cyberchef 9.39.6 → 9.40.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberchef",
-  "version": "9.39.6",
+  "version": "9.40.0",
   "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
   "author": "n1474335 <n1474335@gmail.com>",
   "homepage": "https://gchq.github.io/CyberChef",

package/src/core/config/Categories.json

@@ -457,6 +457,7 @@
             "Frequency distribution",
             "Index of Coincidence",
             "Chi Square",
+            "P-list Viewer",
             "Disassemble x86",
             "Pseudo-Random Number Generator",
             "Generate UUID",

package/src/core/config/OperationConfig.json

@@ -8770,6 +8770,16 @@
             }
         ]
     },
+    "P-list Viewer": {
+        "module": "Default",
+        "description": "In the macOS, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Property list files use the filename extension .plist, and thus are often referred to as p-list files.<br><br>This operation displays plist files in a human readable format.",
+        "infoURL": "https://wikipedia.org/wiki/Property_list",
+        "inputType": "string",
+        "outputType": "string",
+        "flowControl": false,
+        "manualBake": false,
+        "args": []
+    },
     "Pad lines": {
         "module": "Default",
         "description": "Add the specified number of the specified character to the beginning or end of each line",
@@ -12947,7 +12957,7 @@
     },
     "Subsection": {
         "module": "Default",
-        "description": "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.",
+        "description": "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.<br><br>Use the Merge operation to reset the effects of subsection.",
         "infoURL": "",
         "inputType": "string",
         "outputType": "string",

package/src/core/config/modules/Default.mjs

@@ -92,6 +92,7 @@ import OR from "../../operations/OR.mjs";
 import OffsetChecker from "../../operations/OffsetChecker.mjs";
 import PEMToHex from "../../operations/PEMToHex.mjs";
 import PHPDeserialize from "../../operations/PHPDeserialize.mjs";
+import PLISTViewer from "../../operations/PLISTViewer.mjs";
 import PadLines from "../../operations/PadLines.mjs";
 import ParseColourCode from "../../operations/ParseColourCode.mjs";
 import ParseDateTime from "../../operations/ParseDateTime.mjs";
@@ -261,6 +262,7 @@ OpModules.Default = {
     "Offset checker": OffsetChecker,
     "PEM to Hex": PEMToHex,
     "PHP Deserialize": PHPDeserialize,
+    "P-list Viewer": PLISTViewer,
     "Pad lines": PadLines,
     "Parse colour code": ParseColourCode,
     "Parse DateTime": ParseDateTime,

package/src/core/operations/PLISTViewer.mjs

@@ -0,0 +1,133 @@
+/**
+ * @author n1073645 [n1073645@gmail.com]
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * P-list Viewer operation
+ */
+class PlistViewer extends Operation {
+
+    /**
+     * PlistViewer constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "P-list Viewer";
+        this.module = "Default";
+        this.description = "In the macOS, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Property list files use the filename extension .plist, and thus are often referred to as p-list files.<br><br>This operation displays plist files in a human readable format.";
+        this.infoURL = "https://wikipedia.org/wiki/Property_list";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+
+        // Regexes are designed to transform the xml format into a more readable string format.
+        input = input.slice(input.indexOf("<plist"))
+            .replace(/<plist.+>/g, "plist => ")
+            .replace(/<dict>/g, "{")
+            .replace(/<\/dict>/g, "}")
+            .replace(/<array>/g, "[")
+            .replace(/<\/array>/g, "]")
+            .replace(/<key>.+<\/key>/g, m => `${m.slice(5, m.indexOf(/<\/key>/g)-5)}\t=> `)
+            .replace(/<real>.+<\/real>/g, m => `${m.slice(6, m.indexOf(/<\/real>/g)-6)}\n`)
+            .replace(/<string>.+<\/string>/g, m => `"${m.slice(8, m.indexOf(/<\/string>/g)-8)}"\n`)
+            .replace(/<integer>.+<\/integer>/g, m => `${m.slice(9, m.indexOf(/<\/integer>/g)-9)}\n`)
+            .replace(/<false\/>/g, m => "false")
+            .replace(/<true\/>/g, m => "true")
+            .replace(/<\/plist>/g, "/plist")
+            .replace(/<date>.+<\/date>/g, m => `${m.slice(6, m.indexOf(/<\/integer>/g)-6)}`)
+            .replace(/<data>(\s|.)+?<\/data>/g, m => `${m.slice(6, m.indexOf(/<\/data>/g)-6)}`)
+            .replace(/[ \t\r\f\v]/g, "");
+
+        /**
+         * Depending on the type of brace, it will increment the depth and amount of arrays accordingly.
+         *
+         * @param {string} elem
+         * @param {array} vals
+         * @param {number} offset
+         */
+        function braces(elem, vals, offset) {
+            const temp = vals.indexOf(elem);
+            if (temp !== -1) {
+                depthCount += offset;
+                if (temp === 1)
+                    arrCount += offset;
+            }
+        }
+
+        let result = "";
+        let arrCount = 0;
+        let depthCount = 0;
+
+        /**
+         * Formats the input after the regex has replaced all of the relevant parts.
+         *
+         * @param {array} input
+         * @param {number} index
+         */
+        function printIt(input, index) {
+            if (!(input.length))
+                return;
+
+            let temp = "";
+            const origArr = arrCount;
+            let currElem = input[0];
+
+            // If the current position points at a larger dynamic structure.
+            if (currElem.indexOf("=>") !== -1) {
+
+                // If the LHS also points at a larger structure (nested plists in a dictionary).
+                if (input[1].indexOf("=>") !== -1)
+                    temp = currElem.slice(0, -2) + " => " + input[1].slice(0, -2) + " =>\n";
+                else
+                    temp = currElem.slice(0, -2) + " => " + input[1] + "\n";
+
+                input = input.slice(1);
+            } else {
+                // Controls the tab depth for how many closing braces there have been.
+
+                braces(currElem, ["}", "]"], -1);
+
+                // Has to be here since the formatting breaks otherwise.
+                temp = currElem + "\n";
+            }
+
+            currElem = input[0];
+
+            // Tab out to the correct distance.
+            result += ("\t".repeat(depthCount));
+
+            // If it is enclosed in an array show index.
+            if (arrCount > 0 && currElem !== "]")
+                result += index.toString() + " => ";
+
+            result += temp;
+
+            // Controls the tab depth for how many opening braces there have been.
+            braces(currElem, ["{", "["], 1);
+
+            // If there has been a new array then reset index.
+            if (arrCount > origArr)
+                return printIt(input.slice(1), 0);
+            return printIt(input.slice(1), ++index);
+        }
+
+        input = input.split("\n").filter(e => e !== "");
+        printIt(input, 0);
+        return result;
+    }
+}
+
+export default PlistViewer;

package/src/core/operations/Subsection.mjs

@@ -22,7 +22,7 @@ class Subsection extends Operation {
         this.name = "Subsection";
         this.flowControl = true;
         this.module = "Default";
-        this.description = "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.";
+        this.description = "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.<br><br>Use the Merge operation to reset the effects of subsection.";
         this.infoURL = "";
         this.inputType = "string";
         this.outputType = "string";

package/src/core/operations/index.mjs

@@ -220,6 +220,7 @@ import PGPEncrypt from "./PGPEncrypt.mjs";
 import PGPEncryptAndSign from "./PGPEncryptAndSign.mjs";
 import PGPVerify from "./PGPVerify.mjs";
 import PHPDeserialize from "./PHPDeserialize.mjs";
+import PLISTViewer from "./PLISTViewer.mjs";
 import PadLines from "./PadLines.mjs";
 import ParseASN1HexString from "./ParseASN1HexString.mjs";
 import ParseColourCode from "./ParseColourCode.mjs";
@@ -594,6 +595,7 @@ export {
     PGPEncryptAndSign,
     PGPVerify,
     PHPDeserialize,
+    PLISTViewer,
     PadLines,
     ParseASN1HexString,
     ParseColourCode,

package/src/node/index.mjs

@@ -221,6 +221,7 @@ import {
     PGPEncryptAndSign as core_PGPEncryptAndSign,
     PGPVerify as core_PGPVerify,
     PHPDeserialize as core_PHPDeserialize,
+    PLISTViewer as core_PLISTViewer,
     PadLines as core_PadLines,
     ParseASN1HexString as core_ParseASN1HexString,
     ParseColourCode as core_ParseColourCode,
@@ -595,6 +596,7 @@ function generateChef() {
         "PGPEncryptAndSign": _wrap(core_PGPEncryptAndSign),
         "PGPVerify": _wrap(core_PGPVerify),
         "PHPDeserialize": _wrap(core_PHPDeserialize),
+        "PLISTViewer": _wrap(core_PLISTViewer),
         "padLines": _wrap(core_PadLines),
         "parseASN1HexString": _wrap(core_ParseASN1HexString),
         "parseColourCode": _wrap(core_ParseColourCode),
@@ -986,6 +988,7 @@ const PGPEncrypt = chef.PGPEncrypt;
 const PGPEncryptAndSign = chef.PGPEncryptAndSign;
 const PGPVerify = chef.PGPVerify;
 const PHPDeserialize = chef.PHPDeserialize;
+const PLISTViewer = chef.PLISTViewer;
 const padLines = chef.padLines;
 const parseASN1HexString = chef.parseASN1HexString;
 const parseColourCode = chef.parseColourCode;
@@ -1362,6 +1365,7 @@ const operations = [
     PGPEncryptAndSign,
     PGPVerify,
     PHPDeserialize,
+    PLISTViewer,
     padLines,
     parseASN1HexString,
     parseColourCode,
@@ -1742,6 +1746,7 @@ export {
     PGPEncryptAndSign,
     PGPVerify,
     PHPDeserialize,
+    PLISTViewer,
     padLines,
     parseASN1HexString,
     parseColourCode,