In this update, I add option -W to write items to disk.
Option -W takes a value. Possible values are: vir, hash, hashvir and idvir.
This value determines the filename for each item written to disk.
vir: filename is item name + extension vir
hash: filename is sha256 hash
hashvir: filename is sha256 hash + extension vir
idvir: filename is item id + extension vir
For an example, take a look at my SANS ISC diary entry “Extracting Multiple Streams From OLE Files“.
myjson-filter_V0_0_4.zip (http)MD5: 7CFB64BDE6A60DB44EBEA18DD4B966D3
SHA256: B8128DC14DC7235710AB4DF9B0B2A55C43FA2035140D5CBCDC09D9079AB6D6DA
Didier Stevens 
Leave a Reply (comments are moderated)