Didier Stevens

Thursday 18 September 2014

FileScanner.exe Part 4

Filed under: My Software — Didier Stevens @ 0:00

Please read part 1, part 2 and part 3 for more info.

A few remarks for people having issues running my program.

Folder Release contains a 32-bit executable that requires the Visual C++ Redistributable Packages for Visual Studio 2013.

Folder Release CRT contains a 32-bit executable with embedded C runtime, it does not require the redistributable.

Folder x64 contains 64-bit executables.

I included a rule file as example, filescanner-analysis-01.txt:

#Comment
exhaustive
PK:start:str=PK
$META:icontent:str=MANIFEST.MF
JAR:and:PK $META
CLASS:start:CAFEBABE
MZ:start:4D5A
PDF:start:str=%PDF-
OLE:start:D0CF11E0
RAR:start:526172211A07
$ATTRIBUT:content:00417474726962757400
OLE-VBA:and:OLE $ATTRIBUT
CAB:start:str=MSCF
ARJ:start:EA60
JFIF:start:FFD8FFE0

FileScanner_V0_0_0_3.zip (https)
MD5: D9A7BA5874C10B10BF380D03E49C82A6
SHA256: C89FF7DBDB71A22E2A88C16ECD65E36619BD8EA39A77036404B6F4B1049D21E5

7 Comments »

  1. Please replace character ‘;’ with ‘,’ in output csv file.

    Comment by Yogesh — Friday 19 September 2014 @ 13:07

  2. @Yogesh What problem are you experiencing with the csv output?

    Comment by Didier Stevens — Friday 19 September 2014 @ 13:11

  3. All columns data get stored in single column(first column). If i replace character ‘;’ with ‘,’,then everything fine

    Comment by Yogesh — Monday 22 September 2014 @ 7:28

  4. @Yogesh What are you using to do this? Are you using Excel?

    Comment by Didier Stevens — Monday 22 September 2014 @ 22:23

  5. Yes, I am using kingsoft office suit.

    Comment by Yogesh — Wednesday 1 October 2014 @ 1:58

  6. @Yogesh Then I suggest you take a look at my InteractiveSieve: https://blog.didierstevens.com/2012/08/29/update-interactivesieve-0-7-6/

    Comment by Didier Stevens — Friday 3 October 2014 @ 16:46

  7. […] released this new version of FileScanner at the end of 2015, but forgot to announce it here on my […]

    Pingback by Update: FileScanner Version 0.0.0.4 | Didier Stevens — Sunday 29 January 2017 @ 0:00


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Blog at WordPress.com.

%d bloggers like this: