JSON document containing all embedded files inside all *.one files. I can then write these files to disk with my myjson-filter.py tool, like this:

onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir

Thursday 1 October 2026

Overview of Content Published in September

Filed under: Announcement — Didier Stevens @ 18:45
Here is an overview of content I published in September:

Blog posts:
SANS ISC Diary entries:

Wednesday 30 September 2026

Update: search-for-compression.py Version 0.0.8

Filed under: My Software,Update — Didier Stevens @ 7:33

I’ve noticed when a zlib compressed chunk of data is followed by other data, search-for-compression.py will not always be able to detect the compressed chunk. This is caused by the fact that the other data generates a decompression error, and the complete chunk is disregarded.

I’ve added a new option to try to solve this: -S

Option -S takes a value, a positive number. It’s the size of the decompression buffer. By default, its value is 0.

When you try -S 100 for example, search-for-compression.py will try to decompress up to 100 bytes. If that succeeds, then we assume that we found compressed data, and search-for-compression.py will try to decompress the remainder of the data until either a decompression error occurs, or there is no more data. But when an error occurs, search-for-compression.py will revert to the last decompression without error, and report that.

search-for-compression.py is still in my beta repository.

Tuesday 1 September 2026

Overview of Content Published in August

Filed under: Announcement — Didier Stevens @ 8:33
Here is an overview of content I published in August:

Blog posts:
SANS ISC Diary entries:

Sunday 23 August 2026

Update: base64dump.py Version 0.0.31

Filed under: My Software,Update — Didier Stevens @ 17:44

More info on this update: “zipdump.py: Metadata Encoding“.

base64dump_V0_0_31.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

Saturday 1 August 2026

Overview of Content Published in July

Filed under: Uncategorized — Didier Stevens @ 10:44
Here is an overview of content I published in July:

SANS ISC Diary entries:

Wednesday 1 July 2026

Overview of Content Published in June

Filed under: Announcement — Didier Stevens @ 9:04
Here is an overview of content I published in June:

Blog posts:
SANS ISC Diary entries:

Tuesday 30 June 2026

Update: base64dump.py Version 0.0.30

Filed under: My Software,Update — Didier Stevens @ 19:12

This new version adds option –stats. For more details, take a look at SANS Internet Storm Center diary entry “Evil MSI Background: BASE64 Statistical Analysis“.

base64dump_V0_0_30.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

Monday 1 June 2026

Overview of Content Published in May

Filed under: Announcement,Uncategorized — Didier Stevens @ 7:33
Here is an overview of content I published in May:

Blog posts:
SANS ISC Diary entries:

Next Page »

Blog at WordPress.com.