Didier Stevens

Sunday 30 November 2025

Copy/Paste Delays In Excel Because Of Default Printer

Filed under: Networking — Didier Stevens @ 0:00

I experienced delays in Excel whenever I would copy/paste some cells, like this:

A delay of 1 to several seconds was clearly noticeable and inconvenient.

I started to review what had recently changed on my Windows computer. Turns out this was caused by a printer setting: I had recently set a default printer (a network printer), and whenever that printer was not online, I would experience the delay.

I removed that setting and no longer have the copy/paste delay.

Saturday 29 November 2025

Quickpost: CR1225 vs CR1220

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I had to replace a button cell, a CR1225, but I only had a CR1220.

So I just used that CR1220 in stead. This works, because a CR1220 and CR1225 differ in mechanical properties (dimension), but not in electrical properties (voltage).

Both cells have a nominal voltage of 3 Volts.

CR1220 means the following:

  • C: Lithium battery
  • R: Round
  • 12: 12mm diameter
  • 20: 2,0mm thickness

The difference between a CR1220 and CR1225 is the thickness: a CR1220 is 0,5mm slimmer than a CR1225. So a CR1220 fits in a CR1225 holder without problem.


Quickpost info

Friday 21 November 2025

Quickpost: Power Requirements Of A Keylogger

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I did some tests with a Keelog keylogger, the AirDrive Forensic Keylogger: I wanted to find out how much power that keylogger requires.

This is my test setup:

  1. This is the USB keyboard
  2. The USB cable of the keyboard is plugged into the USB breakout board
  3. This is the USB breakout board, allowing me to measure the voltage and current of the USB power lines
  4. This is specialized multimeter that can measure power (by measuring voltage and current simultaneously)
  5. The USB cable of the USB breakout board is plugged into a USB extension cable that is plugged into a computer

In this standby state, with all its LEDs turned of, the keyboard consumes 11 mW.

That’s not much power. Compare this with the Numlock LED turned on, and we have 4 times as much: 47 mW:

And here I have the keylogger plugged in (between the keyboard and the USB breakout board):

Now the total power measured is 383 mW: that’s for the keyboard (with LEDs turned off) and the keylogger.

That’s a huge difference with 11 mW for a keyboard without keylogger.

If this keylogger would be hidden into the keyboard, it would be easily detected using this measurement method, because this particular keyboard requires 30+ times less power than the keylogger itself.


Quickpost info

Saturday 15 November 2025

Update: numbers-to-hex.py Version 0.0.4

Filed under: My Software,Update — Didier Stevens @ 10:13

This update add option -e to handle binary numeric expressions like 79+1.

numbers-to-hex_V0_0_4.zip (http)
MD5: 8CD22E998E84F80D1FD92504B3D3A559
SHA256: 6963ED3F013D9C6E70ACA95DA00399B0F95DD279597EABE5BA1EC51E0B28DD4D

Monday 3 November 2025

Update: cs-parse-traffic.py Version 0.0.6

Filed under: My Software,Update — Didier Stevens @ 11:28

This is a bugfix version.

cs-parse-traffic_V0_0_6.zip (http)
MD5: AED53E99D7BFF14EC45F573663A91780
SHA256: C73614FD69660C4D0E851414D86091E9E90DE9A92D58F9E6AC71D76B4A6EC638

Saturday 1 November 2025

Overview of Content Published in October

Filed under: Announcement — Didier Stevens @ 7:38
Here is an overview of content I published in October:

Blog posts: SANS ISC Diary entries:

Blog at WordPress.com.