Updates II

• libemu pop esp and jg bugfixes
• now supports drag and drop for shellcode files and folders

• FaxDecode filter added
• JBIG2 filter added (disabled by default)
• right click Image viewer feature added (for JPXDecode and DCTDecode streams)
• tools->Filter Visualizer form added
• tools->Download file w/progressbar and abort support
• Search->extract URLS
• Search->Filter Chains
• dedicated hexeditor component now utilized
• VirusTotal plugin
  • Hash lookup of the current pdf
  • Bulk hash lookup of embedded objects in the current pdf
  • Bulk hash lookup of CRLF list of MD5s loaded from clipboard

• Virustotal app, right click in explorer, or bulk lookup from Hash Files form.
• added dirwatch and procwatch from SysAnalyzer package. (monitor file system changes and process creation events)
• added finddll command line utility (scan all processes for target dll)
• ShellExt.Hash files right click menu:
  • Copy Hashs
  • VirusTotal search selected, VirusTotal search All
  • Make Extensions Safe,
  • Rename to MD5,
  • Coopy to CSV,
  • Rename Extensions.
  • A compile date/detected file type field was also added
  • Google search for hash button added
• ShellExt.Strings form:
  • Find all button
  • file offsets now included in results with raw and VA modes(for PE files)
  • progress bar displayed while searching or scanning
  • better font
  • automatic filter to reduce noise (filtered results still viewable)
  • rescan button to change size of minimum match length
  • form maintains its size and position across runs now

• now has tcpdump option to take full pcap
• more filtering on directory watch captures
• sniffhit now defaults to non-promiscious mode
• api_log.dll now hooks and ignores calls to sleep
• api_log supports config (and runtime reconfig) options
• api_logger.exe expanded and includes preliminary log parser
• sysanalyzer now has scan for RWE injections, memory map, scan for dll features.
• added procwatch application (log new process creation)

Comments: (0)