mirrors/CyberChef
1
0
Fork 0
mirror of https://github.com/gchq/CyberChef.git synced 2025-05-07 06:57:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

added GootLoader decoder

Browse source
This commit is contained in:
Rodel Mendrez 2023-05-02 14:58:56 +12:00
parent 1bc88728f0
commit ef3e8eb3b0
5 changed files with 2341 additions and 10661 deletions
Download patch file Download diff file Expand all files Collapse all files

12909
package-lock.json generated
View file

File diff suppressed because it is too large Load diff

2
package.json
View file

@ -125,7 +125,7 @@
"flat": "^5.0.2",
"geodesy": "1.1.3",
"highlight.js": "^11.7.0",
"jimp": "^0.16.13",
"jimp": "^0.22.7",
"jquery": "3.6.4",
"js-crc": "^0.2.0",
"js-sha3": "^0.8.0",

3
src/core/config/Categories.json
View file

@ -500,7 +500,8 @@
"HTML To Text",
"Generate Lorem Ipsum",
"Numberwang",
"XKCD Random Number"
"XKCD Random Number",
"GootLoader Decode"
]
},
{

44
src/core/operations/GootLoaderDecode.mjs Normal file
View file

@ -0,0 +1,44 @@
/**
* @author drole [rodelm@gmail.com]
* @copyright Crown Copyright 2016
* @license Apache-2.0
*/
import Operation from "../Operation.mjs";
/**
* Gootloader decode operation
*/
class GootLoaderDecode extends Operation {
/**
* GootLoader constructor
*/
constructor() {
super();
this.name = "GootLoader Decode";
this.module = "Code";
this.description = "Decodes GootLoader JScript code block obfuscation";
this.inputType = "string";
this.outputType = "string";
this.args = [];
}
/**
* @param {string} input
* @param {Object[]} args
* @returns {string}
*/
run(input, args) {
if (!input) return "";
let decoded = "";
let decodedReversed = "";
for (let i = 0; i < input.length; i++) {
if (i%2) {
decoded += input.charAt(i);
} else {
decodedReversed += input.charAt(i);
}
}
return decodedReversed.split("").reverse().join("") + decoded;
}
}
export default GootLoaderDecode;

44
tests/operations/tests/GootLoaderDecode.mjs Normal file
View file

@ -0,0 +1,44 @@
/**
* @author drole [rodelm@gmail.com]
* @copyright Crown Copyright 2016
* @license Apache-2.0
*/
import Operation from "../Operation.mjs";
/**
* Gootloader decode operation
*/
class GootLoaderDecode extends Operation {
/**
* GootLoader constructor
*/
constructor() {
super();
this.name = "GootLoader Decode";
this.module = "Code";
this.description = "Decodes GootLoader JScript code block obfuscation";
this.inputType = "string";
this.outputType = "string";
this.args = [];
}
/**
* @param {string} input
* @param {Object[]} args
* @returns {string}
*/
run(input, args) {
if (!input) return "";
let decoded = "";
let decodedReversed = "";
for (let i = 0; i < input.length; i++) {
if (i%2) {
decoded += input.charAt(i);
} else {
decodedReversed += input.charAt(i);
}
}
return decodedReversed.split("").reverse().join("") + decoded;
}
}
export default GootLoaderDecode;