cyberchef 9.46.4 → 9.46.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberchef",
-  "version": "9.46.4",
+  "version": "9.46.6",
   "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
   "author": "n1474335 <n1474335@gmail.com>",
   "homepage": "https://gchq.github.io/CyberChef",
@@ -128,7 +128,7 @@
     "jsrsasign": "^10.5.23",
     "kbpgp": "2.1.15",
     "libbzip2-wasm": "0.0.4",
-    "libyara-wasm": "^1.1.0",
+    "libyara-wasm": "^1.2.1",
     "lodash": "^4.17.21",
     "loglevel": "^1.8.0",
     "loglevel-message-prefix": "^3.0.0",
@@ -154,7 +154,7 @@
     "split.js": "^1.6.5",
     "ssdeep.js": "0.0.3",
     "stream-browserify": "^3.0.0",
-    "tesseract.js": "2.1.5",
+    "tesseract.js": "3.0.2",
     "ua-parser-js": "^1.0.2",
     "unorm": "^1.6.0",
     "utf8": "^3.0.0",
@@ -167,6 +167,7 @@
   "scripts": {
     "start": "npx grunt dev",
     "build": "npx grunt prod",
+    "node": "npx grunt node",
     "repl": "node --experimental-modules --experimental-json-modules --experimental-specifier-resolution=node --no-warnings src/node/repl.mjs",
     "test": "npx grunt configTests && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation tests/node/index.mjs && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation tests/operations/index.mjs",
     "testnodeconsumer": "npx grunt testnodeconsumer",

package/src/core/config/OperationConfig.json

@@ -9478,6 +9478,7 @@
                     "Europe/Kaliningrad",
                     "Europe/Kiev",
                     "Europe/Kirov",
+                    "Europe/Kyiv",
                     "Europe/Lisbon",
                     "Europe/Ljubljana",
                     "Europe/London",
@@ -14861,6 +14862,7 @@
                     "Europe/Kaliningrad",
                     "Europe/Kiev",
                     "Europe/Kirov",
+                    "Europe/Kyiv",
                     "Europe/Lisbon",
                     "Europe/Ljubljana",
                     "Europe/London",
@@ -15467,6 +15469,7 @@
                     "Europe/Kaliningrad",
                     "Europe/Kiev",
                     "Europe/Kirov",
+                    "Europe/Kyiv",
                     "Europe/Lisbon",
                     "Europe/Ljubljana",
                     "Europe/London",
@@ -16835,6 +16838,16 @@
                 "name": "Show counts",
                 "type": "boolean",
                 "value": true
+            },
+            {
+                "name": "Show rule warnings",
+                "type": "boolean",
+                "value": true
+            },
+            {
+                "name": "Show console module messages",
+                "type": "boolean",
+                "value": true
             }
         ]
     },

package/src/core/operations/OpticalCharacterRecognition.mjs

@@ -12,10 +12,8 @@ import { isImage } from "../lib/FileType.mjs";
 import { toBase64 } from "../lib/Base64.mjs";
 import { isWorkerEnvironment } from "../Utils.mjs";
 
-import Tesseract from "tesseract.js";
-const { createWorker } = Tesseract;
-
 import process from "process";
+import { createWorker } from "tesseract.js";
 
 /**
  * Optical Character Recognition operation
@@ -55,7 +53,7 @@ class OpticalCharacterRecognition extends Operation {
 
         const type = isImage(input);
         if (!type) {
-            throw new OperationError("Invalid File Type");
+            throw new OperationError("Unsupported file type (supported: jpg,png,pbm,bmp) or no file provided");
         }
 
         const assetDir = isWorkerEnvironment() ? `${self.docURL}/assets/` : `${process.cwd()}/src/core/vendor/`;
@@ -74,7 +72,7 @@ class OpticalCharacterRecognition extends Operation {
                 }
             });
             await worker.load();
-            self.sendStatusMessage("Loading English language...");
+            self.sendStatusMessage(`Loading English language pack...`);
             await worker.loadLanguage("eng");
             self.sendStatusMessage("Intialising Tesseract API...");
             await worker.initialize("eng");

package/src/core/operations/YARARules.mjs

@@ -52,7 +52,17 @@ class YARARules extends Operation {
                 name: "Show counts",
                 type: "boolean",
                 value: true
-            }
+            },
+            {
+                name: "Show rule warnings",
+                type: "boolean",
+                value: true
+            },
+            {
+                name: "Show console module messages",
+                type: "boolean",
+                value: true
+            },
         ];
     }
 
@@ -64,7 +74,7 @@ class YARARules extends Operation {
     async run(input, args) {
         if (isWorkerEnvironment())
             self.sendStatusMessage("Instantiating YARA...");
-        const [rules, showStrings, showLengths, showMeta, showCounts] = args;
+        const [rules, showStrings, showLengths, showMeta, showCounts, showRuleWarns, showConsole] = args;
         return new Promise((resolve, reject) => {
             Yara().then(yara => {
                 if (isWorkerEnvironment()) self.sendStatusMessage("Converting data for YARA.");
@@ -83,11 +93,19 @@ class YARARules extends Operation {
                         const compileError = resp.compileErrors.get(i);
                         if (!compileError.warning) {
                             reject(new OperationError(`Error on line ${compileError.lineNumber}: ${compileError.message}`));
-                        } else {
-                            matchString += `Warning on line ${compileError.lineNumber}: ${compileError.message}`;
+                        } else if (showRuleWarns) {
+                            matchString += `Warning on line ${compileError.lineNumber}: ${compileError.message}\n`;
                         }
                     }
                 }
+
+                if (showConsole) {
+                    const consoleLogs = resp.consoleLogs;
+                    for (let i = 0; i < consoleLogs.size(); i++) {
+                        matchString += consoleLogs.get(i) + "\n";
+                    }
+                }
+
                 const matchedRules = resp.matchedRules;
                 for (let i = 0; i < matchedRules.size(); i++) {
                     const rule = matchedRules.get(i);
@@ -100,11 +118,11 @@ class YARARules extends Operation {
                         }
                         meta = meta.slice(0, -2) + "]";
                     }
-                    const countString = showCounts ? `${matches.size()} time${matches.size() > 1 ? "s" : ""}` : "";
+                    const countString = matches.size() === 0 ? "" : (showCounts ? ` (${matches.size()} time${matches.size() > 1 ? "s" : ""})` : "");
                     if (matches.size() === 0 || !(showStrings || showLengths)) {
                         matchString += `Input matches rule "${rule.ruleName}"${meta}${countString.length > 0 ? ` ${countString}`: ""}.\n`;
                     } else {
-                        matchString += `Rule "${rule.ruleName}"${meta} matches (${countString}):\n`;
+                        matchString += `Rule "${rule.ruleName}"${meta} matches${countString}:\n`;
                         for (let j = 0; j < matches.size(); j++) {
                             const match = matches.get(j);
                             if (showStrings || showLengths) {

package/tests/operations/tests/YARA.mjs

@@ -8,6 +8,22 @@
  */
 import TestRegister from "../../lib/TestRegister.mjs";
 
+const CONSOLE_COMPILE_WARNING_RULE = `import "console"
+rule a
+{
+  strings:
+    $s=" "
+  condition:
+    $s and console.log("log rule a")
+}
+rule b
+{
+  strings:
+    $s=" "
+  condition:
+    $s and console.hex("log rule b: int8(0)=", int8(0))
+}`;
+
 TestRegister.addTests([
     {
         name: "YARA Match: simple foobar",
@@ -20,5 +36,56 @@ TestRegister.addTests([
             }
         ],
     },
+    {
+        name: "YARA Match: hashing rules",
+        input: "Hello World!",
+        expectedOutput: "Input matches rule \"HelloWorldMD5\".\nInput matches rule \"HelloWorldSHA256\".\n",
+        recipeConfig: [
+            {
+                "op": "YARA Rules",
+                "args": [
+                    `import "hash"
+                    rule HelloWorldMD5 {
+                        condition:
+                            hash.md5(0,filesize) == "ed076287532e86365e841e92bfc50d8c"
+                    }
+
+                    rule HelloWorldSHA256 {
+                        condition:
+                            hash.sha256(0,filesize) == "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
+                    }`,
+                    true, true, true, true, false, false
+                ],
+            }
+        ],
+    },
+    {
+        name: "YARA Match: compile warnings",
+        input: "CyberChef Yara",
+        expectedOutput: "Warning on line 5: string \"$s\" may slow down scanning\n" +
+            "Warning on line 12: string \"$s\" may slow down scanning\n" +
+            "Input matches rule \"a\".\n" +
+            "Input matches rule \"b\".\n",
+        recipeConfig: [
+            {
+                "op": "YARA Rules",
+                "args": [CONSOLE_COMPILE_WARNING_RULE, false, false, false, false, true, false],
+            }
+        ],
+    },
+    {
+        name: "YARA Match: console messages",
+        input: "CyberChef Yara",
+        expectedOutput: "log rule a\n" +
+            "log rule b: int8(0)=0x43\n" +
+            "Input matches rule \"a\".\n" +
+            "Input matches rule \"b\".\n",
+        recipeConfig: [
+            {
+                "op": "YARA Rules",
+                "args": [CONSOLE_COMPILE_WARNING_RULE, false, false, false, false, false, true],
+            }
+        ],
+    },
 ]);
 

package/webpack.config.js

@@ -109,7 +109,8 @@ module.exports = {
             "buffer": require.resolve("buffer/"),
             "crypto": require.resolve("crypto-browserify"),
             "stream": require.resolve("stream-browserify"),
-            "zlib": require.resolve("browserify-zlib")
+            "zlib": require.resolve("browserify-zlib"),
+            "process": false
         }
     },
     module: {