I’ve a feature in some of my tools, that let you choose the hash algorithm.
Many of my tools calculate hashes, and for historical reasons, that is the MD5 hash.
But if you want another hash, you can change this (for some of my tools) by setting environment variable DSS_DEFAULT_HASH_ALGORITHMS.
Like for pdf-parser.py, on Windows, you can set DSS_DEFAULT_HASH_ALGORITHMS=sha256 and then the hashes of the streams will be SHA256 in stead of MD5.
This tool is still beta.
VBA compression is now supported, besides zlib compression. Option -t (–type) was added so that one can choose the compression type to search for. Possible values are zlib (default) or vba.
And shortcut #p# was added to the yara option, to predefine these rules:
rule attribute_vb_name {
strings:
$a = "Attribute VB_Name = "
condition:
$a
}
rule dir {
strings:
$a = { 01 00 04 }
condition:
$a at 0
}I’ll explain in another blog post how these features can be used to analyze MS Access databases with VBA project.
This update brings options -f and -c.
Option -f is used to define a Python function (function name or lambda) that will be applied to the content of each item in the MyJSON data.
Option -c is a shortcut for calling the CutData function via option -f. The lambda that is generated is: lambda data: CutData(data, ‘CUTEXPRESSION’)[0]
CUTEXPRESSION is the cut-expression provides as value for option -c.
A new possible value for option -W (–write) has been added: nameext. This allows for writing files with the sanitized item name and the given extension. For example, nameext:config will create files with extension .config.
myjson-filter_V0_0_8.zip (http)This oledump update brings option –trimnull and updates plugin_vba_dir with option -f (–force).
oledump_V0_0_82.zip (http)Option –jsonoutput was added to produce MyJSON data for the files that are read.
python-templates_V0_0_13.zip (http)This version brings a new plugin to extract clickable links from Word documents (.doc): plugin_hyperlink.py
This new version of myjson-filter brings:
Plugin plugin_ooxml_url.py is a plugin that extracts clickable links from OOXML documents:
This version fixes a bug in IsPrintable and adds option -D.
xorsearch_v0_0_5.zip (http)I added support for TAB separator and added options –recursedir, –literalfilenames and –checkfilenames.
re-search_V0_0_23.zip (http)
Didier Stevens 