cyberchef 11.1.0 → 11.3.0

package/src/core/operations/PRESENTDecrypt.mjs

@@ -0,0 +1,94 @@
+/**
+ * @author Medjedtxm
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import Utils from "../Utils.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { toHex } from "../lib/Hex.mjs";
+import { decryptPRESENT } from "../lib/Present.mjs";
+
+/**
+ * PRESENT Decrypt operation
+ */
+class PRESENTDecrypt extends Operation {
+
+    /**
+     * PRESENTDecrypt constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "PRESENT Decrypt";
+        this.module = "Ciphers";
+        this.description = "PRESENT is an ultra-lightweight block cipher designed for constrained environments such as RFID tags and sensor networks. It operates on 64-bit blocks and supports 80-bit or 128-bit keys with 31 rounds. Standardised in ISO/IEC 29192-2:2019.<br><br>When using CBC mode, the PKCS#7 padding scheme is used.";
+        this.infoURL = "https://wikipedia.org/wiki/PRESENT_(cipher)";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Key",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "IV",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": ["CBC", "ECB"]
+            },
+            {
+                "name": "Input",
+                "type": "option",
+                "value": ["Hex", "Raw"]
+            },
+            {
+                "name": "Output",
+                "type": "option",
+                "value": ["Raw", "Hex"]
+            },
+            {
+                "name": "Padding",
+                "type": "option",
+                "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const key = Utils.convertToByteArray(args[0].string, args[0].option),
+            iv = Utils.convertToByteArray(args[1].string, args[1].option),
+            [,, mode, inputType, outputType, padding] = args;
+
+        if (key.length !== 10 && key.length !== 16)
+            throw new OperationError(`Invalid key length: ${key.length} bytes
+
+PRESENT uses a key length of 10 bytes (80 bits) or 16 bytes (128 bits).`);
+
+        if (iv.length !== 8 && mode !== "ECB")
+            throw new OperationError(`Invalid IV length: ${iv.length} bytes
+
+PRESENT uses an IV length of 8 bytes (64 bits).
+Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
+
+        input = Utils.convertToByteArray(input, inputType);
+        const output = decryptPRESENT(input, key, iv, mode, padding);
+        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
+    }
+
+}
+
+export default PRESENTDecrypt;

package/src/core/operations/PRESENTEncrypt.mjs

@@ -0,0 +1,94 @@
+/**
+ * @author Medjedtxm
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import Utils from "../Utils.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { toHex } from "../lib/Hex.mjs";
+import { encryptPRESENT } from "../lib/Present.mjs";
+
+/**
+ * PRESENT Encrypt operation
+ */
+class PRESENTEncrypt extends Operation {
+
+    /**
+     * PRESENTEncrypt constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "PRESENT Encrypt";
+        this.module = "Ciphers";
+        this.description = "PRESENT is an ultra-lightweight block cipher designed for constrained environments such as RFID tags and sensor networks. It operates on 64-bit blocks and supports 80-bit or 128-bit keys with 31 rounds. Standardised in ISO/IEC 29192-2:2019.<br><br>When using CBC mode, the PKCS#7 padding scheme is used.";
+        this.infoURL = "https://wikipedia.org/wiki/PRESENT_(cipher)";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Key",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "IV",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": ["CBC", "ECB"]
+            },
+            {
+                "name": "Input",
+                "type": "option",
+                "value": ["Raw", "Hex"]
+            },
+            {
+                "name": "Output",
+                "type": "option",
+                "value": ["Hex", "Raw"]
+            },
+            {
+                "name": "Padding",
+                "type": "option",
+                "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const key = Utils.convertToByteArray(args[0].string, args[0].option),
+            iv = Utils.convertToByteArray(args[1].string, args[1].option),
+            [,, mode, inputType, outputType, padding] = args;
+
+        if (key.length !== 10 && key.length !== 16)
+            throw new OperationError(`Invalid key length: ${key.length} bytes
+
+PRESENT uses a key length of 10 bytes (80 bits) or 16 bytes (128 bits).`);
+
+        if (iv.length !== 8 && mode !== "ECB")
+            throw new OperationError(`Invalid IV length: ${iv.length} bytes
+
+PRESENT uses an IV length of 8 bytes (64 bits).
+Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
+
+        input = Utils.convertToByteArray(input, inputType);
+        const output = encryptPRESENT(input, key, iv, mode, padding);
+        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
+    }
+
+}
+
+export default PRESENTEncrypt;

package/src/core/operations/ParityBit.mjs

@@ -20,7 +20,7 @@ class ParityBit extends Operation {
 
         this.name = "Parity Bit";
         this.module = "Default";
-        this.description = "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurence of the delimiter character";
+        this.description = "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurrence of the delimiter character";
         this.infoURL = "https://wikipedia.org/wiki/Parity_bit";
         this.inputType = "string";
         this.outputType = "string";

package/src/core/operations/ParseIPv4Header.mjs

@@ -74,7 +74,7 @@ class ParseIPv4Header extends Operation {
             checksum = input[10] << 8 | input[11],
             srcIP = input[12] << 24 | input[13] << 16 | input[14] << 8 | input[15],
             dstIP = input[16] << 24 | input[17] << 16 | input[18] << 8 | input[19],
-            checksumHeader = input.slice(0, 10).concat([0, 0]).concat(input.slice(12, 20));
+            checksumHeader = [...input.slice(0, 10), 0, 0, ...input.slice(12, 20)];
         let version = (input[0] >>> 4) & 0x0f,
             options = [];
 

package/src/core/operations/ParseURI.mjs

@@ -33,7 +33,7 @@ class ParseURI extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const uri = url.parse(input, true);
+        const uri = url.parse(input, false);
 
         let output = "";
 
@@ -43,7 +43,20 @@ class ParseURI extends Operation {
         if (uri.port) output += "Port:\t\t" + uri.port + "\n";
         if (uri.pathname) output += "Path name:\t" + uri.pathname + "\n";
         if (uri.query) {
-            const keys = Object.keys(uri.query);
+            const queryObj = Object.create(null);
+            for (const [key, value] of new URLSearchParams(uri.query)) {
+                if (Object.prototype.hasOwnProperty.call(queryObj, key)) {
+                    if (Array.isArray(queryObj[key])) {
+                        queryObj[key].push(value);
+                    } else {
+                        queryObj[key] = [queryObj[key], value];
+                    }
+                } else {
+                    queryObj[key] = value;
+                }
+            }
+
+            const keys = Object.keys(queryObj);
             let padding = 0;
 
             keys.forEach(k => {
@@ -51,10 +64,10 @@ class ParseURI extends Operation {
             });
 
             output += "Arguments:\n";
-            for (const key in uri.query) {
+            for (const key in queryObj) {
                 output += "\t" + key.padEnd(padding, " ");
-                if (uri.query[key].length) {
-                    output += " = " + uri.query[key] + "\n";
+                if (queryObj[key].length) {
+                    output += " = " + queryObj[key] + "\n";
                 } else {
                     output += "\n";
                 }

package/src/core/operations/PseudoRandomNumberGenerator.mjs

@@ -31,7 +31,8 @@ class PseudoRandomNumberGenerator extends Operation {
             {
                 "name": "Number of bytes",
                 "type": "number",
-                "value": 32
+                "value": 32,
+                "min": 1
             },
             {
                 "name": "Output as",

package/src/core/operations/RandomPrime.mjs

@@ -0,0 +1,154 @@
+/**
+ * @author p-leriche [philip.leriche@cantab.net]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { modPow } from "../lib/BigIntUtils.mjs";
+
+/* ---------- helper functions ---------- */
+
+/**
+ * Generate random BigInt with specified bit length
+ */
+function randBigInt(bits) {
+    const bytes = Math.ceil(bits / 8);
+    const a = new Uint8Array(bytes);
+    crypto.getRandomValues(a);
+
+    // Set high bit to ensure correct bit length
+    a[0] |= 1 << (7 - ((8 * bytes - bits)));
+    // Set low bit to ensure odd (primes > 2 are odd)
+    a[bytes - 1] |= 1;
+
+    let h = "";
+    for (const b of a) h += b.toString(16).padStart(2, "0");
+    return BigInt("0x" + h);
+}
+
+/**
+ * Miller-Rabin primality test
+ */
+function isProbablePrime(n, rounds) {
+    if (n < 2n) return false;
+    if (n === 2n || n === 3n) return true;
+    if (n % 2n === 0n) return false;
+
+    // Write n-1 as 2^r * d
+    let d = n - 1n;
+    let r = 0n;
+    while (d % 2n === 0n) {
+        d /= 2n;
+        r++;
+    }
+
+    // Witness loop
+    for (let i = 0; i < rounds; i++) {
+        const a = randBigInt(n.toString(2).length - 1) % (n - 3n) + 2n;
+        let x = modPow(a, d, n);
+
+        if (x === 1n || x === n - 1n) continue;
+
+        let composite = true;
+        for (let j = 0n; j < r - 1n; j++) {
+            x = modPow(x, 2n, n);
+            if (x === n - 1n) {
+                composite = false;
+                break;
+            }
+        }
+
+        if (composite) return false;
+    }
+
+    return true;
+}
+
+/* ---------- operation class ---------- */
+
+/**
+ * Generate Prime Number operation
+ */
+class GeneratePrime extends Operation {
+    /**
+     * GeneratePrime constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Pseudo-Random Prime Generator";
+        this.module = "Crypto";
+        this.description =
+            "Generates a random probable prime number of specified bit length using the Miller-Rabin primality test.<br><br>" +
+            "<b>Primality guarantee:</b><br>" +
+            "For numbers . 3,317, the result is guaranteed prime (deterministic test).<br>" +
+            "For larger numbers, uses probabilistic testing:<br>" +
+            "- <b>Standard (7 rounds):</b> Probability of composite approx 1 in 16,000)<br><br>" +
+            "- <b>Crypto grade (40 rounds):</b> Probability of composite(approx 1 in 10^24)<br>" +
+            "Crypto grade is recommended for cryptographic applications (RSA, Diffie-Hellman, etc.).<br><br>" ;
+        this.infoURL = "https://wikipedia.org/wiki/Miller-Rabin_primality_test";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                name: "Bit length",
+                type: "number",
+                value: 512,
+                min: 2
+            },
+            {
+                name: "Crypto grade",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Output format",
+                type: "option",
+                value: ["Decimal", "Hexadecimal"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const [bits, cryptoGrade, outputFormat] = args;
+
+        if (bits < 2) {
+            throw new OperationError("Bit length must be at least 2");
+        }
+
+        if (bits > 4096) {
+            throw new OperationError("Bit length limited to 4096 bits for performance reasons");
+        }
+
+        const rounds = cryptoGrade ? 40 : 7;
+        let attempts = 0;
+        const maxAttempts = 10000;
+
+        let n = randBigInt(bits);
+
+        while (!isProbablePrime(n, rounds)) {
+            n = randBigInt(bits);
+            attempts++;
+
+            if (attempts > maxAttempts) {
+                throw new OperationError(`Failed to generate prime after ${maxAttempts} attempts. Try a different bit length.`);
+            }
+        }
+
+        // Return only the prime for pipeability
+        if (outputFormat === "Hexadecimal") {
+            return "0x" + n.toString(16);
+        } else {
+            return n.toString();
+        }
+    }
+}
+
+export default GeneratePrime;

package/src/core/operations/RenderPDF.mjs

@@ -0,0 +1,100 @@
+/**
+ * @author Shailendra [singhshailendra.in]
+ * @copyright Crown Copyright 2017
+ * @license Apache-2.0
+ */
+
+import { fromBase64, toBase64 } from "../lib/Base64.mjs";
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import Utils from "../Utils.mjs";
+
+/**
+ * Render PDF operation
+ */
+class RenderPDF extends Operation {
+
+    /**
+     * RenderPDF constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Render PDF";
+        this.module = "File";
+        this.description = "Displays the input as a PDF preview. Supports Raw and Base64 input formats.";
+        this.inputType = "string";
+        this.outputType = "byteArray";
+        this.presentType = "html";
+        this.args = [
+            {
+                "name": "Input format",
+                "type": "option",
+                "value": ["Base64", "Raw"],
+            }
+        ];
+        this.checks = [
+            {
+                pattern: "^%PDF-",
+                flags: "",
+                args: ["Raw"],
+                useful: true,
+                output: {
+                    mime: "application/pdf"
+                }
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {byteArray}
+     */
+    run(input, args) {
+        const inputFormat = args[0];
+
+        if (!input.length) return [];
+
+        // Convert input to raw bytes
+        switch (inputFormat) {
+            case "Base64":
+                input = fromBase64(input, undefined, "byteArray");
+                break;
+            case "Raw":
+            default:
+                input = Utils.strToByteArray(input);
+                break;
+        }
+
+        // Check PDF signature
+        if (
+            input[0] !== 0x25 || // %
+            input[1] !== 0x50 || // P
+            input[2] !== 0x44 || // D
+            input[3] !== 0x46    // F
+        ) {
+            throw new OperationError("Input does not appear to be a PDF file.");
+        }
+
+        return input;
+    }
+
+    /**
+     * Displays the PDF using HTML for web apps.
+     *
+     * @param {byteArray} data
+     * @returns {html}
+     */
+    async present(data) {
+        if (!data.length) return "";
+
+        const base64 = toBase64(data);
+        const dataURI = "data:application/pdf;base64," + base64;
+
+        return `<iframe src="${dataURI}" style="width:100%;height:100%;border:1px solid #ccc;"></iframe>`;
+    }
+
+}
+
+export default RenderPDF;

package/src/core/operations/SHA2.mjs

@@ -20,7 +20,7 @@ class SHA2 extends Operation {
 
         this.name = "SHA2";
         this.module = "Crypto";
-        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bytes.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bytes.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
+        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bits.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bits.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
         this.infoURL = "https://wikipedia.org/wiki/SHA-2";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";

package/src/core/operations/SM4Encrypt.mjs

@@ -43,7 +43,7 @@ class SM4Encrypt extends Operation {
             {
                 "name": "Mode",
                 "type": "option",
-                "value": ["CBC", "CFB", "OFB", "CTR", "ECB"]
+                "value": ["CBC", "CFB", "OFB", "CTR", "ECB", "CBC/NoPadding", "ECB/NoPadding"]
             },
             {
                 "name": "Input",

package/src/core/operations/SetDifference.mjs

@@ -75,9 +75,16 @@ class SetDifference extends Operation {
      * @returns {Object[]}
      */
     runSetDifference(a, b) {
+        const excluded = new Set(b);
+        const seen = new Set();
+
         return a
             .filter((item) => {
-                return b.indexOf(item) === -1;
+                if (excluded.has(item) || seen.has(item)) {
+                    return false;
+                }
+                seen.add(item);
+                return true;
             })
             .join(this.itemDelimiter);
     }

package/src/core/operations/SetIntersection.mjs

@@ -75,9 +75,16 @@ class SetIntersection extends Operation {
      * @returns {Object[]}
      */
     runIntersect(a, b) {
+        const included = new Set(b);
+        const seen = new Set();
+
         return a
             .filter((item) => {
-                return b.indexOf(item) > -1;
+                if (!included.has(item) || seen.has(item)) {
+                    return false;
+                }
+                seen.add(item);
+                return true;
             })
             .join(this.itemDelimiter);
     }

package/src/core/operations/ShowOnMap.mjs

@@ -36,7 +36,8 @@ class ShowOnMap extends Operation {
             {
                 name: "Input Format",
                 type: "option",
-                value: ["Auto"].concat(FORMATS)
+                value: ["Auto"].concat(FORMATS),
+                allowEmpty: false
             },
             {
                 name: "Input Delimiter",
@@ -49,7 +50,8 @@ class ShowOnMap extends Operation {
                     "Comma",
                     "Semi-colon",
                     "Colon"
-                ]
+                ],
+                allowEmpty: false
             }
         ];
     }
@@ -71,6 +73,16 @@ class ShowOnMap extends Operation {
             }
             latLong = latLong.replace(/[,]$/, "");
             latLong = latLong.replace(/°/g, "");
+
+            // The map requires a latitude and longitude pair. If the conversion only produced a
+            // single value (e.g. because the chosen input delimiter didn't match the input), bail
+            // out with a helpful message rather than passing it on to the map, which would throw an
+            // uncaught TypeError in the browser.
+            const coords = latLong.split(",").map(v => v.trim());
+            if (coords.length !== 2 || coords.some(v => v === "" || isNaN(Number(v)))) {
+                throw new OperationError(`Could not show coordinates '${latLong}' on the map. Expected a latitude and longitude pair - check that the input format and delimiter are correct.`);
+            }
+
             return latLong;
         }
         return input;