cyberchef 10.22.0 → 10.23.0

package/src/core/config/modules/OpModules.mjs

@@ -0,0 +1,63 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* Imports all modules for builds which do not load modules separately.
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import CiphersModule from "./Ciphers.mjs";
+import DefaultModule from "./Default.mjs";
+import EncodingsModule from "./Encodings.mjs";
+import ImageModule from "./Image.mjs";
+import CryptoModule from "./Crypto.mjs";
+import SerialiseModule from "./Serialise.mjs";
+import HashingModule from "./Hashing.mjs";
+import BletchleyModule from "./Bletchley.mjs";
+import CompressionModule from "./Compression.mjs";
+import CodeModule from "./Code.mjs";
+import DiffModule from "./Diff.mjs";
+import ShellcodeModule from "./Shellcode.mjs";
+import ChartsModule from "./Charts.mjs";
+import RegexModule from "./Regex.mjs";
+import PGPModule from "./PGP.mjs";
+import PublicKeyModule from "./PublicKey.mjs";
+import JqModule from "./Jq.mjs";
+import OCRModule from "./OCR.mjs";
+import URLModule from "./URL.mjs";
+import UserAgentModule from "./UserAgent.mjs";
+import ProtobufModule from "./Protobuf.mjs";
+import HandlebarsModule from "./Handlebars.mjs";
+import YaraModule from "./Yara.mjs";
+
+const OpModules = {};
+
+Object.assign(
+    OpModules,
+    CiphersModule,
+    DefaultModule,
+    EncodingsModule,
+    ImageModule,
+    CryptoModule,
+    SerialiseModule,
+    HashingModule,
+    BletchleyModule,
+    CompressionModule,
+    CodeModule,
+    DiffModule,
+    ShellcodeModule,
+    ChartsModule,
+    RegexModule,
+    PGPModule,
+    PublicKeyModule,
+    JqModule,
+    OCRModule,
+    URLModule,
+    UserAgentModule,
+    ProtobufModule,
+    HandlebarsModule,
+    YaraModule,
+);
+
+export default OpModules;

package/src/core/config/modules/PGP.mjs

@@ -0,0 +1,26 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import GeneratePGPKeyPair from "../../operations/GeneratePGPKeyPair.mjs";
+import PGPDecrypt from "../../operations/PGPDecrypt.mjs";
+import PGPDecryptAndVerify from "../../operations/PGPDecryptAndVerify.mjs";
+import PGPEncrypt from "../../operations/PGPEncrypt.mjs";
+import PGPEncryptAndSign from "../../operations/PGPEncryptAndSign.mjs";
+import PGPVerify from "../../operations/PGPVerify.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.PGP = {
+    "Generate PGP Key Pair": GeneratePGPKeyPair,
+    "PGP Decrypt": PGPDecrypt,
+    "PGP Decrypt and Verify": PGPDecryptAndVerify,
+    "PGP Encrypt": PGPEncrypt,
+    "PGP Encrypt and Sign": PGPEncryptAndSign,
+    "PGP Verify": PGPVerify,
+};
+
+export default OpModules;

package/src/core/config/modules/Protobuf.mjs

@@ -0,0 +1,18 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import ProtobufDecode from "../../operations/ProtobufDecode.mjs";
+import ProtobufEncode from "../../operations/ProtobufEncode.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.Protobuf = {
+    "Protobuf Decode": ProtobufDecode,
+    "Protobuf Encode": ProtobufEncode,
+};
+
+export default OpModules;

package/src/core/config/modules/PublicKey.mjs

@@ -0,0 +1,36 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import HexToObjectIdentifier from "../../operations/HexToObjectIdentifier.mjs";
+import HexToPEM from "../../operations/HexToPEM.mjs";
+import JWKToPem from "../../operations/JWKToPem.mjs";
+import ObjectIdentifierToHex from "../../operations/ObjectIdentifierToHex.mjs";
+import PEMToJWK from "../../operations/PEMToJWK.mjs";
+import ParseASN1HexString from "../../operations/ParseASN1HexString.mjs";
+import ParseCSR from "../../operations/ParseCSR.mjs";
+import ParseX509CRL from "../../operations/ParseX509CRL.mjs";
+import ParseX509Certificate from "../../operations/ParseX509Certificate.mjs";
+import PubKeyFromCert from "../../operations/PubKeyFromCert.mjs";
+import PubKeyFromPrivKey from "../../operations/PubKeyFromPrivKey.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.PublicKey = {
+    "Hex to Object Identifier": HexToObjectIdentifier,
+    "Hex to PEM": HexToPEM,
+    "JWK to PEM": JWKToPem,
+    "Object Identifier to Hex": ObjectIdentifierToHex,
+    "PEM to JWK": PEMToJWK,
+    "Parse ASN.1 hex string": ParseASN1HexString,
+    "Parse CSR": ParseCSR,
+    "Parse X.509 CRL": ParseX509CRL,
+    "Parse X.509 certificate": ParseX509Certificate,
+    "Public Key from Certificate": PubKeyFromCert,
+    "Public Key from Private Key": PubKeyFromPrivKey,
+};
+
+export default OpModules;

package/src/core/config/modules/Regex.mjs

@@ -0,0 +1,40 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import ExtractDates from "../../operations/ExtractDates.mjs";
+import ExtractDomains from "../../operations/ExtractDomains.mjs";
+import ExtractEmailAddresses from "../../operations/ExtractEmailAddresses.mjs";
+import ExtractFilePaths from "../../operations/ExtractFilePaths.mjs";
+import ExtractHashes from "../../operations/ExtractHashes.mjs";
+import ExtractIPAddresses from "../../operations/ExtractIPAddresses.mjs";
+import ExtractMACAddresses from "../../operations/ExtractMACAddresses.mjs";
+import ExtractURLs from "../../operations/ExtractURLs.mjs";
+import Filter from "../../operations/Filter.mjs";
+import FindReplace from "../../operations/FindReplace.mjs";
+import Register from "../../operations/Register.mjs";
+import RegularExpression from "../../operations/RegularExpression.mjs";
+import Strings from "../../operations/Strings.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.Regex = {
+    "Extract dates": ExtractDates,
+    "Extract domains": ExtractDomains,
+    "Extract email addresses": ExtractEmailAddresses,
+    "Extract file paths": ExtractFilePaths,
+    "Extract hashes": ExtractHashes,
+    "Extract IP addresses": ExtractIPAddresses,
+    "Extract MAC addresses": ExtractMACAddresses,
+    "Extract URLs": ExtractURLs,
+    "Filter": Filter,
+    "Find / Replace": FindReplace,
+    "Register": Register,
+    "Regular expression": RegularExpression,
+    "Strings": Strings,
+};
+
+export default OpModules;

package/src/core/config/modules/Serialise.mjs

@@ -0,0 +1,26 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import AvroToJSON from "../../operations/AvroToJSON.mjs";
+import BSONDeserialise from "../../operations/BSONDeserialise.mjs";
+import BSONSerialise from "../../operations/BSONSerialise.mjs";
+import CBORDecode from "../../operations/CBORDecode.mjs";
+import CBOREncode from "../../operations/CBOREncode.mjs";
+import ParseObjectIDTimestamp from "../../operations/ParseObjectIDTimestamp.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.Serialise = {
+    "Avro to JSON": AvroToJSON,
+    "BSON deserialise": BSONDeserialise,
+    "BSON serialise": BSONSerialise,
+    "CBOR Decode": CBORDecode,
+    "CBOR Encode": CBOREncode,
+    "Parse ObjectID timestamp": ParseObjectIDTimestamp,
+};
+
+export default OpModules;

package/src/core/config/modules/Shellcode.mjs

@@ -0,0 +1,18 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import DisassembleARM from "../../operations/DisassembleARM.mjs";
+import DisassembleX86 from "../../operations/DisassembleX86.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.Shellcode = {
+    "Disassemble ARM": DisassembleARM,
+    "Disassemble x86": DisassembleX86,
+};
+
+export default OpModules;

package/src/core/config/modules/URL.mjs

@@ -0,0 +1,20 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import ParseURI from "../../operations/ParseURI.mjs";
+import URLDecode from "../../operations/URLDecode.mjs";
+import URLEncode from "../../operations/URLEncode.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.URL = {
+    "Parse URI": ParseURI,
+    "URL Decode": URLDecode,
+    "URL Encode": URLEncode,
+};
+
+export default OpModules;

package/src/core/config/modules/UserAgent.mjs

@@ -0,0 +1,16 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import ParseUserAgent from "../../operations/ParseUserAgent.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.UserAgent = {
+    "Parse User Agent": ParseUserAgent,
+};
+
+export default OpModules;

package/src/core/config/modules/Yara.mjs

@@ -0,0 +1,16 @@
+/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateConfig.mjs
+*
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright 2026
+* @license Apache-2.0
+*/
+import YARARules from "../../operations/YARARules.mjs";
+
+const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
+
+OpModules.Yara = {
+    "YARA Rules": YARARules,
+};
+
+export default OpModules;

package/src/core/lib/AudioBytes.mjs

@@ -0,0 +1,103 @@
+/**
+ * Byte-reading and text-decoding utilities for audio metadata parsing.
+ *
+ * @author d0s1nt [d0s1nt@cyberchefaudio]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+/** @returns {string} 4-byte ASCII at offset, or "" if out of bounds. */
+export function ascii4(b, off) {
+    if (off + 4 > b.length) return "";
+    return String.fromCharCode(b[off], b[off + 1], b[off + 2], b[off + 3]);
+}
+
+/** @returns {number} Byte offset of ASCII needle `s`, or -1. */
+export function indexOfAscii(b, s, start, end) {
+    const limit = Math.max(0, Math.min(end, b.length) - s.length);
+    for (let i = start; i <= limit; i++) {
+        let ok = true;
+        for (let j = 0; j < s.length; j++) {
+            if (b[i + j] !== s.charCodeAt(j)) {
+                ok = false;
+                break;
+            }
+        }
+        if (ok) return i;
+    }
+    return -1;
+}
+
+/** @returns {number} Unsigned 32-bit big-endian read. */
+export function u32be(bytes, off) {
+    return ((bytes[off] << 24) >>> 0) | (bytes[off + 1] << 16) | (bytes[off + 2] << 8) | bytes[off + 3];
+}
+
+/** @returns {number} Unsigned 32-bit little-endian read. */
+export function u32le(bytes, off) {
+    return (bytes[off] | (bytes[off + 1] << 8) | (bytes[off + 2] << 16) | (bytes[off + 3] << 24)) >>> 0;
+}
+
+/** @returns {number} Unsigned 16-bit little-endian read. */
+export function u16le(bytes, off) {
+    return bytes[off] | (bytes[off + 1] << 8);
+}
+
+/** @returns {BigInt} Unsigned 64-bit little-endian read. */
+export function u64le(bytes, off) {
+    return BigInt(u32le(bytes, off)) | (BigInt(u32le(bytes, off + 4)) << 32n);
+}
+
+/** @returns {number} Decoded ID3v2 synchsafe integer from four 7-bit bytes. */
+export function synchsafeToInt(b0, b1, b2, b3) {
+    return ((b0 & 0x7f) << 21) | ((b1 & 0x7f) << 14) | ((b2 & 0x7f) << 7) | (b3 & 0x7f);
+}
+
+/** @returns {string} Decoded UTF-16LE byte range, nulls stripped. */
+export function decodeUtf16LE(b, off, len) {
+    if (len <= 0 || off + len > b.length) return "";
+    try {
+        return new TextDecoder("utf-16le").decode(b.slice(off, off + len)).replace(/\u0000/g, "").trim();
+    } catch {
+        return "";
+    }
+}
+
+/** @returns {{valueBytes: Uint8Array, next: number}} Bytes until null terminator, UTF-16 aware. */
+export function readNullTerminated(bytes, start, encoding) {
+    const isUtf16 = encoding === 1 || encoding === 2;
+    if (!isUtf16) {
+        let i = start;
+        while (i < bytes.length && bytes[i] !== 0x00) i++;
+        return { valueBytes: bytes.slice(start, i), next: i + 1 };
+    }
+    let i = start;
+    while (i + 1 < bytes.length && !(bytes[i] === 0x00 && bytes[i + 1] === 0x00)) i += 2;
+    return { valueBytes: bytes.slice(start, i), next: i + 2 };
+}
+
+const ID3_ENCODINGS = ["iso-8859-1", "utf-16", "utf-16be", "utf-8"];
+
+/** @returns {string} Text decoded using ID3v2 encoding byte (0=latin1, 1=utf16, 2=utf16be, 3=utf8). */
+export function decodeText(bytes, encoding) {
+    if (!bytes || bytes.length === 0) return "";
+    try {
+        return new TextDecoder(ID3_ENCODINGS[encoding] || "utf-16").decode(bytes);
+    } catch {
+        return safeUtf8(bytes);
+    }
+}
+
+/** @returns {string} UTF-8 decode with replacement (never throws). */
+export function safeUtf8(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    } catch {
+        return "";
+    }
+}
+
+/** @returns {string} ISO-8859-1 decode, nulls stripped, trimmed. */
+export function decodeLatin1Trim(bytes) {
+    return decodeText(bytes, 0).replace(/\u0000/g, "").trim();
+}

package/src/core/lib/AudioMetaSchema.mjs

@@ -0,0 +1,82 @@
+/**
+ * Report skeleton and container detection for audio metadata extraction.
+ *
+ * @author d0s1nt [d0s1nt@cyberchefaudio]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+/* eslint-disable camelcase */
+
+import { ascii4, indexOfAscii } from "./AudioBytes.mjs";
+
+/** Builds the empty report skeleton ready for a format parser to populate. */
+export function makeEmptyReport(filename, byteLength, container) {
+    return {
+        schema_version: "audio-meta-1.0",
+        artifact: {
+            filename,
+            byte_length: byteLength,
+            container: { type: container.type, brand: container.brand || null, mime: container.mime || null },
+        },
+        detections: { metadata_systems: [], provenance_systems: [] },
+        tags: {
+            common: {
+                title: null, artist: null, album: null, date: null, track: null,
+                genre: null, comment: null, composer: null, copyright: null, language: null,
+            },
+            raw: {},
+        },
+        embedded: [],
+        provenance: {
+            c2pa: {
+                present: false,
+                embedding: [],
+                manifest_store: { active_manifest_urn: null, instance_id: null, claim_generator: null },
+                assertions: [],
+                signature: {
+                    algorithm: null, signing_time: null,
+                    certificate: { subject_cn: null, issuer_cn: null, serial_number: null },
+                },
+                validation: { validation_state: "Unknown", reasons: [], details_raw: null },
+            },
+        },
+        errors: [],
+    };
+}
+
+/** Detects the audio container format from magic bytes. */
+export function sniffContainer(b) {
+    if (b.length >= 3 && b[0] === 0x49 && b[1] === 0x44 && b[2] === 0x33)
+        return { type: "mp3", mime: "audio/mpeg" };
+    if (b.length >= 2 && b[0] === 0xff && (b[1] & 0xe0) === 0xe0) {
+        if ((b[1] & 0x06) === 0x00) return { type: "aac", mime: "audio/aac" };
+        return { type: "mp3", mime: "audio/mpeg" };
+    }
+    if (b.length >= 8 && b[0] === 0x0b && b[1] === 0x77)
+        return { type: "ac3", mime: "audio/ac3" };
+    if (b.length >= 16 &&
+        b[0] === 0x30 && b[1] === 0x26 && b[2] === 0xb2 && b[3] === 0x75 &&
+        b[4] === 0x8e && b[5] === 0x66 && b[6] === 0xcf && b[7] === 0x11)
+        return { type: "wma", mime: "audio/x-ms-wma" };
+    if (b.length >= 12 && ascii4(b, 0) === "RIFF" && ascii4(b, 8) === "WAVE")
+        return { type: "wav", mime: "audio/wav" };
+    if (b.length >= 12 && ascii4(b, 0) === "BW64" && ascii4(b, 8) === "WAVE")
+        return { type: "bw64", mime: "audio/wav" };
+    if (b.length >= 4 && ascii4(b, 0) === "fLaC")
+        return { type: "flac", mime: "audio/flac" };
+    if (b.length >= 4 && ascii4(b, 0) === "OggS") {
+        const idx = indexOfAscii(b, "OpusHead", 0, Math.min(b.length, 65536));
+        return idx >= 0 ? { type: "opus", mime: "audio/ogg" } : { type: "ogg", mime: "audio/ogg" };
+    }
+    if (b.length >= 12 && ascii4(b, 4) === "ftyp") {
+        const brand = ascii4(b, 8);
+        const isM4A = brand === "M4A " || brand === "M4B " || brand === "M4P ";
+        return { type: isM4A ? "m4a" : "mp4", mime: isM4A ? "audio/mp4" : "video/mp4", brand };
+    }
+    if (b.length >= 12 && ascii4(b, 0) === "FORM") {
+        const formType = ascii4(b, 8);
+        if (formType === "AIFF" || formType === "AIFC") return { type: "aiff", mime: "audio/aiff", brand: formType };
+    }
+    return { type: "unknown", mime: null };
+}