This new version adds JSON input support, allowing,for example, to detect encoded payloads inside the registry:
More info in an upcoming blog post.
base64dump_V0_0_23.zip (http)This new version of format-bytes.py adds a feature to search for a range of integers:
#iv5#6080 means: look for an integer (i) equal to 6080 with a variation of 5 (v5), e.g., look for integers between 6075 and 6085.
format-bytes_V0_0_14.zip (http)This new version contains a Python 3 fix.
cut-bytes_V0_0_15.zip (http)This new version of base64dump.py adds some extra info for the encoded strings.
In -e all mode, a new column Chars tells you how many unique characters are used for that encoded string:
For example, the last line is recognized as a syntactically valid variant of BASE85 (b85), but it uses only 63 unique characters (85 unique characters is the maximum). So this is probably not b85, or else the encoded data has low entropy.
And there is also new info when you select a string for info:
This new version adds option -l to provide a short list via an option, in stead of using a file. And there’s a Python 3 bug fix.
python-per-line_V0_0_8.zip (http)This new version of oledump.py brings extra info variables %CTIME% %MTIME% %CTIMEHEX% and %MTIMEHEX% to view the creation time & modification time of storages (UTC).
And there’s a new plugin (plugin_olestreams) to parse the OLE data found in streams like \001Ole, \003LinkInfo and \003ObjInfo:
Some small updates to my Python templates.
python-templates_V0_0_7.zip (http)Here is a small update of my tool to analyze Cobalt Strike beacons.
1768_v0_0_14.zip (http)This new version of pdf-parser fixes a couple of bug and has a work around for non compliant PDFs.
pdf-parser_V0_7_6.zip (http)This new version of re-search.py brings input & output encoding to option –encoding (this was input encoding only in prior versions).
re-search_V0_0_20.zip (http)
