Didier Stevens

This new version adds a new post processing function to extract the longest string from the decoded payload (ExtractLongestString). Post processing functions take the decoded content, and replace it with the processed content. To view to original decoded content, the select option -s now supports suffix o. For example, to select the original decoded content of entry 5, use option -s 5o.

And there is now a –sort option to sort the entries based on payload, decoded content, length, …

base64dump_V0_0_25.zip (http)
MD5: 5A193C98658FF26ED680130E61F62D0F
SHA256: 002517F56484A7017E12D3D9BE0667E9E907F1EBD9B9091647F4336615D494E1

I added option -j –jsonoutput to my pdf-parser.py tool.

This option produces JSON output with the content of all of the streams, unfiltered.

To have the filtered stream content as JSON output, include option -f.

pdf-parser_V0_7_9.zip (http)
MD5: E435A374A233C9DFEDA8A4E16887FB99
SHA256: 99F50D4F030A5B3E9F9CBA20A7BB8C51FBA368526077CCA3466C784DA39D42DB

This is a small change to my FileScanner tool to make it long path aware.

FileScanner_V0_0_0_9.zip (http)
MD5: 2BCD526792C76890CC6EF7EED9396BE2
SHA256: 9063221557F2EBACDC5B1CA977828250A2524B9795369AB4918B9287CAEB7DBF

Added option -D –dumpformat to specify the format of the dumped information when using option -d.

what-is-new_V0_0_4.zip (http)
MD5: B2BED149AF949C058E19CD6077D64D2D
SHA256: 8C7C475C62D7F79AE45150309AB47757CE308760FAB2BE93D0E03C56D0DA59F6

I added IPv6 support to simple_listener.py.

Although it was not by design, it turned out that simple_listener.py only works for IPv4. So I made some small changes to add IPv6 support.

When you use dictionary to define your listeners, use THP_TCP6 and THP_UDP6 to define TCP IPv6 and UDP IPv6 listeners respectively. The meaning of THP_TCP and THP_UDP has not changed, that’s for IPv4 listeners.

When you use port options to define your listeners, use prefix t6: and u6: to define TCP IPv6 and UDP IPv6 listeners respectively. The meaning of t: and u: has not changed, that’s for IPv4 listeners.

And by default, listening takes place on all IPv4 interfaces (0.0.0.0) when IPv4 listeners are defined, and listening takes place on all IPv6 interfaces (::) when IPv6 listeners are defined. That’s governed by option -a –address’ default value 0.0.0.0,::.

To explicitly specify an interface with option -a, you will need to provide an IPv4 address and an IPv6 address separated by a comma.

simple_listener_v0_1_5.zip (http)
MD5: 3FAC80E7D6E3CE71AD4276125AD080E8
SHA256: BA716A27401DB4A76D3FE826A21BA4F7C74DC26AF4B96EA965D5E85517F94214

This new version brings option –encoding, to handle different text encodings.

count_v0_3_2.zip (http)
MD5: 552B7E8C92D07FB422AF6956A88B3C6E
SHA256: B0CA909EC5CDA7471D80B7562D93388D81225EEB73A6421D4784F2DAD785AC0B

I added a –stats option, extra processing for PK END records and a new choice for -W –write option: alphanumhashvir.

zipdump_v0_0_30.zip (http)
MD5: 890E9000F6CD7CD91BA9FC75D4297D8D
SHA256: 2A266E7E35D7DEF8A63964E73B105992752E51AA32CD20C97D3383FBB77F1587

This update to strings.py brings option -V to add extra statistics for the 10 longest strings when option -a –stats is used.

strings_V0_0_9.zip (http)
MD5: 5611044374DDCA8E7C1A74D88ED9B9C2
SHA256: C198D543F4D46B1330D1A4778829F534E77AA320CE500DF2B1F78910A50ADCCF

This new version of myjson-filer brings a new choice for option -W (–write): hashext.

This write files where the filename is the sha256 hash + provided extension. For example, option -W hash:jpeg will create files with extension .jpeg, and the name is the sha256 hash of the content of the file.

myjson-filter_V0_0_6.zip (http)
MD5: 379880AF93E312F8A8D80A7F8E0825E5
SHA256: E1B09AEEFB437ECDF3A6223BE3D72A3D552EF5A3B2E9CC42D06A83E4230EA9D1

This new version of hash.py adds JSON input support: –jsoninput.

hash_V0_0_12.zip (http)
MD5: 087C9DB7D2C22449B568F7F35015A2D1
SHA256: 1021D93E0048F2196AA4D4018C1FA3DC61BAA28E6A00F97AB48442BAF7FB8C12