Skip to content

Commit 74bcdf6

Browse files
authored
Merge pull request #25 from malvidin/dev_compress
Add ZLIB Compression
2 parents 7001c00 + 95d5fb0 commit 74bcdf6

File tree

3 files changed

+187
-83
lines changed

3 files changed

+187
-83
lines changed

README.md

Lines changed: 88 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
1+
```
22
.___ __
33
__| _/____ ___________ ___.__._______/ |_
44
/ __ |/ __ \_/ ___\_ __ < | |\____ \ __\
@@ -8,7 +8,7 @@
88
99
Original author: Michael Zalewski <[email protected]>
1010
New maintainer: Gareth Anderson
11-
11+
```
1212

1313
DECRYPT is a set of Splunk commands which provide encryption and
1414
decryption routines commonly used in malware communication and data
@@ -51,102 +51,120 @@ The above example can be explained as:
5151
- Pass the output of `hex` to `emit` with the argument `'decrypted'`, creating a `decrypted` field
5252

5353
## Functions
54-
`btoa()`
55-
Encodes input to a Base64 string.
54+
### `btoa()`
55+
- Encodes input to a Base64 string.
5656

5757
`b64(), atob()`
58-
Decodes a Base64 encoded string.
58+
- Decodes a Base64 encoded string.
5959

6060
`b32()`
61-
Decodes a Base32 encoded string.
61+
- Decodes a Base32 encoded string.
6262

6363
`b58()`
64-
Decodes a Base58 encoded string.
64+
- Decodes a Base58 encoded string.
6565

6666
`rotx(count)`
67-
Implements Caesarian shift. The count argument specifies the amount to shift and must be an integer.
67+
- Implements Caesarian shift. The count argument specifies the amount to shift and must be an integer.
6868

6969
`rol(count)`
70-
Implements rotate-on-left to each character within the string using an 8 bit boundary. The count argument specifies the amount to rotate and must be an integer.
70+
- Implements rotate-on-left to each character within the string using an 8 bit boundary. The count argument specifies the amount to rotate and must be an integer.
7171

7272
`ror(count)`
73-
Implements rotate-on-right to each character within the string using an 8 bit boundary. The count argument specifies the amount to rotate and must be an integer.
73+
- Implements rotate-on-right to each character within the string using an 8 bit boundary.
74+
- The count argument specifies the amount to rotate and must be an integer.
7475

7576
`xor(key)`
76-
Implements basic XOR cipher against the field with the supplied key. The key can be provided as a string or integer.
77+
- Implements basic XOR cipher against the field with the supplied key.
78+
- The key can be provided as a string or integer.
7779

7880
`rc4('key')`
79-
Implements the RC4 cipher against the field with the supplied key. The key provided must be a string.
81+
- Implements the RC4 cipher against the field with the supplied key.
82+
- The key provided must be a string.
8083

8184
`hex()`
82-
Transforms input into its hexadecimal representation.
85+
- Transforms input into its hexadecimal representation.
8386

8487
`unhex()`
85-
Transforms hexadecimal input into its byte form.
88+
- Transforms hexadecimal input into its byte form.
8689

8790
`save('name')`
88-
Saves the current state to memory as name.
91+
- Saves the current state to memory as name.
8992

9093
`load('name')`
91-
Recalls the previously saved state name from memory.
94+
- Recalls the previously saved state name from memory.
9295

9396
`ascii()`
94-
Transforms input into ASCII output. Non-printable characters will be replaced with a period.
97+
- Transforms input into ASCII output. Non-printable characters will be replaced with a period.
9598

9699
`emit('name')`
97-
Outputs the current state as UTF-8 to the field name.
100+
- Outputs the current state as UTF-8 to the field name.
98101

99102
`substr(offset, count)`
100-
Returns a substring of the input, starting at the index offset with the number of characters count. Set the count to `'null'` to return from the start offset to the end of the input.
103+
- Returns a substring of the input, starting at the index offset with the number of characters count.
104+
- Set the count to `'null'` to return from the start offset to the end of the input.
101105

102106
`slice(start, end)`
103-
Returns a slice of the input, starting at start offset to the end offset. Set the end to `'null'` to go to the end of the input.
107+
- Returns a slice of the input, starting at start offset to the end offset.
108+
- Set the end to `'null'` to go to the end of the input.
104109

105110
`decode('codec')`
106-
Returns a decoded version of the input based on the codec, python codec list is available on https://docs.python.org/3/library/codecs.html#standard-encodings
111+
- Returns a decoded version of the input based on the codec.
112+
- Python codec list is available on https://docs.python.org/3/library/codecs.html#standard-encodings
107113

108114
`escape`
109-
Returns a string where control characters, \, and non-ASCII characters are backslash escaped (e.g. `\x0a`, `\\`, `\x80`).
115+
- Returns a string where control characters, \, and non-ASCII characters are backslash escaped (e.g. `\x0a`, `\\`, `\x80`).
110116

111117
`unescape`
112-
Returns a string run through python unicode_escape (i.e. return the unicode point(s)). Reverses `escape`. Also unescapes Unicode codepoints (`\uxxxx` or `\Uxxxxxxxx`), which `escape` does not produce.
118+
- Returns a string run through python unicode_escape (i.e. return the unicode point(s)). Reverses `escape`.
119+
- Also unescapes Unicode codepoints (`\uxxxx` or `\Uxxxxxxxx`), which `escape` does not produce.
113120

114121
`htmlescape`
115-
Returns a string with `&`, `<`, and `>` XML escaped like `&amp;`.
122+
- Returns a string with `&`, `<`, and `>` XML escaped like `&amp;`.
116123

117124
`htmlunescape`
118-
Returns a string with HTML references like `&gt;` and `&#62;` unescaped to `>`.
125+
- Returns a string with HTML references like `&gt;` and `&#62;` unescaped to `>`.
119126

120127
`tr('from', 'to')`
121-
Takes an argument to translate "from" and an argument of characters to translate "to" and then returns a result with the result (similar to `tr` in Unix).
128+
- Takes an argument to translate "from" and an argument of characters to translate "to" and then returns a result with the result (similar to `tr` in Unix).
122129

123130
`rev()`
124-
Returns the input in reverse order.
131+
- Returns the input in reverse order.
125132

126133
`find('subseq', start)`
127-
Returns the index of a subsequence "subseq" starting at index "start", or `-1` if the subsequence is not found.
134+
- Returns the index of a subsequence "subseq" starting at index "start", or `-1` if the subsequence is not found.
128135

129136
`b32re()`
130-
Returns a reverse-endian base32 decoded string, as used in the SunBurst DGA.
137+
- Returns a reverse-endian base32 decoded string, as used in the SunBurst DGA.
131138

132139
`b64re()`
133-
Returns a reverse-endian base64 decoded string.
140+
- Returns a reverse-endian base64 decoded string.
134141

135142
`zlib_inflate()`
136-
Returns zlib.decompress() inflated bytes. The window size (wbits) must be provided.
143+
- Returns zlib.decompress() inflated bytes.
144+
- Default window size of -15 (raw inflate) is used if a wbits value is not provided.
145+
146+
`zlib_deflate()`
147+
- Returns zlib.compress() deflated bytes.
148+
- Default level of -1 (currently 6) and window size of -15 (raw deflate) if values are not provided.
149+
150+
`entropy()`
151+
- Returns base2 entropy of input. The maximum entropy for Unicode strings can be greater than 8.
137152

138153
_Note: you must use **single quotes** around the strings._
139154

140155
# Function Arguments
141156
## Strings
142-
Strings can be specified by encapsulating values in apostrophes (single quote). Strings accept Pythonic escape sequences, so hexadecimal and octal values can be specified with \xhh and \ooo respectively.
157+
Strings can be specified by encapsulating values in apostrophes (single quote). Strings accept Pythonic escape sequences, so hexadecimal and octal values can be specified with `\xhh` and `\ooo` respectively.
158+
Unicode values can be expressed as `\u0000` or `\U00000000`
143159

144160
`'This is a valid string'`
161+
145162
`'This is also \x61 valid string.'`
146163

147164
Quotation marks (double quotes) **cannot** be used.
148165

149166
`"This is not a valid string"`
167+
150168
## Integers
151169
Integers can be specified numerically or as hexadecimal representations by prefixing values with a 0x.
152170

@@ -161,19 +179,23 @@ The above example demonstrates passing the sourcetype field as the key to the xo
161179
Fields saved using the save command can also be referenced.
162180

163181
`... | decrypt field=_raw substr(0,1) save('1byte') substr(1, 4096) xor(1byte) ...`
182+
164183
## Style
165184
Functions which take no arguments do not need parenthesis in order for syntax checking to pass. The following examples will pass syntax checks and execute the same.
166185

167186
`... | decrypt field=_raw b64 hex unhex`
187+
168188
`... | decrypt field=_raw b64() hex() unhex()`
189+
169190
`... | decrypt field=_raw b64() hex unhex`
170191

171192
New lines can be used to break up command sequences for easier readability.
172-
173-
`... | decrypt field=_raw`
174-
` b64`
175-
` hex`
176-
` unhex`
193+
```
194+
... | decrypt field=_raw
195+
b64
196+
hex
197+
unhex
198+
```
177199
# Recipes
178200
## XOR
179201
`... | decrypt field=data xor('secret') emit('result')`
@@ -182,26 +204,32 @@ New lines can be used to break up command sequences for easier readability.
182204
## Base64 decode, XOR
183205
`... | decrypt field=data b64 xor('secret') emit('result')`
184206
## Base64 decode, XOR with first byte
185-
`... | decrypt field=data`
186-
`b64`
187-
`save('bin')`
188-
`substr(0, 1) emit('key')`
189-
`load('bin')`
190-
`substr(1, 9999) xor(key) emit('result')`
207+
```
208+
... | decrypt field=data
209+
b64
210+
save('bin')
211+
substr(0, 1) emit('key')
212+
load('bin')
213+
substr(1, 9999) xor(key) emit('result')
214+
```
191215
## Brute force RC4
192-
`... | decrypt field=data`
193-
`b64`
194-
`save('orig') rc4('secret') emit('rc4-secret')`
195-
`load('orig') rc4('password') emit('rc4-password')`
196-
`load('orig') rc4('abc123') emit('rc4-abc123')`
197-
`load('orig') rc4('aabbccdd') emit('rc4-aabbccdd')`
216+
```
217+
... | decrypt field=data
218+
b64
219+
save('orig') rc4('secret') emit('rc4-secret')
220+
load('orig') rc4('password') emit('rc4-password')
221+
load('orig') rc4('abc123') emit('rc4-abc123')
222+
load('orig') rc4('aabbccdd') emit('rc4-aabbccdd')
223+
```
198224
## Brute force XOR key
199-
`... | decrypt field=data`
200-
`b64`
201-
`save('data') xor(0x01) emit('xor0x01')`
202-
`load('data') xor(0x02) emit('xor0x02')`
203-
`load('data') xor(0x03) emit('xor0x03')`
204-
`...`
225+
```
226+
... | decrypt field=data
227+
b64
228+
save('data') xor(0x01) emit('xor0x01')
229+
load('data') xor(0x02) emit('xor0x02')
230+
load('data') xor(0x03) emit('xor0x03')
231+
...
232+
```
205233
## Reverse the data field
206234
`... | decrypt field=data rev`
207235

@@ -216,6 +244,11 @@ Shannon Davis (Splunk)
216244
Steven (malvidin on github)
217245

218246
# Release Notes
247+
## 2.4.1
248+
- Added support for null argument padding, so `find('decrypt2')` is equivalent to `find('decrypt2', 0)`
249+
- Added zlib_deflate for internal validation of zlib_inflate, which can also be used for information analysis
250+
- Add basic entropy calculation
251+
219252
## 2.4.0
220253
Merged pull request from Steven (malvidin on github)
221254

0 commit comments

Comments
 (0)