A small update to plugin_msi_info to provide extra info on streams.
Indicator ! marks PE and CAB files.
Indicator ? marks files that are not images (and are not marked with !).
The idea is to first inspect streams marked with ! and ?.
The plugin also provides an overview of the files contained inside the CAB file.
oledump_V0_0_73.zip (http)This update brings a new plugin to analyze MSI files: plugin_msi_info
This is a bug fix update.
python-templates_V0_0_10.zip (http)In this new version of cut-bytes.py, I add support for custom Python transforms (options -P and -S), pyzipper and fixed a bug.
cut-bytes_V0_0_16.zip (http)I added extra plaintexts for the modulus of Cobalt Strike’s public RSA key.
xor-kpa_V0_0_7.zip (http)This new version of file-magic.py adds a definition to identify OneNote .one files:
And adds support for pyzipper.
file-magic_V0_0_6.zip (http)A small feature update for pdf-parser.py Statistics include unreferenced objects now:
New functions and classes have been added to process-binary-file.py.
python-templates_V0_0_9.zip (http)A small update to option -W of zipdump.py.
Next to value vir, you can now also specify values hash and hashvir.
hash: write each file with name equal to the SHA256 of the content of the file.
hashvir: write each file with name equal to the SHA256 of the content of the file plus extension .vir.
zipdump_v0_0_24.zip (http)This update to dnsresolver.py, my custom DNS server, adds a command to forward DNS request.
With this forward command, all requests that are not handled by other commands, are forwarded to the provided DNS server.
dnsresolver_V0_0_2.zip (http)
Didier Stevens 