Didier Stevens

Thursday 15 September 2022

Update: virustotal-search.py Version 0.1.7

Filed under: My Software,Update — Didier Stevens @ 7:41

A new option was added to limit the amount of requests: -l (–limitrequests).

virustotal-search_V0_1_7.zip (http)
MD5: BB6E9D480F7BCF0FD3F0CB8EED1B49FE
SHA256: AEFEB5761A5BBEE998FA20A68213316522C7554796F47EB8C7EB2A5DF1D4E73D

Wednesday 14 September 2022

Quickpost: An Inefficient Powerbank

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I tested a small powerbank that I have, and it’s very inefficient.

It takes 10.07 Wh to charge:

And it delivers 5.95 Wh when I discharge it (5V at 0.250 mA).

So I only got 59% back of the energy I put in.

This powerbank is quite old, it might have become so inefficient over the years. Google searches tell me that you should get at least 85% efficiency.

Although this powerbank still works fine, and his very handy to me because of its small form factor, I’ll see if I can get a more efficient one with a similar form factor.


Quickpost info

Tuesday 13 September 2022

Quickpost: “Exploding Multimeter”

Filed under: Hardware,Quickpost — Didier Stevens @ 12:22

I made a mistake and destroyed my old multimeter.

It’s a 30+ year old multimeter, and it had become very dirty because of all the dust it collected while I used it in a home renovation project, years ago. It was still functional, so I used it for years like that.

But recently, after discovering YouTube “restoration videos”, I got the idea to open it up and clean it.

The result was very good. Until I used it the first time to measure a 230V cable. Then there was a big flash inside the casing, and all the lights went out.

This is how it looks now (notice the black soot marks on the orange plastic):

And the burned diodes:

What went wrong? The meter also has aluminum foil to shield the electronics:

And I was not careful enough when I put it back, and it shorted the 2 connectors:


Quickpost info

Saturday 10 September 2022

Maldoc Analysis Video – Rehearsed & Unrehearsed

Filed under: maldoc,Malware,My Software,video — Didier Stevens @ 21:41

When I record maldoc analysis videos, I have already analyzed the maldoc prior to recording, and I rehearse the recording.

This time, I also recorded the unrehearsed analysis: when I take the first look at a maldoc I’ve not seen before.

All in this video:

Friday 9 September 2022

Quickpost: Dolmen du roc de l’Arca

Filed under: Quickpost — Didier Stevens @ 0:00

While on holiday in Feilluns (France, Pyrénées-Orientales) in September 2021, I did search several dolmens.

While the dolmen Caouno del Moro is easy to find (it is right next to a road, just follow the signs starting in the village), the nearby dolmen du roc de l’Arca is not so easy to find, as there are no signs and it’s on the top of a wooded hill.

Dolmen du roc de l’Arca:

Map:

Drone picture:

Video: walking from dolmen Caouno del Moro to dolmen du roc de l’Arca.

Video: drone view of dolmen du roc de l’Arca.


Quickpost info

Thursday 8 September 2022

Quickpost: Sun Drying Biodegradable Waste

Filed under: Quickpost — Didier Stevens @ 0:00

As biodegradable waste contains a lot of water, I was wondering how much mass reduction I can achieve by exposing it to the sun (by evaporating some of the contained water).

On a sunny day in March (Belgium), I weighed these fruit peels (I had just consumed the fruit):

66 grams

Exposing it to sun & air:

After 7 hours, 24 grams left:

So we lost 42 grams, almost 2/3 of the original mass.

For those of you having to pay for their household biodegradable waste processing by the kilo, it might be something to look into.

I’ll have to figure out if this is something practical & that scales easily, or not.


Quickpost info

Wednesday 7 September 2022

Update: hex-to-bin.py Version 0.0.6

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a small update: when non-hexadecimal characters are found, they are listed before an exception is raised.

hex-to-bin_V0_0_6.zip (http)
MD5: 9939263DCF538BBF5FC98DB2EC83F247
SHA256: 94B2B23BCA5C000CA85EEE8AE1A16AEEDB77E72057111C8207A683BD4DDF4581

Tuesday 6 September 2022

Update: xor-kpa.py Version 0.0.6

Filed under: Encryption,My Software,Update — Didier Stevens @ 0:00

This is an update for my tool to perform XOR known plaintext attacks: xor-kpa.py.

The tool has been updated for Python 3, and 3 new plaintext have been added, all for Cobalt Strike configurations.

cs-key is the header of the configuration entry for the public key.

cs-key-dot is the header of the configuration entry for the public key XORed with value 0x2E (a dot).

cs-key-i is the header of the configuration entry for the public key XORed with value 0x69 (letter i).

xor-kpa_V0_0_6.zip (http)
MD5: 4BA5EDEAEF6C8D528227607E78A2A797
SHA256: F7BE170D09E8B8A5B4127F64EC66FFF69EFD3EFA3B4EAC0304B39905A75CDE2A

Monday 5 September 2022

Update: translate.py Version 2.5.12

Filed under: My Software,Update — Didier Stevens @ 15:50

A small update for my translate.py program.

Python function Xor takes now 2 extra, optional arguments:

hexadecimal: a boolean, by default False.

When True, the key is provided as an hexadecimal string.

rotation: an integer, by default 0

This is the number of bytes to rotate the key to the left. For example, when the key is ABCD, a rotation value of 1 yiels key BCDA.

translate_v2_5_12.zip (http)
MD5: 4B0C79AF8A1D41BA735C5030912E6C28
SHA256: 899109A9D787D6781AEB0569330A01709063BB3FD58F4AED068A57951B230F88

Sunday 4 September 2022

Update: oledump.py Version 0.0.70

Filed under: maldoc,My Software,Update,video — Didier Stevens @ 15:38

This is an update to plugin plugin_vba_dco.py, improving generalization and adding option -p.

You can watch this maldoc analysis video to learn how to use the generalization feature of this plugin:

oledump_V0_0_70.zip (http)
MD5: D6EC4FD6B7BE60E01A98922BC06A1E8F
SHA256: E9EE79501A08E896A601F1AFDDB6D3C05D9A2A1FD5899D44AC422DD79E4EF678
« Previous PageNext Page »

Blog at WordPress.com.