mirrors/CyberChef
1
0
Fork 0
mirror of https://github.com/gchq/CyberChef.git synced 2025-04-22 07:46:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Changed the name. Small logic change. Changed from split join to regex replace.

Browse source
This commit is contained in:
bwhitn 2017-08-28 17:55:54 -04:00
parent aa5939c051
commit 0fc2a219a7
5 changed files with 26 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/core/operations/VBE.js → src/core/operations/MS.js
View file

@ -1,12 +1,12 @@
/**
* Decodes Microsft Encoded VBS files that can be read and executed by cscript.exe/wscript.exe.
* Decodes Microsft Encoded Script files that can be read and executed by cscript.exe/wscript.exe.
* This is a conversion of a Python script that was originally created by Didier Stevens (https://DidierStevens.com).
*
* @author bmwhitn [brian.m.whitney@outlook.com]
*
* @namespace
*/
const VBE = {
const MS = {
/**
* @constant
@ -215,17 +215,17 @@ const VBE = {
],
/**
* @param {string} input
* @param {string} data
* @returns {string}
*/
decode: function (data) {
let result = [];
let index = -1;
data = data.split("@&").join(String.fromCharCode(10));
data = data.split("@#").join(String.fromCharCode(13));
data = data.split("@*").join(">");
data = data.split("@!").join("<");
data = data.split("@$").join("@");
data = data.replace(/@&/g, String.fromCharCode(10));
data = data.replace(/@#/g, String.fromCharCode(13));
data = data.replace(/@\*/g, ">");
data = data.replace(/@!/g, "<");
data = data.replace(/@\$/g, "@");
for (let i = 0; i < data.length; i++) {
let byte = data.charCodeAt(i);
let char = data.charAt(i);
@ -233,7 +233,7 @@ const VBE = {
index++;
}
if ((byte === 9 || byte > 31 && byte < 128) && byte !== 60 && byte !== 62 && byte !== 64) {
char = VBE.D_DECODE[byte].charAt([VBE.D_COMBINATION[index % 64]]);
char = MS.D_DECODE[byte].charAt(MS.D_COMBINATION[index % 64]);
}
result.push(char);
}
@ -245,11 +245,15 @@ const VBE = {
* @param {Object[]} args
* @returns {string}
*/
runDecodeVBE: function (data, args) {
runDecodeScript: function (input, args) {
let matcher = /#@~\^......==(.+)......==\^#~@/;
let encodedData = matcher.exec(data);
return VBE.decode(encodedData[1]);
let encodedData = matcher.exec(input);
if (encodedData){
return MS.decode(encodedData[1]);
} else {
return "";
}
},
};
export default VBE;
export default MS;