Didier Stevens

Tuesday 22 April 2025

Update: xorsearch.py Version 0.0.4

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a YARA bug fix version.

xorsearch_v0_0_4.zip (http)
MD5: 762F589E29847BF0CFE31FF0D38259BF
SHA256: 52EFA3EC74A4F79081E320C572793153CD300501BE48760A28194F9624EAE053

Wednesday 16 April 2025

Quickpost: Testing The Capacity Of My New Power Bank

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I bought a new power bank (Anker PowerCore 533, capacity 10.000 mAh 36 Wh, 30 Watt Power Delivery) and did some tests that I’m summarizing here.

Charging it with a generic USB C charger capable of delivering 20 W PD required 46,979 Wh. That’s measured on the 230V side, thus including the loss in the charger.

Charging it with a Anker 737 Charger (GaNPrime 120W) required 45,515 Wh.

Discharging the power bank via the USB A port connected to an electronic load gave me:

  • 30,970 Wh (6516 mAh ) when drawing 0,5A
  • 29,362 Wh (6523 mAh) when drawing 1,0A

30 Wh compared to 36 Wh (the advertised capacity of the power bank) is 83,33%, which is much better than what Anker estimates you can get out of a power bank (60% to 70%).

As I couldn’t get more than 1,0A out of the power bank via the USB A port, I used the USB C port with a trigger module to deliver 20,0V.

The electronic load drew 1,250A and measured around 18,6V, or 23,25W. I got 29,020 Wh (1557 mAh) out of it.

The power bank became hot while getting completely drained at 23W:

You can see the outline of the cells and the electronic circuit (it’s the hottest: white).

I couldn’t immediately recharge my power bank after that, I had to let it cool down (“Let the power bank cool down before use”):

I also tried to get more out of the power bank by drawing 1,5A at 18,55V or 27,82W (advertized maximum is 30W).

But after 34 minutes (delivering 15,670 Wh) it stopped delivering power and displayed the following message (“Use after protection removal”):

I guess that’s the overcurrent protection kicking in. I’m not sure why this happened, as the electronic load was in constant current mode.

I had to disconnect the cable to use the power bank again.

And finally, this power bank is capable of trickle charging: delivering a very low current for about two hours. You enable this mode by pushing the button twice.

I configured the electronic load to draw a really low current of 0,005A (it measured 0,003A) from the USB A port and it delivered 0,032 Wh (6 mAh) over a period of 2:01:05 after which it shut down automatically (as advertized).


Quickpost info

Tuesday 15 April 2025

Update: xorsearch.py Version 0.0.3

Filed under: My Software,Update — Didier Stevens @ 0:00

I added option –verbose to visualize generated YARA rules.

xorsearch_v0_0_3.zip (http)
MD5: 394557EDD88EF9862ACC97D15A2308A3
SHA256: D8FE6914F25FEC4E589A3F3EF7C30F8281C0B918D9254B8AEB2322D2BB8DAE36

Monday 14 April 2025

Update: xorsearch.py Version 0.0.2

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a rewrite of xorsearch.py, an implementation of XORsearch.exe in Python.

xorsearch_v0_0_2.zip (http)
MD5: 4AA44E14060B461405AD670AE20D4AAC
SHA256: F452BC239664A1516070D79596C2FC5238963833440C66CD77DC8892C30A3D0D

Sunday 13 April 2025

Overview of Content Published in March

Filed under: Announcement — Didier Stevens @ 7:53
Here is an overview of content I published in March:

Blog posts: SANS ISC Diary entries:

Sunday 30 March 2025

Quickpost: Electrical Power & Mining: Dissipated Heat

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I got an interesting question on my blog post “Quickpost: Electrical Power & Mining“:

Does the temperature in your room increase due to the miner running full blast? Would you turn down the heater to compensate (which may change the calculation slightly).

That was indeed the case: I did turn down the heating in the room, and the heat of the desktop computer made it a nice 20°C.

We heat our home with natural gas, and on that day, we consumed 2,23 cubic meters to heat the rooms in our house, except for the office where the computer was running. Counting the volumes of the rooms, I estimate that 0,55 cubic meters would have been necessary to heat the office.

Using that same spreadsheet, consuming an extra 0,55 cubic meter would cost me €0,55. Deducting this from the €3,91 I had to spend on electricity gives me €3,36, which is still around 10 times more than the €0,39 I earned through mining.


Quickpost info

Saturday 15 March 2025

Update: zipdump.py Version 0.0.31

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a bug fix version.

zipdump_v0_0_31.zip (http)
MD5: 8EA7D6DBC2877C0E8F3635F06F6E5639
SHA256: C063421D1A87E1DB08205948D481CD733F1F170398D990711F92F4F5921134A4

Monday 10 March 2025

Update: xmldump.py Version 0.0.10

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a bugfix version.

xmldump_V0_0_10.zip (http)
MD5: 8A42C57B10E9D41CCD4D48C2C618431B
SHA256: F0E37F1B61D065A92E2F2C3A678CDE101413BE6099A89AA81FB7C80F18965966

Sunday 9 March 2025

Update: pdf-parser.py Version 0.7.11

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a bugfix version.

pdf-parser_V0_7_11.zip (http)
MD5: 54425CBB5E3E88D931AE7A627105947E
SHA256: 4B550F11DBEA5EE3CF10C842AC1C290407E6BD2A60ECFA2EE192E2D3663227B9

Saturday 8 March 2025

Update: pdfid.py Version 0.2.10

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a bugfix version.

pdfid_v0_2_10.zip (http)
MD5: E2F369B34D7148BE4D5C4C02430E7983
SHA256: A677336B1CF51386E35DBDED8FDB79F27368FD5D5ECC3FC5C8DA020A029CB6B6

« Previous PageNext Page »

Blog at WordPress.com.