cyberchef 9.39.1 → 9.39.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cyberchef",
|
|
3
|
-
"version": "9.39.
|
|
3
|
+
"version": "9.39.2",
|
|
4
4
|
"description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
|
|
5
5
|
"author": "n1474335 <n1474335@gmail.com>",
|
|
6
6
|
"homepage": "https://gchq.github.io/CyberChef",
|
|
@@ -5044,7 +5044,7 @@
|
|
|
5044
5044
|
},
|
|
5045
5045
|
"Extract Files": {
|
|
5046
5046
|
"module": "Default",
|
|
5047
|
-
"description": "Performs file carving to attempt to extract files from the input.<br><br>This operation is currently capable of carving out the following formats:\n <ul>\n <li>\n JPG,JPEG,JPE,THM,MPO</li><li>GIF</li><li>PNG</li><li>BMP</li><li>ICO</li><li>TGA</li><li>FLV</li><li>WAV</li><li>MP3</li><li>PDF</li><li>RTF</li><li>DOCX,XLSX,PPTX</li><li>EPUB</li><li>EXE,DLL,DRV,VXD,SYS,OCX,VBX,COM,FON,SCR</li><li>ELF,BIN,AXF,O,PRX,SO</li><li>DYLIB</li><li>ZIP</li><li>TAR</li><li>GZ</li><li>BZ2</li><li>ZLIB</li><li>XZ</li><li>JAR</li><li>LZOP,LZO</li><li>DEB</li><li>SQLITE</li><li>EVT</li><li>EVTX</li><li>DMP</li><li>PF</li><li>PLIST</li><li>KEYCHAIN</li><li>LNK\n </li>\n </ul>",
|
|
5047
|
+
"description": "Performs file carving to attempt to extract files from the input.<br><br>This operation is currently capable of carving out the following formats:\n <ul>\n <li>\n JPG,JPEG,JPE,THM,MPO</li><li>GIF</li><li>PNG</li><li>BMP</li><li>ICO</li><li>TGA</li><li>FLV</li><li>WAV</li><li>MP3</li><li>PDF</li><li>RTF</li><li>DOCX,XLSX,PPTX</li><li>EPUB</li><li>EXE,DLL,DRV,VXD,SYS,OCX,VBX,COM,FON,SCR</li><li>ELF,BIN,AXF,O,PRX,SO</li><li>DYLIB</li><li>ZIP</li><li>TAR</li><li>GZ</li><li>BZ2</li><li>ZLIB</li><li>XZ</li><li>JAR</li><li>LZOP,LZO</li><li>DEB</li><li>SQLITE</li><li>EVT</li><li>EVTX</li><li>DMP</li><li>PF</li><li>PLIST</li><li>KEYCHAIN</li><li>LNK\n </li>\n </ul>Minimum File Size can be used to prune small false positives.",
|
|
5048
5048
|
"infoURL": "https://forensicswiki.xyz/wiki/index.php?title=File_Carving",
|
|
5049
5049
|
"inputType": "ArrayBuffer",
|
|
5050
5050
|
"outputType": "html",
|
|
@@ -5090,6 +5090,11 @@
|
|
|
5090
5090
|
"name": "Ignore failed extractions",
|
|
5091
5091
|
"type": "boolean",
|
|
5092
5092
|
"value": true
|
|
5093
|
+
},
|
|
5094
|
+
{
|
|
5095
|
+
"name": "Minimum File Size",
|
|
5096
|
+
"type": "number",
|
|
5097
|
+
"value": 100
|
|
5093
5098
|
}
|
|
5094
5099
|
]
|
|
5095
5100
|
},
|
|
@@ -38,7 +38,7 @@ class ExtractFiles extends Operation {
|
|
|
38
38
|
<li>
|
|
39
39
|
${supportedExts.join("</li><li>")}
|
|
40
40
|
</li>
|
|
41
|
-
</ul
|
|
41
|
+
</ul>Minimum File Size can be used to prune small false positives.`;
|
|
42
42
|
this.infoURL = "https://forensicswiki.xyz/wiki/index.php?title=File_Carving";
|
|
43
43
|
this.inputType = "ArrayBuffer";
|
|
44
44
|
this.outputType = "List<File>";
|
|
@@ -54,6 +54,11 @@ class ExtractFiles extends Operation {
|
|
|
54
54
|
name: "Ignore failed extractions",
|
|
55
55
|
type: "boolean",
|
|
56
56
|
value: true
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
name: "Minimum File Size",
|
|
60
|
+
type: "number",
|
|
61
|
+
value: 100
|
|
57
62
|
}
|
|
58
63
|
]);
|
|
59
64
|
}
|
|
@@ -66,6 +71,7 @@ class ExtractFiles extends Operation {
|
|
|
66
71
|
run(input, args) {
|
|
67
72
|
const bytes = new Uint8Array(input),
|
|
68
73
|
categories = [],
|
|
74
|
+
minSize = args.pop(1),
|
|
69
75
|
ignoreFailedExtractions = args.pop(1);
|
|
70
76
|
|
|
71
77
|
args.forEach((cat, i) => {
|
|
@@ -80,7 +86,9 @@ class ExtractFiles extends Operation {
|
|
|
80
86
|
const errors = [];
|
|
81
87
|
detectedFiles.forEach(detectedFile => {
|
|
82
88
|
try {
|
|
83
|
-
|
|
89
|
+
const file = extractFile(bytes, detectedFile.fileDetails, detectedFile.offset);
|
|
90
|
+
if (file.size >= minSize)
|
|
91
|
+
files.push(file);
|
|
84
92
|
} catch (err) {
|
|
85
93
|
if (!ignoreFailedExtractions && err.message.indexOf("No extraction algorithm available") < 0) {
|
|
86
94
|
errors.push(
|