Didier Stevens

This is a fix for option –yarastrings.

rtfdump_V0_0_15.zip (http)
MD5: C70F327DDC11B549A399B2F85B2B9607
SHA256: 9EFDEB5978372BD93065BCDAB6486DAECA4CB7E2EDA15DD5BD4C98AF69FB19A7

This update adds option -C (–combinations). When this option is used together with -j (–jsonoutput), 2 extra versions of each stream are added. One with option -H enabled, and one with option -H and -S enabled.

rtfdump_V0_0_14.zip (http)
MD5: D9BBA8F83E04D4FD25268E7A2BB4653E
SHA256: DB852CEDA1AE368FF32C1D12951A02BD7A4E36C74632D0D1F790C700FB298689

This update adds pseudo-field sha256 which can be used to calculate the sha256 hash of the content (compressed or decompressed):
-E sha256:data
-E sha256:data:decompress
-E sha256:decompress
-E sha256:extra

zipdump_v0_0_33.zip (http)
MD5: ABF2AC037D2CB7E26664D28B109E9293
SHA256: A80E956072E9C4E3051992EA3E551444585854747EFE2A997A232E6F5B94E8E4

This is a bug fix version.

hash_V0_0_14.zip (http)
MD5: 66A205915A280CC474541053739B8EDD
SHA256: C459B75F132BB4AA394D8EA27A79F409C446AAA67536946673EC824EA9219F9F

This is a small fix for an escape sequence warning.

pecheck-v0_7_19.zip (http)
MD5: A53F4648119CC9A44FB684EAC2C84C08
SHA256: 67637A257967807800AF04D45E0B8DA8F32D38AA772C3596DAE7E0CD4ECFCE52

This update add option -e to handle binary numeric expressions like 79+1.

numbers-to-hex_V0_0_4.zip (http)
MD5: 8CD22E998E84F80D1FD92504B3D3A559
SHA256: 6963ED3F013D9C6E70ACA95DA00399B0F95DD279597EABE5BA1EC51E0B28DD4D

This is a bugfix version.

cs-parse-traffic_V0_0_6.zip (http)
MD5: AED53E99D7BFF14EC45F573663A91780
SHA256: C73614FD69660C4D0E851414D86091E9E90DE9A92D58F9E6AC71D76B4A6EC638

This update brings function= to the definition of a resolve command.

Key-value pair function is optional. If provided, the value will be interpreted as a Python function and called when there is a match. The function must inspect the request and update the reply. Arguments to the function are request, reply and dCommand. The function must return a list with 2 values: first one is True when NXDOMAIN must be returned (and False if there is an answer), second one is an integer with the rcode value, it must be None if there is no rcode set by the function.

An extra Python script (for example with function definitions) can be loaded using option -s.

dnsresolver_V0_0_4.zip (http)
MD5: 7520FB4510E6ED5E5975A8606852F548
SHA256: 1C4BC4D6030A2534600283962890545D428F2BBAFD85D0B3E934B03B07EA1F6A

This is a bugfix version.

pdf-parser_V0_7_13.zip (http)
MD5: B9C0EF6EC526CDA51FB147D04FC3C5B8
SHA256: F9BA57419998748559D60EE13EEDA3BBC6BA48135C5781CB8801063AE7C29E6E

This update adds option -t: it directs teeplus.py to use the timestamp as filename for saving the incoming bytes.

teeplus_V0_0_2.zip (http)
MD5: 50C60D13D3FC6BD4306D376694D26858
SHA256: 50D7CA7D03BA6E3893DD032228A73618B560C9D81B485DE76FF415332648EC03