Didier Stevens

This is a bugfix version.

oledump_V0_0_78.zip (http)
MD5: EAE4457988371D88FED6F063BBBDADC7
SHA256: 01D314C505C1C5A0AFF8CE8A5910223FA8511E27F1B2DB6054864723B5677581

This is a bug fix version.

1768_v0_0_22.zip (http)
MD5: 6446F5C09BF70FAFBB3171734844B350
SHA256: 4716A4A72FB4C0265CAF541D5FF709615B9CB4129C20C98F1BBA535AA5D40717

When all items are selected with -s A and option -d from this new version on, items are decoded and dumped to stdout en separated by end-of-line character(s).

base64dump_V0_0_27.zip (http)
MD5: 6C3AE99A7FA0C525FF17B938A632AE53
SHA256: CDD84F574E25C93675BC0C14D954B59799B1FFEECC253A906B72A6DD669BDF4C

This is a bugfix version.

base64dump_V0_0_26.zip (http)
MD5: CD4370499288015C7EE13B59CB062129
SHA256: 3EEB76875ECCA782293D4486286F8155D1BB04DF23E3D3433E36C6373389B81D

This small update brings support for ZIP 2.0 via the pyzipper module.

strings_V0_0_10.zip (http)
MD5: F98C9D646A83322BC9226673D79FFE2D
SHA256: 7C062616C95DE5DDF0792A8CE9CA0CCA14FF43A8786DCED043193B729361BB59

This is a post for version updates 0.0.8 and 0.0.9.

Added command officeprotection and option -j for pretty.

xmldump_V0_0_9.zip (http)
MD5: 6EC24845F61FE3F9AC111BFEC69B53C7
SHA256: B1F3F6B153367AEF83C42B8002E7EA8A650B7E7092D97ACA288F2B62A93D4B9D

This small update brings support for ZIP 2.0 via the pyzipper module and fixes a /ObjStm parsing bug.

pdf-parser_V0_7_10.zip (http)
MD5: 2EB627850B215F3B9D1532880DA4E8DB
SHA256: 17F9EA0B4CADF0143AA52E1406EEC7769DA1B860375440D8492ADC113300CDFD

This small update brings support for ZIP 2.0 via the pyzipper module.

pdfid_v0_2_9.zip (http)
MD5: 57C5AE391116B79E1F90FFF7BBB36331
SHA256: 1FC540C9EB9722C1E430262DFF64F39606A7B4838DDE9F70EE3C56526EDEF5FF

–prefix and –suffix can now also be filenames.

cut-bytes_V0_0_17.zip (http)
MD5: 86D0692C6303248639A740E7A2AC4525
SHA256: D4FCFBD2305D7E5E97AB993741DF95B4565A882B0CD7DBA061D09578A1DDADA7

This is an update for plugin plugin_biff.py.

Protected xls files (workbook protection, sheet protection) are protected with a password, but are not encrypted.

The password is hashed to a 16-bit hash called verifier, such a short hash gives ample opportunity for hash collisions.

I calculated passwords for all possible hash values (32768, or 0x8000) mostly with letters and digits, some with special characters (verifier table). This verifier table is not a rainbow table, because the table contains all possible hash values and a corresponding password.

If a verifier can not be cracked with a provided password list, the password will be taken from the verifier list.

Example: this spreadsheet has a sheet protected with password azeqsdwxc, which is not in the embedded password list (obtained from John The Ripper); thus the password from the verifier table is taken (bbbbhz):

Passwords azeqsdwxc and bbbbhz both hash to the same verifier value (0xd9b1), thus there is a hash collision, and both passwords can be used to unprotect the sheet.

oledump_V0_0_77.zip (http)
MD5: CC8E3BB7BFA8D6312F8371DADE414EE4
SHA256: 08A097FB2491072043BFD4032BEBC4B2994AEF94B99F3C68EFAEB56004AE7ECE