Didier Stevens

This is a bug fix update.

python-templates_V0_0_10.zip (http)
MD5: 29806A562411E4584455746C8CE41BAB
SHA256: CC520C26BE6E59F48AEA639EC477983333D75F91FFE295915DB4711C275E26DB

In this new version of cut-bytes.py, I add support for custom Python transforms (options -P and -S), pyzipper and fixed a bug.

cut-bytes_V0_0_16.zip (http)
MD5: 04E6E0E46C6698127BAE443AF5CEF0F6
SHA256: 0657F6A6837CEC9F3E9E50551F8861D19B70305A4B7C3C409D561C3462550D24

I added extra plaintexts for the modulus of Cobalt Strike’s public RSA key.

xor-kpa_V0_0_7.zip (http)
MD5: FB8155E56234648CC3AFFD890BFE9043
SHA256: 069DCA2A1901D448DBF2CF202B5CE49846EFCBAACB73BF35B20AA085AAB31BA9

This new version of file-magic.py adds a definition to identify OneNote .one files:

And adds support for pyzipper.

file-magic_V0_0_6.zip (http)
MD5: 2C564E9B215672BA9352934C8B91B0EC
SHA256: 6102CE6788EB17B17AB3C0AB054FE9ECA2C557E9349A7ACF9612759CC5C6CA97

A small feature update for pdf-parser.py Statistics include unreferenced objects now:

pdf-parser_V0_7_8.zip (http)
MD5: 7BBEA9497666397CBBB88B012A710210
SHA256: FE393865861E00B48124B99CD5AEBBB5A632F1FBD883F4E4044DF8C8FA75BE9D

New functions and classes have been added to process-binary-file.py.

python-templates_V0_0_9.zip (http)
MD5: 7C5E8602F225735015E9A431C5818762
SHA256: CAEEEBB1E402E5127A431446A01BBE607B22AA0EB1F6FA12B8E7703275BE6F15

A small update to option -W of zipdump.py.

Next to value vir, you can now also specify values hash and hashvir.

hash: write each file with name equal to the SHA256 of the content of the file.

hashvir: write each file with name equal to the SHA256 of the content of the file plus extension .vir.

zipdump_v0_0_24.zip (http)
MD5: 33E7B7602263CB2C23D59C7EDEC8666C
SHA256: 1BEF40A9B567DAE84563FEA1B4DE8E0BD7F5926F7FCFF6D7086D2643133FBACE

This update to dnsresolver.py, my custom DNS server, adds a command to forward DNS request.

With this forward command, all requests that are not handled by other commands, are forwarded to the provided DNS server.

dnsresolver_V0_0_2.zip (http)
MD5: D96EA9517E106C4C9E3668AB6799B150
SHA256: 611C1540FE7FA2016E38689A153681428BBF3EAFC927A62342310A93022B3EC4

This update of myjson-filter.py adds an option (-t) to filter on the magic field added by file-magic.py.

To be explained in an upcoming blog post.

myjson-filter_V0_0_3.zip (http)
MD5: AB8AF505B120D02AD1A9846A72A340B5
SHA256: AB73314ACCD65EC765D6DDA629AF273FF882D293F11F6A2EA8FC633B019E5836

This update of file-magic.py brings option –jsonoutput to augment json input data with a magic field.

To be explained in an upcoming blog post after myjson-filter.py update is released.

file-magic_V0_0_5.zip (http)
MD5: 5B4CB4EE75E1CAC7705E33CCE4809E10
SHA256: 876F9AC31E1EC395EB93922AA2A7EFA027534F7343500648FE0A036021C7F1B9