cyberchef 10.22.1 → 10.24.0

package/src/core/config/OperationConfig.json

@@ -702,13 +702,19 @@
     },
     "Analyse UUID": {
         "module": "Crypto",
-        "description": "Tries to determine information about a given UUID and suggests which version may have been used to generate it",
+        "description": "Operation for extracting metadata and detecting the version of a given UUID.",
         "infoURL": "https://wikipedia.org/wiki/Universally_unique_identifier",
         "inputType": "string",
         "outputType": "string",
         "flowControl": false,
         "manualBake": false,
-        "args": []
+        "args": [
+            {
+                "name": "Include Metadata",
+                "type": "boolean",
+                "value": true
+            }
+        ]
     },
     "Argon2": {
         "module": "Crypto",
@@ -6566,6 +6572,58 @@
             }
         ]
     },
+    "Disassemble ARM": {
+        "module": "Shellcode",
+        "description": "Disassembles ARM machine code into assembly language.<br><br>Supports ARM (32-bit), Thumb, and ARM64 (AArch64) architectures using the Capstone disassembly framework.<br><br>Input should be in hexadecimal.",
+        "infoURL": "https://wikipedia.org/wiki/ARM_architecture_family",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Architecture",
+                "type": "option",
+                "value": [
+                    "ARM (32-bit)",
+                    "ARM64 (AArch64)"
+                ]
+            },
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": [
+                    "ARM",
+                    "Thumb",
+                    "Thumb + Cortex-M",
+                    "ARMv8"
+                ]
+            },
+            {
+                "name": "Endianness",
+                "type": "option",
+                "value": [
+                    "Little Endian",
+                    "Big Endian"
+                ]
+            },
+            {
+                "name": "Starting address (hex)",
+                "type": "number",
+                "value": 0
+            },
+            {
+                "name": "Show instruction hex",
+                "type": "boolean",
+                "value": true
+            },
+            {
+                "name": "Show instruction position",
+                "type": "boolean",
+                "value": true
+            }
+        ]
+    },
     "Disassemble x86": {
         "module": "Shellcode",
         "description": "Disassembly is the process of translating machine language into assembly language.<br><br>This operation supports 64-bit, 32-bit and 16-bit code written for Intel or AMD x86 processors. It is particularly useful for reverse engineering shellcode.<br><br>Input should be in hexadecimal.",
@@ -7571,29 +7629,6 @@
                 "type": "boolean",
                 "value": true
             }
-        ],
-        "checks": [
-            {
-                "pattern": "\\\\u(?:[\\da-f]{4,6})",
-                "flags": "i",
-                "args": [
-                    "\\u"
-                ]
-            },
-            {
-                "pattern": "%u(?:[\\da-f]{4,6})",
-                "flags": "i",
-                "args": [
-                    "%u"
-                ]
-            },
-            {
-                "pattern": "U\\+(?:[\\da-f]{4,6})",
-                "flags": "i",
-                "args": [
-                    "U+"
-                ]
-            }
         ]
     },
     "Expand alphabet range": {
@@ -7612,6 +7647,27 @@
             }
         ]
     },
+    "Extract Audio Metadata": {
+        "module": "Default",
+        "description": "Extract common audio metadata across MP3 (ID3v2/ID3v1/GEOB), WAV/BWF/BW64 (INFO/bext/iXML/axml), FLAC (Vorbis Comment/Picture), OGG (Vorbis/OpusTags), AAC (ADTS), AC3 (Dolby Digital), WMA (ASF), plus best-effort MP4/M4A and AIFF scanning. Outputs normalized JSON.",
+        "infoURL": "https://wikipedia.org/wiki/Audio_file_format",
+        "inputType": "ArrayBuffer",
+        "outputType": "html",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Filename (optional)",
+                "type": "string",
+                "value": ""
+            },
+            {
+                "name": "Max embedded text bytes (iXML/axml/etc)",
+                "type": "number",
+                "value": 524288
+            }
+        ]
+    },
     "Extract dates": {
         "module": "Regex",
         "description": "Extracts dates in the following formats<ul><li><code>yyyy-mm-dd</code></li><li><code>dd/mm/yyyy</code></li><li><code>mm/dd/yyyy</code></li></ul>Dividers can be any of /, -, . or space",
@@ -8188,6 +8244,117 @@
             }
         ]
     },
+    "Flask Session Decode": {
+        "module": "Crypto",
+        "description": "Decodes the payload of a Flask session cookie (itsdangerous) into JSON.",
+        "infoURL": null,
+        "inputType": "string",
+        "outputType": "JSON",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "View TimeStamp",
+                "type": "boolean",
+                "value": false
+            }
+        ]
+    },
+    "Flask Session Sign": {
+        "module": "Crypto",
+        "description": "Signs a JSON payload to produce a Flask session cookie (itsdangerous HMAC).",
+        "infoURL": null,
+        "inputType": "JSON",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Key",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": [
+                    "Hex",
+                    "Decimal",
+                    "Binary",
+                    "Base64",
+                    "UTF8",
+                    "Latin1"
+                ]
+            },
+            {
+                "name": "Salt",
+                "type": "toggleString",
+                "value": "cookie-session",
+                "toggleValues": [
+                    "UTF8",
+                    "Hex",
+                    "Decimal",
+                    "Binary",
+                    "Base64",
+                    "Latin1"
+                ]
+            },
+            {
+                "name": "Algorithm",
+                "type": "option",
+                "value": [
+                    "sha1",
+                    "sha256"
+                ]
+            }
+        ]
+    },
+    "Flask Session Verify": {
+        "module": "Crypto",
+        "description": "Verifies the HMAC signature of a Flask session cookie (itsdangerous) generated.",
+        "infoURL": null,
+        "inputType": "string",
+        "outputType": "JSON",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Key",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": [
+                    "Hex",
+                    "Decimal",
+                    "Binary",
+                    "Base64",
+                    "UTF8",
+                    "Latin1"
+                ]
+            },
+            {
+                "name": "Salt",
+                "type": "toggleString",
+                "value": "cookie-session",
+                "toggleValues": [
+                    "UTF8",
+                    "Hex",
+                    "Decimal",
+                    "Binary",
+                    "Base64",
+                    "Latin1"
+                ]
+            },
+            {
+                "name": "Algorithm",
+                "type": "option",
+                "value": [
+                    "sha1",
+                    "sha256"
+                ]
+            },
+            {
+                "name": "View TimeStamp",
+                "type": "boolean",
+                "value": true
+            }
+        ]
+    },
     "Fletcher-16 Checksum": {
         "module": "Crypto",
         "description": "The Fletcher checksum is an algorithm for computing a position-dependent checksum devised by John Gould Fletcher at Lawrence Livermore Labs in the late 1970s.<br><br>The objective of the Fletcher checksum was to provide error-detection properties approaching those of a cyclic redundancy check but with the lower computational effort associated with summation techniques.",
@@ -11822,6 +11989,11 @@
                 "name": "Query",
                 "type": "string",
                 "value": ""
+            },
+            {
+                "name": "Raw",
+                "type": "boolean",
+                "value": false
             }
         ]
     },
@@ -13052,6 +13224,46 @@
             }
         ]
     },
+    "Parity Bit": {
+        "module": "Default",
+        "description": "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurence of the delimiter character",
+        "infoURL": "https://wikipedia.org/wiki/Parity_bit",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": [
+                    "Even Parity",
+                    "Odd Parity"
+                ]
+            },
+            {
+                "name": "Postion",
+                "type": "option",
+                "value": [
+                    "Start",
+                    "End"
+                ]
+            },
+            {
+                "name": "Encode or Decode",
+                "type": "option",
+                "value": [
+                    "Encode",
+                    "Decode"
+                ]
+            },
+            {
+                "name": "Delimiter",
+                "type": "shortString",
+                "value": ""
+            }
+        ]
+    },
     "Parse ASN.1 hex string": {
         "module": "PublicKey",
         "description": "Abstract Syntax Notation One (ASN.1) is a standard and notation that describes rules and structures for representing, encoding, transmitting, and decoding data in telecommunications and computer networking.<br><br>This operation parses arbitrary ASN.1 data (encoded as an hex string: use the 'To Hex' operation if necessary) and presents the resulting tree.",
@@ -13263,6 +13475,7 @@
                     "America/Coral_Harbour",
                     "America/Cordoba",
                     "America/Costa_Rica",
+                    "America/Coyhaique",
                     "America/Creston",
                     "America/Cuiaba",
                     "America/Curacao",
@@ -13764,6 +13977,34 @@
             }
         ]
     },
+    "Parse Ethernet frame": {
+        "module": "Default",
+        "description": "Parses an Ethernet frame and either shows the deduced values (Source and destination MAC, VLANs) or returns the packet data.<br /><br />Good for use in conjunction with the Parse IPv4, and Parse TCP/UDP recipes.",
+        "infoURL": "https://en.wikipedia.org/wiki/Ethernet_frame#Frame_%E2%80%93_data_link_layer",
+        "inputType": "string",
+        "outputType": "html",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Input type",
+                "type": "option",
+                "value": [
+                    "Raw",
+                    "Hex"
+                ]
+            },
+            {
+                "name": "Return type",
+                "type": "option",
+                "value": [
+                    "Text output",
+                    "Packet data",
+                    "Packet data (hex)"
+                ]
+            }
+        ]
+    },
     "Parse IP range": {
         "module": "Default",
         "description": "Given a CIDR range (e.g. <code>10.0.0.0/24</code>), hyphenated range (e.g. <code>10.0.0.0 - 10.0.1.0</code>), or a list of IPs and/or CIDR ranges (separated by a new line), this operation provides network information and enumerates all IP addresses in the range.<br><br>IPv6 is supported but will not be enumerated.",
@@ -13806,6 +14047,15 @@
                     "Hex",
                     "Raw"
                 ]
+            },
+            {
+                "name": "Output format",
+                "type": "option",
+                "value": [
+                    "Table",
+                    "Data (hex)",
+                    "Data (raw)"
+                ]
             }
         ]
     },
@@ -14144,6 +14394,58 @@
             }
         ]
     },
+    "Pseudo-Random Integer Generator": {
+        "module": "Ciphers",
+        "description": "A cryptographically-secure pseudo-random number generator (PRNG).<br><br>Generates random integers within a specified range using the browser's built-in <code>crypto.getRandomValues()</code> method if available.<br><br>The supported range of integers is from <code>-(2^53 - 1)</code> to <code>(2^53 - 1)</code>.",
+        "infoURL": "https://wikipedia.org/wiki/Pseudorandom_number_generator",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Number of Integers",
+                "type": "number",
+                "value": 1,
+                "min": 1
+            },
+            {
+                "name": "Min Value",
+                "type": "number",
+                "value": 0,
+                "min": -9007199254740991,
+                "max": 9007199254740991
+            },
+            {
+                "name": "Max Value",
+                "type": "number",
+                "value": 99,
+                "min": -9007199254740991,
+                "max": 9007199254740991
+            },
+            {
+                "name": "Delimiter",
+                "type": "option",
+                "value": [
+                    "Space",
+                    "Comma",
+                    "Semi-colon",
+                    "Colon",
+                    "Line feed",
+                    "CRLF"
+                ]
+            },
+            {
+                "name": "Output",
+                "type": "option",
+                "value": [
+                    "Raw",
+                    "Hex",
+                    "Decimal"
+                ]
+            }
+        ]
+    },
     "Pseudo-Random Number Generator": {
         "module": "Ciphers",
         "description": "A cryptographically-secure pseudo-random number generator (PRNG).<br><br>This operation uses the browser's built-in <code>crypto.getRandomValues()</code> method if available. If this cannot be found, it falls back to a Fortuna-based PRNG algorithm.",
@@ -14423,6 +14725,178 @@
             }
         ]
     },
+    "RC6 Decrypt": {
+        "module": "Ciphers",
+        "description": "RC6 is a symmetric key block cipher derived from RC5. It was designed by Ron Rivest, Matt Robshaw, Ray Sidney, and Yiqun Lisa Yin to meet the requirements of the AES competition, and was one of the five finalists.<br><br>RC6 is parameterised as RC6-w/r/b where w is word size in bits (any multiple of 8 from 8-256), r is the number of rounds (1-255), and b is the key length in bytes. The standard AES submission uses w=32, r=20. Common word sizes: 8, 16, 32 (standard), 64, 128.<br><br><b>IV:</b> The Initialisation Vector should be 4*w/8 bytes (e.g. 16 bytes for w=32). If not entered, it will default to null bytes.<br><br><b>Padding:</b> In CBC and ECB mode, the PKCS#7 padding scheme is used.",
+        "infoURL": "https://wikipedia.org/wiki/RC6",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Key",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": [
+                    "Hex",
+                    "UTF8",
+                    "Latin1",
+                    "Base64"
+                ]
+            },
+            {
+                "name": "IV",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": [
+                    "Hex",
+                    "UTF8",
+                    "Latin1",
+                    "Base64"
+                ]
+            },
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": [
+                    "CBC",
+                    "CFB",
+                    "OFB",
+                    "CTR",
+                    "ECB"
+                ]
+            },
+            {
+                "name": "Input",
+                "type": "option",
+                "value": [
+                    "Hex",
+                    "Raw"
+                ]
+            },
+            {
+                "name": "Output",
+                "type": "option",
+                "value": [
+                    "Raw",
+                    "Hex"
+                ]
+            },
+            {
+                "name": "Padding",
+                "type": "option",
+                "value": [
+                    "PKCS5",
+                    "NO",
+                    "ZERO",
+                    "RANDOM",
+                    "BIT"
+                ]
+            },
+            {
+                "name": "Word Size",
+                "type": "number",
+                "value": 32,
+                "min": 8,
+                "max": 256,
+                "step": 8
+            },
+            {
+                "name": "Rounds",
+                "type": "number",
+                "value": 20,
+                "min": 1,
+                "max": 255
+            }
+        ]
+    },
+    "RC6 Encrypt": {
+        "module": "Ciphers",
+        "description": "RC6 is a symmetric key block cipher derived from RC5. It was designed by Ron Rivest, Matt Robshaw, Ray Sidney, and Yiqun Lisa Yin to meet the requirements of the AES competition, and was one of the five finalists.<br><br>RC6 is parameterised as RC6-w/r/b where w is word size in bits (any multiple of 8 from 8-256), r is the number of rounds (1-255), and b is the key length in bytes. The standard AES submission uses w=32, r=20. Common word sizes: 8, 16, 32 (standard), 64, 128.<br><br><b>IV:</b> The Initialisation Vector should be 4*w/8 bytes (e.g. 16 bytes for w=32). If not entered, it will default to null bytes.<br><br><b>Padding:</b> In CBC and ECB mode, the PKCS#7 padding scheme is used.",
+        "infoURL": "https://wikipedia.org/wiki/RC6",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Key",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": [
+                    "Hex",
+                    "UTF8",
+                    "Latin1",
+                    "Base64"
+                ]
+            },
+            {
+                "name": "IV",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": [
+                    "Hex",
+                    "UTF8",
+                    "Latin1",
+                    "Base64"
+                ]
+            },
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": [
+                    "CBC",
+                    "CFB",
+                    "OFB",
+                    "CTR",
+                    "ECB"
+                ]
+            },
+            {
+                "name": "Input",
+                "type": "option",
+                "value": [
+                    "Raw",
+                    "Hex"
+                ]
+            },
+            {
+                "name": "Output",
+                "type": "option",
+                "value": [
+                    "Hex",
+                    "Raw"
+                ]
+            },
+            {
+                "name": "Padding",
+                "type": "option",
+                "value": [
+                    "PKCS5",
+                    "NO",
+                    "ZERO",
+                    "RANDOM",
+                    "BIT"
+                ]
+            },
+            {
+                "name": "Word Size",
+                "type": "number",
+                "value": 32,
+                "min": 8,
+                "max": 256,
+                "step": 8
+            },
+            {
+                "name": "Rounds",
+                "type": "number",
+                "value": 20,
+                "min": 1,
+                "max": 255
+            }
+        ]
+    },
     "RIPEMD": {
         "module": "Crypto",
         "description": "RIPEMD (RACE Integrity Primitives Evaluation Message Digest) is a family of cryptographic hash functions developed in Leuven, Belgium, by Hans Dobbertin, Antoon Bosselaers and Bart Preneel at the COSIC research group at the Katholieke Universiteit Leuven, and first published in 1996.<br><br>RIPEMD was based upon the design principles used in MD4, and is similar in performance to the more popular SHA-1.<br><br>",
@@ -15008,7 +15482,7 @@
                     },
                     {
                         "name": "Email address",
-                        "value": "(?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*\")@(?:(?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9](?:[\\u00A0-\\uD7FF\\uE000-\\uFFFF-a-z0-9-]*[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9])?\\.)+[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9](?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9-]*[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9])?|\\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\.){3}\\])"
+                        "value": "(?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*\")@(?:(?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9](?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9-]*[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9])?\\.)+[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9](?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9-]*[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9])?|\\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\])"
                     },
                     {
                         "name": "URL",
@@ -15232,6 +15706,11 @@
                 "name": "Enable syntax highlighting",
                 "type": "boolean",
                 "value": true
+            },
+            {
+                "name": "Open links in new tab.",
+                "type": "boolean",
+                "value": false
             }
         ]
     },
@@ -18217,6 +18696,26 @@
             }
         ]
     },
+    "Text-Integer Conversion": {
+        "module": "Default",
+        "description": "Converts between text strings and large integers (decimal or hexadecimal).<br><br>Text is interpreted as a big-endian sequence of character codes. For example:<br>ABC is 0x414243 (hex) is 4276803 (decimal)<br><b>Input format detection:</b><br>Decimal: digits 0-9 only<br>Hexadecimal: 0x... prefix<br>Quoted or unquoted text: treated as string<br><br><b>Character limitations:</b><br>Text input may only contain ASCII and Latin-1 characters (code point < 256).<br>Multi-byte Unicode characters will generate an error.<br><br>.",
+        "infoURL": "https://wikipedia.org/wiki/Endianness",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": [
+            {
+                "name": "Output format",
+                "type": "option",
+                "value": [
+                    "String",
+                    "Decimal",
+                    "Hexadecimal"
+                ]
+            }
+        ]
+    },
     "To BCD": {
         "module": "Default",
         "description": "Binary-Coded Decimal (BCD) is a class of binary encodings of decimal numbers where each decimal digit is represented by a fixed number of bits, usually four or eight. Special bit patterns are sometimes used for a sign",
@@ -19228,6 +19727,7 @@
                     "America/Coral_Harbour",
                     "America/Cordoba",
                     "America/Costa_Rica",
+                    "America/Coyhaique",
                     "America/Creston",
                     "America/Cuiaba",
                     "America/Curacao",
@@ -19836,6 +20336,7 @@
                     "America/Coral_Harbour",
                     "America/Cordoba",
                     "America/Costa_Rica",
+                    "America/Coyhaique",
                     "America/Creston",
                     "America/Cuiaba",
                     "America/Curacao",
@@ -21136,6 +21637,29 @@
                     "U+"
                 ]
             }
+        ],
+        "checks": [
+            {
+                "pattern": "\\\\u(?:[\\da-f]{4,6})",
+                "flags": "i",
+                "args": [
+                    "\\u"
+                ]
+            },
+            {
+                "pattern": "%u(?:[\\da-f]{4,6})",
+                "flags": "i",
+                "args": [
+                    "%u"
+                ]
+            },
+            {
+                "pattern": "U\\+(?:[\\da-f]{4,6})",
+                "flags": "i",
+                "args": [
+                    "U+"
+                ]
+            }
         ]
     },
     "Unicode Text Format": {