I releasing a new version of my beta tool onedump.py to list files embedded inside OneNote files (.one). I had to extract all the embedded files out of a set of .one files. This update adds option –jsonoutput that helps with this problem.

Running command “onedump.py –jsonoutput *.one” will create a JSON document containing all embedded files inside all *.one files. I can then write these files to disk with my myjson-filter.py tool, like this:

onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir

Here is an overview of content I published in September: Blog posts:

• b’Update: search-for-compression.py Version 0.0.8′

SANS ISC Diary entries:

• YARA 4.5.0 Release
• TerminalFix: PNG Steganography
• Wireshark 4.6.9 Released

I’ve noticed when a zlib compressed chunk of data is followed by other data, search-for-compression.py will not always be able to detect the compressed chunk. This is caused by the fact that the other data generates a decompression error, and the complete chunk is disregarded.

I’ve added a new option to try to solve this: -S

Option -S takes a value, a positive number. It’s the size of the decompression buffer. By default, its value is 0.

When you try -S 100 for example, search-for-compression.py will try to decompress up to 100 bytes. If that succeeds, then we assume that we found compressed data, and search-for-compression.py will try to decompress the remainder of the data until either a decompression error occurs, or there is no more data. But when an error occurs, search-for-compression.py will revert to the last decompression without error, and report that.

search-for-compression.py is still in my beta repository.

Here is an overview of content I published in August: Blog posts:

• Update: base64dump.py Version 0.0.31

SANS ISC Diary entries:

• Wireshark 4.6.8 Released
• DOUBLECUP’s PNG Payload
• YARA-X 1.20.0 Release

More info on this update: “zipdump.py: Metadata Encoding“.

base64dump_V0_0_31.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

Here is an overview of content I published in July: SANS ISC Diary entries:

• Wireshark 4.6.7 Released
• zipdump.py: Metadata Encoding

Here is an overview of content I published in June: Blog posts:

• Update: base64dump.py Version 0.0.30

SANS ISC Diary entries:

• Microsoft’s Coreutils for Windows
• Evil MSI Background: BASE64 Statistical Analysis
• YARA-X 1.18.0 and 1.19.0 Release

This new version adds option –stats. For more details, take a look at SANS Internet Storm Center diary entry “Evil MSI Background: BASE64 Statistical Analysis“.

base64dump_V0_0_30.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

Here is an overview of content I published in May: Blog posts:

• Update: search-for-compression.py Version 0.0.7

SANS ISC Diary entries:

• Wireshark 4.6.5 Released
• YARA-X 1.16.0 Release
• Wireshark 4.6.6 Released
• Microsoft Access VBA
• YARA-X 1.17.0 Release

This is a small bug fix for search-for-compression.py, and I’m also taking it out of the beta repository and putting it into the DidierStevensSuite repository.

search-for-compression_V0_0_7.zip (http)
MD5: DD113FF41851A562D271804E4558EA08
SHA256: 6E663316F774BA5B373704E7FE41B8266F5D1ADC618327F9F2C4C4C830A1B3DE

Here is an overview of content I published in April: Blog posts:

• Update: cut-bytes.py Version 0.0.18

SANS ISC Diary entries:

• A .WAV With A Payload

This is a fix for escape sequences that trigger warnings in the latest Python versions.

cut-bytes_V0_0_18.zip (http)
MD5: C5FE455A5371C6675EDF16200D7C5657
SHA256: A4F2A2CFE3614F32F9127F1BAA898260B7C3DF6DEA9544513A375519DE7A5595

Here is an overview of content I published in March: Blog posts:

• Update: base64dump.py Version 0.0.29
• Update: emldump.py Version 0.0.16
• Update: search-for-compression.py 0.0.6
• Update: pecheck.py Version 0.7.20
• Update: zipdump.py Version 0.0.34
• Update: zipdump.py Version 0.0.34
• Update: pdf-parser.py Version 0.7.14
• Update: oledump.py Version 0.0.84
• Update: oledump.py Version 0.0.85

SANS ISC Diary entries:

• Wireshark 4.6.4 Released
• Quick Howto: ZIP Files Inside RTF
• YARA-X 1.14.0 Release
• Analyzing “Zombie Zip” Files (CVE-2026-0866)

Fixing newlines in some plugins.

oledump_V0_0_85.zip (http)
MD5: D972CE411B395EF77DBCE9A63059E8C1
SHA256: 721C095F3126745A42720316A0B3AC1BCCB9DCDBBA9FF59F5FE1F70F8BA3A1AB

This is a fix for option –yarastrings.

oledump_V0_0_84.zip (http)
MD5: 24EA0DEAA6FCB2FA234F33DD179BBAAF
SHA256: C966607C864AAE1D956279B4C3087D37BD003072ED39143512979E771BA5462A

This is a fix for option –yarastrings.

pdf-parser_V0_7_14.zip (http)
MD5: EB3808ACE5497B428138594AFDC5205F
SHA256: 6A60223D52B75F8AFF8C8CF19A58699A20829AC758C251B405B08EC734EF6A4A

This update adds option forcedecompress when using options -f and -s.

More info: Analyzing “Zombie Zip” Files (CVE-2026-0866).

zipdump_v0_0_35.zip (http)
MD5: F4A48AE14C1B258D688BF61D9ACF5E54
SHA256: 8DF7B3EBA282A0391AD619AD33A5F77CD25CC0FDA760E116934DD953714A27C5

This is a fix for option –yarastrings.

zipdump_v0_0_34.zip (http)
MD5: F2BB1DF9A4E1BA323D85C3F8F71B5E69
SHA256: 2455A026DB2BE1678AD8F1AAC2D148D40A7AB7412CCE180C3E9E1FC4B39B9378

This is a fix for option –yarastrings.

pecheck-v0_7_20.zip (http)
MD5: DB34684DA9A5DEC0E94746328318FFE1
SHA256: F6B702206E4DAE3971778263F4B234F7E77BA91A3A1F59419D12CA312316CA96

This is a fix for option –yarastrings in search-for-compression.py.