Skip to content

Commit f2d8f93

Browse files
n1474335n1474335
committed
Merge branch 'bwhitn-vbe'
2 parents d012fd3 + 4a86340 commit f2d8f93

File tree

5 files changed

+247
-0
lines changed

5 files changed

+247
-0
lines changed

‎src/core/config/Categories.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,7 @@ const Categories = [
282282
"XPath expression",
283283
"JPath expression",
284284
"CSS selector",
285+
"Microsoft Script Decoder",
285286
"Strip HTML tags",
286287
"Diff",
287288
"To Snake case",

‎src/core/config/OperationConfig.js

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import IP from "../operations/IP.js";
2525
import JS from "../operations/JS.js";
2626
import MAC from "../operations/MAC.js";
2727
import MorseCode from "../operations/MorseCode.js";
28+
import MS from "../operations/MS.js";
2829
import NetBIOS from "../operations/NetBIOS.js";
2930
import Numberwang from "../operations/Numberwang.js";
3031
import OS from "../operations/OS.js";
@@ -520,6 +521,7 @@ const OperationConfig = {
520521
}
521522
]
522523
},
524+
523525
"To Charcode": {
524526
description: "Converts text to its unicode character code equivalent.<br><br>e.g. <code>Γειά σου</code> becomes <code>0393 03b5 03b9 03ac 20 03c3 03bf 03c5</code>",
525527
run: ByteRepr.runToCharcode,
@@ -3204,6 +3206,13 @@ const OperationConfig = {
32043206
}
32053207
]
32063208
},
3209+
"Microsoft Script Decoder": {
3210+
description: "Decodes Microsoft Encoded Script files that have been encoded with Microsoft's custom encoding. These are often VBS (Visual Basic Script) files that are encoded and renamed with a '.vbe' extention or JS (JScript) files renamed with a '.jse' extention.<br><br><b>Sample</b><br><br>Encoded:<br><code>#@~^RQAAAA==-mD~sX|:/TP{~J:+dYbxL~@!F@*@!+@*@!&amp;@*eEI@#@&amp;@#@&amp;.jm.raY 214Wv:zms/obI0xEAAA==^#~@</code><br><br>Decoded:<br><code>var my_msg = &#34;Testing <1><2><3>!&#34;;\n\nVScript.Echo(my_msg);</code>",
3211+
run: MS.runDecodeScript,
3212+
inputType: "string",
3213+
outputType: "string",
3214+
args: []
3215+
},
32073216
"Syntax highlighter": {
32083217
description: "Adds syntax highlighting to a range of source code languages. Note that this will not indent the code. Use one of the 'Beautify' operations for that.",
32093218
run: Code.runSyntaxHighlight,

‎src/core/operations/MS.js

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
/**
2+
* Microsoft operations.
3+
*
4+
* @author bmwhitn [[email protected]]
5+
* @copyright Crown Copyright 2017
6+
* @license Apache-2.0
7+
*
8+
* @namespace
9+
*/
10+
const MS = {
11+
12+
/**
13+
* @constant
14+
* @default
15+
*/
16+
D_DECODE: [
17+
"",
18+
"",
19+
"",
20+
"",
21+
"",
22+
"",
23+
"",
24+
"",
25+
"",
26+
"\x57\x6E\x7B",
27+
"\x4A\x4C\x41",
28+
"\x0B\x0B\x0B",
29+
"\x0C\x0C\x0C",
30+
"\x4A\x4C\x41",
31+
"\x0E\x0E\x0E",
32+
"\x0F\x0F\x0F",
33+
"\x10\x10\x10",
34+
"\x11\x11\x11",
35+
"\x12\x12\x12",
36+
"\x13\x13\x13",
37+
"\x14\x14\x14",
38+
"\x15\x15\x15",
39+
"\x16\x16\x16",
40+
"\x17\x17\x17",
41+
"\x18\x18\x18",
42+
"\x19\x19\x19",
43+
"\x1A\x1A\x1A",
44+
"\x1B\x1B\x1B",
45+
"\x1C\x1C\x1C",
46+
"\x1D\x1D\x1D",
47+
"\x1E\x1E\x1E",
48+
"\x1F\x1F\x1F",
49+
"\x2E\x2D\x32",
50+
"\x47\x75\x30",
51+
"\x7A\x52\x21",
52+
"\x56\x60\x29",
53+
"\x42\x71\x5B",
54+
"\x6A\x5E\x38",
55+
"\x2F\x49\x33",
56+
"\x26\x5C\x3D",
57+
"\x49\x62\x58",
58+
"\x41\x7D\x3A",
59+
"\x34\x29\x35",
60+
"\x32\x36\x65",
61+
"\x5B\x20\x39",
62+
"\x76\x7C\x5C",
63+
"\x72\x7A\x56",
64+
"\x43\x7F\x73",
65+
"\x38\x6B\x66",
66+
"\x39\x63\x4E",
67+
"\x70\x33\x45",
68+
"\x45\x2B\x6B",
69+
"\x68\x68\x62",
70+
"\x71\x51\x59",
71+
"\x4F\x66\x78",
72+
"\x09\x76\x5E",
73+
"\x62\x31\x7D",
74+
"\x44\x64\x4A",
75+
"\x23\x54\x6D",
76+
"\x75\x43\x71",
77+
"\x4A\x4C\x41",
78+
"\x7E\x3A\x60",
79+
"\x4A\x4C\x41",
80+
"\x5E\x7E\x53",
81+
"\x40\x4C\x40",
82+
"\x77\x45\x42",
83+
"\x4A\x2C\x27",
84+
"\x61\x2A\x48",
85+
"\x5D\x74\x72",
86+
"\x22\x27\x75",
87+
"\x4B\x37\x31",
88+
"\x6F\x44\x37",
89+
"\x4E\x79\x4D",
90+
"\x3B\x59\x52",
91+
"\x4C\x2F\x22",
92+
"\x50\x6F\x54",
93+
"\x67\x26\x6A",
94+
"\x2A\x72\x47",
95+
"\x7D\x6A\x64",
96+
"\x74\x39\x2D",
97+
"\x54\x7B\x20",
98+
"\x2B\x3F\x7F",
99+
"\x2D\x38\x2E",
100+
"\x2C\x77\x4C",
101+
"\x30\x67\x5D",
102+
"\x6E\x53\x7E",
103+
"\x6B\x47\x6C",
104+
"\x66\x34\x6F",
105+
"\x35\x78\x79",
106+
"\x25\x5D\x74",
107+
"\x21\x30\x43",
108+
"\x64\x23\x26",
109+
"\x4D\x5A\x76",
110+
"\x52\x5B\x25",
111+
"\x63\x6C\x24",
112+
"\x3F\x48\x2B",
113+
"\x7B\x55\x28",
114+
"\x78\x70\x23",
115+
"\x29\x69\x41",
116+
"\x28\x2E\x34",
117+
"\x73\x4C\x09",
118+
"\x59\x21\x2A",
119+
"\x33\x24\x44",
120+
"\x7F\x4E\x3F",
121+
"\x6D\x50\x77",
122+
"\x55\x09\x3B",
123+
"\x53\x56\x55",
124+
"\x7C\x73\x69",
125+
"\x3A\x35\x61",
126+
"\x5F\x61\x63",
127+
"\x65\x4B\x50",
128+
"\x46\x58\x67",
129+
"\x58\x3B\x51",
130+
"\x31\x57\x49",
131+
"\x69\x22\x4F",
132+
"\x6C\x6D\x46",
133+
"\x5A\x4D\x68",
134+
"\x48\x25\x7C",
135+
"\x27\x28\x36",
136+
"\x5C\x46\x70",
137+
"\x3D\x4A\x6E",
138+
"\x24\x32\x7A",
139+
"\x79\x41\x2F",
140+
"\x37\x3D\x5F",
141+
"\x60\x5F\x4B",
142+
"\x51\x4F\x5A",
143+
"\x20\x42\x2C",
144+
"\x36\x65\x57"
145+
],
146+
147+
/**
148+
* @constant
149+
* @default
150+
*/
151+
D_COMBINATION: [
152+
0, 1, 2, 0, 1, 2, 1, 2, 2, 1, 2, 1, 0, 2, 1, 2, 0, 2, 1, 2, 0, 0, 1, 2, 2, 1, 0, 2, 1, 2, 2, 1,
153+
0, 0, 2, 1, 2, 1, 2, 0, 2, 0, 0, 1, 2, 0, 2, 1, 0, 2, 1, 2, 0, 0, 1, 2, 2, 0, 0, 1, 2, 0, 2, 1
154+
],
155+
156+
157+
/**
158+
* Decodes Microsoft Encoded Script files that can be read and executed by cscript.exe/wscript.exe.
159+
* This is a conversion of a Python script that was originally created by Didier Stevens
160+
* (https://DidierStevens.com).
161+
*
162+
* @private
163+
* @param {string} data
164+
* @returns {string}
165+
*/
166+
_decode: function (data) {
167+
let result = [];
168+
let index = -1;
169+
data = data.replace(/@&/g, String.fromCharCode(10))
170+
.replace(/@#/g, String.fromCharCode(13))
171+
.replace(/@\*/g, ">")
172+
.replace(/@!/g, "<")
173+
.replace(/@\$/g, "@");
174+
175+
for (let i = 0; i < data.length; i++) {
176+
let byte = data.charCodeAt(i);
177+
let char = data.charAt(i);
178+
if (byte < 128) {
179+
index++;
180+
}
181+
182+
if ((byte === 9 || byte > 31 && byte < 128) &&
183+
byte !== 60 &&
184+
byte !== 62 &&
185+
byte !== 64) {
186+
char = MS.D_DECODE[byte].charAt(MS.D_COMBINATION[index % 64]);
187+
}
188+
result.push(char);
189+
}
190+
return result.join("");
191+
},
192+
193+
194+
/**
195+
* Microsoft Script Decoder operation.
196+
*
197+
* @param {string} input
198+
* @param {Object[]} args
199+
* @returns {string}
200+
*/
201+
runDecodeScript: function (input, args) {
202+
let matcher = /#@~\^.{6}==(.+).{6}==\^#~@/;
203+
let encodedData = matcher.exec(input);
204+
if (encodedData){
205+
return MS._decode(encodedData[1]);
206+
} else {
207+
return "";
208+
}
209+
}
210+
211+
};
212+
213+
export default MS;

‎test/index.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,11 @@ import "./tests/operations/DateTime.js";
2222
import "./tests/operations/FlowControl.js";
2323
import "./tests/operations/Image.js";
2424
import "./tests/operations/MorseCode.js";
25+
import "./tests/operations/MS.js";
2526
import "./tests/operations/StrUtils.js";
2627
import "./tests/operations/SeqUtils.js";
2728

29+
2830
let allTestsPassing = true;
2931
const testStatusCounts = {
3032
total: 0,

‎test/tests/operations/MS.js

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* MS tests.
3+
*
4+
* @author bwhitn [[email protected]]
5+
* @copyright Crown Copyright 2017
6+
* @license Apache-2.0
7+
*/
8+
import TestRegister from "../../TestRegister.js";
9+
10+
TestRegister.addTests([
11+
{
12+
name: "Microsoft Script Decoder",
13+
input: "#@~^RQAAAA==-mD~sX|:/TP{~J:+dYbxL~@!F@*@!+@*@!&@*eEI@#@&@#@&\x7fjm.raY 214Wv:zms/obI0xEAAA==^#~@",
14+
expectedOutput: "var my_msg = \"Testing <1><2><3>!\";\r\n\r\nWScript.Echo(my_msg);",
15+
recipeConfig: [
16+
{
17+
"op": "Microsoft Script Decoder",
18+
"args": []
19+
},
20+
],
21+
},
22+
]);

0 commit comments

Comments
 (0)