Didier Stevens

Thursday 5 June 2025

Quickpost: emldump Bulk Extraction

Filed under: Quickpost — Didier Stevens @ 0:00

A reader asked about bulk extraction of email attachments with emldump.py

If you want to extract all attachments and write them to disk, you can use the following command:

emldump.py --jsonoutput sample.eml | myjson-filter.py -W hashvir

This command will produce a MyJSON data structure will the content and metadata of all parts (not only attachments, also the different bodies) and save the parts to disk with filenames formatted as the sha256 hash of the content and the extension .vir.

You can then run the desired analysis commands on the files written to disk.

But you can also run a command directly on the items, without writing them to disk. Here is an example of such a command:

emldump.py --jsonoutput sample.eml | myjson-filter.py -r "cmd.exe /c oledump.py"

This command will start a oledump.py command for each part in the multipart document, and provide the content of each part via stdout.


Quickpost info

Wednesday 4 June 2025

Quickpost: Firefox Profiles and Multiple Instances

Filed under: Quickpost — Didier Stevens @ 0:00

It’s something that I’ve been doing for 10+years, but every couple of years I need to configure this again (on a new machine), and then I need to look it up because I forgot the details. Hence this quickpost.

This is how I run Firefox on Windows:

"C:\Program Files\Mozilla Firefox\firefox.exe" -ProfileManager -no-remote

This allow me to run multiple instances (option -no-remote) of Firefox and invoke the profile manager to select the desired profile at startup


Quickpost info

Thursday 29 May 2025

Quickpost: Airplanes & Radiation

Filed under: Quickpost — Didier Stevens @ 7:42

When you’re flying high in a commercial airliner, you’re exposed to more radiation, because cosmic rays travel through less atmosphere before they hit a plane flying at 30000 feet. Compared to an airplane on the ground at sea level.

This is something my cheap Geiger counter can pick up.

This is a reading in the airport:

The real-time measure is 0,15 µSv/h, the average is 0,11 µSv/h.

The total dose (accumulated radiation exposure) is 0,0 µSv, because I just reset the counter (prior to take off).

This is a reading at 30,000 altitude:

The real-time measure is 4,02 µSv/h, the average is 3,33 µSv/h.

And after one hour and 5 minutes, the total dose is 2,18 µSv.

So at least this meter is working. I can’t say how precise it is, but it does pick up radiation.

And here is the measure after landing:

The total dose is 3,63 µSv. This was a flight from Brussels to Rome:

And for the flight back to Brussels, the total dose was 4,15 µSv:

The difference between the first flight and the second flight can be a change in cosmic ray activity, but it can also be that this cheap Geiger meter is not reliable enough.

And I also left this meter switched on while it went through the X-ray baggage scanner at airport security:

The dose was 157 µSv.

Let’s compare this to exposure levels for medical purposes, to put this into perspective.

According to this Wikipedia article, a chest X-ray is equivalent to an effective dose of 0,013 mSv. That’s 13 µSv.

So a dose of 4 µSv measured during the flights between Brussels and Rome, is about 3 times less than a chest X-ray.

While the dose from the X-ray baggage scanner (157 µSv) is equivalent to 12 chest X-rays.

And there is also this information:

Cosmic ray dose rate on commercial flights varies from 1 to 10 μSv/hour, depending on altitude, position and solar sunspot phase.

According to ChatGPT:

Commercial airline pilots are classified as occupational radiation workers due to their exposure to cosmic ionizing radiation at high altitudes. The International Commission on Radiological Protection (ICRP) recommends an annual effective dose limit of 20 millisieverts (mSv), averaged over five years, with no single year exceeding 50 mSv.

In the European Union, regulations mandate that aircrew likely to receive more than 1 mSv per year must have their exposure assessed and monitored. Employers are required to implement measures to ensure that individual doses do not exceed 6 mSv per year.

Actual radiation exposure for pilots varies based on factors such as flight altitude, duration, and routes flown. Long-haul pilots, especially those on polar routes, can receive between 4.5 and 6 mSv annually, while short-haul pilots typically receive around 2 mSv per year.


Quickpost info

Wednesday 16 April 2025

Quickpost: Testing The Capacity Of My New Power Bank

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I bought a new power bank (Anker PowerCore 533, capacity 10.000 mAh 36 Wh, 30 Watt Power Delivery) and did some tests that I’m summarizing here.

Charging it with a generic USB C charger capable of delivering 20 W PD required 46,979 Wh. That’s measured on the 230V side, thus including the loss in the charger.

Charging it with a Anker 737 Charger (GaNPrime 120W) required 45,515 Wh.

Discharging the power bank via the USB A port connected to an electronic load gave me:

  • 30,970 Wh (6516 mAh ) when drawing 0,5A
  • 29,362 Wh (6523 mAh) when drawing 1,0A

30 Wh compared to 36 Wh (the advertised capacity of the power bank) is 83,33%, which is much better than what Anker estimates you can get out of a power bank (60% to 70%).

As I couldn’t get more than 1,0A out of the power bank via the USB A port, I used the USB C port with a trigger module to deliver 20,0V.

The electronic load drew 1,250A and measured around 18,6V, or 23,25W. I got 29,020 Wh (1557 mAh) out of it.

The power bank became hot while getting completely drained at 23W:

You can see the outline of the cells and the electronic circuit (it’s the hottest: white).

I couldn’t immediately recharge my power bank after that, I had to let it cool down (“Let the power bank cool down before use”):

I also tried to get more out of the power bank by drawing 1,5A at 18,55V or 27,82W (advertized maximum is 30W).

But after 34 minutes (delivering 15,670 Wh) it stopped delivering power and displayed the following message (“Use after protection removal”):

I guess that’s the overcurrent protection kicking in. I’m not sure why this happened, as the electronic load was in constant current mode.

I had to disconnect the cable to use the power bank again.

And finally, this power bank is capable of trickle charging: delivering a very low current for about two hours. You enable this mode by pushing the button twice.

I configured the electronic load to draw a really low current of 0,005A (it measured 0,003A) from the USB A port and it delivered 0,032 Wh (6 mAh) over a period of 2:01:05 after which it shut down automatically (as advertized).


Quickpost info

Sunday 30 March 2025

Quickpost: Electrical Power & Mining: Dissipated Heat

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I got an interesting question on my blog post “Quickpost: Electrical Power & Mining“:

Does the temperature in your room increase due to the miner running full blast? Would you turn down the heater to compensate (which may change the calculation slightly).

That was indeed the case: I did turn down the heating in the room, and the heat of the desktop computer made it a nice 20°C.

We heat our home with natural gas, and on that day, we consumed 2,23 cubic meters to heat the rooms in our house, except for the office where the computer was running. Counting the volumes of the rooms, I estimate that 0,55 cubic meters would have been necessary to heat the office.

Using that same spreadsheet, consuming an extra 0,55 cubic meter would cost me €0,55. Deducting this from the €3,91 I had to spend on electricity gives me €3,36, which is still around 10 times more than the €0,39 I earned through mining.


Quickpost info

Monday 10 February 2025

Quickpost: Electrical Power & Mining

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I was wondering: how costly is crypto mining for me?

I let an easy-to-use mining application run on my desktop computer (RTX 3080 GPU) for 24 hours.
After 24 hours, the miner reported that I had mined 0,00000365 BTC, and that this would earn me €0,39. The electrical power consumption of my desktop computer for that period was 13,024 kWh.

How much does 13 kWh cost me? Here in Belgium, we pay a lot of taxes on our utility bill. So just multiplying 13 kWh with the cost for 1 kWh would not produce realistic costs.
What I did instead: I took my utility bill of December 2024, with all the taxes, and created a spreadsheet that re-calculates all of the costs and taxes. That gives me a spreadsheet were I can simulate changes to my bill and see what the final result is. And with that spreadsheet, I increased my electrical power consumption for December 2024 with 13,024 kWh. That gave me an extra cost of €3,91.

Spending €3,91 to earn €0,39 is not viable at all.

But what if I would run the miner only when my solar panels produce enough power? That’s free electricity, right?

Yes, but … my electricity supplier also pays me money for the solar power I produce and don’t consume (e.g., inject).
Injecting 13,024 kWh would earn me €0,86. So that’s at least double the amount that mining would earn me.

Conclusion: as long as electricity tariffs don’t change significantly, mining is not financially viable for me. One would be better of buying BTC with the small payouts for injected power.


Quickpost info

Thursday 21 November 2024

Quickpost: The Electric Energy Consumption Of A Soundbar

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I have a Samsung Neo QLED 65 inch TV.

Its standby power consumption is pretty good: 1,3 Watt.

It comes with a soundbar, and its standby power consumption is pretty awful: 5,5 Watt!


Quickpost info

Sunday 3 November 2024

Quickpost: The Electric Energy Consumption Of A Wired Doorbell

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I have a classic wired doorbell at home: the 230V powered transformer produces 12V on its secondary winding. The circuit on that secondary winding powers an electromechanical doorbell via a pushbutton. The bell rings (“ding-dong”) when the button is pushed (closing the circuit).

Since losses occur in all transformers, I wanted to know how much my doorbell transformer consumes in standby mode (doorbell not ringing). The primary winding is always energized, as the pushbutton (normal-open switch) is on the circuit of the secondary winding.

I made the measurements on the primary winding: 3,043 Watt. That’s more than I expected, so I double-checked, and noticed I had forgotten this:

There’s a small incandescent light-bulb in the doorbell button. That consumes power too!

Second set of measurements after removing the light-bulb: 1,475 Watt.

So with light-bulb, my doorbell consumes 3 Watt 24/7, and 1,5 Watt without light-bulb.

1,5 Watt is very similar to the standby consumption of linear power supplies. As energy experts here in Europe advice to replace linear power supplies in favor of switched-mode power supplies, I wonder why they never mention doorbells … Replacing your doorbell would not be as easy as replacing a (USB) charger though (it would best be done by an electrician), so that might explain it, but on the other hand, there are enough energy experts proposing impractical solutions.

3 Watt is 26,28 kWh for a whole year. In my case, that’s a cost of €5,89 (that’s total cost: electricity plus taxes). I could reduce this by half, just by removing the incandescent light-bulb.

Should I do this? Well, the decision has already been taken for me: I dropped the light-bulb while it was still hot, and the impact broke the filament …

For comparison: 3 Watt is at least three times higher than the individual standby consumption of our appliances like TV, fridge, freezer, …

Yet another comparison: asking an LLM to write an email requires less (< 0,3 Wh) than my doorbell over a period of an hour (3 Wh).


Quickpost info

Tuesday 8 October 2024

Quickpost: The Electric Energy Consumption Of LLMs – No GPU

Filed under: Quickpost — Didier Stevens @ 0:00

A friend asked me if I had used a GPU for my tests described in blog post “Quickpost: The Electric Energy Consumption Of LLMs”. Because he had tried running an LLM on a machine without GPU, and it was too slow.

I did a quick test, just redoing previous test but without GPU (by setting environment variable CUDA_VISIBLE_DEVICES=-1).

Answering my query took 17 seconds, and required 1.13 Wh (again, for the whole PC).


Quickpost info

Sunday 6 October 2024

Quickpost: The Electric Energy Consumption Of LLMs

Filed under: Quickpost — Didier Stevens @ 19:17

I’ve read claims that AI queries require a lot of energy. Today I heard another claim on the Nerdland Podcast (a popular science podcast here in Belgium): “letting ChatGPT write an email of 100 words requires 70 Wh” (if you’re interested, that’s said at 00:28:05 in this episode).

I though to myself: that’s a lot of energy. 70 Wh is 252,000 Ws (70 W * 3600 s). Assume that it takes 10 seconds to write that email, then it requires 25,200 W of power, or 25 kW. That’s way more than the theoretical maximum I can get here at home from the power grid (9 kW).

So I decided to do some quick & dirty tests with my desktop computer and my powermeter.

First test: measure everything.

Step 1: starting up my desktop computer (connected to my powermeter) and waiting for the different services to startup, required 2.67 Wh of electrical energy:

Step 2: I opened a command prompt, started Ollama, typed a query to generate an email, and waited for the result. By then, the required electrical energy op my desktop computer (since starting up) was 3.84 Wh:

So step 2 took 57 seconds (00:02:36 minus 00:01:39) and required 1.17 Wh (3.84 – 2.67). That’s way less than 70 Wh.

Second test: just measure the query.

I restarted my computer and started Ollama. Then I started my powermeter and pasted my query and waited for the answer:

That took 3 seconds and required 0.236 Wh:

Notice that I have not just measured the electrical energy consumption of Ollama processing my query, but I measured the total electrical energy consumption of my desktop computer while Ollama was processing my query.

0.236 Wh for a computer running Ollama and processing a query is very different than 70 Wh for ChatGPT processing a query. That’s almost 300 times more, so even though my test here is just anecdotal and I’m using another LLM than ChatGPT, I will assume that 70 Wh is a gross overestimation.

FYI: asking Google “what is the electrical energy consumption of chatgpt processing a query”, I find results mentioning between 1 and 10 Wh. That’s closer to my tests than the 70 Wh claim.


Quickpost info

« Previous Page — Next Page »

Blog at WordPress.com.