In this version, I’ve changed the output for “level 0”. Level 0 is actually the remainder, e.g. what comes after the last balanced curly brace. In a normal RTF document, there should be no remainder.
rtfdump_V0_0_7.zip (https)
MD5: 59F86BA57D67CB78B9D863AFEA710709
SHA256: 1A8EDD4F73F020F44B0AAB39FC3A1C313C81BF8A1E031A76D8B8C85E34116DD6
[…] Update: rtfdump.py Version 0.0.7 […]
Pingback by Overview of Content Published In January | Didier Stevens — Thursday 1 February 2018 @ 0:00
[…] rtfdump.py, oledump.py, format-bytes.py, […]
Pingback by Dissecting a CVE-2017-11882 Exploit – Didier Stevens Videos — Monday 31 December 2018 @ 17:22