exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
cyberchef/tests/operations/tests
History
vigneshrajan94 19dd80b10e Add PowerShell deobfuscation operations (addresses #2396) 
Implements five new operations under the 'Code tidy' category to
deobfuscate common PowerShell obfuscation techniques:

- PowerShell Format String Deobfuscate: resolves (-f) format operator
  expressions such as ("{0}{2}{1}" -f 'new-ob','t','jec') -> new-object
- PowerShell Decode EncodedCommand: decodes -enc / -e / -ec Base64
  UTF-16LE payloads, accepting raw tokens or full command lines
- PowerShell Backtick Remove: strips obfuscating backticks with an opt-in
  'Preserve escape sequences' mode for legitimate PS escapes
- PowerShell Concatenation Join: iteratively joins 'frag'+'ment' string
  literals, handling mixed quote types and arbitrary chain lengths
- PowerShell Char Decode: decodes [char]N and [char[]](N,N,...) casts
  supporting both decimal and 0x hex values

Each operation includes auto-detection checks for the Magic operation,
comprehensive unit tests, and OSINT-validated test cases sourced from
Emotet, AMSI bypass, and Invoke-Obfuscation real-world samples.
2026-05-27 16:30:53 +05:30
..
A1Z26CipherDecode.mjs
fix(A1Z26): return empty string instead of empty array for empty input (#2257)
2026-03-19 10:10:35 +00:00
AESKeyWrap.mjs
add new operations: AES Key Wrap/Unwrap
2022-11-01 00:35:27 +09:00
AlternatingCaps.mjs
Added alternating caps functionality
2024-09-12 15:40:54 +01:00
AnalyseUUID.mjs
Added metadata extraction for UUID strings. (#2322)
2026-04-24 15:14:35 +01:00
AvroToJSON.mjs
Always use mjs imports
2021-09-17 08:48:04 +02:00
BaconCipher.mjs
Always use mjs imports
2021-09-17 08:48:04 +02:00
Base32.mjs
Add Base32 Hex Extended option.
2025-02-28 16:52:15 +00:00
Base45.mjs
Tidied up Base45 ops
2022-03-28 16:15:37 +01:00
Base58.mjs
Fix Base58 handling of strings with only null characters
2024-04-01 17:31:36 +02:00
Base62.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
Base64.mjs
Fix XSS in Show Base64 offsets (#2346)
2026-04-28 10:02:00 +01:00
Base85.mjs
im dumb, please pass the test now
2022-11-25 22:40:40 +08:00
Base92.mjs
Feature: Add Base92 operations
2023-04-12 10:37:16 +05:30
BCD.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
Bech32.mjs
Add Bech32 and Bech32m encoding/decoding operations (#2159)
2026-01-30 19:02:23 +00:00
BitwiseOp.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
BLAKE2b.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
BLAKE2s.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
BLAKE3.mjs
Fix all zeros after 16384 bytes with Blake3 (#2351)
2026-04-29 21:52:00 +01:00
Bombe.mjs
AES Decrypt now supports Additional Authenticated Data in GCM mode. Added tests for ADD at each AES size.
2021-02-02 17:18:35 +00:00
BSON.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
ByteRepr.mjs
Linting changes
2019-11-14 08:55:27 +00:00
CaesarBoxCipher.mjs
Tidied Caesar Box Cipher
2022-07-08 15:36:30 +01:00
CaretMdecode.mjs
add to tests, fix test, fix a comma
2024-02-13 10:22:54 +01:00
CartesianProduct.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
CBORDecode.mjs
Tidied up CBOR operations
2021-03-26 14:07:02 +00:00
CBOREncode.mjs
Tidied up CBOR operations
2021-03-26 14:07:02 +00:00
CetaceanCipherDecode.mjs
add cetacean cipher encoder and decoder operations, tests. Update .gitignore to exclude idea generated files
2022-01-17 23:37:24 +13:00
CetaceanCipherEncode.mjs
add cetacean cipher encoder and decoder operations, tests. Update .gitignore to exclude idea generated files
2022-01-17 23:37:24 +13:00
ChaCha.mjs
Fix ChaCha operation Raw output
2023-07-30 17:02:36 +02:00
ChangeIPFormat.mjs
Add octal support to Change IP Format.
2019-08-24 01:14:44 +01:00
CharEnc.mjs
Added support for 109 more character encodings
2019-11-01 14:56:18 +00:00
Charts.mjs
Series Chart HTML Formatting fix (#2403)
2026-05-18 11:57:16 +01:00
Ciphers.mjs
Remove trim from rail fence.
2025-02-21 20:40:37 -06:00
CipherSaber2.mjs
Fix Ciphersaber2 key concatenation
2024-04-01 18:40:00 +02:00
CMAC.mjs
Fixed tests for CMAC
2022-11-25 15:13:54 +00:00
Code.mjs
Bump jsonpath-plus (#2166)
2026-01-29 13:40:34 +00:00
Colossus.mjs
AES Decrypt now supports Additional Authenticated Data in GCM mode. Added tests for ADD at each AES size.
2021-02-02 17:18:35 +00:00
Comment.mjs
Fork no longer appends its merge delimiter to the end of the output. Closes #692
2019-10-18 13:57:21 +01:00
Compress.mjs
Added 'LZ4 Compress' and 'LZ4 Decompress' operations. Closes #1116
2022-11-11 16:27:14 +00:00
ConditionalJump.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
ConvertCoordinateFormat.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
ConvertLeetSpeak.mjs
Preserve uppercase
2025-02-17 17:35:22 +01:00
ConvertToNATOAlphabet.mjs
Tidied up 'Convert to NATO alphabet' operation
2020-03-13 17:10:29 +00:00
CRCChecksum.mjs
Fixed Test for non-working buttons
2025-03-04 08:46:41 +01:00
Crypt.mjs
Merge pull request #1904 from FranciscoPombal/des_triple_des_error_message
2025-02-16 01:43:36 +00:00
CSV.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
DateTime.mjs
Fix test to fit new time-delta format
2024-04-01 19:42:56 +03:00
DefangIP.mjs
Fix Defang IP tests causing the tests to fail
2019-08-13 16:45:53 +01:00
DisassembleARM.mjs
feat: add ARM disassembler operation (#2156)
2026-03-08 19:07:46 +00:00
DropNthBytes.mjs
Add tests
2019-10-21 20:59:04 +01:00
ECDSA.mjs
Add to ECDSA Verify the message format
2025-04-25 13:56:10 +02:00
ELFInfo.mjs
Added tests for ELF-Info
2022-06-09 10:02:38 +01:00
Enigma.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
ExtractAudioMetadata.mjs
Add Extract Audio Metadata operation (#2170)
2026-03-19 12:14:28 +00:00
ExtractEmailAddresses.mjs
Regular Expression operation email address regex: Support IPv4 domains (#2167)
2026-04-13 13:04:33 +01:00
ExtractHashes.mjs
Fixed op name in test
2024-04-01 22:30:18 -04:00
ExtractIPAddresses.mjs
Updated warning now that original issue has been resolved.
2025-05-12 14:24:07 +00:00
Fernet.mjs
Fix, and link, Fernet tests (#2335)
2026-04-27 12:35:10 +01:00
FileTree.mjs
Adding and removing tests
2024-02-12 16:52:43 +00:00
FlaskSession.mjs
Add Flask Session operations (Decode, Sign, Verify) (#2208)
2026-03-07 07:29:22 +00:00
FletcherChecksum.mjs
fix Fletcher-32/64 Checksum
2022-11-02 21:54:45 +09:00
Float.mjs
Add "To Float" and "From Float" operations
2019-10-07 20:02:28 +08:00
Fork.mjs
Added nesting to Merge/Fork/Subsection
2022-06-17 09:26:00 +01:00
FromDecimal.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
GenerateAllChecksums.mjs
Add All Checksums Operation
2025-04-29 17:25:29 +02:00
GenerateAllHashes.mjs
Remove Checksums from All Hashes
2025-04-28 16:43:22 +02:00
GenerateDeBruijnSequence.mjs
Fixed De Bruijn test import
2023-03-24 22:40:07 +00:00
GenerateQRCode.mjs
Fix return of buffer for PNG QR image generation - resolves #2124 (#2125)
2026-02-20 16:07:37 +00:00
GetAllCasings.mjs
fix: GetAllCasings.mjs test
2022-03-28 16:52:59 +02:00
GOST.mjs
Improved GOST algorithm naming and block size selection
2024-05-16 18:09:12 +01:00
Gunzip.mjs
Linting on tests
2019-12-17 12:30:32 +00:00
Gzip.mjs
Added tests for gunzip.
2019-12-17 12:28:09 +00:00
Hash.mjs
Added a range of GOST operations
2023-07-14 18:37:02 +01:00
HASSH.mjs
Added HASSH operations
2021-08-10 16:48:35 +01:00
HaversineDistance.mjs
Correct Haversine test output
2020-12-09 21:12:26 +11:00
Hex.mjs
Fixed Percent delimiter for hex encoding (#2137)
2026-02-11 09:20:08 +00:00
Hexdump.mjs
Fix: Correctly parse xxd odd byte hexdumps (#2058)
2026-02-04 09:38:25 +00:00
HKDF.mjs
Fixed HKDF op name
2023-03-23 18:21:43 +00:00
Image.mjs
refactor samples, and more tests
2022-04-04 17:40:58 +01:00
IndexOfCoincidence.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
IPv6Transition.mjs
updates to operation and addition of more tests
2024-09-20 10:46:09 +01:00
JA3Fingerprint.mjs
Added 'JA3S Fingerprint' operation
2021-08-10 14:57:34 +01:00
JA3SFingerprint.mjs
Added HASSH operations
2021-08-10 16:48:35 +01:00
JA4.mjs
Fix the processing of ALPNs for JA4 to align with new specification update (#2165)
2026-01-31 12:01:10 +00:00
Jq.mjs
feat: add Raw option for Jq operation (#2237)
2026-03-20 09:26:39 +00:00
Jsonata.mjs
updated Jsonata Query tests header title
2025-02-17 10:19:38 -07:00
JSONBeautify.mjs
'JSON Beautify' operation now supports formatting, collapsing and syntax highlighting. Closes #203.
2022-06-08 18:07:11 +01:00
JSONMinify.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
JSONtoCSV.mjs
feat: support boolean and null in JSON to CSV
2022-08-17 02:12:39 +09:00
JSONtoYAML.mjs
renamed function for clarity
2025-03-10 20:55:35 +01:00
Jump.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
JWK.mjs
JWK conversion from/to PEM
2024-04-13 13:30:46 +02:00
JWTDecode.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
JWTSign.mjs
Bump jsonwebtoken from 8.5.1 to 9.0.0 (#2219)
2026-03-04 19:58:25 +00:00
JWTVerify.mjs
Tidied up JWT tests
2021-02-09 14:23:02 +00:00
LevenshteinDistance.mjs
add new operation: Levenshtein Distance
2023-01-11 05:16:37 +09:00
Lorenz.mjs
Tidied up Lorenz operation and created new Bletchley module for WW2-era ciphers
2019-11-06 12:14:22 +00:00
LS47.mjs
Update LS47.mjs
2020-02-14 13:43:30 +00:00
LuhnChecksum.mjs
fixed code format, added tests
2024-10-27 22:36:53 +01:00
LZNT1Decompress.mjs
Add support for LZNT1 decompression.
2023-12-25 23:06:11 +01:00
LZString.mjs
Added 'LZString Decompress' and 'LZString Compress' operations
2021-10-29 15:26:31 -05:00
Magic.mjs
Added 'Strict mode' to 'From Base64' operation
2022-06-03 21:41:37 +01:00
Media.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
MIMEDecoding.mjs
Fixed linting issues
2025-02-15 22:20:42 -05:00
Modhex.mjs
fix: return empty output for zero-length To Modhex input (#2249)
2026-03-23 12:26:09 +00:00
MorseCode.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
MS.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
MultipleBombe.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
MurmurHash3.mjs
Fix calculation bug and add Convert to Signed
2024-02-06 15:21:39 -05:00
NetBIOS.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
NormaliseUnicode.mjs
Fix bug in Normalise Unicode operation: replace nfc by nfkc
2020-05-27 15:47:40 +01:00
NTLM.mjs
Added 'LM Hash' opertaion
2022-10-15 00:13:39 +01:00
OTP.mjs
style: fix linting
2025-01-23 11:46:01 +00:00
ParityBit.mjs
[#927] added parity bit operation (#1036)
2026-04-25 08:52:26 +01:00
ParseCSR.mjs
Add support for ECDSA and DSA keys to Parse CSR operation
2024-06-09 01:00:20 +01:00
ParseEthernetFrame.mjs
Parse Ethernet Frame HTML formatting fix (#2402)
2026-05-18 11:54:13 +01:00
ParseIPRange.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
ParseIPv4Header.mjs
Parse IPv4 Header HTML formatting fix (#2401)
2026-05-18 11:52:10 +01:00
ParseObjectIDTimestamp.mjs
Renamed Parse ObjectID Timestamp operation files
2020-03-27 12:09:57 +00:00
ParseQRCode.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
ParseSSHHostKey.mjs
Support Ed25519 SSH host key parsing
2022-09-18 12:47:55 +02:00
ParseTCP.mjs
Added 'Parse TCP' operation
2022-05-30 18:06:15 +01:00
ParseTLSRecord.mjs
Add Parse TLS record operation
2024-11-02 16:58:19 +00:00
ParseTLV.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
ParseUDP.mjs
Added 'Parse TCP' operation
2022-05-30 18:06:15 +01:00
ParseX509CRL.mjs
Add basic tests for Parse X.509 CRL operations
2024-08-25 14:28:55 +01:00
PEMtoHex.mjs
Tidied up 'PEM to Hex' operation
2022-06-03 22:57:49 +01:00
PGP.mjs
refactor samples, and more tests
2022-04-04 17:40:58 +01:00
PHP.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
PHPSerialize.mjs
added PHP Serialize operation
2023-04-06 20:32:50 +00:00
PowerSet.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
PowerShellBacktickRemove.mjs
Add PowerShell deobfuscation operations (addresses #2396)
2026-05-27 16:30:53 +05:30
PowerShellCharDecode.mjs
Add PowerShell deobfuscation operations (addresses #2396)
2026-05-27 16:30:53 +05:30
PowerShellConcatenationJoin.mjs
Add PowerShell deobfuscation operations (addresses #2396)
2026-05-27 16:30:53 +05:30
PowerShellDecodeEncodedCommand.mjs
Add PowerShell deobfuscation operations (addresses #2396)
2026-05-27 16:30:53 +05:30
PowerShellFormatStringDeobfuscate.mjs
Add PowerShell deobfuscation operations (addresses #2396)
2026-05-27 16:30:53 +05:30
Protobuf.mjs
fix protobuf field order
2022-07-21 16:36:15 +02:00
PubKeyFromCert.mjs
Public Key from Certificate
2024-04-13 12:38:14 +02:00
PubKeyFromPrivKey.mjs
Public Key from Private Key
2024-04-13 12:39:58 +02:00
Rabbit.mjs
Tidied up Rabbit operations
2022-11-25 16:48:54 +00:00
RAKE.mjs
Lint and dependency update
2024-03-26 14:38:27 +00:00
RC6.mjs
Feat/rc6 add RC6 Encrypt/Decrypt operations (#2163)
2026-03-07 12:07:17 +00:00
Regex.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
Register.mjs
AES Additional data can now be entered in a range of formats. #1011
2021-02-22 19:33:52 +00:00
RegularExpression.mjs
Regular Expression operation email address regex: Support IPv4 domains (#2167)
2026-04-13 13:04:33 +01:00
RenderMarkdown.mjs
Feature md link blanks (#660)
2026-04-25 08:43:22 +01:00
RisonEncodeDecode.mjs
RISON operation
2023-04-12 15:09:07 +05:30
Rotate.mjs
fix: ROT13 - shifting numbers by negative amounts
2024-09-15 23:51:48 +01:00
RSA.mjs
refactor samples, and more tests
2022-04-04 17:40:58 +01:00
Salsa20.mjs
Add Salsa20 and XSalsa20 operation
2024-03-10 17:05:19 +01:00
SeqUtils.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
SetDifference.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
SetIntersection.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
SetUnion.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
Shuffle.mjs
Simplified 'Shuffle' operation to work in the same way as 'Sort' and 'Unique'
2022-11-25 11:50:27 +00:00
SIGABA.mjs
Added operation description note and modified comment formatting
2020-06-08 12:27:40 +01:00
SM2.mjs
Additional linter corrections
2024-09-21 12:00:37 +02:00
SM4.mjs
Add the SM4 block cipher, also a no-padding option for block ciphers.
2021-03-24 00:58:54 +01:00
SplitColourChannels.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
SQLBeautify.mjs
Improve SQL Beautify: use sql-formatter and support bind variables (#2071)
2026-03-02 12:55:54 +00:00
StripIPv4Header.mjs
Add Strip IPv4 header operation
2024-09-15 17:46:47 +01:00
StripTCPHeader.mjs
Add Strip TCP header operation
2024-09-15 18:49:17 +01:00
StripUDPHeader.mjs
Add Strip UDP header operation
2024-09-15 18:14:21 +01:00
StrUtils.mjs
change Diff to output <ins>, <del>
2023-08-31 03:20:20 +00:00
Subsection.mjs
Added nesting to Merge/Fork/Subsection
2022-06-17 09:26:00 +01:00
SwapCase.mjs
add new operation: Swap case
2023-01-11 05:48:05 +09:00
SymmetricDifference.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
TakeNthBytes.mjs
Add tests
2019-10-21 20:16:14 +01:00
Template.mjs
Add Template operation for basic JSON rendering
2025-04-09 15:54:39 -07:00
TextEncodingBruteForce.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
TextIntegerConverter.mjs
Add Text/Integer Converter operation (#2213)
2026-03-08 13:46:36 +00:00
ToFromInsensitiveRegex.mjs
Linting for regex operation
2019-11-22 10:58:24 +00:00
TranslateDateTimeFormat.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
Typex.mjs
Imports now specify the file extension to support Node v12
2019-07-09 12:23:59 +01:00
UnescapeString.mjs
Added escape sequence "\a" (audible bell, 0x07) to Utils.parseEscapedChars().
2022-09-28 20:32:21 -07:00
Unicode.mjs
Add unicode tests
2020-08-19 10:55:29 +01:00
URLEncodeDecode.mjs
Add tests for URLDecode and URLEncode
2025-05-12 13:09:59 +00:00
Wrap.mjs
feat(operation-wrap): add new Wrap operation to format text at specified line width (#1882)
2026-05-08 15:58:19 +01:00
XORChecksum.mjs
Merged master and followed naming convention updates
2025-05-12 10:11:15 +00:00
XSalsa20.mjs
Add Salsa20 and XSalsa20 operation
2024-03-10 17:05:19 +01:00
XXTEA.mjs
Improved XXTEA operations. Added XXTEA Decrypt.
2024-04-24 13:09:17 +01:00
YARA.mjs
Update libyara package to fix bug with compile messages and add support for console module
2022-09-18 16:11:04 +01:00