When I record maldoc analysis videos, I have already analyzed the maldoc prior to recording, and I rehearse the recording.
This time, I also recorded the unrehearsed analysis: when I take the first look at a maldoc I’ve not seen before.
All in this video:
While on holiday in Feilluns (France, Pyrénées-Orientales) in September 2021, I did search several dolmens.
While the dolmen Caouno del Moro is easy to find (it is right next to a road, just follow the signs starting in the village), the nearby dolmen du roc de l’Arca is not so easy to find, as there are no signs and it’s on the top of a wooded hill.
Dolmen du roc de l’Arca:
Map:
Drone picture:
Video: walking from dolmen Caouno del Moro to dolmen du roc de l’Arca.
Video: drone view of dolmen du roc de l’Arca.
As biodegradable waste contains a lot of water, I was wondering how much mass reduction I can achieve by exposing it to the sun (by evaporating some of the contained water).
On a sunny day in March (Belgium), I weighed these fruit peels (I had just consumed the fruit):
66 grams
Exposing it to sun & air:
After 7 hours, 24 grams left:
So we lost 42 grams, almost 2/3 of the original mass.
For those of you having to pay for their household biodegradable waste processing by the kilo, it might be something to look into.
I’ll have to figure out if this is something practical & that scales easily, or not.
This is a small update: when non-hexadecimal characters are found, they are listed before an exception is raised.
hex-to-bin_V0_0_6.zip (http)This is an update for my tool to perform XOR known plaintext attacks: xor-kpa.py.
The tool has been updated for Python 3, and 3 new plaintext have been added, all for Cobalt Strike configurations.
cs-key is the header of the configuration entry for the public key.
cs-key-dot is the header of the configuration entry for the public key XORed with value 0x2E (a dot).
cs-key-i is the header of the configuration entry for the public key XORed with value 0x69 (letter i).
A small update for my translate.py program.
Python function Xor takes now 2 extra, optional arguments:
hexadecimal: a boolean, by default False.
When True, the key is provided as an hexadecimal string.
rotation: an integer, by default 0
This is the number of bytes to rotate the key to the left. For example, when the key is ABCD, a rotation value of 1 yiels key BCDA.
translate_v2_5_12.zip (http)This is an update to plugin plugin_vba_dco.py, improving generalization and adding option -p.
You can watch this maldoc analysis video to learn how to use the generalization feature of this plugin:
This update to jpegdump.py, my tool to analyze JPEG images, brings 2 small changes:
Data between segments can be selected with suffix d. Like this: -s 10d
This means: select the data between segments 9 and 10.
And when option -E is used to add hash values, repeating hashes are marked with parentheses.
I have 2 Bosch 18V “power for all” chargers. A normal charger (AL 1830 CV) and a fast charger (AL 1880 CV).
Measuring the power consumption of these 2 chargers in standby mode (plugged into a 230V outlet, but no battery connected) with a GPM-8310 powermeter, I obtained the following results:
AL 1830 CV: 476,33 mW
AL 1880 CV: 344,39 mW
Didier Stevens 