Didier Stevens

Saturday 26 April 2025

Update: rtfdump.py Version 0.0.13

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a YARA bug fix version.

rtfdump_V0_0_13.zip (http)
MD5: 0D8C3D74449C409332FD8DB9E0CBD39F
SHA256: 640C557DF98B0B80BD0647264E049BF26D68ED93E51222FCAA893025C2EEDC0C

Friday 25 April 2025

Update: pecheck.py Version 0.7.17

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a YARA bug fix version.

pecheck-v0_7_17.zip (http)
MD5: 2C1AEC3183C2E3A3FC45BD642C89716A
SHA256: C4884736955BBE579A6EA0D9A0FB8B7D6457D031593FDF3E89B31CB88CDABFE0

Thursday 24 April 2025

Update: emldump.py Version 0.0.15

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a YARA bug fix version.

emldump_V0_0_15.zip (http)
MD5: 6D329CFCF3417518870D7096E51277E7
SHA256: 5754B5F22D0BD10CBB29727C7CC4EC98407DDC920AD9F846587DE4F269279ABE

Wednesday 23 April 2025

Update: basedump64.py Version 0.0.28

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a YARA bug fix version.

base64dump_V0_0_28.zip (http)
MD5: 19B560408531D0BCE4D90C4CF94FE6A6
SHA256: 9A3734410A2054B8F93CB693C23F7AE475B3B79877FA2B9EC5E6DBCD05682D40

Tuesday 22 April 2025

Update: xorsearch.py Version 0.0.4

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a YARA bug fix version.

xorsearch_v0_0_4.zip (http)
MD5: 762F589E29847BF0CFE31FF0D38259BF
SHA256: 52EFA3EC74A4F79081E320C572793153CD300501BE48760A28194F9624EAE053

Wednesday 16 April 2025

Quickpost: Testing The Capacity Of My New Power Bank

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I bought a new power bank (Anker PowerCore 533, capacity 10.000 mAh 36 Wh, 30 Watt Power Delivery) and did some tests that I’m summarizing here.

Charging it with a generic USB C charger capable of delivering 20 W PD required 46,979 Wh. That’s measured on the 230V side, thus including the loss in the charger.

Charging it with a Anker 737 Charger (GaNPrime 120W) required 45,515 Wh.

Discharging the power bank via the USB A port connected to an electronic load gave me:

  • 30,970 Wh (6516 mAh ) when drawing 0,5A
  • 29,362 Wh (6523 mAh) when drawing 1,0A

30 Wh compared to 36 Wh (the advertised capacity of the power bank) is 83,33%, which is much better than what Anker estimates you can get out of a power bank (60% to 70%).

As I couldn’t get more than 1,0A out of the power bank via the USB A port, I used the USB C port with a trigger module to deliver 20,0V.

The electronic load drew 1,250A and measured around 18,6V, or 23,25W. I got 29,020 Wh (1557 mAh) out of it.

The power bank became hot while getting completely drained at 23W:

You can see the outline of the cells and the electronic circuit (it’s the hottest: white).

I couldn’t immediately recharge my power bank after that, I had to let it cool down (“Let the power bank cool down before use”):

I also tried to get more out of the power bank by drawing 1,5A at 18,55V or 27,82W (advertized maximum is 30W).

But after 34 minutes (delivering 15,670 Wh) it stopped delivering power and displayed the following message (“Use after protection removal”):

I guess that’s the overcurrent protection kicking in. I’m not sure why this happened, as the electronic load was in constant current mode.

I had to disconnect the cable to use the power bank again.

And finally, this power bank is capable of trickle charging: delivering a very low current for about two hours. You enable this mode by pushing the button twice.

I configured the electronic load to draw a really low current of 0,005A (it measured 0,003A) from the USB A port and it delivered 0,032 Wh (6 mAh) over a period of 2:01:05 after which it shut down automatically (as advertized).


Quickpost info

Tuesday 15 April 2025

Update: xorsearch.py Version 0.0.3

Filed under: My Software,Update — Didier Stevens @ 0:00

I added option –verbose to visualize generated YARA rules.

xorsearch_v0_0_3.zip (http)
MD5: 394557EDD88EF9862ACC97D15A2308A3
SHA256: D8FE6914F25FEC4E589A3F3EF7C30F8281C0B918D9254B8AEB2322D2BB8DAE36

Monday 14 April 2025

Update: xorsearch.py Version 0.0.2

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a rewrite of xorsearch.py, an implementation of XORsearch.exe in Python.

xorsearch_v0_0_2.zip (http)
MD5: 4AA44E14060B461405AD670AE20D4AAC
SHA256: F452BC239664A1516070D79596C2FC5238963833440C66CD77DC8892C30A3D0D

Sunday 13 April 2025

Overview of Content Published in March

Filed under: Announcement — Didier Stevens @ 7:53
Here is an overview of content I published in March:

Blog posts: SANS ISC Diary entries:

Sunday 30 March 2025

Quickpost: Electrical Power & Mining: Dissipated Heat

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I got an interesting question on my blog post “Quickpost: Electrical Power & Mining“:

Does the temperature in your room increase due to the miner running full blast? Would you turn down the heater to compensate (which may change the calculation slightly).

That was indeed the case: I did turn down the heating in the room, and the heat of the desktop computer made it a nice 20°C.

We heat our home with natural gas, and on that day, we consumed 2,23 cubic meters to heat the rooms in our house, except for the office where the computer was running. Counting the volumes of the rooms, I estimate that 0,55 cubic meters would have been necessary to heat the office.

Using that same spreadsheet, consuming an extra 0,55 cubic meter would cost me €0,55. Deducting this from the €3,91 I had to spend on electricity gives me €3,36, which is still around 10 times more than the €0,39 I earned through mining.


Quickpost info
« Previous PageNext Page »

Blog at WordPress.com.