FileInsight-plugins 1.5

New plugins

• Binary data to decimal text
  • Convert binary of selected region into decimal text
• Decimal text to binary data
  • Convert decimal text of selected region into binary data
• Binary data to octal text
  • Convert binary of selected region into octal text
• Octal text to binary data
  • Convert octal text of selected region into binary data

Enhancement

• Addition of installation script install.ps1
  install.ps1 automatically installs the latest release version of FileInsight-plugins and all pre-requisites. it is not included in the release archive because it checks the hash value of the archive. Please download it from the repository then execute

  powershell -exec bypass .\install.ps1
  

  to use it or please execute the following command to directly execute it.

  powershell -exec bypass -command "IEX((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1'))"
  

  install.ps1 can also be used for update of FileInsight-plugins. Please execute the following command.

  powershell -exec bypass -command "& ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1'))) -update"
  

Other changes

• The slide deck files of CODE BLUE 2019 are excluded from the release archive.

FileInsight-plugins 1.4.3.1

Bug fix

• All plugins
  • Add a workaround not to execute python.exe of Python 3.

Other changes

• Add the slide deck presented at Bluebox of CODE BLUE 2019 to "doc" folder.
• Add an instruction to README files to make sure that python.exe of Python 2.7 will be executed from FileInsight.
  (reported by graneed (@graneed111))

FileInsight-plugins 1.4.3

Enhancement

• Search operations category
  • "XOR hex search" and "XOR text search" plugins
    • Add capability to search data encoded with combination of XOR and bit rotate at one time.

Bug fixes

• Misc operations category
  • "Send to" plugin
    • Fix the bug that an external program is executed twice.
• All plugins
  • Add a workaround not to execute python.exe of Microsoft Store (for Windows 10 version 1903)

Other change

• Add notes regarding Python 3 to README.

FileInsight-plugins 1.4.2

Bug fix

• Add workarounds to avoid crash of FileInsight on closing on Windows 7 (reported by You Nakatsuru (@you0708)).

Enhancement

• Misc operations category
  • Send to
    • Show a file selection dialog when a selected program file is missing.
      send_to.json file will be updated accordingly with the new file location.

Other changes

• Move plugin folders into the "plugins" folder.
• Move screenshots into the "docs" folder.

FileInsight-plugins 1.4.1

New plugins

• Parsing operations category
  • Strings (extracts text strings from selected region (the whole file if not selected))
    This plugin supports de-dupulication and decoding hex strings.

Enhancements

• Markdown version of README has been added.

Bug fix

• Encoding operations category
  • Dialog position of ROT13 plugin has been adjusted.
• Misc operations category
  • Breakage of "Send to" plugin has been fixed.

FileInsight-plugins 1.4.0

Important changes

• New "Parsing operations" category has been created.
• Misc operations category
  • "File type" plugin and "Find PE file" plugin have been moved to the new "Parsing operations" category.
• New Python module dependencies
  • backport.lzma (for new "LZMA compress", "LZMA decompress", "XZ compress" and "XZ decompress" plugins)
  • binwalk (for new "Binwalk scan" plugin)
• Encoding operations category
  • "Binary to hex text" plugin has been renamed to "Binary data to hex text".
  • "Hex text to binary" plugin has been renamed to "Hex text to binary data".

New plugins

• Compression operations category
  • LZMA compress (compresses selected region with LZMA algorithm)
  • LZMA decompress (decompresses selected region with LZMA algorithm)
  • XZ compress (compresses selected region with XZ format)
  • XZ decompress (decompresses selected XZ compressed region)
• Encoding operations caterogy
  • Binary data to binary text (converts binary of selected region into binary text)
  • Binary text to binary data (converts binary text of selected region into binary data)
• Parsing operations category
  • Binwalk scan (scans selected region (the whole file if not selected) to find embedded files)

Enhancements

• Encoding operations category
  • ROT13 plugin becomes capable to rotate by the specified amount.
• Misc operations category
  • Send to plugin
    • CyberChef file path has become customizable.
    • File input dialog will be shown if CyberChef file is not found.

Bug fix

• Encoding operations
  • Custom base64 decode / Custom base64 encode
    • Exit GUI script when a dialog is closed

FileIngiht-plugins 1.3.0

Important change

• Switch from PyCrypto to PyCryptodome for crypto-related plugins.
  Please execute "c:\Python27\python.exe -m pip install pycryptodomex".
  to install PyCryptodome.

New plugins

• Crypto operations category
  • AES decrypt (decrypt selected region with AES)
  • AES encrypt (encrypt selected region with AES)
  • ARC2 decrypt (decrypt selected region with ARC2 (Alleged RC2))
  • ARC2 encrypt (encrypt selected region with ARC2 (Alleged RC2))
  • Blowfish decrypt (decrypt selected region with Blowfish)
  • Blowfish encrypt (encrypt selected region with Blowfish)
  • ChaCha20 decrypt / encrypt (decrypt / encrypt selected region with ChaCha20)
  • DES decrypt (decrypt selected region with DES)
  • DES encrypt (encrypt selected region with DES)
  • Salsa20 decrypt / encrypt (decrypt / encrypt selected region with Salsa20)
  • Triple DES decrypt (decrypt selected region with Triple DES)
  • Triple DES encrypt (encrypt selected region with Triple DES)

Other change

• Rename "ARC4 decrypt" plugin to "ARC4 decrypt / encrypt".

FileIngiht-plugins 1.2.0

New plugins

• Search operations category
  • Replace (replace matched data in selected region (the whole file if not selected) with specified data)
  • YARA scan (scan selected region (the whole file if not selected) with YARA)
    YARA scan requires yara-python Python module.
    Please install it with 'python -m pip install yara-python' .

Enhancements

• All plugins depend on additional Python modules
  • Show instructions to install the modules if they are not installed.
• Misc operations category
  • File comparison
    • Show elapsed time at the end of execution.
  • Send to
    • Move menu config to the external config file "send_to.json".
• Search operations category
  • Regex search, Replace and YARA scan
    • Show matched data as hex if it contains non-printable characters

Bug fix

• Misc operations category
  • File comparison
    • Fix handling on window close.
• Search operations category
  • All plugins
    • Do nothing if no file is opened.

FileIngiht-plugins 1.1.0

New plugins

• Basic operations category
  • To upper case
  • To lower case
  • Swap case
• Encoding operations category
  • From quoted printable
  • To quoted printable
• Misc operations
  • File comparison
• Search operations
  • Regex search (with Python re module syntax)

Enhancements

• Misc operations category
  • Send to
    • Change path of VS Code to the current default install location.
    • New "CyberChef" menu to send data to CyberChef locally saved on desktop (up to 12000 bytes)

FileIngiht-plugins 1.0.0

• Reorganize plugins into the following seven categories. Plugins can be launched from pull-down menus.
  Basic operations
  Compression operations
  Crypto operations
  Encoding operations
  Misc operations
  Search operations
  XOR operations
• Remove TrID plugin (please use 'Misc operations' -> 'Send to' plugin instead).