Monthly Archives: March 2012

Entropy

The upcoming version 0.8.0 version of the Profiler features computation of entropy and the representation of it through a graphical plot. The algorithm used for the calculation is the one described by Ero Carrera on his blog. When foreign data … Continue reading

Posted in Action, Data, Profiler | Tagged , , | Comments Off on Entropy

Info-Tech Storage Format support

The Info-Tech Storage Format (ITSF) is the primary format that has been adopted by Microsoft for online help files since Windows 98. Due to its popularity, it has been used (and exploited) by many other third parties, mostly because of … Continue reading

Posted in ITSF, Profiler | Tagged , , , , , , , , , | Comments Off on Info-Tech Storage Format support

PDF object search output

In the upcoming 0.8.0 version of the Profiler it will be possible to print out the matches of PDF object searches. This comes very handy during analysis if we want to know, for instance, all values for a given key. … Continue reading

Posted in PDF, Profiler | Tagged , | Comments Off on PDF object search output

Zip bomb

While the Profiler was designed for document analysis and currently has virtual memory limitations, let’s see how it performs with a Zip bomb. :) A friend of mine linked me the Zip file on this page. The file contains 16 … Continue reading

Posted in Profiler, Zip | Tagged , , | Comments Off on Zip bomb

PDF AES256 (Revision 6)

The upcoming version 0.7.9 of the Profiler features support for the still to be publicly released PDF symmetric encryption revision 6. While the PDF specifications are not yet freely available, Adobe has already started supporting the new standard. This is … Continue reading

Posted in PDF, Profiler | Tagged , , | Comments Off on PDF AES256 (Revision 6)

Zip archives support

Among other additions, the new 0.7.8 version of the Profiler features support for Zip archives and an improved interface for displaying the file hierarchy. The supported decompression methods are Deflate and BZIP2 (more will be added). All popular encryption technologies … Continue reading

Posted in Zip | Tagged | Comments Off on Zip archives support