Didier Stevens

Wednesday 28 September 2022

Update: rtfdump.py Version 0.0.11

Filed under: My Software,Update — Didier Stevens @ 21:40

This new version of rtfdump, my tool to analyze RTF files, brings json output for options -O and -F.

rtfdump_V0_0_11.zip (http)
MD5: AFC884082B251BF288B05203DD5D4F69
SHA256: CB3984924137897F75E62C3A835BB9197CBF1DDBD6BCFB3E18423999B06A36C8

Sunday 25 September 2022

Taking A Look At PNG Files with pngdump.py Beta Version 0.0.3

Filed under: Beta,My Software,Update — Didier Stevens @ 20:10

Here’s a new beta version of my tool pngdump.py, a tool to analyze PNG files.

I took a look at all files on MalwareBazaar with a PNG tag, and made updates to pngdump.py to handle them.

I found 3 types of “PNG” files.

First, files spoofing PNG files: files that are not PNG files, but have a .png extension.

Like .exe and .rar files:

Second, valid PNG files with an appended payload:

Third, invalid PNG files. For example, PNG files with the right record structure, but where the Zlib compressed image is replaced by an RC4 encrypted payload (IcedID):

I also have other samples, but that’s for another blog post.

Beta version 0.0.3 is available on GitHub.

Thursday 22 September 2022

Quickpost: Tuning The Electric Energy Consumption Of My TV

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

TLDR: reducing the sound volume level of our TV has no (significant) impact on its electric energy consumption, but reducing the back-lighting does.

Here in Belgium, mainstream media is full of news with tips to reduce energy consumption.

Some good tips, some bad tips … That’s mainstream media for you 🙂

Recently, there was an article with the following tip: “reduce the sound volume level of your TV to save energy” … (I’m not linking to this article).

It is true that a speaker (and the audio amplifier) requires power. And that there is a positive correlation between electric energy consumption and sound volume level. Large speakers can draw quite some amps…

But I was a little doubtful that lowering the sound volume level of our TV with a view clicks, would have a significant/measurable impact. Because some time ago, I already made measurements, and our TV drew 120 Watt maximum. So I did not expect a big impact.

Anyways, one has to make measurements to know if there is a (significant) impact or not.

We have a 55 inch QLED Samsung TV from 2018. The test protocol I worked out is the following: start to play a long movie (LoTR) and measure the electric energy consumption during one hour exactly (with a GW Instek GPM-8310 digital power meter). Don’t touch the TV or remote while testing is going on, and make sure that no dynamic settings are enabled that can influence the electric energy consumption (like ambient light based brightness control).

I measured at 3 sound volume levels: 20, 19 and muted. And I did this twice.

Here are the results:

Sound levelElectric energy consumption (Wh)
0 (muted)117,66

For our TV, there’s no difference between a sound volume level of 20 and 19.

And by completely muting the TV, we save 0,08 Watts. That’s a very small amount. To put that in perspective, we would have to watch 125 hours of muted TV to power a 10 Watt LED light-bulb for 1 hour.

Of course, that’s for our TV. If you have a TV with a powerful soundbar and extra speakers, your measurements will be totally different.

While going through all the settings of our TV, there is one thing I noticed: the back-lighting setting was set to its maximum (20).

I reduced the back-lighting to 10 and measured again. That made a significant change: 77,666 Wh in stead of 117,74 Wh (both at sound volume level 20, our usual setting). That’s a 34% reduction in electric energy consumption. That’s a significant reduction, but …, don’t forget that the back-lighting setting happened to be at its maximum.

We will keep it like that for the moment, and see if we still enjoy watching TV.

Quickpost info

Tuesday 20 September 2022

Update: My Python Templates Version 0.0.8

Filed under: My Software,Update — Didier Stevens @ 0:00

This update adds the option –trim to template process-text-files.py.

python-templates_V0_0_8.zip (http)
MD5: 6C845823BB8AC4DB42993B994E93AF66
SHA256: 20EC1E6540DF31939686CA4B54C5312DF3724EB756B16BA724722C3196BDF93F

Monday 19 September 2022

Update: strings.py Version 0.0.8

Filed under: My Software,Update — Didier Stevens @ 0:00

This version of my strings.py program adds option -N to select strings that end with a NUL character (C-strings).

strings_V0_0_8.zip (http)
MD5: 29015239E6385FFA63C2E33755C34CD9
SHA256: 449AC9AA39A464D7C5883DED3FE9CB21A2E8E700F7763AD4199C25D37DCBD296

Sunday 18 September 2022

New Tool: split-overlap.py

Filed under: Announcement,My Software — Didier Stevens @ 12:19

split-overlap.py is a tool to split a binary file in parts of a given size.

For example: split-overlap.py 1000 test.data

When test.data is a binary file with size 2500 bytes, the above command will create 2 files of 1000 bytes and one file of 500 bytes.

It’s also possible to split a file with some overlap. Like this:

The blue block represents the original file, the yellow blocks are parts of the original file without overlap, and the green blocks represent parts of the original file with some overlap.

A command to achieve this, is, for example: split-overlap.py 100M+1M dump

This will create parts of 101 MB in size, with a overlap of 1 MB.

The main reason I developed this tool, is to be able to handle very large files, like memory dumps, by tools who can not handle such large files.

Splitting up a file in smaller, equal parts is a solution, but then you run the risk (a small risk) that the pattern you are looking for, is just at the “edge”: that the file is split in such a way, that one part contains the beginning of the pattern, and the next part contains the rest of the pattern. Then your tools are unlikely to find the pattern.

I solve this with my tool by using an overlap. You just have to make sure that the size of the overlap, is larger than the pattern you are looking for.

If you want to know more, read the man page: split-overlap.py -m

split-overlap_V0_0_1.zip (http)
MD5: 77CFF0787244B3B940B07D099C26C3F1
SHA256: 3C246F35F612A43B83843F327AB4EA4EE2CADDBCEDEAD9C50540228DAB17025A

Thursday 15 September 2022

Update: virustotal-search.py Version 0.1.7

Filed under: My Software,Update — Didier Stevens @ 7:41

A new option was added to limit the amount of requests: -l (–limitrequests).

virustotal-search_V0_1_7.zip (http)
SHA256: AEFEB5761A5BBEE998FA20A68213316522C7554796F47EB8C7EB2A5DF1D4E73D

Wednesday 14 September 2022

Quickpost: An Inefficient Powerbank

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I tested a small powerbank that I have, and it’s very inefficient.

It takes 10.07 Wh to charge:

And it delivers 5.95 Wh when I discharge it (5V at 0.250 mA).

So I only got 59% back of the energy I put in.

This powerbank is quite old, it might have become so inefficient over the years. Google searches tell me that you should get at least 85% efficiency.

Although this powerbank still works fine, and his very handy to me because of its small form factor, I’ll see if I can get a more efficient one with a similar form factor.

Quickpost info

Tuesday 13 September 2022

Quickpost: “Exploding Multimeter”

Filed under: Hardware,Quickpost — Didier Stevens @ 12:22

I made a mistake and destroyed my old multimeter.

It’s a 30+ year old multimeter, and it had become very dirty because of all the dust it collected while I used it in a home renovation project, years ago. It was still functional, so I used it for years like that.

But recently, after discovering YouTube “restoration videos”, I got the idea to open it up and clean it.

The result was very good. Until I used it the first time to measure a 230V cable. Then there was a big flash inside the casing, and all the lights went out.

This is how it looks now (notice the black soot marks on the orange plastic):

And the burned diodes:

What went wrong? The meter also has aluminum foil to shield the electronics:

And I was not careful enough when I put it back, and it shorted the 2 connectors:

Quickpost info

Saturday 10 September 2022

Maldoc Analysis Video – Rehearsed & Unrehearsed

Filed under: maldoc,Malware,My Software,video — Didier Stevens @ 21:41

When I record maldoc analysis videos, I have already analyzed the maldoc prior to recording, and I rehearse the recording.

This time, I also recorded the unrehearsed analysis: when I take the first look at a maldoc I’ve not seen before.

All in this video:

Next Page »

Blog at WordPress.com.