mirrors/CyberChef
1
0
Fork 0
mirror of https://github.com/gchq/CyberChef.git synced 2025-04-22 07:46:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Tidied up 'Microsoft Script Decoder' operation

Browse source
This commit is contained in:
n1474335 2017-08-30 15:56:51 +00:00
parent f8e9e9ba85
commit 4a86340d50
3 changed files with 22 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

89
src/core/operations/MS.js
View file

@ -1,8 +1,9 @@
/**
* Decodes Microsoft Encoded Script files that can be read and executed by cscript.exe/wscript.exe.
* This is a conversion of a Python script that was originally created by Didier Stevens (https://DidierStevens.com).
* Microsoft operations.
*
* @author bmwhitn [brian.m.whitney@outlook.com]
* @copyright Crown Copyright 2017
* @license Apache-2.0
*
* @namespace
*/
@ -148,73 +149,16 @@ const MS = {
* @default
*/
D_COMBINATION: [
0,
1,
2,
0,
1,
2,
1,
2,
2,
1,
2,
1,
0,
2,
1,
2,
0,
2,
1,
2,
0,
0,
1,
2,
2,
1,
0,
2,
1,
2,
2,
1,
0,
0,
2,
1,
2,
1,
2,
0,
2,
0,
0,
1,
2,
0,
2,
1,
0,
2,
1,
2,
0,
0,
1,
2,
2,
0,
0,
1,
2,
0,
2,
1
0, 1, 2, 0, 1, 2, 1, 2, 2, 1, 2, 1, 0, 2, 1, 2, 0, 2, 1, 2, 0, 0, 1, 2, 2, 1, 0, 2, 1, 2, 2, 1,
0, 0, 2, 1, 2, 1, 2, 0, 2, 0, 0, 1, 2, 0, 2, 1, 0, 2, 1, 2, 0, 0, 1, 2, 2, 0, 0, 1, 2, 0, 2, 1
],
/**
* Decodes Microsoft Encoded Script files that can be read and executed by cscript.exe/wscript.exe.
* This is a conversion of a Python script that was originally created by Didier Stevens
* (https://DidierStevens.com).
*
* @private
* @param {string} data
* @returns {string}
@ -227,13 +171,18 @@ const MS = {
.replace(/@\*/g, ">")
.replace(/@!/g, "<")
.replace(/@\$/g, "@");
for (let i = 0; i < data.length; i++) {
let byte = data.charCodeAt(i);
let char = data.charAt(i);
if (byte < 128) {
index++;
}
if ((byte === 9 || byte > 31 && byte < 128) && byte !== 60 && byte !== 62 && byte !== 64) {
if ((byte === 9 || byte > 31 && byte < 128) &&
byte !== 60 &&
byte !== 62 &&
byte !== 64) {
char = MS.D_DECODE[byte].charAt(MS.D_COMBINATION[index % 64]);
}
result.push(char);
@ -241,8 +190,9 @@ const MS = {
return result.join("");
},
/**
* Microsoft Script Decoder operation
* Microsoft Script Decoder operation.
*
* @param {string} input
* @param {Object[]} args
@ -256,7 +206,8 @@ const MS = {
} else {
return "";
}
},
}
};
export default MS;