Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added Decode VBE #183

Merged
merged 8 commits into from
Aug 30, 2017
Merged

Added Decode VBE #183

merged 8 commits into from
Aug 30, 2017

Conversation

bwhitn
Copy link
Contributor

@bwhitn bwhitn commented Aug 27, 2017

This will allow the decoding of Microsoft VBE files. Wasn't sure where to put this so I put it in "Data Format".

runDecodeVBE: function (data, args) {
let matcher = /#@~\^......==(.+)......==\^#~@/;
let encodedData = matcher.exec(data);
console.log(encodedData[1]);

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this logging call intended to be part of the PR?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, my bad. Added it to find a looping issue. I took it out.

@bwhitn
Copy link
Contributor Author

bwhitn commented Aug 28, 2017

I was just looking at the issues. I guess this would solve #165. Maybe it should be renamed Microsoft Script decoder.

@mattnotmitt
Copy link
Collaborator

mattnotmitt commented Aug 28, 2017 via email

@bwhitn
Copy link
Contributor Author

bwhitn commented Aug 28, 2017

Yea, it should. Haven't seen anything saying different.

Copy link
Member

@n1474335 n1474335 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks very much, this looks great. There are a few things to tidy up then we can get it merged.

data = data.replace(/@#/g, String.fromCharCode(13));
data = data.replace(/@\*/g, ">");
data = data.replace(/@!/g, "<");
data = data.replace(/@\$/g, "@");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These .replace calls should be chained i.e.

data = data
    .replace(...)
    .replace(...)
    .replace(...);

* @param {string} data
* @returns {string}
*/
decode: function (data) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Private functions should start with an underscore.


/**
* @param {string} data
* @returns {string}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add @private tag.

return result.join("");
},

/**
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add 'Microsoft Script Decoder operation.' to this comment.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@@ -3204,6 +3205,13 @@ const OperationConfig = {
}
]
},
"Micrsoft Script Decoder": {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo - missing 'o' in 'Microsoft'.

@@ -3204,6 +3205,13 @@ const OperationConfig = {
}
]
},
"Micrsoft Script Decoder": {
description: "Decodes Microsoft Encoded Script files that have been encoded with Microsoft's custom encoding.",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a bit more detail here to describe what kind of script files this works on (Jscript.Encode, VBE etc.)? This is important as users may search for these terms and this operation should be listed for them. It might also be worth including an example in <code> tags. The one in your test could be suitable.

* @returns {string}
*/
runDecodeScript: function (input, args) {
let matcher = /#@~\^......==(.+)......==\^#~@/;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dots in this regex can be collapsed using range notation e.g. #@~\^.{6}==(.+).{6}==\^#~@. This seems a little easier to read to me.

},
],
},
]);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a test to confirm that this works for JScript.Encode as well as VBE.

Copy link
Contributor Author

@bwhitn bwhitn Aug 29, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using the VBS script from https://gallery.technet.microsoft.com/scriptcenter/16439c02-3296-4ec8-9134-6eb6fb599880 I was able check both JS and VBS and noticed that they produce the same file output given the same file input even when you specify a different script type in the EncodeScriptFile function. I did create a more complex test though.

@@ -0,0 +1,22 @@
/**
* CharEnc tests.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update this to 'MS tests."

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

/**
* CharEnc tests.
*
* @author tlwr [toby@toby.codes]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change this to your author tag.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@n1474335 n1474335 merged commit f8e9e9b into gchq:master Aug 30, 2017
@bwhitn bwhitn deleted the vbe branch August 30, 2017 16:01
BRAVO68WEB pushed a commit to BRAVO68WEB/CyberChef that referenced this pull request May 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants