This new version of cut-bytes.py adds access to the read data for Python expressions in prefix and suffix options.
cut-bytes_V0_0_14.zip (http)A couple of my tools can produce JSON output, using my own format (myjson).
This output can then be piped into another tool, like strings.py or file-magic.py.
I’m now releasing a tool that can be put into a command pipe to filter the JSON data: myjson-filter.py
For example, here I use myjson-filter.py to remove all items that are XML files (based on the content: starting with <?xml) before strings are extracted with strings.py:
More info in this ISC diary entry I wrote: “Method For String Extraction Filtering“.
This new version of oledump brings option -u. This option is used to look for data past the end of the streams.
oledump_V0_0_64.zip (http)I included a new Cobalt Strike 4.5 private key in this released, shared with me by a user.
Further, ZIP files with AES encryption are supported. And a few other bug fixes
1768_v0_0_12b.zip (https)This is a bug fix update for oledump.py.
It fixes a bug that occurred when you calculated the hash of decompressed VBA code:
This Python script is essentially a wrapper for the smtpd Python module.
I use it to receive emails, and write them to disk.
Sometimes I use this to exfiltrate (malicious) emails.
This new version of jpegdump.py adds option -E to display extra info for each segment.
This extra data is a hash of the segment’s data: md5, sha1, sha256.
This new version brings a new encoding: zxcn
zxcn stands for “zero x comma no-leading zero”, and is very similar to zxc encoding (zero x comma).
Example of zxc: 0x90,0x0A,0x4D,0x5A
Remark the leading zero for value 0x0A (values smaller than 0x10).
With zxcn encoding, there is no leading zero for values smaller than 0x10.
Thus the example for zxcn becomes: 0x90,0xA,0x4D,0x5A
base64dump_V0_0_20.zip (https)This new version of pecheck adds support for dumping files (-D) while using option -l P.
pecheck-v0_7_14.zip (https)
