Here is an overview of content I published in August: Blog posts:

• Update: base64dump.py Version 0.0.31

SANS ISC Diary entries:

• Wireshark 4.6.8 Released
• DOUBLECUP’s PNG Payload
• YARA-X 1.20.0 Release

Here is an overview of content I published in June: Blog posts:

• Update: base64dump.py Version 0.0.30

SANS ISC Diary entries:

• Microsoft’s Coreutils for Windows
• Evil MSI Background: BASE64 Statistical Analysis
• YARA-X 1.18.0 and 1.19.0 Release

Here is an overview of content I published in May: Blog posts:

• Update: search-for-compression.py Version 0.0.7

SANS ISC Diary entries:

• Wireshark 4.6.5 Released
• YARA-X 1.16.0 Release
• Wireshark 4.6.6 Released
• Microsoft Access VBA
• YARA-X 1.17.0 Release

Here is an overview of content I published in April: Blog posts:

• Update: cut-bytes.py Version 0.0.18

SANS ISC Diary entries:

• A .WAV With A Payload

Here is an overview of content I published in March: Blog posts:

• Update: base64dump.py Version 0.0.29
• Update: emldump.py Version 0.0.16
• Update: search-for-compression.py 0.0.6
• Update: pecheck.py Version 0.7.20
• Update: zipdump.py Version 0.0.34
• Update: zipdump.py Version 0.0.34
• Update: pdf-parser.py Version 0.7.14
• Update: oledump.py Version 0.0.84
• Update: oledump.py Version 0.0.85

SANS ISC Diary entries:

• Wireshark 4.6.4 Released
• Quick Howto: ZIP Files Inside RTF
• YARA-X 1.14.0 Release
• Analyzing “Zombie Zip” Files (CVE-2026-0866)

Here is an overview of content I published in February: Blog posts:

• Update: rtfdump.py Version 0.0.14
• Update: rtfdump.py Version 0.0.15

SANS ISC Diary entries:

• YARA-X 1.13.0 Release
• Quick Howto: Extract URLs from RTF files

Here is an overview of content I published in January: Blog posts:

• Update: hash.py Version 0.0.14
• Update: zipdump.py Version 0.0.33

SANS ISC Diary entries:

• YARA-X 1.11.0 Release: Hash Function Warnings
• Wireshark 4.6.3 Released
• “How many states are there in the United States?”

Here is an overview of content I published in 2025:

Blog posts:

• Update: strings.py Version 0.0.11
• Quickpost: Electrical Power & Mining
• Update: Python Templates Version 0.0.12
• Update: cs-decrypt-metadata.py Version?0.0.5
• Update: zoneidentifier.exe Version 0.0.2
• Update: oledump.py Version 0.0.79
• Update: 1768.py Version 0.0.23
• Update: pdfid.py Version 0.2.10
• Update: pdf-parser.py Version 0.7.11
• Update: xmldump.py Version 0.0.10
• Update: zipdump.py Version 0.0.31
• Quickpost: Electrical Power & Mining: Dissipated Heat
• Update: xorsearch.py Version 0.0.2
• Update: xorsearch.py Version 0.0.3
• Quickpost: Testing The Capacity Of My New Power Bank
• Update: xorsearch.py Version 0.0.4
• Update: basedump64.py Version 0.0.28
• Update: emldump.py Version 0.0.15
• Update: pecheck.py Version 0.7.17
• Update: rtfdump.py Version 0.0.13
• Update: zipdump.py Version 0.0.32
• Update: oledump.py Version 0.0.80
• Update: pdf-parser.py Version 0.7.2
• Update: re-search.py Version 0.0.23
• Update: xorsearch.py Version 0.0.5
• Update: myjson-filter.py Version 0.0.7
• Update: oledump.py Version 0.0.81
• Update: process-binary-file.py Version 0.0.11
• Quickpost: Airplanes & Radiation
• Update: oledump.py Version 0.0.82
• Update: myjson-filter.py Version 0.0.8
• Update: myjson-transform.py Version 0.0.2
• Update: search-for-compression.py Version 0.0.4
• Quickpost: Firefox Profiles and Multiple Instances
• Quickpost: emldump Bulk Extraction
• DSS_DEFAULT_HASH_ALGORITHMS
• Python Requirements for Didier Stevens Suite
• Quickpost: USB-C Couplers
• Update: pngdump.py Version 0.0.7
• My Fridge & My Portable Power Station
• Update: pecheck.py Version 0.7.18
• Update: search-for-compression.py 0.0.5
• Update: myjson-filter.py Version 0.0.9
• Update: virustotal-search.py Version 0.1.9
• New Tool: myipaddress.py
• Update: teeplus.py Version 0.0.2
• Quickpost: Doorbell & Condensation
• Quickpost: 12V Portable Power Station
• Update: pdf-parser.py Version 0.7.13
• Quickpost: PEP 515 ? Underscores in Numeric Literals
• Update: dnsresolver.py Version 0.0.4
• Bytes over DNS Tools
• Update: cs-parse-traffic.py Version 0.0.6
• Update: numbers-to-hex.py Version 0.0.4
• Quickpost: Power Requirements Of A Keylogger
• Quickpost: CR1225 vs CR1220
• Copy/Paste Delays In Excel Because Of Default Printer
• Quickpost: USB Electric Razor
• Quickpost: USB-C Rechargeable Batteries
• USB Trigger Boards
• Update: pecheck.py Version 0.7.19
• Using a USB-C Trigger Cable To Power An FM Radio

SANS ISC Diary entries:

• Wireshark 4.4.3 Released
• Multi-OLE
• Partial ZIP File Downloads
• Crypto Wallet Scam
• Crypto Wallet Scam: Not For Free
• Reminder: 7-Zip & MoW
• Wireshark 4.4.4 Released
• Wireshark 4.4.5 Released
• Mark of the Web: Some Technical Details
• Static Analysis of GUID Encoded Shellcode
• XORsearch: Searching With Regexes
• xorsearch.py: Searching With Regexes
• Wireshark 4.4.6 Released
• xorsearch.py: “Ad Hoc YARA Rules”
• Steganography Analysis With pngdump.py
• Steganography Analysis With pngdump.py: Bitstreams
• Steganography Challenge
• Steganography Challenge: My Solution
• xorsearch.py: Python Functions
• YARA 4.5.3 Release
• Wireshark 4.4.7 Released
• Extracting With pngdump.py
• A JPEG With A Payload
• ADS & Python Tools
• Wireshark 4.4.8 Released
• WinRAR MoTW Propagation Privacy
• Wireshark 4.4.9 Released
• pdf-parser: All Streams
• BASE64 Over DNS
• Web Searches For Archives
• Wireshark 4.4.10 and 4.6.0 Released
• Kaitai Struct WebIDE
• Bytes over DNS
• Honeypot: Requests for (Code) Repositories
• Honeypot: FortiWeb CVE-2025-64446 Exploits
• SANS Holiday Hack Challenge 2025
• Finger.exe & ClickFix
• Decoding Binary Numeric Expressions
• Wireshark 4.4.1 Released
• YARA-X 1.10.0 Release: Fix Warnings
• Wireshark 4.6.2 Released
• DLLs & TLS Callbacks

Here is an overview of content I published in December: Blog posts:

• Quickpost: USB Electric Razor
• Quickpost: USB-C Rechargeable Batteries
• USB Trigger Boards
• Update: pecheck.py Version 0.7.19
• Using a USB-C Trigger Cable To Power An FM Radio

SANS ISC Diary entries:

• Wireshark 4.6.2 Released
• DLLs & TLS Callbacks

Here is an overview of content I published in November:

Blog posts:

• Update: cs-parse-traffic.py Version 0.0.6
• Update: numbers-to-hex.py Version 0.0.4
• Quickpost: Power Requirements Of A Keylogger
• Quickpost: CR1225 vs CR1220
• Copy/Paste Delays In Excel Because Of Default Printer

SANS ISC Diary entries:

• Honeypot: Requests for (Code) Repositories
• Honeypot: FortiWeb CVE-2025-64446 Exploits
• SANS Holiday Hack Challenge 2025
• Finger.exe & ClickFix
• Decoding Binary Numeric Expressions
• Wireshark 4.4.1 Released
• YARA-X 1.10.0 Release: Fix Warnings