cyberchef 10.22.1 → 10.24.0

package/src/core/operations/DisassembleARM.mjs

@@ -0,0 +1,193 @@
+/**
+ * @author MedjedThomasXM
+ * @copyright Crown Copyright 2024
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { isWorkerEnvironment } from "../Utils.mjs";
+import cs from "@alexaltea/capstone-js/dist/capstone.min.js";
+
+/**
+ * Disassemble ARM operation
+ */
+class DisassembleARM extends Operation {
+
+    /**
+     * DisassembleARM constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Disassemble ARM";
+        this.module = "Shellcode";
+        this.description = "Disassembles ARM machine code into assembly language.<br><br>Supports ARM (32-bit), Thumb, and ARM64 (AArch64) architectures using the Capstone disassembly framework.<br><br>Input should be in hexadecimal.";
+        this.infoURL = "https://wikipedia.org/wiki/ARM_architecture_family";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Architecture",
+                "type": "option",
+                "value": ["ARM (32-bit)", "ARM64 (AArch64)"]
+            },
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": ["ARM", "Thumb", "Thumb + Cortex-M", "ARMv8"]
+            },
+            {
+                "name": "Endianness",
+                "type": "option",
+                "value": ["Little Endian", "Big Endian"]
+            },
+            {
+                "name": "Starting address (hex)",
+                "type": "number",
+                "value": 0
+            },
+            {
+                "name": "Show instruction hex",
+                "type": "boolean",
+                "value": true
+            },
+            {
+                "name": "Show instruction position",
+                "type": "boolean",
+                "value": true
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    async run(input, args) {
+        const [
+            architecture,
+            mode,
+            endianness,
+            startAddress,
+            showHex,
+            showPosition
+        ] = args;
+
+        // Remove whitespace from input
+        const hexInput = input.replace(/\s/g, "");
+
+        // Validate hex input
+        if (!/^[0-9a-fA-F]*$/.test(hexInput)) {
+            throw new OperationError("Invalid hexadecimal input. Please provide valid hex characters only.");
+        }
+
+        if (hexInput.length === 0) {
+            return "";
+        }
+
+        if (hexInput.length % 2 !== 0) {
+            throw new OperationError("Invalid hexadecimal input. Length must be even.");
+        }
+
+        // Convert hex string to byte array
+        const bytes = [];
+        for (let i = 0; i < hexInput.length; i += 2) {
+            bytes.push(parseInt(hexInput.substr(i, 2), 16));
+        }
+
+        // Determine architecture constant
+        let arch;
+        if (architecture === "ARM64 (AArch64)") {
+            arch = cs.ARCH_ARM64;
+        } else {
+            arch = cs.ARCH_ARM;
+        }
+
+        // Determine mode constant
+        let modeValue = cs.MODE_LITTLE_ENDIAN;
+
+        if (architecture === "ARM (32-bit)") {
+            switch (mode) {
+                case "ARM":
+                    modeValue = cs.MODE_ARM;
+                    break;
+                case "Thumb":
+                    modeValue = cs.MODE_THUMB;
+                    break;
+                case "Thumb + Cortex-M":
+                    modeValue = cs.MODE_THUMB | cs.MODE_MCLASS;
+                    break;
+                case "ARMv8":
+                    modeValue = cs.MODE_ARM | cs.MODE_V8;
+                    break;
+                default:
+                    modeValue = cs.MODE_ARM;
+            }
+        } else {
+            // ARM64 only has one mode (ARM mode is default for ARM64)
+            modeValue = cs.MODE_ARM;
+        }
+
+        // Add endianness
+        if (endianness === "Big Endian") {
+            modeValue |= cs.MODE_BIG_ENDIAN;
+        }
+
+        if (isWorkerEnvironment()) {
+            self.sendStatusMessage("Disassembling...");
+        }
+
+        let disassembler;
+        try {
+            disassembler = new cs.Capstone(arch, modeValue);
+        } catch (e) {
+            throw new OperationError(`Failed to initialise Capstone disassembler: ${e}`);
+        }
+
+        let instructions;
+        try {
+            instructions = disassembler.disasm(bytes, startAddress);
+        } catch (e) {
+            disassembler.close();
+            // Check if it's a "no valid instructions" error (code 0 means OK but nothing decoded)
+            if (e && e.includes && e.includes("code 0:")) {
+                throw new OperationError(`No valid ${architecture} instructions found in input. The bytes may be for a different architecture or mode.`);
+            }
+            throw new OperationError(`Disassembly failed: ${e}`);
+        }
+
+        // Format output
+        const output = [];
+        for (const insn of instructions) {
+            let line = "";
+
+            if (showPosition) {
+                // Format address as hex with 0x prefix
+                const addrHex = "0x" + insn.address.toString(16).padStart(8, "0");
+                line += addrHex + "  ";
+            }
+
+            if (showHex) {
+                // Format instruction bytes as hex
+                const bytesHex = insn.bytes.map(b => b.toString(16).padStart(2, "0")).join("");
+                line += bytesHex.padEnd(16, " ") + "  ";
+            }
+
+            line += insn.mnemonic;
+            if (insn.op_str) {
+                line += " " + insn.op_str;
+            }
+
+            output.push(line);
+        }
+
+        disassembler.close();
+
+        return output.join("\n");
+    }
+
+}
+
+export default DisassembleARM;

package/src/core/operations/DitherImage.mjs

@@ -9,13 +9,12 @@ import OperationError from "../errors/OperationError.mjs";
 import { isImage } from "../lib/FileType.mjs";
 import { toBase64 } from "../lib/Base64.mjs";
 import { isWorkerEnvironment } from "../Utils.mjs";
-import Jimp from "jimp/es/index.js";
+import { Jimp, JimpMime } from "jimp";
 
 /**
  * Image Dither operation
  */
 class DitherImage extends Operation {
-
     /**
      * DitherImage constructor
      */
@@ -51,17 +50,19 @@ class DitherImage extends Operation {
         try {
             if (isWorkerEnvironment())
                 self.sendStatusMessage("Applying dither to image...");
-            image.dither565();
+            image.dither();
 
             let imageBuffer;
-            if (image.getMIME() === "image/gif") {
-                imageBuffer = await image.getBufferAsync(Jimp.MIME_PNG);
+            if (image.mime === "image/gif") {
+                imageBuffer = await image.getBuffer(JimpMime.png);
             } else {
-                imageBuffer = await image.getBufferAsync(Jimp.AUTO);
+                imageBuffer = await image.getBuffer(image.mime);
             }
             return imageBuffer.buffer;
         } catch (err) {
-            throw new OperationError(`Error applying dither to image. (${err})`);
+            throw new OperationError(
+                `Error applying dither to image. (${err})`,
+            );
         }
     }
 
@@ -81,7 +82,6 @@ class DitherImage extends Operation {
 
         return `<img src="data:${type};base64,${toBase64(dataArray)}">`;
     }
-
 }
 
 export default DitherImage;

package/src/core/operations/EscapeUnicodeCharacters.mjs

@@ -44,23 +44,6 @@ class EscapeUnicodeCharacters extends Operation {
                 "value": true
             }
         ];
-        this.checks = [
-            {
-                pattern: "\\\\u(?:[\\da-f]{4,6})",
-                flags: "i",
-                args: ["\\u"]
-            },
-            {
-                pattern: "%u(?:[\\da-f]{4,6})",
-                flags: "i",
-                args: ["%u"]
-            },
-            {
-                pattern: "U\\+(?:[\\da-f]{4,6})",
-                flags: "i",
-                args: ["U+"]
-            }
-        ];
     }
 
     /**

package/src/core/operations/ExtractAudioMetadata.mjs

@@ -0,0 +1,175 @@
+/**
+ * @author d0s1nt [d0s1nt@cyberchefaudio]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import Utils from "../Utils.mjs";
+import { makeEmptyReport, sniffContainer } from "../lib/AudioMetaSchema.mjs";
+import {
+    parseMp3, parseRiffWave, parseFlac, parseOgg,
+    parseMp4BestEffort, parseAiffBestEffort,
+    parseAacAdts, parseAc3, parseWmaAsf,
+} from "../lib/AudioParsers.mjs";
+
+/**
+ * Extract Audio Metadata operation.
+ */
+class ExtractAudioMetadata extends Operation {
+    /** Creates the Extract Audio Metadata operation. */
+    constructor() {
+        super();
+
+        this.name = "Extract Audio Metadata";
+        this.module = "Default";
+        this.description =
+            "Extract common audio metadata across MP3 (ID3v2/ID3v1/GEOB), WAV/BWF/BW64 (INFO/bext/iXML/axml), FLAC (Vorbis Comment/Picture), OGG (Vorbis/OpusTags), AAC (ADTS), AC3 (Dolby Digital), WMA (ASF), plus best-effort MP4/M4A and AIFF scanning. Outputs normalized JSON.";
+        this.infoURL = "https://wikipedia.org/wiki/Audio_file_format";
+        this.inputType = "ArrayBuffer";
+        this.outputType = "JSON";
+        this.presentType = "html";
+
+        this.args = [
+            { name: "Filename (optional)", type: "string", value: "" },
+            { name: "Max embedded text bytes (iXML/axml/etc)", type: "number", value: 1024 * 512 },
+        ];
+    }
+
+    /**
+     * @param {ArrayBuffer} input
+     * @param {Object[]} args
+     * @returns {Object}
+     */
+    run(input, args) {
+        const filename = (args?.[0] || "").trim() || null;
+        const maxTextBytes = Number.isFinite(args?.[1]) ? Math.max(1024, args[1]) : 1024 * 512;
+
+        if (!(input instanceof ArrayBuffer) || input.byteLength === 0)
+            throw new OperationError("No input data. Load an audio file (drag/drop or use the open file button).");
+
+        const bytes = new Uint8Array(input);
+        const container = sniffContainer(bytes);
+        const report = makeEmptyReport(filename, bytes.length, container);
+
+        try {
+            const parsers = {
+                mp3: () => parseMp3(bytes, report),
+                wav: () => parseRiffWave(bytes, report, maxTextBytes),
+                bw64: () => parseRiffWave(bytes, report, maxTextBytes),
+                flac: () => parseFlac(bytes, report, maxTextBytes),
+                ogg: () => parseOgg(bytes, report),
+                opus: () => parseOgg(bytes, report),
+                mp4: () => parseMp4BestEffort(bytes, report),
+                m4a: () => parseMp4BestEffort(bytes, report),
+                aiff: () => parseAiffBestEffort(bytes, report, maxTextBytes),
+                aac: () => parseAacAdts(bytes, report),
+                ac3: () => parseAc3(bytes, report),
+                wma: () => parseWmaAsf(bytes, report),
+            };
+            if (parsers[container.type]) {
+                parsers[container.type]();
+            } else {
+                report.errors.push({ stage: "sniff", message: "Unknown/unsupported container (best-effort scan not implemented)." });
+            }
+        } catch (e) {
+            report.errors.push({ stage: "parse", message: String(e?.message || e) });
+        }
+
+        return report;
+    }
+
+    /** Renders the extracted metadata as an HTML table. */
+    present(data) {
+        if (!data || typeof data !== "object") return JSON.stringify(data, null, 4);
+
+        const esc = Utils.escapeHtml;
+        const row = (k, v) => `<tr><td>${esc(String(k))}</td><td>${esc(String(v ?? ""))}</td></tr>\n`;
+        const section = (title) => `<tr><th colspan="2" style="background:#e9ecef;text-align:center">${esc(title)}</th></tr>\n`;
+        const objRows = (obj, filter = (v) => v !== null) => {
+            for (const [k, v] of Object.entries(obj)) {
+                if (filter(v)) html += row(k, v);
+            }
+        };
+        const objSection = (obj, title, filter) => {
+            if (!obj) return;
+            html += section(title);
+            objRows(obj, filter);
+        };
+        const listSection = (arr, title, fmt) => {
+            if (!arr?.length) return;
+            html += section(title);
+            for (const item of arr) html += fmt(item);
+        };
+
+        let html = `<table class="table table-hover table-sm table-bordered table-nonfluid">\n`;
+
+        html += section("Artifact");
+        html += row("Filename", data.artifact?.filename || "(none)");
+        html += row("Size", `${(data.artifact?.byte_length ?? 0).toLocaleString()} bytes`);
+        html += row("Container", data.artifact?.container?.type);
+        html += row("MIME", data.artifact?.container?.mime);
+        if (data.artifact?.container?.brand) html += row("Brand", data.artifact.container.brand);
+
+        html += section("Detections");
+        html += row("Metadata systems", (data.detections?.metadata_systems || []).join(", ") || "None");
+        html += row("Provenance systems", (data.detections?.provenance_systems || []).join(", ") || "None");
+
+        const common = data.tags?.common || {};
+        html += section("Common Tags");
+        if (Object.values(common).some((v) => v !== null)) {
+            for (const [key, val] of Object.entries(common)) {
+                if (val !== null) html += row(key.charAt(0).toUpperCase() + key.slice(1), val);
+            }
+        } else {
+            html += row("(none)", "No common tags found");
+        }
+
+        listSection(data.tags?.raw?.id3v2?.frames, "ID3v2 Frames", (f) => {
+            const val = typeof f.decoded === "object" ? JSON.stringify(f.decoded) : (f.decoded ?? `(${f.size} bytes)`);
+            return row(f.id + (f.description ? ` \u2014 ${f.description}` : ""), val);
+        });
+        objSection(data.tags?.raw?.id3v1, "ID3v1", (v) => !!v);
+        listSection(data.tags?.raw?.apev2?.items, "APEv2 Tags", (i) => row(i.key, i.value));
+
+        if (data.tags?.raw?.vorbis_comments?.comments?.length) {
+            html += section("Vorbis Comments");
+            html += row("Vendor", data.tags.raw.vorbis_comments.vendor);
+            for (const c of data.tags.raw.vorbis_comments.comments) html += row(c.key, c.value);
+        }
+
+        objSection(data.tags?.raw?.riff?.info, "RIFF INFO", () => true);
+        objSection(data.tags?.raw?.riff?.bext, "BWF bext");
+        listSection(data.tags?.raw?.riff?.chunks, "RIFF Chunks", (c) => row(c.id, `${c.size} bytes @ offset ${c.offset}`));
+        listSection(data.tags?.raw?.flac?.blocks, "FLAC Metadata Blocks", (b) => row(b.type, `${b.length} bytes`));
+
+        if (data.tags?.raw?.mp4?.top_level_atoms?.length) {
+            html += section("MP4 Top-Level Atoms");
+            const atoms = data.tags.raw.mp4.top_level_atoms;
+            for (const a of atoms.slice(0, 50)) html += row(a.type, `${a.size} bytes @ offset ${a.offset}`);
+            if (atoms.length > 50) html += row("...", `${atoms.length - 50} more atoms`);
+        }
+
+        listSection(data.tags?.raw?.aiff?.chunks, "AIFF Chunks", (c) => row(c.id, c.value));
+        objSection(data.tags?.raw?.aac, "AAC ADTS");
+        objSection(data.tags?.raw?.ac3, "AC3 (Dolby Digital)");
+        objSection(data.tags?.raw?.asf?.content_description, "ASF Content Description", (v) => !!v);
+        listSection(data.tags?.raw?.asf?.extended_content, "ASF Extended Content", (d) => row(d.name, d.value));
+        listSection(data.embedded, "Embedded Objects", (e) => row(e.id, `${e.content_type || "unknown"} \u2014 ${(e.byte_length ?? 0).toLocaleString()} bytes`));
+
+        if (data.provenance?.c2pa?.present) {
+            html += section("C2PA Provenance");
+            html += row("Present", "Yes");
+            for (const emb of (data.provenance.c2pa.embedding || []))
+                html += row("Carrier", `${emb.carrier} \u2014 ${(emb.byte_length ?? 0).toLocaleString()} bytes`);
+        }
+
+        listSection(data.errors, "Errors", (e) => row(e.stage, e.message));
+
+        html += "</table>";
+        return html;
+    }
+}
+
+export default ExtractAudioMetadata;

package/src/core/operations/ExtractEmailAddresses.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import { search } from "../lib/Extract.mjs";
+import { EMAIL_REGEX, search } from "../lib/Extract.mjs";
 import { caseInsensitiveSort } from "../lib/Sort.mjs";
 
 /**
@@ -50,8 +50,7 @@ class ExtractEmailAddresses extends Operation {
      */
     run(input, args) {
         const [displayTotal, sort, unique] = args,
-            // email regex from: https://www.regextester.com/98066
-            regex = /(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?\.)+[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\])/ig;
+            regex = EMAIL_REGEX;
 
         const results = search(
             input,

package/src/core/operations/ExtractLSB.mjs

@@ -9,13 +9,12 @@ import OperationError from "../errors/OperationError.mjs";
 import Utils from "../Utils.mjs";
 import { fromBinary } from "../lib/Binary.mjs";
 import { isImage } from "../lib/FileType.mjs";
-import Jimp from "jimp/es/index.js";
+import { Jimp } from "jimp";
 
 /**
  * Extract LSB operation
  */
 class ExtractLSB extends Operation {
-
     /**
      * ExtractLSB constructor
      */
@@ -24,8 +23,10 @@ class ExtractLSB extends Operation {
 
         this.name = "Extract LSB";
         this.module = "Image";
-        this.description = "Extracts the Least Significant Bit data from each pixel in an image. This is a common way to hide data in Steganography.";
-        this.infoURL = "https://wikipedia.org/wiki/Bit_numbering#Least_significant_bit_in_digital_steganography";
+        this.description =
+            "Extracts the Least Significant Bit data from each pixel in an image. This is a common way to hide data in Steganography.";
+        this.infoURL =
+            "https://wikipedia.org/wiki/Bit_numbering#Least_significant_bit_in_digital_steganography";
         this.inputType = "ArrayBuffer";
         this.outputType = "byteArray";
         this.args = [
@@ -57,8 +58,8 @@ class ExtractLSB extends Operation {
             {
                 name: "Bit",
                 type: "number",
-                value: 0
-            }
+                value: 0,
+            },
         ];
     }
 
@@ -68,21 +69,27 @@ class ExtractLSB extends Operation {
      * @returns {byteArray}
      */
     async run(input, args) {
-        if (!isImage(input)) throw new OperationError("Please enter a valid image file.");
+        if (!isImage(input))
+            throw new OperationError("Please enter a valid image file.");
 
         const bit = 7 - args.pop(),
             pixelOrder = args.pop(),
-            colours = args.filter(option => option !== "").map(option => COLOUR_OPTIONS.indexOf(option)),
+            colours = args
+                .filter((option) => option !== "")
+                .map((option) => COLOUR_OPTIONS.indexOf(option)),
             parsedImage = await Jimp.read(input),
             width = parsedImage.bitmap.width,
             height = parsedImage.bitmap.height,
             rgba = parsedImage.bitmap.data;
 
         if (bit < 0 || bit > 7) {
-            throw new OperationError("Error: Bit argument must be between 0 and 7");
+            throw new OperationError(
+                "Error: Bit argument must be between 0 and 7",
+            );
         }
 
-        let i, combinedBinary = "";
+        let i,
+            combinedBinary = "";
 
         if (pixelOrder === "Row") {
             for (i = 0; i < rgba.length; i += 4) {
@@ -106,7 +113,6 @@ class ExtractLSB extends Operation {
 
         return fromBinary(combinedBinary);
     }
-
 }
 
 const COLOUR_OPTIONS = ["R", "G", "B", "A"];

package/src/core/operations/ExtractRGBA.mjs

@@ -7,15 +7,14 @@
 import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
 import { isImage } from "../lib/FileType.mjs";
-import Jimp from "jimp/es/index.js";
+import { Jimp } from "jimp";
 
-import {RGBA_DELIM_OPTIONS} from "../lib/Delim.mjs";
+import { RGBA_DELIM_OPTIONS } from "../lib/Delim.mjs";
 
 /**
  * Extract RGBA operation
  */
 class ExtractRGBA extends Operation {
-
     /**
      * ExtractRGBA constructor
      */
@@ -24,7 +23,8 @@ class ExtractRGBA extends Operation {
 
         this.name = "Extract RGBA";
         this.module = "Image";
-        this.description = "Extracts each pixel's RGBA value in an image. These are sometimes used in Steganography to hide text or data.";
+        this.description =
+            "Extracts each pixel's RGBA value in an image. These are sometimes used in Steganography to hide text or data.";
         this.infoURL = "https://wikipedia.org/wiki/RGBA_color_space";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";
@@ -32,13 +32,13 @@ class ExtractRGBA extends Operation {
             {
                 name: "Delimiter",
                 type: "editableOption",
-                value: RGBA_DELIM_OPTIONS
+                value: RGBA_DELIM_OPTIONS,
             },
             {
                 name: "Include Alpha",
                 type: "boolean",
-                value: true
-            }
+                value: true,
+            },
         ];
     }
 
@@ -48,18 +48,20 @@ class ExtractRGBA extends Operation {
      * @returns {string}
      */
     async run(input, args) {
-        if (!isImage(input)) throw new OperationError("Please enter a valid image file.");
+        if (!isImage(input))
+            throw new OperationError("Please enter a valid image file.");
 
         const delimiter = args[0],
             includeAlpha = args[1],
             parsedImage = await Jimp.read(input);
 
         let bitmap = parsedImage.bitmap.data;
-        bitmap = includeAlpha ? bitmap : bitmap.filter((val, idx) => idx % 4 !== 3);
+        bitmap = includeAlpha ?
+            bitmap :
+            bitmap.filter((val, idx) => idx % 4 !== 3);
 
         return bitmap.join(delimiter);
     }
-
 }
 
 export default ExtractRGBA;

package/src/core/operations/FlaskSessionDecode.mjs

@@ -0,0 +1,80 @@
+/**
+ * @author ThePlayer372-FR []
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { fromBase64 } from "../lib/Base64.mjs";
+
+/**
+ * Flask Session Decode operation
+ */
+class FlaskSessionDecode extends Operation {
+    /**
+     * FlaskSessionDecode constructor
+    */
+    constructor() {
+        super();
+
+        this.name = "Flask Session Decode";
+        this.module = "Crypto";
+        this.description = "Decodes the payload of a Flask session cookie (itsdangerous) into JSON.";
+        this.inputType = "string";
+        this.outputType = "JSON";
+        this.args = [
+            {
+                name: "View TimeStamp",
+                type: "boolean",
+                value: false
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {Object[]}
+     */
+    run(input, args) {
+        input = input.trim();
+        const parts = input.split(".");
+        if (parts.length !== 3) {
+            throw new OperationError("Invalid Flask token format. Expected payload.timestamp.signature");
+        }
+
+        const payloadB64 = parts[0];
+        const time = parts[1];
+
+        const timeB64 = time.replace(/-/g, "+").replace(/_/g, "/");
+        const binary = fromBase64(timeB64);
+        const bytes = new Uint8Array(4);
+        for (let i = 0; i < 4; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        const view = new DataView(bytes.buffer);
+        const timestamp = view.getInt32(0, false);
+
+        const base64 = payloadB64.replace(/-/g, "+").replace(/_/g, "/");
+        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+        let payloadJson;
+        try {
+            payloadJson = fromBase64(padded);
+        } catch (e) {
+            throw new OperationError("Invalid Base64 payload");
+        }
+
+        try {
+            let data = JSON.parse(payloadJson);
+
+            if (args[0]) {
+                data = {payload: data, timestamp: timestamp};
+            }
+            return data;
+        } catch (e) {
+            throw new OperationError("Unable to decode JSON payload: " + e.message);
+        }
+    }
+}
+
+export default FlaskSessionDecode;