A couple years ago I published tool xorsearch.py for this diary entry: "Small Challenge: A Simple Word Maldoc - Part 4".

It could be used to search for XOR-encoded text:

This was a beta version, and its user interface was subject to change. The version I released recently is a rewrite, and option -t no longer exists.

To achieve a similar result with the new version of xorsearch.py, one uses now option -P (Python) and provides a Python function that filters out printable text: IsPrintable

Option -D can then be used to dump the decoded data with an extra newline:

Here too XOR encoding with key 0x6f reveals the hidden command.

Didier Stevens
Senior handler
blog.DidierStevens.com