Merge branch 'master' of github.com:gchq/CyberChef into node-lib

src/core/operations/ConvertCoordinateFormat.mjs

@@ -0,0 +1,95 @@
+/**
+ * @author j433866 [j433866@gmail.com]
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation";
+import {FORMATS, convertCoordinates} from "../lib/ConvertCoordinates";
+
+/**
+ * Convert co-ordinate format operation
+ */
+class ConvertCoordinateFormat extends Operation {
+
+    /**
+     * ConvertCoordinateFormat constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Convert co-ordinate format";
+        this.module = "Hashing";
+        this.description = "Converts geographical coordinates between different formats.<br><br>Supported formats:<ul><li>Degrees Minutes Seconds (DMS)</li><li>Degrees Decimal Minutes (DDM)</li><li>Decimal Degrees (DD)</li><li>Geohash</li><li>Military Grid Reference System (MGRS)</li><li>Ordnance Survey National Grid (OSNG)</li><li>Universal Transverse Mercator (UTM)</li></ul><br>The operation can try to detect the input co-ordinate format and delimiter automatically, but this may not always work correctly.";
+        this.infoURL = "https://wikipedia.org/wiki/Geographic_coordinate_conversion";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Input Format",
+                "type": "option",
+                "value": ["Auto"].concat(FORMATS)
+            },
+            {
+                "name": "Input Delimiter",
+                "type": "option",
+                "value": [
+                    "Auto",
+                    "Direction Preceding",
+                    "Direction Following",
+                    "\\n",
+                    "Comma",
+                    "Semi-colon",
+                    "Colon"
+                ]
+            },
+            {
+                "name": "Output Format",
+                "type": "option",
+                "value": FORMATS
+            },
+            {
+                "name": "Output Delimiter",
+                "type": "option",
+                "value": [
+                    "Space",
+                    "\\n",
+                    "Comma",
+                    "Semi-colon",
+                    "Colon"
+                ]
+            },
+            {
+                "name": "Include Compass Directions",
+                "type": "option",
+                "value": [
+                    "None",
+                    "Before",
+                    "After"
+                ]
+            },
+            {
+                "name": "Precision",
+                "type": "number",
+                "value": 3
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        if (input.replace(/[\s+]/g, "") !== "") {
+            const [inFormat, inDelim, outFormat, outDelim, incDirection, precision] = args;
+            const result = convertCoordinates(input, inFormat, inDelim, outFormat, outDelim, incDirection, precision);
+            return result;
+        } else {
+            return input;
+        }
+    }
+}
+
+export default ConvertCoordinateFormat;

src/core/operations/FromCaseInsensitiveRegex.mjs

@@ -0,0 +1,39 @@
+/**
+ * @author masq [github.cyberchef@masq.cc]
+ * @copyright Crown Copyright 2018
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation";
+
+/**
+ * From Case Insensitive Regex operation
+ */
+class FromCaseInsensitiveRegex extends Operation {
+
+    /**
+     * FromCaseInsensitiveRegex constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "From Case Insensitive Regex";
+        this.module = "Default";
+        this.description = "Converts a case-insensitive regex string to a case sensitive regex string (no guarantee on it being the proper original casing) in case the i flag wasn't available at the time but now is, or you need it to be case-sensitive again.<br><br>e.g. <code>[mM][oO][zZ][iI][lL][lL][aA]/[0-9].[0-9] .*</code> becomes <code>Mozilla/[0-9].[0-9] .*</code>";
+        this.infoURL = "https://wikipedia.org/wiki/Regular_expression";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        return input.replace(/\[[a-z]{2}\]/ig, m => m[1].toUpperCase() === m[2].toUpperCase() ? m[1] : m);
+    }
+}
+
+export default FromCaseInsensitiveRegex;

src/core/operations/FromGeohash.mjs

@@ -1,44 +0,0 @@
-/**
- * @author gchq77703 []
- * @copyright Crown Copyright 2018
- * @license Apache-2.0
- */
-
-import Operation from "../Operation";
-import geohash from "ngeohash";
-
-/**
- * From Geohash operation
- */
-class FromGeohash extends Operation {
-
-    /**
-     * FromGeohash constructor
-     */
-    constructor() {
-        super();
-
-        this.name = "From Geohash";
-        this.module = "Crypto";
-        this.description = "Converts Geohash strings into Lat/Long coordinates. For example, <code>ww8p1r4t8</code> becomes <code>37.8324,112.5584</code>.";
-        this.infoURL = "https://wikipedia.org/wiki/Geohash";
-        this.inputType = "string";
-        this.outputType = "string";
-        this.args = [];
-    }
-
-    /**
-     * @param {string} input
-     * @param {Object[]} args
-     * @returns {string}
-     */
-    run(input, args) {
-        return input.split("\n").map(line => {
-            const coords = geohash.decode(line);
-            return [coords.latitude, coords.longitude].join(",");
-        }).join("\n");
-    }
-
-}
-
-export default FromGeohash;

src/core/operations/GenerateLoremIpsum.mjs

@@ -0,0 +1,70 @@
+/**
+ * @author klaxon [klaxon@veyr.com]
+ * @copyright Crown Copyright 2018
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation";
+import OperationError from "../errors/OperationError";
+import { GenerateParagraphs, GenerateSentences, GenerateWords, GenerateBytes } from "../lib/LoremIpsum";
+
+/**
+ * Generate Lorem Ipsum operation
+ */
+class GenerateLoremIpsum extends Operation {
+
+    /**
+     * GenerateLoremIpsum constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Generate Lorem Ipsum";
+        this.module = "Default";
+        this.description = "Generate varying length lorem ipsum placeholder text.";
+        this.infoURL = "https://wikipedia.org/wiki/Lorem_ipsum";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Length",
+                "type": "number",
+                "value": "3"
+            },
+            {
+                "name": "Length in",
+                "type": "option",
+                "value": ["Paragraphs", "Sentences", "Words", "Bytes"]
+            }
+
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const [length, lengthType] = args;
+        if (length < 1){
+            throw new OperationError("Length must be greater than 0");
+        }
+        switch (lengthType) {
+            case "Paragraphs":
+                return GenerateParagraphs(length);
+            case "Sentences":
+                return GenerateSentences(length);
+            case "Words":
+                return GenerateWords(length);
+            case "Bytes":
+                return GenerateBytes(length);
+            default:
+                throw new OperationError("Invalid length type");
+
+        }
+    }
+
+}
+
+export default GenerateLoremIpsum;

src/core/operations/RegularExpression.mjs

@@ -228,40 +228,29 @@ function regexList (input, regex, displayTotal, matches, captureGroups) {
 function regexHighlight (input, regex, displayTotal) {
     let output = "",
         title = "",
-        m,
         hl = 1,
-        i = 0,
         total = 0;
 
-    while ((m = regex.exec(input))) {
-        // Moves pointer when an empty string is matched (prevents infinite loop)
-        if (m.index === regex.lastIndex) {
-            regex.lastIndex++;
-        }
+    output = input.replace(regex, (match, ...args) => {
+        args.pop(); // Throw away full string
+        const offset = args.pop(),
+            groups = args;
 
-        // Add up to match
-        output += Utils.escapeHtml(input.slice(i, m.index));
-
-        title = `Offset: ${m.index}\n`;
-        if (m.length > 1) {
+        title = `Offset: ${offset}\n`;
+        if (groups.length) {
             title += "Groups:\n";
-            for (let n = 1; n < m.length; ++n) {
-                title += `\t${n}: ${m[n]}\n`;
+            for (let i = 0; i < groups.length; i++) {
+                title += `\t${i+1}: ${Utils.escapeHtml(groups[i])}\n`;
             }
         }
 
-        // Add match with highlighting
-        output += "<span class='hl"+hl+"' title='"+title+"'>" + Utils.escapeHtml(m[0]) + "</span>";
-
         // Switch highlight
         hl = hl === 1 ? 2 : 1;
 
-        i = regex.lastIndex;
         total++;
-    }
 
-    // Add all after final match
-    output += Utils.escapeHtml(input.slice(i, input.length));
+        return `<span class='hl${hl}' title='${title}'>${Utils.escapeHtml(match)}</span>`;
+    });
 
     if (displayTotal)
         output = "Total found: " + total + "\n\n" + output;

src/core/operations/Subsection.mjs

@@ -0,0 +1,153 @@
+/**
+ * @author j433866 [j433866@gmail.com]
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+
+import XRegExp from "xregexp";
+import Operation from "../Operation";
+import Recipe from "../Recipe";
+import Dish from "../Dish";
+
+/**
+ * Subsection operation
+ */
+class Subsection extends Operation {
+
+    /**
+     * Subsection constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Subsection";
+        this.flowControl = true;
+        this.module = "Regex";
+        this.description = "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.";
+        this.infoURL = "";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Section (regex)",
+                "type": "string",
+                "value": ""
+            },
+            {
+                "name": "Case sensitive matching",
+                "type": "boolean",
+                "value": true
+            },
+            {
+                "name": "Global matching",
+                "type": "boolean",
+                "value": true
+            },
+            {
+                "name": "Ignore errors",
+                "type": "boolean",
+                "value": false
+            }
+        ];
+    }
+
+    /**
+     * @param {Object} state - The current state of the recipe.
+     * @param {number} state.progress - The current position in the recipe.
+     * @param {Dish} state.dish - The Dish being operated on
+     * @param {Operation[]} state.opList - The list of operations in the recipe
+     * @returns {Object} - The updated state of the recipe
+     */
+    async run(state) {
+        const opList    = state.opList,
+            inputType   = opList[state.progress].inputType,
+            outputType  = opList[state.progress].outputType,
+            input       = await state.dish.get(inputType),
+            ings        = opList[state.progress].ingValues,
+            [section, caseSensitive, global, ignoreErrors] = ings,
+            subOpList   = [];
+
+        if (input && section !== "") {
+            // Create subOpList for each tranche to operate on
+            // all remaining operations unless we encounter a Merge
+            for (let i = state.progress + 1; i < opList.length; i++) {
+                if (opList[i].name === "Merge" && !opList[i].disabled) {
+                    break;
+                } else {
+                    subOpList.push(opList[i]);
+                }
+            }
+
+            let flags = "",
+                inOffset = 0,
+                output = "",
+                m,
+                progress = 0;
+
+            if (!caseSensitive) flags += "i";
+            if (global) flags += "g";
+
+            const regex = new XRegExp(section, flags),
+                recipe = new Recipe();
+
+            recipe.addOperations(subOpList);
+            state.forkOffset += state.progress + 1;
+
+            // Take a deep(ish) copy of the ingredient values
+            const ingValues = subOpList.map(op => JSON.parse(JSON.stringify(op.ingValues)));
+            let matched = false;
+
+            // Run recipe over each match
+            while ((m = regex.exec(input))) {
+                matched = true;
+                // Add up to match
+                let matchStr = m[0];
+
+                if (m.length === 1) { // No capture groups
+                    output += input.slice(inOffset, m.index);
+                    inOffset = m.index + m[0].length;
+                } else if (m.length >= 2) {
+                    matchStr = m[1];
+
+                    // Need to add some of the matched string that isn't in the capture group
+                    output += input.slice(inOffset, m.index + m[0].indexOf(m[1]));
+                    // Set i to be after the end of the first capture group
+                    inOffset = m.index + m[0].indexOf(m[1]) + m[1].length;
+                }
+
+                // Baseline ing values for each tranche so that registers are reset
+                subOpList.forEach((op, i) => {
+                    op.ingValues = JSON.parse(JSON.stringify(ingValues[i]));
+                });
+
+                const dish = new Dish();
+                dish.set(matchStr, inputType);
+
+                try {
+                    progress = await recipe.execute(dish, 0, state);
+                } catch (err) {
+                    if (!ignoreErrors) {
+                        throw err;
+                    }
+                    progress = err.progress + 1;
+                }
+                output += await dish.get(outputType);
+                if (!regex.global) break;
+            }
+
+            // If no matches were found, advance progress to after a Merge op
+            // Otherwise, the operations below Subsection will be run on all the input data
+            if (!matched) {
+                state.progress += subOpList.length + 1;
+            }
+
+            output += input.slice(inOffset);
+            state.progress += progress;
+            state.dish.set(output, outputType);
+        }
+        return state;
+    }
+
+}
+
+export default Subsection;

src/core/operations/ToBase64.mjs

@@ -20,7 +20,7 @@ class ToBase64 extends Operation {
 
         this.name = "To Base64";
         this.module = "Default";
-        this.description = "Base64 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.<br><br>This operation decodes data from an ASCII Base64 string back into its raw format.<br><br>e.g. <code>aGVsbG8=</code> becomes <code>hello</code>";
+        this.description = "Base64 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.<br><br>This operation encodes raw data into an ASCII Base64 string.<br><br>e.g. <code>hello</code> becomes <code>aGVsbG8=</code>";
         this.infoURL = "https://wikipedia.org/wiki/Base64";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";

src/core/operations/ToCaseInsensitiveRegex.mjs

@@ -0,0 +1,39 @@
+/**
+ * @author masq [github.cyberchef@masq.cc]
+ * @copyright Crown Copyright 2018
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation";
+
+/**
+ * To Case Insensitive Regex operation
+ */
+class ToCaseInsensitiveRegex extends Operation {
+
+    /**
+     * ToCaseInsensitiveRegex constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "To Case Insensitive Regex";
+        this.module = "Default";
+        this.description = "Converts a case-sensitive regex string into a case-insensitive regex string in case the i flag is unavailable to you.<br><br>e.g. <code>Mozilla/[0-9].[0-9] .*</code> becomes <code>[mM][oO][zZ][iI][lL][lL][aA]/[0-9].[0-9] .*</code>";
+        this.infoURL = "https://wikipedia.org/wiki/Regular_expression";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        return input.replace(/[a-z]/ig, m => `[${m.toLowerCase()}${m.toUpperCase()}]`);
+    }
+}
+
+export default ToCaseInsensitiveRegex;

src/core/operations/ToGeohash.mjs

@@ -1,53 +0,0 @@
-/**
- * @author gchq77703 []
- * @copyright Crown Copyright 2018
- * @license Apache-2.0
- */
-
-import Operation from "../Operation";
-import geohash from "ngeohash";
-
-/**
- * To Geohash operation
- */
-class ToGeohash extends Operation {
-
-    /**
-     * ToGeohash constructor
-     */
-    constructor() {
-        super();
-
-        this.name = "To Geohash";
-        this.module = "Crypto";
-        this.description = "Converts Lat/Long coordinates into a Geohash string.  For example, <code>37.8324,112.5584</code> becomes <code>ww8p1r4t8</code>.";
-        this.infoURL = "https://wikipedia.org/wiki/Geohash";
-        this.inputType = "string";
-        this.outputType = "string";
-        this.args = [
-            {
-                name: "Precision",
-                type: "number",
-                value: 9
-            }
-        ];
-    }
-
-    /**
-     * @param {string} input
-     * @param {Object[]} args
-     * @returns {string}
-     */
-    run(input, args) {
-        const [precision] = args;
-
-        return input.split("\n").map(line => {
-            line = line.replace(/ /g, "");
-            if (line === "") return "";
-            return geohash.encode(...line.split(",").map(num => parseFloat(num)), precision);
-        }).join("\n");
-    }
-
-}
-
-export default ToGeohash;

src/core/operations/YARARules.mjs

@@ -0,0 +1,122 @@
+/**
+ * @author Matt C [matt@artemisbot.uk]
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation";
+import OperationError from "../errors/OperationError";
+import Yara from "libyara-wasm";
+
+/**
+ * YARA Rules operation
+ */
+class YARARules extends Operation {
+
+    /**
+     * YARARules constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "YARA Rules";
+        this.module = "Yara";
+        this.description = "YARA is a tool developed at VirusTotal, primarily aimed at helping malware researchers to identify and classify malware samples. It matches based on rules specified by the user containing textual or binary patterns and a boolean expression. For help on writing rules, see the <a href='https://yara.readthedocs.io/en/latest/writingrules.html'>YARA documentation.</a>";
+        this.infoURL = "https://wikipedia.org/wiki/YARA";
+        this.inputType = "ArrayBuffer";
+        this.outputType = "string";
+        this.args = [
+            {
+                name: "Rules",
+                type: "text",
+                value: "",
+                rows: 5
+            },
+            {
+                name: "Show strings",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Show string lengths",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Show metadata",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Show counts",
+                type: "boolean",
+                value: true
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        if (ENVIRONMENT_IS_WORKER())
+            self.sendStatusMessage("Instantiating YARA...");
+        const [rules, showStrings, showLengths, showMeta, showCounts] = args;
+        return new Promise((resolve, reject) => {
+            Yara().then(yara => {
+                if (ENVIRONMENT_IS_WORKER()) self.sendStatusMessage("Converting data for YARA.");
+                let matchString = "";
+
+                const inpArr = new Uint8Array(input); // Turns out embind knows that JS uint8array <==> C++ std::string
+
+                if (ENVIRONMENT_IS_WORKER()) self.sendStatusMessage("Running YARA matching.");
+
+                const resp = yara.run(inpArr, rules);
+
+                if (ENVIRONMENT_IS_WORKER()) self.sendStatusMessage("Processing data.");
+
+                if (resp.compileErrors.size() > 0) {
+                    for (let i = 0; i < resp.compileErrors.size(); i++) {
+                        const compileError = resp.compileErrors.get(i);
+                        if (!compileError.warning) {
+                            reject(new OperationError(`Error on line ${compileError.lineNumber}: ${compileError.message}`));
+                        } else {
+                            matchString += `Warning on line ${compileError.lineNumber}: ${compileError.message}`;
+                        }
+                    }
+                }
+                const matchedRules = resp.matchedRules;
+                for (let i = 0; i < matchedRules.size(); i++) {
+                    const rule = matchedRules.get(i);
+                    const matches = rule.resolvedMatches;
+                    let meta = "";
+                    if (showMeta && rule.metadata.size() > 0) {
+                        meta += " [";
+                        for (let j = 0; j < rule.metadata.size(); j++) {
+                            meta += `${rule.metadata.get(j).identifier}: ${rule.metadata.get(j).data}, `;
+                        }
+                        meta = meta.slice(0, -2) + "]";
+                    }
+                    const countString = showCounts ? `${matches.size()} time${matches.size() > 1 ? "s" : ""}` : "";
+                    if (matches.size() === 0 || !(showStrings || showLengths)) {
+                        matchString += `Input matches rule "${rule.ruleName}"${meta}${countString.length > 0 ? ` ${countString}`: ""}.\n`;
+                    } else {
+                        matchString += `Rule "${rule.ruleName}"${meta} matches (${countString}):\n`;
+                        for (let j = 0; j < matches.size(); j++) {
+                            const match = matches.get(j);
+                            if (showStrings || showLengths) {
+                                matchString += `Pos ${match.location}, ${showLengths ? `length ${match.matchLength}, ` : ""}identifier ${match.stringIdentifier}${showStrings ? `, data: "${match.data}"` : ""}\n`;
+                            }
+                        }
+                    }
+                }
+                resolve(matchString);
+            });
+        });
+    }
+
+}
+
+export default YARARules;