Here is an overview of content I published in May: Blog posts:

• Update: search-for-compression.py Version 0.0.7

SANS ISC Diary entries:

• Wireshark 4.6.5 Released
• YARA-X 1.16.0 Release
• Wireshark 4.6.6 Released
• Microsoft Access VBA
• YARA-X 1.17.0 Release

This is a small bug fix for search-for-compression.py, and I’m also taking it out of the beta repository and putting it into the DidierStevensSuite repository.

search-for-compression_V0_0_7.zip (http)
MD5: DD113FF41851A562D271804E4558EA08
SHA256: 6E663316F774BA5B373704E7FE41B8266F5D1ADC618327F9F2C4C4C830A1B3DE

Here is an overview of content I published in April: Blog posts:

• Update: cut-bytes.py Version 0.0.18

SANS ISC Diary entries:

• A .WAV With A Payload

This is a fix for escape sequences that trigger warnings in the latest Python versions.

cut-bytes_V0_0_18.zip (http)
MD5: C5FE455A5371C6675EDF16200D7C5657
SHA256: A4F2A2CFE3614F32F9127F1BAA898260B7C3DF6DEA9544513A375519DE7A5595

Here is an overview of content I published in March: Blog posts:

• Update: base64dump.py Version 0.0.29
• Update: emldump.py Version 0.0.16
• Update: search-for-compression.py 0.0.6
• Update: pecheck.py Version 0.7.20
• Update: zipdump.py Version 0.0.34
• Update: zipdump.py Version 0.0.34
• Update: pdf-parser.py Version 0.7.14
• Update: oledump.py Version 0.0.84
• Update: oledump.py Version 0.0.85

SANS ISC Diary entries:

• Wireshark 4.6.4 Released
• Quick Howto: ZIP Files Inside RTF
• YARA-X 1.14.0 Release
• Analyzing “Zombie Zip” Files (CVE-2026-0866)

Fixing newlines in some plugins.

oledump_V0_0_85.zip (http)
MD5: D972CE411B395EF77DBCE9A63059E8C1
SHA256: 721C095F3126745A42720316A0B3AC1BCCB9DCDBBA9FF59F5FE1F70F8BA3A1AB

This is a fix for option –yarastrings.

oledump_V0_0_84.zip (http)
MD5: 24EA0DEAA6FCB2FA234F33DD179BBAAF
SHA256: C966607C864AAE1D956279B4C3087D37BD003072ED39143512979E771BA5462A

This is a fix for option –yarastrings.

pdf-parser_V0_7_14.zip (http)
MD5: EB3808ACE5497B428138594AFDC5205F
SHA256: 6A60223D52B75F8AFF8C8CF19A58699A20829AC758C251B405B08EC734EF6A4A

This update adds option forcedecompress when using options -f and -s.

More info: Analyzing “Zombie Zip” Files (CVE-2026-0866).

zipdump_v0_0_35.zip (http)
MD5: F4A48AE14C1B258D688BF61D9ACF5E54
SHA256: 8DF7B3EBA282A0391AD619AD33A5F77CD25CC0FDA760E116934DD953714A27C5

This is a fix for option –yarastrings.

zipdump_v0_0_34.zip (http)
MD5: F2BB1DF9A4E1BA323D85C3F8F71B5E69
SHA256: 2455A026DB2BE1678AD8F1AAC2D148D40A7AB7412CCE180C3E9E1FC4B39B9378

This is a fix for option –yarastrings.

pecheck-v0_7_20.zip (http)
MD5: DB34684DA9A5DEC0E94746328318FFE1
SHA256: F6B702206E4DAE3971778263F4B234F7E77BA91A3A1F59419D12CA312316CA96

This is a fix for option –yarastrings in search-for-compression.py.

This is a fix for option –yarastrings.

emldump_V0_0_16.zip (http)
MD5: FF80F7768800EB5AB3A77FEF3E162285
SHA256: 87A33A9345C927B56377CBEC04811826930866C181885A6793F70C53A3418426

This is a fix for option –yarastrings.

base64dump_V0_0_29.zip (http)
MD5: CA3FD00D6AD8B6C0CD091526E3D45D72
SHA256: 2B203BF336D4D7971E4277CE9438D271E9F002E75A2386B97BA61C543D712964

Here is an overview of content I published in February: Blog posts:

• Update: rtfdump.py Version 0.0.14
• Update: rtfdump.py Version 0.0.15

SANS ISC Diary entries:

• YARA-X 1.13.0 Release
• Quick Howto: Extract URLs from RTF files

This is a fix for option –yarastrings.

rtfdump_V0_0_15.zip (http)
MD5: C70F327DDC11B549A399B2F85B2B9607
SHA256: 9EFDEB5978372BD93065BCDAB6486DAECA4CB7E2EDA15DD5BD4C98AF69FB19A7

This update adds option -C (–combinations). When this option is used together with -j (–jsonoutput), 2 extra versions of each stream are added. One with option -H enabled, and one with option -H and -S enabled.

rtfdump_V0_0_14.zip (http)
MD5: D9BBA8F83E04D4FD25268E7A2BB4653E
SHA256: DB852CEDA1AE368FF32C1D12951A02BD7A4E36C74632D0D1F790C700FB298689

Here is an overview of content I published in January: Blog posts:

• Update: hash.py Version 0.0.14
• Update: zipdump.py Version 0.0.33

SANS ISC Diary entries:

• YARA-X 1.11.0 Release: Hash Function Warnings
• Wireshark 4.6.3 Released
• “How many states are there in the United States?”

This update adds pseudo-field sha256 which can be used to calculate the sha256 hash of the content (compressed or decompressed):
-E sha256:data
-E sha256:data:decompress
-E sha256:decompress
-E sha256:extra

zipdump_v0_0_33.zip (http)
MD5: ABF2AC037D2CB7E26664D28B109E9293
SHA256: A80E956072E9C4E3051992EA3E551444585854747EFE2A997A232E6F5B94E8E4

This is a bug fix version.

hash_V0_0_14.zip (http)
MD5: 66A205915A280CC474541053739B8EDD
SHA256: C459B75F132BB4AA394D8EA27A79F409C446AAA67536946673EC824EA9219F9F