Didier Stevens

My first post for this blog was in June 2006, 20 years ago: A Ring Tone That I Cannot Hear.

Back then, I tested my hearing with Audacity, and I could hear a tone up to 14 kHz.

20 years later, I do the test again, and I can hear a tone up to 8 kHz.

It’s no surprise that my hearing declined over the years, that happens to everybody.

What did surprise me, or better said, what impressed me, is that a free and open-source tool like Audacity still exists after 20 years, and that I can just issue the exact same commands as 20 years ago!

Here is an overview of content I published in July:

SANS ISC Diary entries:

• Wireshark 4.6.7 Released
• zipdump.py: Metadata Encoding

New features in this version of InteractiveSieve are:

Load and Split

With Load and Split; you can load a CSV file and split rows that have a field that contains more than one value, separated by a separator character.

Take this example:

IP,Count,Methods
10.0.0.220,5,GET
10.0.0.45,13554,GET|POST
10.0.0.135,54302,GET|HEAD|POST

Fields in column Methods can have more than one value: GET, POST and/or HEAD. These values are separated by a pipe | character.

Simply loading this CSV file in InteractiveSieve gives this:

While using Load and Split with separator | for column 3 (Methods) gives this:

Ignore Comments

The Options dialog has now a field “Ignore comments”:

This can be used to ignore each line that starts with the given line-comment character.

Take this CSV file for example:

#Produced 2024/06/01
IP,Count,Methods
10.0.0.220,5,GET
10.0.0.45,13554,GET|POST
#Extra comment
10.0.0.135,54302,GET|HEAD|POST

When loaded in InteractiveSieve without “Ignore comments” character, the result is this:

And providing line-comment character # gives this:

Show

The Show command in the right-click menu for a row gives this dialog:

Sum

The Sum command in the right-click menu for a cell can be used to sum the numerical values of that column. There is no need to convert the text to numbers first.

Group

And finally, there’s the Group command in the right-click menu for a column.

This is a bit the opposite of Load and Split.

Take this CSV file for example:

Let’s say I want to group Methods by IP address. First I specify that column IP is the index:

Next I select column Methods to Group:

And then I specify the separator (~ in this example):

The original values can be restored with Restore from group:

InteractiveSieve_V_0_9_3_0.zip (http)
MD5: 09FE2F374A789EDA8B9BC2A9DFE9E732
SHA256: A3AA9790772466953A3C37785C7F18E0B0201BC1CABEB8D12F674E0BDBF0FDA2

I had a locksmith make a duplicate key of my mailbox lock, and it didn’t work (didn’t open the lock).

The cutting looked good, I saw no difference with the original key.

Until I noticed this notch:

Turns out this notch accepts this tiny “bump” on the cylinder:

This notch was missing on the duplicate. I milled a notch and now the duplicate key opens the lock:

---

Quickpost info

---

A new plugin and an updated plugin.

Plugin plugin_dttm is a plugin for Word documents: it searches for Dop structures. They contain DTTM timestamps.

And plugin plugin_metadata has been updated to parse digital signatures (option -s).

oledump_V0_0_71.zip (http)
MD5: BA1142136F28DB218BADEAA642EA0EA9
SHA256: FA09766D138A1AA60523B487D947BF29222D409CF1FCE078DE61BF62768A5950

This new version adds a sort function to sort email addresses by domain first.

sortcanon_V0_0_2.zip (http)
MD5: ED6DBE384707778E765C9BD6B6880C05
SHA256: 190922F347AC1B32D0CE503D1763F27A250D9BFDD15CB911EA4435BAB7E69CD3