cyberchef 10.22.1 → 10.23.0

package/src/core/config/modules/Default.mjs

@@ -44,6 +44,7 @@ import EncodeNetBIOSName from "../../operations/EncodeNetBIOSName.mjs";
 import EscapeString from "../../operations/EscapeString.mjs";
 import EscapeUnicodeCharacters from "../../operations/EscapeUnicodeCharacters.mjs";
 import ExpandAlphabetRange from "../../operations/ExpandAlphabetRange.mjs";
+import ExtractAudioMetadata from "../../operations/ExtractAudioMetadata.mjs";
 import ExtractFiles from "../../operations/ExtractFiles.mjs";
 import ExtractID3 from "../../operations/ExtractID3.mjs";
 import FangURL from "../../operations/FangURL.mjs";
@@ -116,6 +117,7 @@ import PLISTViewer from "../../operations/PLISTViewer.mjs";
 import PadLines from "../../operations/PadLines.mjs";
 import ParseColourCode from "../../operations/ParseColourCode.mjs";
 import ParseDateTime from "../../operations/ParseDateTime.mjs";
+import ParseEthernetFrame from "../../operations/ParseEthernetFrame.mjs";
 import ParseIPRange from "../../operations/ParseIPRange.mjs";
 import ParseIPv4Header from "../../operations/ParseIPv4Header.mjs";
 import ParseIPv6Address from "../../operations/ParseIPv6Address.mjs";
@@ -167,6 +169,7 @@ import SymmetricDifference from "../../operations/SymmetricDifference.mjs";
 import Tail from "../../operations/Tail.mjs";
 import TakeBytes from "../../operations/TakeBytes.mjs";
 import TakeNthBytes from "../../operations/TakeNthBytes.mjs";
+import TextIntegerConverter from "../../operations/TextIntegerConverter.mjs";
 import ToBCD from "../../operations/ToBCD.mjs";
 import ToBase from "../../operations/ToBase.mjs";
 import ToBase32 from "../../operations/ToBase32.mjs";
@@ -250,6 +253,7 @@ OpModules.Default = {
     "Escape string": EscapeString,
     "Escape Unicode Characters": EscapeUnicodeCharacters,
     "Expand alphabet range": ExpandAlphabetRange,
+    "Extract Audio Metadata": ExtractAudioMetadata,
     "Extract Files": ExtractFiles,
     "Extract ID3": ExtractID3,
     "Fang URL": FangURL,
@@ -322,6 +326,7 @@ OpModules.Default = {
     "Pad lines": PadLines,
     "Parse colour code": ParseColourCode,
     "Parse DateTime": ParseDateTime,
+    "Parse Ethernet frame": ParseEthernetFrame,
     "Parse IP range": ParseIPRange,
     "Parse IPv4 header": ParseIPv4Header,
     "Parse IPv6 address": ParseIPv6Address,
@@ -373,6 +378,7 @@ OpModules.Default = {
     "Tail": Tail,
     "Take bytes": TakeBytes,
     "Take nth bytes": TakeNthBytes,
+    "Text-Integer Conversion": TextIntegerConverter,
     "To BCD": ToBCD,
     "To Base": ToBase,
     "To Base32": ToBase32,

package/src/core/config/modules/Shellcode.mjs

@@ -5,11 +5,13 @@
 * @copyright Crown Copyright 2026
 * @license Apache-2.0
 */
+import DisassembleARM from "../../operations/DisassembleARM.mjs";
 import DisassembleX86 from "../../operations/DisassembleX86.mjs";
 
 const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
 
 OpModules.Shellcode = {
+    "Disassemble ARM": DisassembleARM,
     "Disassemble x86": DisassembleX86,
 };
 

package/src/core/lib/AudioBytes.mjs

@@ -0,0 +1,103 @@
+/**
+ * Byte-reading and text-decoding utilities for audio metadata parsing.
+ *
+ * @author d0s1nt [d0s1nt@cyberchefaudio]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+/** @returns {string} 4-byte ASCII at offset, or "" if out of bounds. */
+export function ascii4(b, off) {
+    if (off + 4 > b.length) return "";
+    return String.fromCharCode(b[off], b[off + 1], b[off + 2], b[off + 3]);
+}
+
+/** @returns {number} Byte offset of ASCII needle `s`, or -1. */
+export function indexOfAscii(b, s, start, end) {
+    const limit = Math.max(0, Math.min(end, b.length) - s.length);
+    for (let i = start; i <= limit; i++) {
+        let ok = true;
+        for (let j = 0; j < s.length; j++) {
+            if (b[i + j] !== s.charCodeAt(j)) {
+                ok = false;
+                break;
+            }
+        }
+        if (ok) return i;
+    }
+    return -1;
+}
+
+/** @returns {number} Unsigned 32-bit big-endian read. */
+export function u32be(bytes, off) {
+    return ((bytes[off] << 24) >>> 0) | (bytes[off + 1] << 16) | (bytes[off + 2] << 8) | bytes[off + 3];
+}
+
+/** @returns {number} Unsigned 32-bit little-endian read. */
+export function u32le(bytes, off) {
+    return (bytes[off] | (bytes[off + 1] << 8) | (bytes[off + 2] << 16) | (bytes[off + 3] << 24)) >>> 0;
+}
+
+/** @returns {number} Unsigned 16-bit little-endian read. */
+export function u16le(bytes, off) {
+    return bytes[off] | (bytes[off + 1] << 8);
+}
+
+/** @returns {BigInt} Unsigned 64-bit little-endian read. */
+export function u64le(bytes, off) {
+    return BigInt(u32le(bytes, off)) | (BigInt(u32le(bytes, off + 4)) << 32n);
+}
+
+/** @returns {number} Decoded ID3v2 synchsafe integer from four 7-bit bytes. */
+export function synchsafeToInt(b0, b1, b2, b3) {
+    return ((b0 & 0x7f) << 21) | ((b1 & 0x7f) << 14) | ((b2 & 0x7f) << 7) | (b3 & 0x7f);
+}
+
+/** @returns {string} Decoded UTF-16LE byte range, nulls stripped. */
+export function decodeUtf16LE(b, off, len) {
+    if (len <= 0 || off + len > b.length) return "";
+    try {
+        return new TextDecoder("utf-16le").decode(b.slice(off, off + len)).replace(/\u0000/g, "").trim();
+    } catch {
+        return "";
+    }
+}
+
+/** @returns {{valueBytes: Uint8Array, next: number}} Bytes until null terminator, UTF-16 aware. */
+export function readNullTerminated(bytes, start, encoding) {
+    const isUtf16 = encoding === 1 || encoding === 2;
+    if (!isUtf16) {
+        let i = start;
+        while (i < bytes.length && bytes[i] !== 0x00) i++;
+        return { valueBytes: bytes.slice(start, i), next: i + 1 };
+    }
+    let i = start;
+    while (i + 1 < bytes.length && !(bytes[i] === 0x00 && bytes[i + 1] === 0x00)) i += 2;
+    return { valueBytes: bytes.slice(start, i), next: i + 2 };
+}
+
+const ID3_ENCODINGS = ["iso-8859-1", "utf-16", "utf-16be", "utf-8"];
+
+/** @returns {string} Text decoded using ID3v2 encoding byte (0=latin1, 1=utf16, 2=utf16be, 3=utf8). */
+export function decodeText(bytes, encoding) {
+    if (!bytes || bytes.length === 0) return "";
+    try {
+        return new TextDecoder(ID3_ENCODINGS[encoding] || "utf-16").decode(bytes);
+    } catch {
+        return safeUtf8(bytes);
+    }
+}
+
+/** @returns {string} UTF-8 decode with replacement (never throws). */
+export function safeUtf8(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    } catch {
+        return "";
+    }
+}
+
+/** @returns {string} ISO-8859-1 decode, nulls stripped, trimmed. */
+export function decodeLatin1Trim(bytes) {
+    return decodeText(bytes, 0).replace(/\u0000/g, "").trim();
+}

package/src/core/lib/AudioMetaSchema.mjs

@@ -0,0 +1,82 @@
+/**
+ * Report skeleton and container detection for audio metadata extraction.
+ *
+ * @author d0s1nt [d0s1nt@cyberchefaudio]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+/* eslint-disable camelcase */
+
+import { ascii4, indexOfAscii } from "./AudioBytes.mjs";
+
+/** Builds the empty report skeleton ready for a format parser to populate. */
+export function makeEmptyReport(filename, byteLength, container) {
+    return {
+        schema_version: "audio-meta-1.0",
+        artifact: {
+            filename,
+            byte_length: byteLength,
+            container: { type: container.type, brand: container.brand || null, mime: container.mime || null },
+        },
+        detections: { metadata_systems: [], provenance_systems: [] },
+        tags: {
+            common: {
+                title: null, artist: null, album: null, date: null, track: null,
+                genre: null, comment: null, composer: null, copyright: null, language: null,
+            },
+            raw: {},
+        },
+        embedded: [],
+        provenance: {
+            c2pa: {
+                present: false,
+                embedding: [],
+                manifest_store: { active_manifest_urn: null, instance_id: null, claim_generator: null },
+                assertions: [],
+                signature: {
+                    algorithm: null, signing_time: null,
+                    certificate: { subject_cn: null, issuer_cn: null, serial_number: null },
+                },
+                validation: { validation_state: "Unknown", reasons: [], details_raw: null },
+            },
+        },
+        errors: [],
+    };
+}
+
+/** Detects the audio container format from magic bytes. */
+export function sniffContainer(b) {
+    if (b.length >= 3 && b[0] === 0x49 && b[1] === 0x44 && b[2] === 0x33)
+        return { type: "mp3", mime: "audio/mpeg" };
+    if (b.length >= 2 && b[0] === 0xff && (b[1] & 0xe0) === 0xe0) {
+        if ((b[1] & 0x06) === 0x00) return { type: "aac", mime: "audio/aac" };
+        return { type: "mp3", mime: "audio/mpeg" };
+    }
+    if (b.length >= 8 && b[0] === 0x0b && b[1] === 0x77)
+        return { type: "ac3", mime: "audio/ac3" };
+    if (b.length >= 16 &&
+        b[0] === 0x30 && b[1] === 0x26 && b[2] === 0xb2 && b[3] === 0x75 &&
+        b[4] === 0x8e && b[5] === 0x66 && b[6] === 0xcf && b[7] === 0x11)
+        return { type: "wma", mime: "audio/x-ms-wma" };
+    if (b.length >= 12 && ascii4(b, 0) === "RIFF" && ascii4(b, 8) === "WAVE")
+        return { type: "wav", mime: "audio/wav" };
+    if (b.length >= 12 && ascii4(b, 0) === "BW64" && ascii4(b, 8) === "WAVE")
+        return { type: "bw64", mime: "audio/wav" };
+    if (b.length >= 4 && ascii4(b, 0) === "fLaC")
+        return { type: "flac", mime: "audio/flac" };
+    if (b.length >= 4 && ascii4(b, 0) === "OggS") {
+        const idx = indexOfAscii(b, "OpusHead", 0, Math.min(b.length, 65536));
+        return idx >= 0 ? { type: "opus", mime: "audio/ogg" } : { type: "ogg", mime: "audio/ogg" };
+    }
+    if (b.length >= 12 && ascii4(b, 4) === "ftyp") {
+        const brand = ascii4(b, 8);
+        const isM4A = brand === "M4A " || brand === "M4B " || brand === "M4P ";
+        return { type: isM4A ? "m4a" : "mp4", mime: isM4A ? "audio/mp4" : "video/mp4", brand };
+    }
+    if (b.length >= 12 && ascii4(b, 0) === "FORM") {
+        const formType = ascii4(b, 8);
+        if (formType === "AIFF" || formType === "AIFC") return { type: "aiff", mime: "audio/aiff", brand: formType };
+    }
+    return { type: "unknown", mime: null };
+}