Didier Stevens adds JSON extraction to his OneNote tool

Didier Stevens reports a new capability added to his onedump.py tool to extract embedded files from OneNote files (with the .one extension) and output the results in JSON format. The enhancement is designed to streamline analysis by producing JSON data that captures the contents found inside a OneNote file, eliminating the need to run the extraction repeatedly for multiple files. The update sits alongside other JSON-enabled tools Stevens has developed, and is specifically triggered by the command line option --jsonoutput.

The article provides practical usage examples: running onedump.py --jsonoutput *.one generates JSON data for each embedded file found within the OneNote files in the current directory, and a subsequent step demonstrates how to write those embedded files to disk. The suggested pipeline uses myjson-filter.py (from Didier Stevens’ toolkit) to filter or process the JSON output, for instance using a command like onedump.py --jsonoutput *.one | myjson-filter.py -W hashvir.

The files written to disk are named by the SHA-256 hash of their content with a .vir extension, i.e. hashvir. The piece attributes the development to Didier Stevens, a senior handler, and provides links to the associated code and related tools.