cyberchef 10.22.1 → 10.24.0

package/src/core/config/modules/Ciphers.mjs

@@ -37,11 +37,14 @@ import GOSTSign from "../../operations/GOSTSign.mjs";
 import GOSTVerify from "../../operations/GOSTVerify.mjs";
 import GenerateECDSAKeyPair from "../../operations/GenerateECDSAKeyPair.mjs";
 import GenerateRSAKeyPair from "../../operations/GenerateRSAKeyPair.mjs";
+import PseudoRandomIntegerGenerator from "../../operations/PseudoRandomIntegerGenerator.mjs";
 import PseudoRandomNumberGenerator from "../../operations/PseudoRandomNumberGenerator.mjs";
 import RC2Decrypt from "../../operations/RC2Decrypt.mjs";
 import RC2Encrypt from "../../operations/RC2Encrypt.mjs";
 import RC4 from "../../operations/RC4.mjs";
 import RC4Drop from "../../operations/RC4Drop.mjs";
+import RC6Decrypt from "../../operations/RC6Decrypt.mjs";
+import RC6Encrypt from "../../operations/RC6Encrypt.mjs";
 import RSADecrypt from "../../operations/RSADecrypt.mjs";
 import RSAEncrypt from "../../operations/RSAEncrypt.mjs";
 import RSASign from "../../operations/RSASign.mjs";
@@ -95,11 +98,14 @@ OpModules.Ciphers = {
     "GOST Verify": GOSTVerify,
     "Generate ECDSA Key Pair": GenerateECDSAKeyPair,
     "Generate RSA Key Pair": GenerateRSAKeyPair,
+    "Pseudo-Random Integer Generator": PseudoRandomIntegerGenerator,
     "Pseudo-Random Number Generator": PseudoRandomNumberGenerator,
     "RC2 Decrypt": RC2Decrypt,
     "RC2 Encrypt": RC2Encrypt,
     "RC4": RC4,
     "RC4 Drop": RC4Drop,
+    "RC6 Decrypt": RC6Decrypt,
+    "RC6 Encrypt": RC6Encrypt,
     "RSA Decrypt": RSADecrypt,
     "RSA Encrypt": RSAEncrypt,
     "RSA Sign": RSASign,

package/src/core/config/modules/Crypto.mjs

@@ -20,6 +20,9 @@ import CipherSaber2Encrypt from "../../operations/CipherSaber2Encrypt.mjs";
 import CompareCTPHHashes from "../../operations/CompareCTPHHashes.mjs";
 import CompareSSDEEPHashes from "../../operations/CompareSSDEEPHashes.mjs";
 import DeriveHKDFKey from "../../operations/DeriveHKDFKey.mjs";
+import FlaskSessionDecode from "../../operations/FlaskSessionDecode.mjs";
+import FlaskSessionSign from "../../operations/FlaskSessionSign.mjs";
+import FlaskSessionVerify from "../../operations/FlaskSessionVerify.mjs";
 import Fletcher16Checksum from "../../operations/Fletcher16Checksum.mjs";
 import Fletcher32Checksum from "../../operations/Fletcher32Checksum.mjs";
 import Fletcher64Checksum from "../../operations/Fletcher64Checksum.mjs";
@@ -81,6 +84,9 @@ OpModules.Crypto = {
     "Compare CTPH hashes": CompareCTPHHashes,
     "Compare SSDEEP hashes": CompareSSDEEPHashes,
     "Derive HKDF key": DeriveHKDFKey,
+    "Flask Session Decode": FlaskSessionDecode,
+    "Flask Session Sign": FlaskSessionSign,
+    "Flask Session Verify": FlaskSessionVerify,
     "Fletcher-16 Checksum": Fletcher16Checksum,
     "Fletcher-32 Checksum": Fletcher32Checksum,
     "Fletcher-64 Checksum": Fletcher64Checksum,

package/src/core/config/modules/Default.mjs

@@ -44,6 +44,7 @@ import EncodeNetBIOSName from "../../operations/EncodeNetBIOSName.mjs";
 import EscapeString from "../../operations/EscapeString.mjs";
 import EscapeUnicodeCharacters from "../../operations/EscapeUnicodeCharacters.mjs";
 import ExpandAlphabetRange from "../../operations/ExpandAlphabetRange.mjs";
+import ExtractAudioMetadata from "../../operations/ExtractAudioMetadata.mjs";
 import ExtractFiles from "../../operations/ExtractFiles.mjs";
 import ExtractID3 from "../../operations/ExtractID3.mjs";
 import FangURL from "../../operations/FangURL.mjs";
@@ -114,8 +115,10 @@ import PHPDeserialize from "../../operations/PHPDeserialize.mjs";
 import PHPSerialize from "../../operations/PHPSerialize.mjs";
 import PLISTViewer from "../../operations/PLISTViewer.mjs";
 import PadLines from "../../operations/PadLines.mjs";
+import ParityBit from "../../operations/ParityBit.mjs";
 import ParseColourCode from "../../operations/ParseColourCode.mjs";
 import ParseDateTime from "../../operations/ParseDateTime.mjs";
+import ParseEthernetFrame from "../../operations/ParseEthernetFrame.mjs";
 import ParseIPRange from "../../operations/ParseIPRange.mjs";
 import ParseIPv4Header from "../../operations/ParseIPv4Header.mjs";
 import ParseIPv6Address from "../../operations/ParseIPv6Address.mjs";
@@ -167,6 +170,7 @@ import SymmetricDifference from "../../operations/SymmetricDifference.mjs";
 import Tail from "../../operations/Tail.mjs";
 import TakeBytes from "../../operations/TakeBytes.mjs";
 import TakeNthBytes from "../../operations/TakeNthBytes.mjs";
+import TextIntegerConverter from "../../operations/TextIntegerConverter.mjs";
 import ToBCD from "../../operations/ToBCD.mjs";
 import ToBase from "../../operations/ToBase.mjs";
 import ToBase32 from "../../operations/ToBase32.mjs";
@@ -250,6 +254,7 @@ OpModules.Default = {
     "Escape string": EscapeString,
     "Escape Unicode Characters": EscapeUnicodeCharacters,
     "Expand alphabet range": ExpandAlphabetRange,
+    "Extract Audio Metadata": ExtractAudioMetadata,
     "Extract Files": ExtractFiles,
     "Extract ID3": ExtractID3,
     "Fang URL": FangURL,
@@ -320,8 +325,10 @@ OpModules.Default = {
     "PHP Serialize": PHPSerialize,
     "P-list Viewer": PLISTViewer,
     "Pad lines": PadLines,
+    "Parity Bit": ParityBit,
     "Parse colour code": ParseColourCode,
     "Parse DateTime": ParseDateTime,
+    "Parse Ethernet frame": ParseEthernetFrame,
     "Parse IP range": ParseIPRange,
     "Parse IPv4 header": ParseIPv4Header,
     "Parse IPv6 address": ParseIPv6Address,
@@ -373,6 +380,7 @@ OpModules.Default = {
     "Tail": Tail,
     "Take bytes": TakeBytes,
     "Take nth bytes": TakeNthBytes,
+    "Text-Integer Conversion": TextIntegerConverter,
     "To BCD": ToBCD,
     "To Base": ToBase,
     "To Base32": ToBase32,

package/src/core/config/modules/Shellcode.mjs

@@ -5,11 +5,13 @@
 * @copyright Crown Copyright 2026
 * @license Apache-2.0
 */
+import DisassembleARM from "../../operations/DisassembleARM.mjs";
 import DisassembleX86 from "../../operations/DisassembleX86.mjs";
 
 const OpModules = typeof self === "undefined" ? {} : self.OpModules || {};
 
 OpModules.Shellcode = {
+    "Disassemble ARM": DisassembleARM,
     "Disassemble x86": DisassembleX86,
 };
 

package/src/core/config/scripts/fixCryptoApiImports.mjs

@@ -0,0 +1,54 @@
+/**
+ * This script updates crypto-api package
+ * It adds .mjs to local imports where its missing
+ *
+ * before:
+ * import foo from "./bar";
+ * after
+ * import foo from "./bar.mjs";
+ *
+ */
+
+/* eslint no-console: ["off"] */
+
+import { readdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// Base directory of crypto-api source
+const baseDir = join(process.cwd(), "node_modules/crypto-api/src");
+
+/**
+ * Recursively walk a directory, updating import statements
+ * to include ".mjs" if missing
+ */
+function walk(dir) {
+    const entries = readdirSync(dir, { withFileTypes: true });
+
+    for (const entry of entries) {
+        if (entry.name === ".git") continue;
+
+        const fullPath = join(dir, entry.name);
+
+        if (entry.isDirectory()) {
+            walk(fullPath);
+        } else if (entry.isFile()) {
+            const content = readFileSync(fullPath, "utf8");
+
+            // Add .mjs to imports if not present
+            const updated = content.replace(
+                /from "(\.[^"]*)";/g,
+                (match, p1) => {
+                    if (p1.endsWith(".mjs")) return match;
+                    return `from "${p1}.mjs";`;
+                }
+            );
+
+            if (updated !== content) {
+                writeFileSync(fullPath, updated, "utf8");
+            }
+        }
+    }
+}
+
+// Run the walker
+walk(baseDir);

package/src/core/config/scripts/fixSnackBarMarkup.mjs

@@ -0,0 +1,28 @@
+/**
+ * This script updates snackbarjs package
+ * Replaces self-closing div with standard opening div
+ *
+ * before:
+ * <div id=snackbar-container/>
+ * after:
+ * <div id=snackbar-container>
+ *
+ */
+
+/* eslint no-console: ["off"] */
+
+import { readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// Base directory of snackbarjs source
+const filePath = join(process.cwd(), "node_modules/snackbarjs/src/snackbar.js");
+
+const content = readFileSync(filePath, "utf8");
+
+// Replace self-closing div with standard opening div
+const updated = content.replace(
+    /<div id=snackbar-container\/>/g,
+    "<div id=snackbar-container>"
+);
+
+writeFileSync(filePath, updated, "utf8");

package/src/core/lib/AudioBytes.mjs

@@ -0,0 +1,103 @@
+/**
+ * Byte-reading and text-decoding utilities for audio metadata parsing.
+ *
+ * @author d0s1nt [d0s1nt@cyberchefaudio]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+/** @returns {string} 4-byte ASCII at offset, or "" if out of bounds. */
+export function ascii4(b, off) {
+    if (off + 4 > b.length) return "";
+    return String.fromCharCode(b[off], b[off + 1], b[off + 2], b[off + 3]);
+}
+
+/** @returns {number} Byte offset of ASCII needle `s`, or -1. */
+export function indexOfAscii(b, s, start, end) {
+    const limit = Math.max(0, Math.min(end, b.length) - s.length);
+    for (let i = start; i <= limit; i++) {
+        let ok = true;
+        for (let j = 0; j < s.length; j++) {
+            if (b[i + j] !== s.charCodeAt(j)) {
+                ok = false;
+                break;
+            }
+        }
+        if (ok) return i;
+    }
+    return -1;
+}
+
+/** @returns {number} Unsigned 32-bit big-endian read. */
+export function u32be(bytes, off) {
+    return ((bytes[off] << 24) >>> 0) | (bytes[off + 1] << 16) | (bytes[off + 2] << 8) | bytes[off + 3];
+}
+
+/** @returns {number} Unsigned 32-bit little-endian read. */
+export function u32le(bytes, off) {
+    return (bytes[off] | (bytes[off + 1] << 8) | (bytes[off + 2] << 16) | (bytes[off + 3] << 24)) >>> 0;
+}
+
+/** @returns {number} Unsigned 16-bit little-endian read. */
+export function u16le(bytes, off) {
+    return bytes[off] | (bytes[off + 1] << 8);
+}
+
+/** @returns {BigInt} Unsigned 64-bit little-endian read. */
+export function u64le(bytes, off) {
+    return BigInt(u32le(bytes, off)) | (BigInt(u32le(bytes, off + 4)) << 32n);
+}
+
+/** @returns {number} Decoded ID3v2 synchsafe integer from four 7-bit bytes. */
+export function synchsafeToInt(b0, b1, b2, b3) {
+    return ((b0 & 0x7f) << 21) | ((b1 & 0x7f) << 14) | ((b2 & 0x7f) << 7) | (b3 & 0x7f);
+}
+
+/** @returns {string} Decoded UTF-16LE byte range, nulls stripped. */
+export function decodeUtf16LE(b, off, len) {
+    if (len <= 0 || off + len > b.length) return "";
+    try {
+        return new TextDecoder("utf-16le").decode(b.slice(off, off + len)).replace(/\u0000/g, "").trim();
+    } catch {
+        return "";
+    }
+}
+
+/** @returns {{valueBytes: Uint8Array, next: number}} Bytes until null terminator, UTF-16 aware. */
+export function readNullTerminated(bytes, start, encoding) {
+    const isUtf16 = encoding === 1 || encoding === 2;
+    if (!isUtf16) {
+        let i = start;
+        while (i < bytes.length && bytes[i] !== 0x00) i++;
+        return { valueBytes: bytes.slice(start, i), next: i + 1 };
+    }
+    let i = start;
+    while (i + 1 < bytes.length && !(bytes[i] === 0x00 && bytes[i + 1] === 0x00)) i += 2;
+    return { valueBytes: bytes.slice(start, i), next: i + 2 };
+}
+
+const ID3_ENCODINGS = ["iso-8859-1", "utf-16", "utf-16be", "utf-8"];
+
+/** @returns {string} Text decoded using ID3v2 encoding byte (0=latin1, 1=utf16, 2=utf16be, 3=utf8). */
+export function decodeText(bytes, encoding) {
+    if (!bytes || bytes.length === 0) return "";
+    try {
+        return new TextDecoder(ID3_ENCODINGS[encoding] || "utf-16").decode(bytes);
+    } catch {
+        return safeUtf8(bytes);
+    }
+}
+
+/** @returns {string} UTF-8 decode with replacement (never throws). */
+export function safeUtf8(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    } catch {
+        return "";
+    }
+}
+
+/** @returns {string} ISO-8859-1 decode, nulls stripped, trimmed. */
+export function decodeLatin1Trim(bytes) {
+    return decodeText(bytes, 0).replace(/\u0000/g, "").trim();
+}

package/src/core/lib/AudioMetaSchema.mjs

@@ -0,0 +1,82 @@
+/**
+ * Report skeleton and container detection for audio metadata extraction.
+ *
+ * @author d0s1nt [d0s1nt@cyberchefaudio]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+/* eslint-disable camelcase */
+
+import { ascii4, indexOfAscii } from "./AudioBytes.mjs";
+
+/** Builds the empty report skeleton ready for a format parser to populate. */
+export function makeEmptyReport(filename, byteLength, container) {
+    return {
+        schema_version: "audio-meta-1.0",
+        artifact: {
+            filename,
+            byte_length: byteLength,
+            container: { type: container.type, brand: container.brand || null, mime: container.mime || null },
+        },
+        detections: { metadata_systems: [], provenance_systems: [] },
+        tags: {
+            common: {
+                title: null, artist: null, album: null, date: null, track: null,
+                genre: null, comment: null, composer: null, copyright: null, language: null,
+            },
+            raw: {},
+        },
+        embedded: [],
+        provenance: {
+            c2pa: {
+                present: false,
+                embedding: [],
+                manifest_store: { active_manifest_urn: null, instance_id: null, claim_generator: null },
+                assertions: [],
+                signature: {
+                    algorithm: null, signing_time: null,
+                    certificate: { subject_cn: null, issuer_cn: null, serial_number: null },
+                },
+                validation: { validation_state: "Unknown", reasons: [], details_raw: null },
+            },
+        },
+        errors: [],
+    };
+}
+
+/** Detects the audio container format from magic bytes. */
+export function sniffContainer(b) {
+    if (b.length >= 3 && b[0] === 0x49 && b[1] === 0x44 && b[2] === 0x33)
+        return { type: "mp3", mime: "audio/mpeg" };
+    if (b.length >= 2 && b[0] === 0xff && (b[1] & 0xe0) === 0xe0) {
+        if ((b[1] & 0x06) === 0x00) return { type: "aac", mime: "audio/aac" };
+        return { type: "mp3", mime: "audio/mpeg" };
+    }
+    if (b.length >= 8 && b[0] === 0x0b && b[1] === 0x77)
+        return { type: "ac3", mime: "audio/ac3" };
+    if (b.length >= 16 &&
+        b[0] === 0x30 && b[1] === 0x26 && b[2] === 0xb2 && b[3] === 0x75 &&
+        b[4] === 0x8e && b[5] === 0x66 && b[6] === 0xcf && b[7] === 0x11)
+        return { type: "wma", mime: "audio/x-ms-wma" };
+    if (b.length >= 12 && ascii4(b, 0) === "RIFF" && ascii4(b, 8) === "WAVE")
+        return { type: "wav", mime: "audio/wav" };
+    if (b.length >= 12 && ascii4(b, 0) === "BW64" && ascii4(b, 8) === "WAVE")
+        return { type: "bw64", mime: "audio/wav" };
+    if (b.length >= 4 && ascii4(b, 0) === "fLaC")
+        return { type: "flac", mime: "audio/flac" };
+    if (b.length >= 4 && ascii4(b, 0) === "OggS") {
+        const idx = indexOfAscii(b, "OpusHead", 0, Math.min(b.length, 65536));
+        return idx >= 0 ? { type: "opus", mime: "audio/ogg" } : { type: "ogg", mime: "audio/ogg" };
+    }
+    if (b.length >= 12 && ascii4(b, 4) === "ftyp") {
+        const brand = ascii4(b, 8);
+        const isM4A = brand === "M4A " || brand === "M4B " || brand === "M4P ";
+        return { type: isM4A ? "m4a" : "mp4", mime: isM4A ? "audio/mp4" : "video/mp4", brand };
+    }
+    if (b.length >= 12 && ascii4(b, 0) === "FORM") {
+        const formType = ascii4(b, 8);
+        if (formType === "AIFF" || formType === "AIFC") return { type: "aiff", mime: "audio/aiff", brand: formType };
+    }
+    return { type: "unknown", mime: null };
+}