This new version of base64dump adds decoding of netbios name encoding with lowercase letters.
base64dump_V0_0_21.zip (http)MD5: 5701B6D9691E366ED5E2EE6D06689012
SHA256: BE939E0225C83319A31A096DA29C1CA9D3C575DCCE9C1795814B335BD0871E92
Sunday 15 May 2022
Update: base64dump.py Version 0.0.21
MD5: 5701B6D9691E366ED5E2EE6D06689012
SHA256: BE939E0225C83319A31A096DA29C1CA9D3C575DCCE9C1795814B335BD0871E92
Saturday 14 May 2022
Update: oledump.py Version 0.0.67
This new version of oledump.py brings support for user defined properties and an update to plugin plugin_msg_summary.py
Office documents with VSTO applications have user defined properties. These properties can be extracted with my plugin plugin_medata.py, but not with the current version of olefile.
However, the development version of olefile can be used to extract these properties. This new version of oledump checks if the olefile module has a function to extract user defined properties (get_userdefined_properties), and if it does, it calls it when analyzing metadata:
I added URL extracting to my plugin plugin_msg_summary, a plugin to summarize the content of an .msg file (Outlook email).
MD5: D6D1748A98AEA3D922D99415E908C609
SHA256: 092A2EA0FBB67357FC5E4D7B8E266B52EA242C147609FD025616754EAA2532E1
Friday 13 May 2022
Update: zipdump.py Version 0.0.22
This is just a bugfix version.
zipdump_v0_0_22.zip (http)MD5: 68F9F3809E4E1F9ADE4A4C3835CDF475
SHA256: 92ED372579001C826D5AF31615B8334CC798FF2DA4AF8B7C46267BF7D995C757
Sunday 8 May 2022
Update: cs-parse-traffic.py Version 0.0.5
In this update for cs-parse-traffic.py, my tool to decrypt & parse Cobalt Strike traffic, I added some error handling.
cs-parse-traffic_V0_0_5.zip (http)MD5: CFF6D97E816B23065F051D91B0F101A6
SHA256: 69763EB4D3A163824B417A0E23131B318F5E97198F255ECE449A65D4360C6302
Thursday 5 May 2022
Update: oledump.py Version 0.0.66
This new version of oledump.py brings some fixes and an update to plugin plugin_vbaproject to decode and display the password for plaintext passwords:
MD5: 20D89F0477ED7B533C2B0C6D27EC4255
SHA256: F67051EF2FA3FD42206C5ADFAC807C94ECD5F7F0F6427433B366217F675D3195
Sunday 1 May 2022
Overview of Content Published in April
Here is an overview of content I published in April:
Blog posts:
- Power Consumption Of A Philips Hue lamp In Off State
- .ISO Files With Office Maldocs & Protected View in Office 2019 and 2021
- New Tool: myjson-filter.py
- Update: cut-bytes.py Version 0.0.14
- Update: 1768.py Version 0.0.13
- New Tool: pngdump.py (Beta)
- Update: re-search.py Version 0.0.19
- Update: oledump.py Version 0.0.65
- Quickpost: Machine Code Infinite Loop
- curl 7.82.0 Adds –json Option
- jo
- Method For String Extraction Filtering
- Video: Method For String Extraction Filtering
- Office Protects You From Malicious ISO Files
- Video: Office Protects You From Malicious ISO Files
- Sysmon’s RegistryEvent (Value Set)
- Analyzing a Phishing Word Document
- YARA 4.2.1 Released
Saturday 30 April 2022
Quickpost: Machine Code Infinite Loop
Someone asked me what the byte sequence is for an infinite loop in x86 machine code (it’s something you could use while debugging, for example).
That byte sequence is just 2 bytes long: EB FE.
It’s something you can check with nasm, for example.
File jump-infinite-loop.asm:
BITS 32
loop1:
jmp loop1
loop2:
jmp short loop2
jmp $
jmp short $
jmp short -2
nasm jump-infinite-loop.asm -l jump-infinite-loop.lst
File jump-infinite-loop.lst:
1 BITS 32
2
3 loop1:
4 00000000 EBFE jmp loop1
5 loop2:
6 00000002 EBFE jmp short loop2
7 00000004 EBFE jmp $
8 00000006 EBFE jmp short $
9 00000008 EB(FE) jmp short -2
Quickpost info
Friday 29 April 2022
Update: oledump.py Version 0.0.65
This new version of oledump.py brings a new plugin (plugin_metadata) and Python 3 fixes for 2 plugins (plugin_msi and plugin_ppt).
The new plugin is actually an old unpublished plugin, that I updated recently.
This plugin parses Office document metadata as defined in document [MS-OLEPS].
I started to write this in 2015 to parse the metadata of Word documents, but soon I figured out that this functionality was already present in olefile, and I introduced option -M to call this functionality.
But recently, I had to parse metadata that isn’t (yet) parsed by olefile, so I updated and released plugin_metadata.
oledump_V0_0_65.zip (http)MD5: 319894D211E0C6F41DCEBD5DBBBE3D33
SHA256: 35786C01AC74BE8604E96B528B7EB8EEFBB0D63407D3C78CC31D058528EF20D7
Saturday 23 April 2022
Update: re-search.py Version 0.0.19
This is a Python3 stdin fix for re-search.py, my tool to search with regular expressions.
re-search_V0_0_19.zip (http)MD5: 4007A3E5540871221B55591B50E2239B
SHA256: 263236ABE75B93F1F999474D690A9EB2575EBE42CED8F369FF98B349A5116D11
Monday 18 April 2022
New Tool: pngdump.py (Beta)
Here is a new tool I’m releasing as beta: pngdump.py.
It’s a tool to analyze PNG files. Unlike jpegdump, you can not yet select items for further analysis.
Didier Stevens 