Didier Stevens

If you get an error running one of my tools, first make sure you have the latest version. Many tools have a dedicated page, but even more tools have no dedicated page but a few blogposts. Check “My Software” list for the latest versions.

Most of my tools are written in Python or C.

Almost all of my Python tools are written for Python 2 and not Python 3. My PDF tools pdfid and pdf-parser are an exception: they are designed to run with Python 2 and Python 3.

If you get a syntax error running one of my Python tools, then it’s most likely that you are using Python 3 with a tool written for Python 2. Remove Python 3 and install Python 2.

Most of my tools use only build-in Python modules, you don’t need to install extra modules. Some tools that require extra modules will print a warning when you run them without the extra module installed. My tools that support Yara rules require the Yara module, but you will only get a warning for a missing Yara module if you use Yara rules.  You can use the tool without the Yara module as long as you don’t use Yara rules.

I develop my tools on Python 2. My few Python tools written for Python 2 and Python 3 are also developed on Python 2, but only tested on Python 3.

My tools written in C are developed with Borland C++ or Visual Studio 2013.

The tools compiled with Borland C++ don’t require a C runtime to be installed.

The tools compiled with Visual Studio 2013 come in several versions:

• You have 32-bit and 64-bit versions. If the filename contains x86, then it is a 32-bit tool, if the filename contains x64, then it is a 64-bit tool. 64-bit executables don’t run on 32-bit Windows.
• You have versions with the C runtime included and versions without. If the filename contains crt, then the C runtime was linked into the executable. If you get an error running executables without crt in the filename, then you are missing the C runtime on your Windows machine. Install the Visual C++ Redistributable Packages for Visual Studio 2013 (remark that there are 32-bit and 64-bit version of the C runtime).
• Versions with elev in the filename will elevate automatically when you run them.