I releasing a new version of my beta tool onedump.py to list files embedded inside OneNote files (.one). I had to extract all the embedded files out of a set of .one files. This update adds option –jsonoutput that helps with this problem.

Running command “onedump.py –jsonoutput *.one” will create a JSON document containing all embedded files inside all *.one files. I can then write these files to disk with my myjson-filter.py tool, like this:

onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir

I’ve noticed when a zlib compressed chunk of data is followed by other data, search-for-compression.py will not always be able to detect the compressed chunk. This is caused by the fact that the other data generates a decompression error, and the complete chunk is disregarded.

I’ve added a new option to try to solve this: -S

Option -S takes a value, a positive number. It’s the size of the decompression buffer. By default, its value is 0.

When you try -S 100 for example, search-for-compression.py will try to decompress up to 100 bytes. If that succeeds, then we assume that we found compressed data, and search-for-compression.py will try to decompress the remainder of the data until either a decompression error occurs, or there is no more data. But when an error occurs, search-for-compression.py will revert to the last decompression without error, and report that.

search-for-compression.py is still in my beta repository.

More info on this update: “zipdump.py: Metadata Encoding“.

base64dump_V0_0_31.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

This new version adds option –stats. For more details, take a look at SANS Internet Storm Center diary entry “Evil MSI Background: BASE64 Statistical Analysis“.

base64dump_V0_0_30.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

This is a small bug fix for search-for-compression.py, and I’m also taking it out of the beta repository and putting it into the DidierStevensSuite repository.

search-for-compression_V0_0_7.zip (http)
MD5: DD113FF41851A562D271804E4558EA08
SHA256: 6E663316F774BA5B373704E7FE41B8266F5D1ADC618327F9F2C4C4C830A1B3DE

This is a fix for escape sequences that trigger warnings in the latest Python versions.

cut-bytes_V0_0_18.zip (http)
MD5: C5FE455A5371C6675EDF16200D7C5657
SHA256: A4F2A2CFE3614F32F9127F1BAA898260B7C3DF6DEA9544513A375519DE7A5595

Fixing newlines in some plugins.

oledump_V0_0_85.zip (http)
MD5: D972CE411B395EF77DBCE9A63059E8C1
SHA256: 721C095F3126745A42720316A0B3AC1BCCB9DCDBBA9FF59F5FE1F70F8BA3A1AB

This is a fix for option –yarastrings.

oledump_V0_0_84.zip (http)
MD5: 24EA0DEAA6FCB2FA234F33DD179BBAAF
SHA256: C966607C864AAE1D956279B4C3087D37BD003072ED39143512979E771BA5462A

This is a fix for option –yarastrings.

pdf-parser_V0_7_14.zip (http)
MD5: EB3808ACE5497B428138594AFDC5205F
SHA256: 6A60223D52B75F8AFF8C8CF19A58699A20829AC758C251B405B08EC734EF6A4A

This update adds option forcedecompress when using options -f and -s.

More info: Analyzing “Zombie Zip” Files (CVE-2026-0866).

zipdump_v0_0_35.zip (http)
MD5: F4A48AE14C1B258D688BF61D9ACF5E54
SHA256: 8DF7B3EBA282A0391AD619AD33A5F77CD25CC0FDA760E116934DD953714A27C5

This is a fix for option –yarastrings.

zipdump_v0_0_34.zip (http)
MD5: F2BB1DF9A4E1BA323D85C3F8F71B5E69
SHA256: 2455A026DB2BE1678AD8F1AAC2D148D40A7AB7412CCE180C3E9E1FC4B39B9378

This is a fix for option –yarastrings.

pecheck-v0_7_20.zip (http)
MD5: DB34684DA9A5DEC0E94746328318FFE1
SHA256: F6B702206E4DAE3971778263F4B234F7E77BA91A3A1F59419D12CA312316CA96

This is a fix for option –yarastrings in search-for-compression.py.

This is a fix for option –yarastrings.

emldump_V0_0_16.zip (http)
MD5: FF80F7768800EB5AB3A77FEF3E162285
SHA256: 87A33A9345C927B56377CBEC04811826930866C181885A6793F70C53A3418426

This is a fix for option –yarastrings.

base64dump_V0_0_29.zip (http)
MD5: CA3FD00D6AD8B6C0CD091526E3D45D72
SHA256: 2B203BF336D4D7971E4277CE9438D271E9F002E75A2386B97BA61C543D712964

This is a fix for option –yarastrings.

rtfdump_V0_0_15.zip (http)
MD5: C70F327DDC11B549A399B2F85B2B9607
SHA256: 9EFDEB5978372BD93065BCDAB6486DAECA4CB7E2EDA15DD5BD4C98AF69FB19A7

This update adds option -C (–combinations). When this option is used together with -j (–jsonoutput), 2 extra versions of each stream are added. One with option -H enabled, and one with option -H and -S enabled.

rtfdump_V0_0_14.zip (http)
MD5: D9BBA8F83E04D4FD25268E7A2BB4653E
SHA256: DB852CEDA1AE368FF32C1D12951A02BD7A4E36C74632D0D1F790C700FB298689

This update adds pseudo-field sha256 which can be used to calculate the sha256 hash of the content (compressed or decompressed):
-E sha256:data
-E sha256:data:decompress
-E sha256:decompress
-E sha256:extra

zipdump_v0_0_33.zip (http)
MD5: ABF2AC037D2CB7E26664D28B109E9293
SHA256: A80E956072E9C4E3051992EA3E551444585854747EFE2A997A232E6F5B94E8E4

This is a bug fix version.

hash_V0_0_14.zip (http)
MD5: 66A205915A280CC474541053739B8EDD
SHA256: C459B75F132BB4AA394D8EA27A79F409C446AAA67536946673EC824EA9219F9F

This is a small fix for an escape sequence warning.

pecheck-v0_7_19.zip (http)
MD5: A53F4648119CC9A44FB684EAC2C84C08
SHA256: 67637A257967807800AF04D45E0B8DA8F32D38AA772C3596DAE7E0CD4ECFCE52