cyberchef 9.39.4 → 9.40.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberchef",
-  "version": "9.39.4",
+  "version": "9.40.0",
   "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
   "author": "n1474335 <n1474335@gmail.com>",
   "homepage": "https://gchq.github.io/CyberChef",

package/src/core/config/Categories.json

@@ -457,6 +457,7 @@
             "Frequency distribution",
             "Index of Coincidence",
             "Chi Square",
+            "P-list Viewer",
             "Disassemble x86",
             "Pseudo-Random Number Generator",
             "Generate UUID",

package/src/core/config/OperationConfig.json

@@ -5652,6 +5652,11 @@
                 "name": "Alphabet",
                 "type": "string",
                 "value": "0-9A-Z $%*+\\-./:"
+            },
+            {
+                "name": "Remove non-alphabet chars",
+                "type": "boolean",
+                "value": true
             }
         ]
     },
@@ -5995,6 +6000,31 @@
                         "value": "0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~"
                     }
                 ]
+            },
+            {
+                "name": "Remove non-alphabet chars",
+                "type": "boolean",
+                "value": true
+            }
+        ],
+        "checks": [
+            {
+                "pattern": "^\\s*(?:<~)?[\\s!-uz]*[!-uz]{15}[\\s!-uz]*(?:~>)?\\s*$",
+                "args": [
+                    "!-u"
+                ]
+            },
+            {
+                "pattern": "^[\\s0-9a-zA-Z.\\-:+=^!/*?&<>()[\\]{}@%$#]*[0-9a-zA-Z.\\-:+=^!/*?&<>()[\\]{}@%$#]{15}[\\s0-9a-zA-Z.\\-:+=^!/*?&<>()[\\]{}@%$#]*$",
+                "args": [
+                    "0-9a-zA-Z.\\-:+=^!/*?&<>()[]{}@%$#"
+                ]
+            },
+            {
+                "pattern": "^[\\s0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~]*[0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~]{15}[\\s0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~]*$",
+                "args": [
+                    "0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~"
+                ]
             }
         ]
     },
@@ -8740,6 +8770,16 @@
             }
         ]
     },
+    "P-list Viewer": {
+        "module": "Default",
+        "description": "In the macOS, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Property list files use the filename extension .plist, and thus are often referred to as p-list files.<br><br>This operation displays plist files in a human readable format.",
+        "infoURL": "https://wikipedia.org/wiki/Property_list",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": []
+    },
     "Pad lines": {
         "module": "Default",
         "description": "Add the specified number of the specified character to the beginning or end of each line",
@@ -12917,7 +12957,7 @@
     },
     "Subsection": {
         "module": "Default",
-        "description": "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.",
+        "description": "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.<br><br>Use the Merge operation to reset the effects of subsection.",
         "infoURL": "",
         "inputType": "string",
         "outputType": "string",

package/src/core/config/modules/Default.mjs

@@ -92,6 +92,7 @@ import OR from "../../operations/OR.mjs";
 import OffsetChecker from "../../operations/OffsetChecker.mjs";
 import PEMToHex from "../../operations/PEMToHex.mjs";
 import PHPDeserialize from "../../operations/PHPDeserialize.mjs";
+import PLISTViewer from "../../operations/PLISTViewer.mjs";
 import PadLines from "../../operations/PadLines.mjs";
 import ParseColourCode from "../../operations/ParseColourCode.mjs";
 import ParseDateTime from "../../operations/ParseDateTime.mjs";
@@ -261,6 +262,7 @@ OpModules.Default = {
     "Offset checker": OffsetChecker,
     "PEM to Hex": PEMToHex,
     "PHP Deserialize": PHPDeserialize,
+    "P-list Viewer": PLISTViewer,
     "Pad lines": PadLines,
     "Parse colour code": ParseColourCode,
     "Parse DateTime": ParseDateTime,

package/src/core/lib/Base85.mjs

@@ -1,3 +1,5 @@
+import Utils from "../Utils.mjs";
+
 /**
  * Base85 resources.
  *
@@ -32,13 +34,12 @@ export const ALPHABET_OPTIONS = [
  * @returns {string}
  */
 export function alphabetName(alphabet) {
-    alphabet = alphabet.replace(/'/g, "'");
-    alphabet = alphabet.replace(/"/g, """);
-    alphabet = alphabet.replace(/\\/g, "\");
+    alphabet = escape(alphabet);
     let name;
 
     ALPHABET_OPTIONS.forEach(function(a) {
-        if (escape(alphabet) === escape(a.value)) name = a.name;
+        const expanded = Utils.expandAlphRange(a.value).join("");
+        if (alphabet === escape(expanded)) name = a.name;
     });
 
     return name;

package/src/core/operations/FromBase45.mjs

@@ -32,7 +32,12 @@ class FromBase45 extends Operation {
                 name: "Alphabet",
                 type: "string",
                 value: ALPHABET
-            }
+            },
+            {
+                name: "Remove non-alphabet chars",
+                type: "boolean",
+                value: true
+            },
         ];
 
         this.highlight = highlightFromBase45;
@@ -46,10 +51,17 @@ class FromBase45 extends Operation {
      */
     run(input, args) {
         if (!input) return [];
-        const alphabet = Utils.expandAlphRange(args[0]);
+        const alphabet = Utils.expandAlphRange(args[0]).join("");
+        const removeNonAlphChars = args[1];
 
         const res = [];
 
+        // Remove non-alphabet characters
+        if (removeNonAlphChars) {
+            const re = new RegExp("[^" + alphabet.replace(/[[\]\\\-^$]/g, "\\$&") + "]", "g");
+            input = input.replace(re, "");
+        }
+
         for (const triple of Utils.chunked(input, 3)) {
             triple.reverse();
             let b = 0;

package/src/core/operations/FromBase85.mjs

@@ -32,6 +32,40 @@ class FromBase85 extends Operation {
                 type: "editableOption",
                 value: ALPHABET_OPTIONS
             },
+            {
+                name: "Remove non-alphabet chars",
+                type: "boolean",
+                value: true
+            },
+        ];
+        this.checks = [
+            {
+                pattern:
+                    "^\\s*(?:<~)?" + // Optional whitespace and starting marker
+                    "[\\s!-uz]*" +   // Any amount of base85 characters and whitespace
+                    "[!-uz]{15}" +   // At least 15 continoues base85 characters without whitespace
+                    "[\\s!-uz]*" +   // Any amount of base85 characters and whitespace
+                    "(?:~>)?\\s*$",  // Optional ending marker and whitespace
+                args: ["!-u"],
+            },
+            {
+                pattern:
+                    "^" +
+                    "[\\s0-9a-zA-Z.\\-:+=^!/*?&<>()[\\]{}@%$#]*" +
+                    "[0-9a-zA-Z.\\-:+=^!/*?&<>()[\\]{}@%$#]{15}" + // At least 15 continoues base85 characters without whitespace
+                    "[\\s0-9a-zA-Z.\\-:+=^!/*?&<>()[\\]{}@%$#]*" +
+                    "$",
+                args: ["0-9a-zA-Z.\\-:+=^!/*?&<>()[]{}@%$#"],
+            },
+            {
+                pattern:
+                    "^" +
+                    "[\\s0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~]*" +
+                    "[0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~]{15}" + // At least 15 continoues base85 characters without whitespace
+                    "[\\s0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~]*" +
+                    "$",
+                args: ["0-9A-Za-z!#$%&()*+\\-;<=>?@^_`{|}~"],
+            },
         ];
     }
 
@@ -43,6 +77,7 @@ class FromBase85 extends Operation {
     run(input, args) {
         const alphabet = Utils.expandAlphRange(args[0]).join(""),
             encoding = alphabetName(alphabet),
+            removeNonAlphChars = args[1],
             result = [];
 
         if (alphabet.length !== 85 ||
@@ -50,11 +85,18 @@ class FromBase85 extends Operation {
             throw new OperationError("Alphabet must be of length 85");
         }
 
-        if (input.length === 0) return [];
-
-        const matches = input.match(/<~(.+?)~>/);
+        // Remove delimiters if present
+        const matches = input.match(/^<~(.+?)~>$/);
         if (matches !== null) input = matches[1];
 
+        // Remove non-alphabet characters
+        if (removeNonAlphChars) {
+            const re = new RegExp("[^" + alphabet.replace(/[[\]\\\-^$]/g, "\\$&") + "]", "g");
+            input = input.replace(re, "");
+        }
+
+        if (input.length === 0) return [];
+
         let i = 0;
         let block, blockBytes;
         while (i < input.length) {
@@ -69,7 +111,7 @@ class FromBase85 extends Operation {
                     .map((chr, idx) => {
                         const digit = alphabet.indexOf(chr);
                         if (digit < 0 || digit > 84) {
-                            throw `Invalid character '${chr}' at index ${idx}`;
+                            throw `Invalid character '${chr}' at index ${i + idx}`;
                         }
                         return digit;
                     });

package/src/core/operations/PLISTViewer.mjs

@@ -0,0 +1,133 @@
+/**
+ * @author n1073645 [n1073645@gmail.com]
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * P-list Viewer operation
+ */
+class PlistViewer extends Operation {
+
+    /**
+     * PlistViewer constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "P-list Viewer";
+        this.module = "Default";
+        this.description = "In the macOS, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Property list files use the filename extension .plist, and thus are often referred to as p-list files.<br><br>This operation displays plist files in a human readable format.";
+        this.infoURL = "https://wikipedia.org/wiki/Property_list";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+
+        // Regexes are designed to transform the xml format into a more readable string format.
+        input = input.slice(input.indexOf("<plist"))
+            .replace(/<plist.+>/g, "plist => ")
+            .replace(/<dict>/g, "{")
+            .replace(/<\/dict>/g, "}")
+            .replace(/<array>/g, "[")
+            .replace(/<\/array>/g, "]")
+            .replace(/<key>.+<\/key>/g, m => `${m.slice(5, m.indexOf(/<\/key>/g)-5)}\t=> `)
+            .replace(/<real>.+<\/real>/g, m => `${m.slice(6, m.indexOf(/<\/real>/g)-6)}\n`)
+            .replace(/<string>.+<\/string>/g, m => `"${m.slice(8, m.indexOf(/<\/string>/g)-8)}"\n`)
+            .replace(/<integer>.+<\/integer>/g, m => `${m.slice(9, m.indexOf(/<\/integer>/g)-9)}\n`)
+            .replace(/<false\/>/g, m => "false")
+            .replace(/<true\/>/g, m => "true")
+            .replace(/<\/plist>/g, "/plist")
+            .replace(/<date>.+<\/date>/g, m => `${m.slice(6, m.indexOf(/<\/integer>/g)-6)}`)
+            .replace(/<data>(\s|.)+?<\/data>/g, m => `${m.slice(6, m.indexOf(/<\/data>/g)-6)}`)
+            .replace(/[ \t\r\f\v]/g, "");
+
+        /**
+         * Depending on the type of brace, it will increment the depth and amount of arrays accordingly.
+         *
+         * @param {string} elem
+         * @param {array} vals
+         * @param {number} offset
+         */
+        function braces(elem, vals, offset) {
+            const temp = vals.indexOf(elem);
+            if (temp !== -1) {
+                depthCount += offset;
+                if (temp === 1)
+                    arrCount += offset;
+            }
+        }
+
+        let result = "";
+        let arrCount = 0;
+        let depthCount = 0;
+
+        /**
+         * Formats the input after the regex has replaced all of the relevant parts.
+         *
+         * @param {array} input
+         * @param {number} index
+         */
+        function printIt(input, index) {
+            if (!(input.length))
+                return;
+
+            let temp = "";
+            const origArr = arrCount;
+            let currElem = input[0];
+
+            // If the current position points at a larger dynamic structure.
+            if (currElem.indexOf("=>") !== -1) {
+
+                // If the LHS also points at a larger structure (nested plists in a dictionary).
+                if (input[1].indexOf("=>") !== -1)
+                    temp = currElem.slice(0, -2) + " => " + input[1].slice(0, -2) + " =>\n";
+                else
+                    temp = currElem.slice(0, -2) + " => " + input[1] + "\n";
+
+                input = input.slice(1);
+            } else {
+                // Controls the tab depth for how many closing braces there have been.
+
+                braces(currElem, ["}", "]"], -1);
+
+                // Has to be here since the formatting breaks otherwise.
+                temp = currElem + "\n";
+            }
+
+            currElem = input[0];
+
+            // Tab out to the correct distance.
+            result += ("\t".repeat(depthCount));
+
+            // If it is enclosed in an array show index.
+            if (arrCount > 0 && currElem !== "]")
+                result += index.toString() + " => ";
+
+            result += temp;
+
+            // Controls the tab depth for how many opening braces there have been.
+            braces(currElem, ["{", "["], 1);
+
+            // If there has been a new array then reset index.
+            if (arrCount > origArr)
+                return printIt(input.slice(1), 0);
+            return printIt(input.slice(1), ++index);
+        }
+
+        input = input.split("\n").filter(e => e !== "");
+        printIt(input, 0);
+        return result;
+    }
+}
+
+export default PlistViewer;

package/src/core/operations/Subsection.mjs

@@ -22,7 +22,7 @@ class Subsection extends Operation {
         this.name = "Subsection";
         this.flowControl = true;
         this.module = "Default";
-        this.description = "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.";
+        this.description = "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.<br><br>Use the Merge operation to reset the effects of subsection.";
         this.infoURL = "";
         this.inputType = "string";
         this.outputType = "string";

package/src/core/operations/index.mjs

@@ -220,6 +220,7 @@ import PGPEncrypt from "./PGPEncrypt.mjs";
 import PGPEncryptAndSign from "./PGPEncryptAndSign.mjs";
 import PGPVerify from "./PGPVerify.mjs";
 import PHPDeserialize from "./PHPDeserialize.mjs";
+import PLISTViewer from "./PLISTViewer.mjs";
 import PadLines from "./PadLines.mjs";
 import ParseASN1HexString from "./ParseASN1HexString.mjs";
 import ParseColourCode from "./ParseColourCode.mjs";
@@ -594,6 +595,7 @@ export {
     PGPEncryptAndSign,
     PGPVerify,
     PHPDeserialize,
+    PLISTViewer,
     PadLines,
     ParseASN1HexString,
     ParseColourCode,

package/src/node/index.mjs

@@ -221,6 +221,7 @@ import {
     PGPEncryptAndSign as core_PGPEncryptAndSign,
     PGPVerify as core_PGPVerify,
     PHPDeserialize as core_PHPDeserialize,
+    PLISTViewer as core_PLISTViewer,
     PadLines as core_PadLines,
     ParseASN1HexString as core_ParseASN1HexString,
     ParseColourCode as core_ParseColourCode,
@@ -595,6 +596,7 @@ function generateChef() {
         "PGPEncryptAndSign": _wrap(core_PGPEncryptAndSign),
         "PGPVerify": _wrap(core_PGPVerify),
         "PHPDeserialize": _wrap(core_PHPDeserialize),
+        "PLISTViewer": _wrap(core_PLISTViewer),
         "padLines": _wrap(core_PadLines),
         "parseASN1HexString": _wrap(core_ParseASN1HexString),
         "parseColourCode": _wrap(core_ParseColourCode),
@@ -986,6 +988,7 @@ const PGPEncrypt = chef.PGPEncrypt;
 const PGPEncryptAndSign = chef.PGPEncryptAndSign;
 const PGPVerify = chef.PGPVerify;
 const PHPDeserialize = chef.PHPDeserialize;
+const PLISTViewer = chef.PLISTViewer;
 const padLines = chef.padLines;
 const parseASN1HexString = chef.parseASN1HexString;
 const parseColourCode = chef.parseColourCode;
@@ -1362,6 +1365,7 @@ const operations = [
     PGPEncryptAndSign,
     PGPVerify,
     PHPDeserialize,
+    PLISTViewer,
     padLines,
     parseASN1HexString,
     parseColourCode,
@@ -1742,6 +1746,7 @@ export {
     PGPEncryptAndSign,
     PGPVerify,
     PHPDeserialize,
+    PLISTViewer,
     padLines,
     parseASN1HexString,
     parseColourCode,

package/tests/lib/TestRegister.mjs

@@ -12,6 +12,7 @@
 import Chef from "../../src/core/Chef.mjs";
 import Utils from "../../src/core/Utils.mjs";
 import cliProgress from "cli-progress";
+import log from "loglevel";
 
 /**
  * Object to store and run the list of tests.
@@ -50,6 +51,9 @@ class TestRegister {
      * Runs all the tests in the register.
      */
     async runTests () {
+        // Turn off logging to avoid messy errors
+        log.setLevel("silent", false);
+
         const progBar = new cliProgress.SingleBar({
             format: formatter,
             stopOnComplete: true
@@ -84,7 +88,17 @@ class TestRegister {
 
             if (result.error) {
                 if (test.expectedError) {
-                    ret.status = "passing";
+                    if (result.error.displayStr === test.expectedOutput) {
+                        ret.status = "passing";
+                    } else {
+                        ret.status = "failing";
+                        ret.output = [
+                            "Expected",
+                            "\t" + test.expectedOutput.replace(/\n/g, "\n\t"),
+                            "Received",
+                            "\t" + result.error.displayStr.replace(/\n/g, "\n\t"),
+                        ].join("\n");
+                    }
                 } else {
                     ret.status = "erroring";
                     ret.output = result.error.displayStr;
@@ -118,6 +132,9 @@ class TestRegister {
             progBar.increment();
         }
 
+        // Turn logging back on
+        log.setLevel("info", false);
+
         return testResults;
     }
 

package/tests/operations/index.mjs

@@ -24,6 +24,7 @@ import "./tests/Base45.mjs";
 import "./tests/Base58.mjs";
 import "./tests/Base64.mjs";
 import "./tests/Base62.mjs";
+import "./tests/Base85.mjs";
 import "./tests/BitwiseOp.mjs";
 import "./tests/ByteRepr.mjs";
 import "./tests/CartesianProduct.mjs";

package/tests/operations/tests/Base85.mjs

@@ -0,0 +1,48 @@
+/**
+ * Base85 tests
+ *
+ * @author john19696
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+// Example from Wikipedia
+const wpExample = "Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.";
+// Escape newline, quote & backslash
+const wpOutput = "9jqo^BlbD-BleB1DJ+*+F(f,q/0JhKF<GL>Cj@.4Gp$d7F!,L7@<6@)/0JDEF<G%<+EV:2F!,O<\
+DJ+*.@<*K0@<6L(Df-\\0Ec5e;DffZ(EZee.Bl.9pF\"AGXBPCsi+DGm>@3BB/F*&OCAfu2/AKYi(\
+DIb:@FD,*)+C]U=@3BN#EcYf8ATD3s@q?d$AftVqCh[NqF<G:8+EV:.+Cf>-FD5W8ARlolDIal(\
+DId<j@<?3r@:F%a+D58'ATD4$Bl@l3De:,-DJs`8ARoFb/0JMK@qB4^F!,R<AKZ&-DfTqBG%G>u\
+D.RTpAKYo'+CT/5+Cei#DII?(E,9)oF*2M7/c";
+
+TestRegister.addTests([
+    {
+        name: "To Base85",
+        input: wpExample,
+        expectedOutput: wpOutput,
+        recipeConfig: [
+            { "op": "To Base85",
+                "args": ["!-u"] }
+        ]
+    },
+    {
+        name: "From Base85",
+        input: wpOutput + "\n",
+        expectedOutput: wpExample,
+        recipeConfig: [
+            { "op": "From Base85",
+                "args": ["!-u", true] }
+        ]
+    },
+    {
+        name: "From Base85",
+        input: wpOutput + "v",
+        expectedError: true,
+        expectedOutput: "From Base85 - Invalid character 'v' at index 337",
+        recipeConfig: [
+            { "op": "From Base85",
+                "args": ["!-u", false] }
+        ]
+    },
+]);