diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json index 09ee8d15..7417d85e 100644 --- a/src/core/config/Categories.json +++ b/src/core/config/Categories.json @@ -18,15 +18,15 @@ "From Binary", "To Octal", "From Octal", + "To Base64", + "From Base64", + "Show Base64 offsets", "To Base32", "From Base32", "To Base58", "From Base58", "To Base62", "From Base62", - "To Base64", - "From Base64", - "Show Base64 offsets", "To Base85", "From Base85", "To Base", @@ -61,9 +61,7 @@ "Parse TLV", "CSV to JSON", "JSON to CSV", - "Avro to JSON", - "CBOR Encode", - "CBOR Decode" + "Avro to JSON" ] }, { @@ -136,11 +134,6 @@ "PGP Verify", "PGP Encrypt and Sign", "PGP Decrypt and Verify", - "Generate RSA Key Pair", - "RSA Sign", - "RSA Verify", - "RSA Encrypt", - "RSA Decrypt", "Parse SSH Host Key" ] }, @@ -191,13 +184,8 @@ "URL Encode", "URL Decode", "Protobuf Decode", - "Protobuf Encode", "VarInt Encode", "VarInt Decode", - "JA3 Fingerprint", - "JA3S Fingerprint", - "HASSH Client Fingerprint", - "HASSH Server Fingerprint", "Format MAC addresses", "Change IP format", "Group IP addresses", @@ -212,10 +200,8 @@ "ops": [ "Encode text", "Decode text", - "Unicode Text Format", "Remove Diacritics", - "Unescape Unicode Characters", - "Convert to NATO alphabet" + "Unescape Unicode Characters" ] }, { @@ -245,7 +231,6 @@ "Pad lines", "Find / Replace", "Regular expression", - "Fuzzy Match", "Offset checker", "Hamming Distance", "Convert distance", @@ -256,7 +241,6 @@ "Convert co-ordinate format", "Show on map", "Parse UNIX file permissions", - "Parse ObjectID timestamp", "Swap endianness", "Parse colour code", "Escape string", @@ -272,10 +256,21 @@ "Translate DateTime Format", "From UNIX Timestamp", "To UNIX Timestamp", + "From UNIX 32-bit Timestamp", + "To UNIX 32-bit Timestamp", "Windows Filetime to UNIX Timestamp", "UNIX Timestamp to Windows Filetime", + "From Mac Absolute Timestamp", + "To Mac Absolute Timestamp", + "From HFS(+) Timestamp", + "To HFS(+) Timestamp", + "From Windows 64-bit Filetime Timestamp", + "To Windows 64-bit Filetime Timestamp", + "From Chrome Browser Timestamp", + "To Chrome Browser Timestamp", + "From Firefox Browser Timestamp", + "To Firefox Browser Timestamp", "Extract dates", - "Get Time", "Sleep" ] }, @@ -295,7 +290,6 @@ "JPath expression", "CSS selector", "Extract EXIF", - "Extract ID3", "Extract Files" ] }, @@ -329,7 +323,6 @@ "SHA1", "SHA2", "SHA3", - "SM3", "Keccak", "Shake", "RIPEMD", @@ -414,7 +407,6 @@ "ops": [ "Render Image", "Play Media", - "Generate Image", "Optical Character Recognition", "Remove EXIF", "Extract EXIF", diff --git a/src/core/operations/FromChromeBrowserTimeStamp.mjs b/src/core/operations/FromChromeBrowserTimeStamp.mjs new file mode 100644 index 00000000..38eba3ff --- /dev/null +++ b/src/core/operations/FromChromeBrowserTimeStamp.mjs @@ -0,0 +1,47 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * From Chrome Browser Timestamp operation + */ +class FromChromeBrowserTimestamp extends Operation { + + /** + * FromChromeBrowserTimestamp constructor + */ + constructor() { + super(); + + this.name = "From Chrome Browser Timestamp"; + this.module = "Default"; + this.description = "Converts Chrome Browser Timestamp to datetime string

e.g. 12883423549000000 \ + becomes 5 April 209 16:45:49 UTC

Chrome Browser timestamp is a 17 digit value representing the number of microseconds since \ + January 1, 1601 UTC."; + this.infoURL = "https://support.google.com/chrome/community?hl=en"; + this.inputType = "string"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {string} input + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + + const d = moment.unix((input /1000000) - 11644473600); + return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC"; + + throw new OperationError(); + } +} + +export default FromChromeBrowserTimestamp; diff --git a/src/core/operations/FromFirefoxBrowserTimeStamp.mjs b/src/core/operations/FromFirefoxBrowserTimeStamp.mjs new file mode 100644 index 00000000..25807418 --- /dev/null +++ b/src/core/operations/FromFirefoxBrowserTimeStamp.mjs @@ -0,0 +1,47 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * From Firefox Browser Timestamp operation + */ +class FromFirefoxBrowserTimestamp extends Operation { + + /** + * FromFirefoxBrowserTimestamp constructor + */ + constructor() { + super(); + + this.name = "From Firefox Browser Timestamp"; + this.module = "Default"; + this.description = "Converts Firefox Browser Timestamp to datetime string

e.g. 1341575244735000 \ + becomes 6 July 2012 11:47:24 UTC

Firefox Browser timestamp is a 16 digit value representing the number of microseconds since \ + January 1, 1970 UTC. Note: fractions of seconds are not retained."; + this.infoURL = "https://support.mozilla.org/en-US/"; + this.inputType = "string"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {string} input + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + + const d = moment.unix((input /1000000)); + return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC"; + + throw new OperationError(); + } +} + +export default FromFirefoxBrowserTimestamp; diff --git a/src/core/operations/FromHFSPlusTimeStamp.mjs b/src/core/operations/FromHFSPlusTimeStamp.mjs new file mode 100644 index 00000000..3905cebd --- /dev/null +++ b/src/core/operations/FromHFSPlusTimeStamp.mjs @@ -0,0 +1,46 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * From HFSPlus filesystem Timestamp operation + */ +class FromHFSPlusTimestamp extends Operation { + + /** + * FromHFSPlusTimestamp constructor + */ + constructor() { + super(); + + this.name = "From HFS(+) Timestamp"; + this.module = "Default"; + this.description = "Converts Apple HFS/HFS+ Filesystem Timestamp to datetime string

e.g. CDF566EE becomes 30 June 2013 04:39:10 UTC

Mac HFS/HFS+ timestamp is a 4 Byte Hex String representing the number of seconds since January 1, 1904 UTC

Use with swap endianness recipe if required."; + this.infoURL = "https://en.wikipedia.org/wiki/HFS_Plus"; + this.inputType = "string"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {string} input + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + + const h = parseInt(input, 16); + const d = moment.unix(h - 2082844800); + return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC"; + + throw new OperationError(); + } +} + +export default FromHFSPlusTimestamp; diff --git a/src/core/operations/FromMacAbsoluteTimestamp.mjs b/src/core/operations/FromMacAbsoluteTimestamp.mjs new file mode 100644 index 00000000..1396d067 --- /dev/null +++ b/src/core/operations/FromMacAbsoluteTimestamp.mjs @@ -0,0 +1,45 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * From Mac Absolute Timestamp operation + */ +class FromMacAbsoluteTimestamp extends Operation { + + /** + * FromMacAbsoluteTimestamp constructor + */ + constructor() { + super(); + + this.name = "From Mac Absolute Timestamp"; + this.module = "Default"; + this.description = "Converts Apple Mac Absolute Timestamp to datetime string

e.g. 591621300 becomes Tue 1 October 2019 11:15:00 UTC

Mac Absolute timestamp is a 32-bit value representing the number of seconds since January 1, 2001 UTC"; + this.infoURL = "https://developer.apple.com/documentation/corefoundation/cfabsolutetime"; + this.inputType = "number"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {number} input + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + + const d = moment.unix(input + 978307200); + return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC"; + + throw new OperationError(); + } +} + +export default FromMacAbsoluteTimestamp; diff --git a/src/core/operations/FromUNIX32bitTimeStamp.mjs b/src/core/operations/FromUNIX32bitTimeStamp.mjs new file mode 100644 index 00000000..62f0c109 --- /dev/null +++ b/src/core/operations/FromUNIX32bitTimeStamp.mjs @@ -0,0 +1,46 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * From UNIX 32bit filesystem Timestamp operation + */ +class FromUNIX32bitTimestamp extends Operation { + + /** + * FromUNIX32bitTimestamp constructor + */ + constructor() { + super(); + + this.name = "From UNIX 32-bit Timestamp"; + this.module = "Default"; + this.description = "Converts UNIX 32-bit Hex Timestamp to datetime string

e.g. 51C3C311 becomes 21 June 2013 03:05:53 UTC

UNIX 32-bit timestamp is a 4 Byte Hex value representing the number of seconds since January 1, 1970 UTC

Use with swap endianness recipe if required."; + this.infoURL = "https://wikipedia.org/wiki/Unix_time"; + this.inputType = "string"; + this.outputType = "string"; + + + this.args = []; + } + + /** + * @param {string} input + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + + const h = parseInt(input, 16); + const d = moment.unix(h); + return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC"; + } +} + +export default FromUNIX32bitTimestamp; diff --git a/src/core/operations/FromWindows64bitTimeStamp.mjs b/src/core/operations/FromWindows64bitTimeStamp.mjs new file mode 100644 index 00000000..437a1f14 --- /dev/null +++ b/src/core/operations/FromWindows64bitTimeStamp.mjs @@ -0,0 +1,47 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * From Windows 64bit Filesystem Timestamp operation + */ +class FromWindows64bitTimestamp extends Operation { + + /** + * FromWindows64bitFilesystemTimestamp constructor + */ + constructor() { + super(); + + this.name = "From Windows 64-bit Filetime Timestamp"; + this.module = "Default"; + this.description = "Converts Windows 64-bit Hex Filetime Timestamp to datetime string

e.g. 01CEE16F415343EE becomes 14 November 2013 19:21:19 UTC

windows 64-bit filetime timestamp is a 8 Byte Hex value representing the number of 100s of nanoseconds since January 1, 1601 UTC

Use with swap endianness recipe if required."; + this.infoURL = "https://en.wikipedia.org/wiki/System_time"; + this.inputType = "string"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {string} input + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + + const h = parseInt(input, 16); + const secs = h/10000000; + const d = moment.unix(secs - 11644473600); + return d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss") + " UTC"; + + throw new OperationError(); + } +} + +export default FromWindows64bitTimestamp; diff --git a/src/core/operations/ToChromeBrowserTimeStamp.mjs b/src/core/operations/ToChromeBrowserTimeStamp.mjs new file mode 100644 index 00000000..758495d7 --- /dev/null +++ b/src/core/operations/ToChromeBrowserTimeStamp.mjs @@ -0,0 +1,52 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * To Chrome Browser Timestamp operation + */ +class ToChromeBrowserTimestamp extends Operation { + + /** + * ToChromeBrowserTimestamp constructor + */ + constructor() { + super(); + + this.name = "To Chrome Browser Timestamp"; + this.module = "Default"; + this.description = "Converts datetime string to Chrome Browser Timestamp

e.g. 5 April 2009 16:45:49 UTC\ + becomes 12883423549000000

Chrome Browser timestamp is a 17 digit value representing the number of microseconds since January 1, 1601 UTC."; + this.infoURL = "https://support.google.com/chrome/community?hl=en"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Show parsed datetime", + "type": "boolean", + "value": true + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + const [showDateTime] = args, + d = moment.utc(input); + let result = ((d.unix()+11644473600) * 1000000); + return showDateTime ? `${result} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : result.toString(); + } +} + +export default ToChromeBrowserTimestamp; diff --git a/src/core/operations/ToFirefoxBrowserTimeStamp.mjs b/src/core/operations/ToFirefoxBrowserTimeStamp.mjs new file mode 100644 index 00000000..17bdf2cb --- /dev/null +++ b/src/core/operations/ToFirefoxBrowserTimeStamp.mjs @@ -0,0 +1,53 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * To Firefox Browser Timestamp operation + */ +class ToFirefoxBrowserTimestamp extends Operation { + + /** + * ToFirefoxBrowserTimestamp constructor + */ + constructor() { + super(); + + this.name = "To Firefox Browser Timestamp"; + this.module = "Default"; + this.description = "Converts datetime string to Firefox Browser Timestamp

e.g. 6 July 2012 11:47:24 UTC\ + becomes 1341575244735000

Firefox Browser timestamp is a 16 digit value representing the number of microseconds since \ + January 1, 1970 UTC. Note: fractions of seconds are not retained."; + this.infoURL = "https://support.mozilla.org/en-US/"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Show parsed datetime", + "type": "boolean", + "value": true + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + const [showDateTime] = args, + d = moment.utc(input); + let result = (d.unix() * 1000000); + return showDateTime ? `${result} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : result.toString(); + } +} + +export default ToFirefoxBrowserTimestamp; diff --git a/src/core/operations/ToHFSPlusTimeStamp.mjs b/src/core/operations/ToHFSPlusTimeStamp.mjs new file mode 100644 index 00000000..33964a1a --- /dev/null +++ b/src/core/operations/ToHFSPlusTimeStamp.mjs @@ -0,0 +1,52 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * To HFSPlus filesystem Timestamp operation + */ +class ToHFSPlusTimestamp extends Operation { + + /** + * ToHFSPlusTimestamp constructor + */ + constructor() { + super(); + + this.name = "To HFS(+) Timestamp"; + this.module = "Default"; + this.description = "Converts datetime string to Apple HFS/HFS+ Filesystem Timestamp

e.g. 30 June 2013 04:39:10 UTC becomes CDF566EE

Mac HFS/HFS+ timestamp is a 4 Byte Hex String representing the number of seconds since January 1, 1904 UTC

Use with swap endianness recipe if required."; + this.infoURL = "https://en.wikipedia.org/wiki/HFS_Plus"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Show parsed datetime", + "type": "boolean", + "value": true + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + const [showDateTime] = args, + d = moment.utc(input); + let result = d.unix(); + const hexString = (result + 2082844800).toString(16); + return showDateTime ? `${hexString.toUpperCase()} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)`: hexString.toUpperCase(); + } +} + +export default ToHFSPlusTimestamp; diff --git a/src/core/operations/ToMacAbsoluteTimestamp.mjs b/src/core/operations/ToMacAbsoluteTimestamp.mjs new file mode 100644 index 00000000..d91dc9c6 --- /dev/null +++ b/src/core/operations/ToMacAbsoluteTimestamp.mjs @@ -0,0 +1,51 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * To Mac Absolute Timestamp operation + */ +class ToMacAbsoluteTimestamp extends Operation { + + /** + * FromMacAbsoluteTimestamp constructor + */ + constructor() { + super(); + + this.name = "To Mac Absolute Timestamp"; + this.module = "Default"; + this.description = "Converts datetime string to Apple Mac Absolute Timestamp

e.g. Tue 1 October 2019 11:15:00 UTC becomes 591621300

Mac Absolute timestamp is a 32-bit value representing the number of seconds since January 1, 2001 UTC"; + this.infoURL = "https://developer.apple.com/documentation/corefoundation/cfabsolutetime"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Show parsed datetime", + "type": "boolean", + "value": true + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + const [showDateTime] = args, + d = moment.utc(input); + let result = (d.unix()-978307200); + return showDateTime ? `${result} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : result.toString(); + } +} + +export default ToMacAbsoluteTimestamp; diff --git a/src/core/operations/ToUNIX32bitTimeStamp.mjs b/src/core/operations/ToUNIX32bitTimeStamp.mjs new file mode 100644 index 00000000..28398290 --- /dev/null +++ b/src/core/operations/ToUNIX32bitTimeStamp.mjs @@ -0,0 +1,52 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * To UNIX 32bit filesystem Timestamp operation + */ +class ToUNIX32bitTimestamp extends Operation { + + /** + * ToUNIX32bitTimestamp constructor + */ + constructor() { + super(); + + this.name = "To UNIX 32-bit Timestamp"; + this.module = "Default"; + this.description = "Converts datetime string to UNIX 32-bit Hex Timestamp

e.g. 21 June 2013 03:05:53 UTC becomes 51C3C311

UNIX 32-bit timestamp is a 4 Byte Hex value representing the number of seconds since January 1, 1970 UTC

Use with swap endianness recipe if required."; + this.infoURL = "https://wikipedia.org/wiki/Unix_time"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Show parsed datetime", + "type": "boolean", + "value": true + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + const [showDateTime] = args, + d = moment.utc(input); + let result = d.unix(); + const hexString = result.toString(16); + return showDateTime ? `${hexString.toUpperCase()} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : hexString.toUpperCase(); + } +} + +export default ToUNIX32bitTimestamp; diff --git a/src/core/operations/ToWindows64bitTimeStamp.mjs b/src/core/operations/ToWindows64bitTimeStamp.mjs new file mode 100644 index 00000000..c95bc8a5 --- /dev/null +++ b/src/core/operations/ToWindows64bitTimeStamp.mjs @@ -0,0 +1,53 @@ +/** + * @author mykulh [mykulh@yahoo.co.uk] + * @copyright Crown Copyright 2021 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import moment from "moment-timezone"; + +/** + * To Windows 64bit filesystem Timestamp operation + */ +class ToWindows64bitTimestamp extends Operation { + + /** + * ToWindows64bitFilesystemTimestamp constructor + */ + constructor() { + super(); + + this.name = "To Windows 64-bit Filetime Timestamp"; + this.module = "Default"; + this.description = "Converts datetime string to Windows 64-bit Hex Filetime Timestamp

e.g. 14 November 2013 19:21:19 UTC becomes
01CEE16F415343EE
windows 64-bit filetime timestamp is a 8 Byte Hex value representing the number of 100s of nanoseconds since January 1, 1601 UTC

Use with swap endianness recipe if required."; + this.infoURL = "https://en.wikipedia.org/wiki/System_time"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Show parsed datetime", + "type": "boolean", + "value": true + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid unit + */ + run(input, args) { + const [showDateTime] = args, + d = moment.utc(input); + let result = d.unix(); + const step1 = result + 11644473600; + const hexString = (step1 * 10000000).toString(16); + return showDateTime ? `${hexString.toUpperCase()} (${d.tz("UTC").format("ddd D MMMM YYYY HH:mm:ss")} UTC)` : hexString.toUpperCase() ; + } +} + +export default ToWindows64bitTimestamp;