Here is an overview of content I published in April: Blog posts:

• Update: cut-bytes.py Version 0.0.18

SANS ISC Diary entries:

• A .WAV With A Payload

This is a fix for escape sequences that trigger warnings in the latest Python versions.

cut-bytes_V0_0_18.zip (http)
MD5: C5FE455A5371C6675EDF16200D7C5657
SHA256: A4F2A2CFE3614F32F9127F1BAA898260B7C3DF6DEA9544513A375519DE7A5595

Here is an overview of content I published in March: Blog posts:

• Update: base64dump.py Version 0.0.29
• Update: emldump.py Version 0.0.16
• Update: search-for-compression.py 0.0.6
• Update: pecheck.py Version 0.7.20
• Update: zipdump.py Version 0.0.34
• Update: zipdump.py Version 0.0.34
• Update: pdf-parser.py Version 0.7.14
• Update: oledump.py Version 0.0.84
• Update: oledump.py Version 0.0.85

SANS ISC Diary entries:

• Wireshark 4.6.4 Released
• Quick Howto: ZIP Files Inside RTF
• YARA-X 1.14.0 Release
• Analyzing “Zombie Zip” Files (CVE-2026-0866)

Fixing newlines in some plugins.

oledump_V0_0_85.zip (http)
MD5: D972CE411B395EF77DBCE9A63059E8C1
SHA256: 721C095F3126745A42720316A0B3AC1BCCB9DCDBBA9FF59F5FE1F70F8BA3A1AB

This is a fix for option –yarastrings.

oledump_V0_0_84.zip (http)
MD5: 24EA0DEAA6FCB2FA234F33DD179BBAAF
SHA256: C966607C864AAE1D956279B4C3087D37BD003072ED39143512979E771BA5462A

This is a fix for option –yarastrings.

pdf-parser_V0_7_14.zip (http)
MD5: EB3808ACE5497B428138594AFDC5205F
SHA256: 6A60223D52B75F8AFF8C8CF19A58699A20829AC758C251B405B08EC734EF6A4A

This update adds option forcedecompress when using options -f and -s.

More info: Analyzing “Zombie Zip” Files (CVE-2026-0866).

zipdump_v0_0_35.zip (http)
MD5: F4A48AE14C1B258D688BF61D9ACF5E54
SHA256: 8DF7B3EBA282A0391AD619AD33A5F77CD25CC0FDA760E116934DD953714A27C5

This is a fix for option –yarastrings.

zipdump_v0_0_34.zip (http)
MD5: F2BB1DF9A4E1BA323D85C3F8F71B5E69
SHA256: 2455A026DB2BE1678AD8F1AAC2D148D40A7AB7412CCE180C3E9E1FC4B39B9378

This is a fix for option –yarastrings.

pecheck-v0_7_20.zip (http)
MD5: DB34684DA9A5DEC0E94746328318FFE1
SHA256: F6B702206E4DAE3971778263F4B234F7E77BA91A3A1F59419D12CA312316CA96

This is a fix for option –yarastrings in search-for-compression.py.

This is a fix for option –yarastrings.

emldump_V0_0_16.zip (http)
MD5: FF80F7768800EB5AB3A77FEF3E162285
SHA256: 87A33A9345C927B56377CBEC04811826930866C181885A6793F70C53A3418426

This is a fix for option –yarastrings.

base64dump_V0_0_29.zip (http)
MD5: CA3FD00D6AD8B6C0CD091526E3D45D72
SHA256: 2B203BF336D4D7971E4277CE9438D271E9F002E75A2386B97BA61C543D712964

Here is an overview of content I published in February: Blog posts:

• Update: rtfdump.py Version 0.0.14
• Update: rtfdump.py Version 0.0.15

SANS ISC Diary entries:

• YARA-X 1.13.0 Release
• Quick Howto: Extract URLs from RTF files

This is a fix for option –yarastrings.

rtfdump_V0_0_15.zip (http)
MD5: C70F327DDC11B549A399B2F85B2B9607
SHA256: 9EFDEB5978372BD93065BCDAB6486DAECA4CB7E2EDA15DD5BD4C98AF69FB19A7

This update adds option -C (–combinations). When this option is used together with -j (–jsonoutput), 2 extra versions of each stream are added. One with option -H enabled, and one with option -H and -S enabled.

rtfdump_V0_0_14.zip (http)
MD5: D9BBA8F83E04D4FD25268E7A2BB4653E
SHA256: DB852CEDA1AE368FF32C1D12951A02BD7A4E36C74632D0D1F790C700FB298689

Here is an overview of content I published in January: Blog posts:

• Update: hash.py Version 0.0.14
• Update: zipdump.py Version 0.0.33

SANS ISC Diary entries:

• YARA-X 1.11.0 Release: Hash Function Warnings
• Wireshark 4.6.3 Released
• “How many states are there in the United States?”

This update adds pseudo-field sha256 which can be used to calculate the sha256 hash of the content (compressed or decompressed):
-E sha256:data
-E sha256:data:decompress
-E sha256:decompress
-E sha256:extra

zipdump_v0_0_33.zip (http)
MD5: ABF2AC037D2CB7E26664D28B109E9293
SHA256: A80E956072E9C4E3051992EA3E551444585854747EFE2A997A232E6F5B94E8E4

This is a bug fix version.

hash_V0_0_14.zip (http)
MD5: 66A205915A280CC474541053739B8EDD
SHA256: C459B75F132BB4AA394D8EA27A79F409C446AAA67536946673EC824EA9219F9F

Here is an overview of content I published in 2025:

Blog posts:

• Update: strings.py Version 0.0.11
• Quickpost: Electrical Power & Mining
• Update: Python Templates Version 0.0.12
• Update: cs-decrypt-metadata.py Version?0.0.5
• Update: zoneidentifier.exe Version 0.0.2
• Update: oledump.py Version 0.0.79
• Update: 1768.py Version 0.0.23
• Update: pdfid.py Version 0.2.10
• Update: pdf-parser.py Version 0.7.11
• Update: xmldump.py Version 0.0.10
• Update: zipdump.py Version 0.0.31
• Quickpost: Electrical Power & Mining: Dissipated Heat
• Update: xorsearch.py Version 0.0.2
• Update: xorsearch.py Version 0.0.3
• Quickpost: Testing The Capacity Of My New Power Bank
• Update: xorsearch.py Version 0.0.4
• Update: basedump64.py Version 0.0.28
• Update: emldump.py Version 0.0.15
• Update: pecheck.py Version 0.7.17
• Update: rtfdump.py Version 0.0.13
• Update: zipdump.py Version 0.0.32
• Update: oledump.py Version 0.0.80
• Update: pdf-parser.py Version 0.7.2
• Update: re-search.py Version 0.0.23
• Update: xorsearch.py Version 0.0.5
• Update: myjson-filter.py Version 0.0.7
• Update: oledump.py Version 0.0.81
• Update: process-binary-file.py Version 0.0.11
• Quickpost: Airplanes & Radiation
• Update: oledump.py Version 0.0.82
• Update: myjson-filter.py Version 0.0.8
• Update: myjson-transform.py Version 0.0.2
• Update: search-for-compression.py Version 0.0.4
• Quickpost: Firefox Profiles and Multiple Instances
• Quickpost: emldump Bulk Extraction
• DSS_DEFAULT_HASH_ALGORITHMS
• Python Requirements for Didier Stevens Suite
• Quickpost: USB-C Couplers
• Update: pngdump.py Version 0.0.7
• My Fridge & My Portable Power Station
• Update: pecheck.py Version 0.7.18
• Update: search-for-compression.py 0.0.5
• Update: myjson-filter.py Version 0.0.9
• Update: virustotal-search.py Version 0.1.9
• New Tool: myipaddress.py
• Update: teeplus.py Version 0.0.2
• Quickpost: Doorbell & Condensation
• Quickpost: 12V Portable Power Station
• Update: pdf-parser.py Version 0.7.13
• Quickpost: PEP 515 ? Underscores in Numeric Literals
• Update: dnsresolver.py Version 0.0.4
• Bytes over DNS Tools
• Update: cs-parse-traffic.py Version 0.0.6
• Update: numbers-to-hex.py Version 0.0.4
• Quickpost: Power Requirements Of A Keylogger
• Quickpost: CR1225 vs CR1220
• Copy/Paste Delays In Excel Because Of Default Printer
• Quickpost: USB Electric Razor
• Quickpost: USB-C Rechargeable Batteries
• USB Trigger Boards
• Update: pecheck.py Version 0.7.19
• Using a USB-C Trigger Cable To Power An FM Radio

SANS ISC Diary entries:

• Wireshark 4.4.3 Released
• Multi-OLE
• Partial ZIP File Downloads
• Crypto Wallet Scam
• Crypto Wallet Scam: Not For Free
• Reminder: 7-Zip & MoW
• Wireshark 4.4.4 Released
• Wireshark 4.4.5 Released
• Mark of the Web: Some Technical Details
• Static Analysis of GUID Encoded Shellcode
• XORsearch: Searching With Regexes
• xorsearch.py: Searching With Regexes
• Wireshark 4.4.6 Released
• xorsearch.py: “Ad Hoc YARA Rules”
• Steganography Analysis With pngdump.py
• Steganography Analysis With pngdump.py: Bitstreams
• Steganography Challenge
• Steganography Challenge: My Solution
• xorsearch.py: Python Functions
• YARA 4.5.3 Release
• Wireshark 4.4.7 Released
• Extracting With pngdump.py
• A JPEG With A Payload
• ADS & Python Tools
• Wireshark 4.4.8 Released
• WinRAR MoTW Propagation Privacy
• Wireshark 4.4.9 Released
• pdf-parser: All Streams
• BASE64 Over DNS
• Web Searches For Archives
• Wireshark 4.4.10 and 4.6.0 Released
• Kaitai Struct WebIDE
• Bytes over DNS
• Honeypot: Requests for (Code) Repositories
• Honeypot: FortiWeb CVE-2025-64446 Exploits
• SANS Holiday Hack Challenge 2025
• Finger.exe & ClickFix
• Decoding Binary Numeric Expressions
• Wireshark 4.4.1 Released
• YARA-X 1.10.0 Release: Fix Warnings
• Wireshark 4.6.2 Released
• DLLs & TLS Callbacks

Here is an overview of content I published in December: Blog posts:

• Quickpost: USB Electric Razor
• Quickpost: USB-C Rechargeable Batteries
• USB Trigger Boards
• Update: pecheck.py Version 0.7.19
• Using a USB-C Trigger Cable To Power An FM Radio

SANS ISC Diary entries:

• Wireshark 4.6.2 Released
• DLLs & TLS Callbacks