Skip to content

Instantly share code, notes, and snippets.

@tomekziel
Last active June 13, 2021 12:22
Show Gist options
  • Save tomekziel/eaaabd55f2d244adf5fcf7db4db0387f to your computer and use it in GitHub Desktop.
Save tomekziel/eaaabd55f2d244adf5fcf7db4db0387f to your computer and use it in GitHub Desktop.
CHEF FORMAT
[
{ "op": "Comment",
"args": ["CYBERCHEF BASE-45 DECODER\n\nTomasz Zielinski (tomasz.zielinski@gmail.com)\npublic domain\n"] },
{ "op": "Conditional Jump",
"args": ["^(...)+$", false, "multiply3", 10] },
{ "op": "Comment",
"args": ["Flow for case with number of input characters that not divide by 3"] },
{ "op": "Comment",
"args": ["\nSTEP 1\nReplace BASE-45 alphabet with numeric values\nhttps://datatracker.ietf.org/doc/html/draft-faltstrom-base45-04"] },
{ "op": "Substitute",
"args": ["0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+\\-./:", "\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f\\x20\\x21\\x22\\x23\\x24\\x25\\x26\\x27\\x28\\x29\\x2a\\x2b\\x2c"] },
{ "op": "Comment",
"args": ["STEP 2\nIf the length of vector is not divisible by 3, add 0 as last value"] },
{ "op": "To Decimal",
"args": ["Space", false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "((\\d+ \\d+ \\d+[ ]*)+)(\\d+ \\d+[ ]*)*" }, "$1/$3_", false, false, false, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "((\\d)+[ ]*)_$" }, "$1 0", true, false, true, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "[ _]*$|/" }, "", true, false, true, false] },
{ "op": "Comment",
"args": ["Take three-number sequences and prepare multiplication by 1, 45, and 2025"] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "(\\d+) (\\d+) (\\d+){0,1}" }, "$1\\n$2 45\\n$3 2025\\n", true, false, true, false] },
{ "op": "Fork",
"args": ["\\n", "\\n", false] },
{ "op": "Multiply",
"args": ["Space"] },
{ "op": "Merge",
"args": [] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "NaN" }, "", true, false, true, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "\\n" }, " ", true, false, true, false] },
{ "op": "Comment",
"args": ["Sum sequences of three numbers"] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "(\\d+) (\\d+) (\\d+)" }, "$1 $2 $3\\n", true, false, true, false] },
{ "op": "Fork",
"args": ["\\n", "\\n", false] },
{ "op": "Sum",
"args": ["Space"] },
{ "op": "Merge",
"args": [] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "NaN" }, "", true, false, true, false] },
{ "op": "Fork",
"args": ["\\n", "\\n", false] },
{ "op": "To Base",
"args": [16] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "NaN" }, "", true, false, true, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "^(\\w\\w\\w)$" }, "0$1", true, false, true, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "^(\\w\\w)$" }, "00$1", true, false, false, false] },
{ "op": "Comment",
"args": ["Split a number to two bytes (effectively DIV256 and MOD256)"] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "(\\w\\w)(\\w\\w)" }, "$1\\n$2", true, false, true, false] },
{ "op": "Merge",
"args": [] },
{ "op": "Comment",
"args": ["Change hex to chars"] },
{ "op": "Fork",
"args": ["\\n", "", false] },
{ "op": "Merge",
"args": [] },
{ "op": "Comment",
"args": ["Special case, last byte is malformed as two bytes, remove unnecessary 0"] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "00(\\w\\w)$" }, "$1", true, false, true, false] },
{ "op": "From Hex",
"args": ["Line feed"] },
{ "op": "Jump",
"args": ["end", 10] },
{ "op": "Label",
"args": ["multiply3"] },
{ "op": "Comment",
"args": ["Flow for case with number of input characters that divide by 3"] },
{ "op": "Substitute",
"args": ["0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+\\-./:", "\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f\\x20\\x21\\x22\\x23\\x24\\x25\\x26\\x27\\x28\\x29\\x2a\\x2b\\x2c"] },
{ "op": "To Decimal",
"args": ["Space", false] },
{ "op": "Comment",
"args": ["Take three-number sequences and prepare multiplication by 1, 45, and 2025"] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "(\\d+) (\\d+) (\\d+){0,1}" }, "$1\\n$2 45\\n$3 2025\\n", true, false, true, false] },
{ "op": "Fork",
"args": ["\\n", "\\n", false] },
{ "op": "Multiply",
"args": ["Space"] },
{ "op": "Merge",
"args": [] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "NaN" }, "", true, false, true, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "\\n" }, " ", true, false, true, false] },
{ "op": "Comment",
"args": ["Sum sequences of three numbers"] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "(\\d+) (\\d+) (\\d+)" }, "$1 $2 $3\\n", true, false, true, false] },
{ "op": "Fork",
"args": ["\\n", "\\n", false] },
{ "op": "Sum",
"args": ["Space"] },
{ "op": "Merge",
"args": [] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "NaN" }, "", true, false, true, false] },
{ "op": "Fork",
"args": ["\\n", "\\n", false] },
{ "op": "To Base",
"args": [16] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "NaN" }, "", true, false, true, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "^(\\w\\w\\w)$" }, "0$1", true, false, true, false] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "^(\\w\\w)$" }, "00$1", true, false, false, false] },
{ "op": "Comment",
"args": ["Split a number to two bytes (effectively DIV256 and MOD256)"] },
{ "op": "Find / Replace",
"args": [{ "option": "Regex", "string": "(\\w\\w)(\\w\\w)" }, "$1\\n$2", true, false, true, false] },
{ "op": "Comment",
"args": ["Change hex to chars"] },
{ "op": "From Hex",
"args": ["Line feed"] },
{ "op": "Merge",
"args": [] },
{ "op": "Fork",
"args": ["\\n", "", false] },
{ "op": "Merge",
"args": [] },
{ "op": "Label",
"args": ["end"] }
]
Compact JSON format:
[{"op":"Comment","args":["CYBERCHEF BASE-45 DECODER\n\nTomasz Zielinski (tomasz.zielinski@gmail.com)\npublic domain\n"]},{"op":"Conditional Jump","args":["^(...)+$",false,"multiply3",10]},{"op":"Comment","args":["Flow for case with number of input characters that not divide by 3"]},{"op":"Comment","args":["\nSTEP 1\nReplace BASE-45 alphabet with numeric values\nhttps://datatracker.ietf.org/doc/html/draft-faltstrom-base45-04"]},{"op":"Substitute","args":["0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+\\-./:","\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f\\x20\\x21\\x22\\x23\\x24\\x25\\x26\\x27\\x28\\x29\\x2a\\x2b\\x2c"]},{"op":"Comment","args":["STEP 2\nIf the length of vector is not divisible by 3, add 0 as last value"]},{"op":"To Decimal","args":["Space",false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"((\\d+ \\d+ \\d+[ ]*)+)(\\d+ \\d+[ ]*)*"},"$1/$3_",false,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"((\\d)+[ ]*)_$"},"$1 0",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"[ _]*$|/"},"",true,false,true,false]},{"op":"Comment","args":["Take three-number sequences and prepare multiplication by 1, 45, and 2025"]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\d+) (\\d+) (\\d+){0,1}"},"$1\\n$2 45\\n$3 2025\\n",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Multiply","args":["Space"]},{"op":"Merge","args":[]},{"op":"Find / Replace","args":[{"option":"Regex","string":"NaN"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"\\n"}," ",true,false,true,false]},{"op":"Comment","args":["Sum sequences of three numbers"]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\d+) (\\d+) (\\d+)"},"$1 $2 $3\\n",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Sum","args":["Space"]},{"op":"Merge","args":[]},{"op":"Find / Replace","args":[{"option":"Regex","string":"NaN"},"",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"To Base","args":[16]},{"op":"Find / Replace","args":[{"option":"Regex","string":"NaN"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(\\w\\w\\w)$"},"0$1",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(\\w\\w)$"},"00$1",true,false,false,false]},{"op":"Comment","args":["Split a number to two bytes (effectively DIV256 and MOD256)"]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\w\\w)(\\w\\w)"},"$1\\n$2",true,false,true,false]},{"op":"Merge","args":[]},{"op":"Comment","args":["Change hex to chars"]},{"op":"Fork","args":["\\n","",false]},{"op":"Merge","args":[]},{"op":"Comment","args":["Special case, last byte is malformed as two bytes, remove unnecessary 0"]},{"op":"Find / Replace","args":[{"option":"Regex","string":"00(\\w\\w)$"},"$1",true,false,true,false]},{"op":"From Hex","args":["Line feed"]},{"op":"Jump","args":["end",10]},{"op":"Label","args":["multiply3"]},{"op":"Comment","args":["Flow for case with number of input characters that divide by 3"]},{"op":"Substitute","args":["0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+\\-./:","\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f\\x20\\x21\\x22\\x23\\x24\\x25\\x26\\x27\\x28\\x29\\x2a\\x2b\\x2c"]},{"op":"To Decimal","args":["Space",false]},{"op":"Comment","args":["Take three-number sequences and prepare multiplication by 1, 45, and 2025"]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\d+) (\\d+) (\\d+){0,1}"},"$1\\n$2 45\\n$3 2025\\n",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Multiply","args":["Space"]},{"op":"Merge","args":[]},{"op":"Find / Replace","args":[{"option":"Regex","string":"NaN"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"\\n"}," ",true,false,true,false]},{"op":"Comment","args":["Sum sequences of three numbers"]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\d+) (\\d+) (\\d+)"},"$1 $2 $3\\n",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Sum","args":["Space"]},{"op":"Merge","args":[]},{"op":"Find / Replace","args":[{"option":"Regex","string":"NaN"},"",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"To Base","args":[16]},{"op":"Find / Replace","args":[{"option":"Regex","string":"NaN"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(\\w\\w\\w)$"},"0$1",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(\\w\\w)$"},"00$1",true,false,false,false]},{"op":"Comment","args":["Split a number to two bytes (effectively DIV256 and MOD256)"]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\w\\w)(\\w\\w)"},"$1\\n$2",true,false,true,false]},{"op":"Comment","args":["Change hex to chars"]},{"op":"From Hex","args":["Line feed"]},{"op":"Merge","args":[]},{"op":"Fork","args":["\\n","",false]},{"op":"Merge","args":[]},{"op":"Label","args":["end"]}]
@tomekziel
Copy link
Author

tomekziel commented Jun 13, 2021

https://gchq.github.io/CyberChef/#recipe=Comment('CYBERCHEF%20BASE-45%20DECODER%5Cn%5CnTomasz%20Zielinski%20(tomasz.zielinski@gmail.com)%5Cnpublic%20domain%5Cn')Conditional_Jump('%5E(...)%2B$',false,'multiply3',10)Comment('Flow%20for%20case%20with%20number%20of%20input%20characters%20that%20not%20divide%20by%203')Comment('%5CnSTEP%201%5CnReplace%20BASE-45%20alphabet%20with%20numeric%20values%5Cnhttps://datatracker.ietf.org/doc/html/draft-faltstrom-base45-04')Substitute('0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ%20$%25*%2B%5C%5C-./:','%5C%5Cx00%5C%5Cx01%5C%5Cx02%5C%5Cx03%5C%5Cx04%5C%5Cx05%5C%5Cx06%5C%5Cx07%5C%5Cx08%5C%5Cx09%5C%5Cx0a%5C%5Cx0b%5C%5Cx0c%5C%5Cx0d%5C%5Cx0e%5C%5Cx0f%5C%5Cx10%5C%5Cx11%5C%5Cx12%5C%5Cx13%5C%5Cx14%5C%5Cx15%5C%5Cx16%5C%5Cx17%5C%5Cx18%5C%5Cx19%5C%5Cx1a%5C%5Cx1b%5C%5Cx1c%5C%5Cx1d%5C%5Cx1e%5C%5Cx1f%5C%5Cx20%5C%5Cx21%5C%5Cx22%5C%5Cx23%5C%5Cx24%5C%5Cx25%5C%5Cx26%5C%5Cx27%5C%5Cx28%5C%5Cx29%5C%5Cx2a%5C%5Cx2b%5C%5Cx2c')Comment('STEP%202%5CnIf%20the%20length%20of%20vector%20is%20not%20divisible%20by%203,%20add%200%20as%20last%20value')To_Decimal('Space',false)Find_/_Replace(%7B'option':'Regex','string':'((%5C%5Cd%2B%20%5C%5Cd%2B%20%5C%5Cd%2B%5B%20%5D*)%2B)(%5C%5Cd%2B%20%5C%5Cd%2B%5B%20%5D*)*'%7D,'$1/$3_',false,false,false,false)Find_/_Replace(%7B'option':'Regex','string':'((%5C%5Cd)%2B%5B%20%5D*)_$'%7D,'$1%200',true,false,true,false)Find_/_Replace(%7B'option':'Regex','string':'%5B%20_%5D*$%7C/'%7D,'',true,false,true,false)Comment('Take%20three-number%20sequences%20and%20prepare%20multiplication%20by%201,%2045,%20and%202025')Find_/_Replace(%7B'option':'Regex','string':'(%5C%5Cd%2B)%20(%5C%5Cd%2B)%20(%5C%5Cd%2B)%7B0,1%7D'%7D,'$1%5C%5Cn$2%2045%5C%5Cn$3%202025%5C%5Cn',true,false,true,false)Fork('%5C%5Cn','%5C%5Cn',false)Multiply('Space')Merge()Find_/_Replace(%7B'option':'Regex','string':'NaN'%7D,'',true,false,true,false)Find_/_Replace(%7B'option':'Regex','string':'%5C%5Cn'%7D,'%20',true,false,true,false)Comment('Sum%20sequences%20of%20three%20numbers')Find_/_Replace(%7B'option':'Regex','string':'(%5C%5Cd%2B)%20(%5C%5Cd%2B)%20(%5C%5Cd%2B)'%7D,'$1%20$2%20$3%5C%5Cn',true,false,true,false)Fork('%5C%5Cn','%5C%5Cn',false)Sum('Space')Merge()Find_/_Replace(%7B'option':'Regex','string':'NaN'%7D,'',true,false,true,false)Fork('%5C%5Cn','%5C%5Cn',false)To_Base(16)Find_/_Replace(%7B'option':'Regex','string':'NaN'%7D,'',true,false,true,false)Find_/_Replace(%7B'option':'Regex','string':'%5E(%5C%5Cw%5C%5Cw%5C%5Cw)$'%7D,'0$1',true,false,true,false)Find_/_Replace(%7B'option':'Regex','string':'%5E(%5C%5Cw%5C%5Cw)$'%7D,'00$1',true,false,false,false)Comment('Split%20a%20number%20to%20two%20bytes%20(effectively%20DIV256%20and%20MOD256)')Find_/_Replace(%7B'option':'Regex','string':'(%5C%5Cw%5C%5Cw)(%5C%5Cw%5C%5Cw)'%7D,'$1%5C%5Cn$2',true,false,true,false)Merge()Comment('Change%20hex%20to%20chars')Fork('%5C%5Cn','',false)Merge()Comment('Special%20case,%20last%20byte%20is%20malformed%20as%20two%20bytes,%20remove%20unnecessary%200')Find_/_Replace(%7B'option':'Regex','string':'00(%5C%5Cw%5C%5Cw)$'%7D,'$1',true,false,true,false)From_Hex('Line%20feed')Jump('end',10)Label('multiply3')Comment('Flow%20for%20case%20with%20number%20of%20input%20characters%20that%20divide%20by%203')Substitute('0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ%20$%25*%2B%5C%5C-./:','%5C%5Cx00%5C%5Cx01%5C%5Cx02%5C%5Cx03%5C%5Cx04%5C%5Cx05%5C%5Cx06%5C%5Cx07%5C%5Cx08%5C%5Cx09%5C%5Cx0a%5C%5Cx0b%5C%5Cx0c%5C%5Cx0d%5C%5Cx0e%5C%5Cx0f%5C%5Cx10%5C%5Cx11%5C%5Cx12%5C%5Cx13%5C%5Cx14%5C%5Cx15%5C%5Cx16%5C%5Cx17%5C%5Cx18%5C%5Cx19%5C%5Cx1a%5C%5Cx1b%5C%5Cx1c%5C%5Cx1d%5C%5Cx1e%5C%5Cx1f%5C%5Cx20%5C%5Cx21%5C%5Cx22%5C%5Cx23%5C%5Cx24%5C%5Cx25%5C%5Cx26%5C%5Cx27%5C%5Cx28%5C%5Cx29%5C%5Cx2a%5C%5Cx2b%5C%5Cx2c')To_Decimal('Space',false)Comment('Take%20three-number%20sequences%20and%20prepare%20multiplication%20by%201,%2045,%20and%202025')Find_/_Replace(%7B'option':'Regex','string':'(%5C%5Cd%2B)%20(%5C%5Cd%2B)%20(%5C%5Cd%2B)%7B0,1%7D'%7D,'$1%5C%5Cn$2%2045%5C%5Cn$3%202025%5C%5Cn',true,false,true,false)Fork('%5C%5Cn','%5C%5Cn',false)Multiply('Space')Merge()Find_/_Replace(%7B'option':'Regex','string':'NaN'%7D,'',true,false,true,false)Find_/_Replace(%7B'option':'Regex','string':'%5C%5Cn'%7D,'%20',true,false,true,false)Comment('Sum%20sequences%20of%20three%20numbers')Find_/_Replace(%7B'option':'Regex','string':'(%5C%5Cd%2B)%20(%5C%5Cd%2B)%20(%5C%5Cd%2B)'%7D,'$1%20$2%20$3%5C%5Cn',true,false,true,false)Fork('%5C%5Cn','%5C%5Cn',false)Sum('Space')Merge()Find_/_Replace(%7B'option':'Regex','string':'NaN'%7D,'',true,false,true,false)Fork('%5C%5Cn','%5C%5Cn',false)To_Base(16)Find_/_Replace(%7B'option':'Regex','string':'NaN'%7D,'',true,false,true,false)Find_/_Replace(%7B'option':'Regex','string':'%5E(%5C%5Cw%5C%5Cw%5C%5Cw)$'%7D,'0$1',true,false,true,false)Find_/_Replace(%7B'option':'Regex','string':'%5E(%5C%5Cw%5C%5Cw)$'%7D,'00$1',true,false,false,false)Comment('Split%20a%20number%20to%20two%20bytes%20(effectively%20DIV256%20and%20MOD256)')Find_/_Replace(%7B'option':'Regex','string':'(%5C%5Cw%5C%5Cw)(%5C%5Cw%5C%5Cw)'%7D,'$1%5C%5Cn$2',true,false,true,false)Comment('Change%20hex%20to%20chars')From_Hex('Line%20feed')Merge()Fork('%5C%5Cn','',false)Merge()Label('end')&input=JTY5IFZEOTJFWDA

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment