mirror of
https://github.com/gchq/CyberChef.git
synced 2025-04-21 23:36:16 -04:00
Merge pull request #878 from n1073645/master
Added extractors for BZIP2, XZ, GIF89
This commit is contained in:
commit
f63d1354ba
1 changed files with 99 additions and 3 deletions
|
@ -40,7 +40,7 @@ export const FILE_SIGNATURES = {
|
||||||
4: [0x37, 0x39], // 7|9
|
4: [0x37, 0x39], // 7|9
|
||||||
5: 0x61 // a
|
5: 0x61 // a
|
||||||
},
|
},
|
||||||
extractor: null
|
extractor: extractGIF
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "Portable Network Graphics image",
|
name: "Portable Network Graphics image",
|
||||||
|
@ -1444,7 +1444,7 @@ export const FILE_SIGNATURES = {
|
||||||
1: 0x5a,
|
1: 0x5a,
|
||||||
2: 0x68
|
2: 0x68
|
||||||
},
|
},
|
||||||
extractor: null
|
extractor: extractBZIP2
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "7zip",
|
name: "7zip",
|
||||||
|
@ -1485,7 +1485,7 @@ export const FILE_SIGNATURES = {
|
||||||
4: 0x5a,
|
4: 0x5a,
|
||||||
5: 0x0
|
5: 0x0
|
||||||
},
|
},
|
||||||
extractor: null
|
extractor: extractXZ
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "Tarball",
|
name: "Tarball",
|
||||||
|
@ -2440,6 +2440,46 @@ export function extractJPEG(bytes, offset) {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* GIF extractor.
|
||||||
|
*
|
||||||
|
* @param {Uint8Array} bytes
|
||||||
|
* @param {Number} offset
|
||||||
|
* @returns {Uint8Array}
|
||||||
|
*/
|
||||||
|
export function extractGIF(bytes, offset) {
|
||||||
|
const stream = new Stream(bytes.slice(offset));
|
||||||
|
|
||||||
|
//Move to application extension block.
|
||||||
|
stream.continueUntil([0x21, 0xff]);
|
||||||
|
|
||||||
|
//Move to Graphic Control Extension for frame #1.
|
||||||
|
stream.continueUntil([0x21, 0xf9]);
|
||||||
|
while (stream.hasMore()) {
|
||||||
|
|
||||||
|
//Move to Image descriptor.
|
||||||
|
stream.continueUntil(0x2c);
|
||||||
|
|
||||||
|
//Move past Image descriptor to the image data.
|
||||||
|
stream.moveForwardsBy(11);
|
||||||
|
|
||||||
|
//Loop until next Graphic Control Extension.
|
||||||
|
while (stream.getBytes(2) !== [0x21, 0xf9]) {
|
||||||
|
stream.moveBackwardsBy(2);
|
||||||
|
stream.moveForwardsBy(stream.getBytes(1)[0]);
|
||||||
|
if (!stream.getBytes(1)[0])
|
||||||
|
break;
|
||||||
|
stream.moveBackwardsBy(1);
|
||||||
|
}
|
||||||
|
//When the end of the file is [0x00, 0x3b], end.
|
||||||
|
if (stream.getBytes(1)[0] === 0x3b)
|
||||||
|
break;
|
||||||
|
stream.moveBackwardsBy(1);
|
||||||
|
}
|
||||||
|
return stream.carve();
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Portable executable extractor.
|
* Portable executable extractor.
|
||||||
* Assumes that the offset refers to an MZ header.
|
* Assumes that the offset refers to an MZ header.
|
||||||
|
@ -2777,6 +2817,42 @@ export function extractGZIP(bytes, offset) {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {Uint8Array} bytes
|
||||||
|
* @param {Number} offset
|
||||||
|
* @returns {Uint8Array}
|
||||||
|
*/
|
||||||
|
export function extractBZIP2(bytes, offset){
|
||||||
|
const stream = new Stream(bytes.slice(offset));
|
||||||
|
|
||||||
|
//The EOFs shifted between all possible combinations.
|
||||||
|
var lookingfor = [
|
||||||
|
[0x77, 0x24, 0x53, 0x85, 0x09],
|
||||||
|
[0xee, 0x48, 0xa7, 0x0a, 0x12],
|
||||||
|
[0xdc, 0x91, 0x4e, 0x14, 0x24],
|
||||||
|
[0xb9, 0x22, 0x9c, 0x28, 0x48],
|
||||||
|
[0x72, 0x45, 0x38, 0x50, 0x90],
|
||||||
|
[0xbb, 0x92, 0x29, 0xc2, 0x84],
|
||||||
|
[0x5d, 0xc9, 0x14, 0xe1, 0x42],
|
||||||
|
[0x2e, 0xe4, 0x8a, 0x70, 0xa1],
|
||||||
|
[0x17, 0x72, 0x45, 0x38, 0x50]];
|
||||||
|
|
||||||
|
for(let i = 0; i < 9; i++){
|
||||||
|
|
||||||
|
//Continue until an EOF.
|
||||||
|
stream.continueUntil(lookingfor[i]);
|
||||||
|
if(stream.getBytes(5).join("") == lookingfor[i].join(""))
|
||||||
|
break;
|
||||||
|
|
||||||
|
//Jump back to the start if invalid EOF.
|
||||||
|
stream.moveTo(0);
|
||||||
|
}
|
||||||
|
stream.moveForwardsBy(4);
|
||||||
|
|
||||||
|
return stream.carve();
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Zlib extractor.
|
* Zlib extractor.
|
||||||
*
|
*
|
||||||
|
@ -2808,6 +2884,26 @@ export function extractZlib(bytes, offset) {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* XZ extractor.
|
||||||
|
*
|
||||||
|
* @param {Uint8Array} bytes
|
||||||
|
* @param {Number} offset
|
||||||
|
* @returns {string}
|
||||||
|
*/
|
||||||
|
export function extractXZ(bytes, offset) {
|
||||||
|
const stream = new Stream(bytes.slice(offset));
|
||||||
|
|
||||||
|
// Move forward to EOF marker
|
||||||
|
stream.continueUntil([0x00, 0x00, 0x00, 0x00, 0x04, 0x59, 0x5a]);
|
||||||
|
|
||||||
|
// Move over EOF marker
|
||||||
|
stream.moveForwardsBy(7);
|
||||||
|
|
||||||
|
return stream.carve();
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* ELF extractor.
|
* ELF extractor.
|
||||||
*
|
*
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue