Didier Stevens

Monday 7 September 2020

Overview of Content Published in August

Filed under: Announcement — Didier Stevens @ 6:12

Here is an overview of content I published in August:

Blog posts:

SANS ISC Diary entries:

Sunday 30 August 2020

Update: oledump.py 0.0.53

Filed under: My Software,Update — Didier Stevens @ 13:45

This new version of oledump.py has bug fixes, updates for -s and –raw -v options, plugins, and a bug fix for plugin_vbaproject.

Streams can now be select (-s –select) by name too. Make sure to include the single quotes:

oledump_V0_0_53.zip (https)
MD5: C26EB56580D65B2E856169A3EFC9BC03
SHA256: A10D90284F10C6D7811E2573049FE0F8315F04129846898C88E0184423988CD9

Sunday 23 August 2020

New Tool: XORSearch.py

Filed under: Announcement,My Software — Didier Stevens @ 19:42

XORSearch, written in C, is a tool of mine I started 10+ years ago. But more and more security tools don’t like it.

So I decided to stop adding new features to XORSeach in C, and start programming a Python version to implement new features. This is a work in progress.

For the moment, the Python version only supports XOR-encoding with a one-byte key, and can only search for printable content.

Take a look at my SANS ISC diary entry to see how I use it.

I will still maintain the C version: perform bug fixes and add new features that require the speed of compiled C.

But features like detecting printable content will normally be used on small files, and then speed is not an issue.

Sunday 16 August 2020

Update: numbers-to-string.py Version 0.0.10

Filed under: My Software,Update — Didier Stevens @ 8:39

This new version of numbers-to-string.py, a tool to extract numbers from text files and convert them to strings, adds a verbose option (-v –verbose).


Running this with verbose option shows which lines were selected for number extraction:

numbers-to-string_v0_0_10.zip (https)
MD5: C7B8985C5A7D856F68A88BBD491375E6
SHA256: 8CED403C795E9287DD1500C8A0EFBF41F8837BE112113D425A7F8C97D9D1A27E

Sunday 2 August 2020

Videos: Defective USB Cable

Filed under: Hardware,video — Didier Stevens @ 0:00

When I had issues with my portapack, it took me some time to remark that these issues only happened with a particular USB cable.

The SDR would work fine, and then when I would try to record or playback, the screen would turn dark.

You can see this in the following video:

What is happening, is that this particular USB cable is electrically defective: the voltage drop is too large, due to the abnormally high resistance of the cable. The portapack doesn’t receive enough power, and starts to malfunction.

In the following 2 videos, I perform various tests with that defective cable:

Videos on my video blog (with some info on the devices I used):

Saturday 1 August 2020

Overview of Content Published in July

Filed under: Announcement — Didier Stevens @ 0:00

Here is an overview of content I published in July:

Blog posts:

YouTube videos:

Videoblog posts:

SANS ISC Diary entries:

Thursday 30 July 2020

Update: pecheck.py Version 0.7.11

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a bugfix version

pecheck-v0_7_11.zip (https)
MD5: D3B69575F0A08377D1A08886D34230FD
SHA256: 2B59F745377EABDF81118997CA70F5F4DBC1CE927370F02C6E0262869F988FA9

Tuesday 28 July 2020

Update: InteractiveSieve 0.9.1

Filed under: My Software,Update — Didier Stevens @ 0:00

There are many new features in this update to InteractiveSieve (I neglected to publish updates).

InteractiveSieve is a C# tool I developed to help me visualize and sift through logs (CSV files).

I want to record a couple of videos to show what this tool can do.

Here is a list of updates:

  • Added Remember and >= <= popup menu commands
  • Added Paste to Sift dialog
  • Added separator option None
  • Added choice for Pivot table: matrix, list and uniques
  • Fixed Reveal all bug, thanks Bart Vanautgaerden for reporting
  • Added Hide colored lines and Hine uncolored lines; Added Info and Set as index column
  • Bugfix DataGridViewEx
  • Added Load sieve and Save sieve
  • Added m:n to pivot table
  • Added Invert
  • Added bookmarks
  • Added Previous and Next Bookmark toolbar buttons
  • Bugfix SaveSieve for bookmarks
  • Added Comment…
  • Added header when saving
  • Fix for header when loading with filter
  • Added load with lookup
  • Added Treeview
  • Added drag and drop; automatic and colon separator; invert with load filter
  • Added Copy for row
  • Pivot table list and uniques: Added support for Hide and Color buttons
  • Added Sift… value
  • Added Transform (regex) and restore
  • Added Reload

InteractiveSieve_V_0_9_1_0.zip (https)
MD5: C8B5B3E768FB62B7508F055122453594
SHA256: 063A83D9DBA900C8B245532D510E822A305B258C9A3DD05F19F4F0ED2753B6E1

Monday 27 July 2020

Update: zipdump.py Version 0.0.20

Filed under: My Software,Update — Didier Stevens @ 0:00

I added detection of data descriptor records (PK 0x07 0x08) to option -f L (list all ZIP records found inside the provided file).

zipdump_v0_0_20.zip (https)
MD5: A0A826BB92805997ED3D9793C8B24385
SHA256: AC626299A6048FA4A7E8BE2993411870F77B4B89F647B6C4264E0CC22E180999

Sunday 26 July 2020

Update: oledump.py 0.0.52

Filed under: My Software,Update — Didier Stevens @ 0:00

This new version of oledump.py brings support for AES encrypted ZIP files via Python module pyzipper (Python 3 only). If module pyzipper is not installed, oledump will fall back to builtin module zipfile.


And plugin plugin_vbaproject.py does now a small dictionary attack on the extracted hash to try to recover the password.

I use the same dictionary as in zipdump.py, a dictionary that is the public domain, default wordlist used by John the Ripper, extended with a couple of passwords: infected, P@ssw0rd and VelvetSweatshop.

oledump_V0_0_52.zip (https)
MD5: 2528824D8A7CD2BE98615B1B1AE8C61A
SHA256: C47A9CC658571FF23E70264B4DD4F8F47D244708E7110EA0A28128F175CF80F5

« Previous PageNext Page »

Blog at WordPress.com.