Skip to content

Commit 4a86340

Browse files
committed
Tidied up 'Microsoft Script Decoder' operation
1 parent f8e9e9b commit 4a86340

File tree

3 files changed

+22
-71
lines changed

3 files changed

+22
-71
lines changed

src/core/config/Categories.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,6 @@ const Categories = [
6666
"Encode text",
6767
"Decode text",
6868
"Swap endianness",
69-
"Microsoft Script Decoder",
7069
]
7170
},
7271
{
@@ -283,6 +282,7 @@ const Categories = [
283282
"XPath expression",
284283
"JPath expression",
285284
"CSS selector",
285+
"Microsoft Script Decoder",
286286
"Strip HTML tags",
287287
"Diff",
288288
"To Snake case",

src/core/config/OperationConfig.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3207,7 +3207,7 @@ const OperationConfig = {
32073207
]
32083208
},
32093209
"Microsoft Script Decoder": {
3210-
description: "Decodes Microsoft Encoded Script files that have been encoded with Microsoft's custom encoding. These are often VBS (Visual Basic Script) files that are encoded and often renamed &#34;.vbe&#34; extention or JS (JScript) files renamed with &#34;.jse&#34; extention.<br><br><b>Sample</b><br><br>Encoded:<br><code>#@~^RQAAAA==-mD~sX|:/TP{~J:+dYbxL~@!F@*@!+@*@!&amp;@*eEI@#@&amp;@#@&amp;.jm.raY 214Wv:zms/obI0xEAAA==^#~@</code><br><br>Decoded:<br><code>MsgBox &#34;Hello&#34;</code>",
3210+
description: "Decodes Microsoft Encoded Script files that have been encoded with Microsoft's custom encoding. These are often VBS (Visual Basic Script) files that are encoded and renamed with a '.vbe' extention or JS (JScript) files renamed with a '.jse' extention.<br><br><b>Sample</b><br><br>Encoded:<br><code>#@~^RQAAAA==-mD~sX|:/TP{~J:+dYbxL~@!F@*@!+@*@!&amp;@*eEI@#@&amp;@#@&amp;.jm.raY 214Wv:zms/obI0xEAAA==^#~@</code><br><br>Decoded:<br><code>var my_msg = &#34;Testing <1><2><3>!&#34;;\n\nVScript.Echo(my_msg);</code>",
32113211
run: MS.runDecodeScript,
32123212
inputType: "string",
32133213
outputType: "string",

src/core/operations/MS.js

Lines changed: 20 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
/**
2-
* Decodes Microsoft Encoded Script files that can be read and executed by cscript.exe/wscript.exe.
3-
* This is a conversion of a Python script that was originally created by Didier Stevens (https://DidierStevens.com).
2+
* Microsoft operations.
43
*
54
* @author bmwhitn [[email protected]]
5+
* @copyright Crown Copyright 2017
6+
* @license Apache-2.0
67
*
78
* @namespace
89
*/
@@ -148,73 +149,16 @@ const MS = {
148149
* @default
149150
*/
150151
D_COMBINATION: [
151-
0,
152-
1,
153-
2,
154-
0,
155-
1,
156-
2,
157-
1,
158-
2,
159-
2,
160-
1,
161-
2,
162-
1,
163-
0,
164-
2,
165-
1,
166-
2,
167-
0,
168-
2,
169-
1,
170-
2,
171-
0,
172-
0,
173-
1,
174-
2,
175-
2,
176-
1,
177-
0,
178-
2,
179-
1,
180-
2,
181-
2,
182-
1,
183-
0,
184-
0,
185-
2,
186-
1,
187-
2,
188-
1,
189-
2,
190-
0,
191-
2,
192-
0,
193-
0,
194-
1,
195-
2,
196-
0,
197-
2,
198-
1,
199-
0,
200-
2,
201-
1,
202-
2,
203-
0,
204-
0,
205-
1,
206-
2,
207-
2,
208-
0,
209-
0,
210-
1,
211-
2,
212-
0,
213-
2,
214-
1
152+
0, 1, 2, 0, 1, 2, 1, 2, 2, 1, 2, 1, 0, 2, 1, 2, 0, 2, 1, 2, 0, 0, 1, 2, 2, 1, 0, 2, 1, 2, 2, 1,
153+
0, 0, 2, 1, 2, 1, 2, 0, 2, 0, 0, 1, 2, 0, 2, 1, 0, 2, 1, 2, 0, 0, 1, 2, 2, 0, 0, 1, 2, 0, 2, 1
215154
],
216155

156+
217157
/**
158+
* Decodes Microsoft Encoded Script files that can be read and executed by cscript.exe/wscript.exe.
159+
* This is a conversion of a Python script that was originally created by Didier Stevens
160+
* (https://DidierStevens.com).
161+
*
218162
* @private
219163
* @param {string} data
220164
* @returns {string}
@@ -227,22 +171,28 @@ const MS = {
227171
.replace(/@\*/g, ">")
228172
.replace(/@!/g, "<")
229173
.replace(/@\$/g, "@");
174+
230175
for (let i = 0; i < data.length; i++) {
231176
let byte = data.charCodeAt(i);
232177
let char = data.charAt(i);
233178
if (byte < 128) {
234179
index++;
235180
}
236-
if ((byte === 9 || byte > 31 && byte < 128) && byte !== 60 && byte !== 62 && byte !== 64) {
181+
182+
if ((byte === 9 || byte > 31 && byte < 128) &&
183+
byte !== 60 &&
184+
byte !== 62 &&
185+
byte !== 64) {
237186
char = MS.D_DECODE[byte].charAt(MS.D_COMBINATION[index % 64]);
238187
}
239188
result.push(char);
240189
}
241190
return result.join("");
242191
},
243192

193+
244194
/**
245-
* Microsoft Script Decoder operation
195+
* Microsoft Script Decoder operation.
246196
*
247197
* @param {string} input
248198
* @param {Object[]} args
@@ -256,7 +206,8 @@ const MS = {
256206
} else {
257207
return "";
258208
}
259-
},
209+
}
210+
260211
};
261212

262213
export default MS;

0 commit comments

Comments
 (0)