mirror of
https://github.com/gchq/CyberChef.git
synced 2024-11-16 08:58:30 +01:00
Added RTF extractor
This commit is contained in:
parent
0d2cb02f97
commit
19b7957523
1 changed files with 42 additions and 2 deletions
|
@ -572,7 +572,7 @@ export const FILE_SIGNATURES = {
|
||||||
3: 0x74,
|
3: 0x74,
|
||||||
4: 0x66
|
4: 0x66
|
||||||
},
|
},
|
||||||
extractor: null
|
extractor: extractRTF
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "Microsoft Office documents/OLE2",
|
name: "Microsoft Office documents/OLE2",
|
||||||
|
@ -1307,7 +1307,7 @@ export function extractFLV(bytes, offset) {
|
||||||
stream.moveForwardsBy(headerSize - 9);
|
stream.moveForwardsBy(headerSize - 9);
|
||||||
|
|
||||||
let tagSize = -11; // Fake size of previous tag header
|
let tagSize = -11; // Fake size of previous tag header
|
||||||
while (stream.position < stream.length) {
|
while (stream.hasMore()) {
|
||||||
const prevTagSize = stream.readInt(4, "be");
|
const prevTagSize = stream.readInt(4, "be");
|
||||||
const tagType = stream.readInt(1, "be");
|
const tagType = stream.readInt(1, "be");
|
||||||
|
|
||||||
|
@ -1332,3 +1332,43 @@ export function extractFLV(bytes, offset) {
|
||||||
|
|
||||||
return stream.carve();
|
return stream.carve();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* RTF extractor.
|
||||||
|
*
|
||||||
|
* @param {Uint8Array} bytes
|
||||||
|
* @param {number} offset
|
||||||
|
* @returns {Uint8Array}
|
||||||
|
*/
|
||||||
|
export function extractRTF(bytes, offset) {
|
||||||
|
const stream = new Stream(bytes.slice(offset));
|
||||||
|
|
||||||
|
let openTags = 0;
|
||||||
|
|
||||||
|
if (stream.readInt(1, "be") !== 0x7b) { // {
|
||||||
|
throw new Error("Not a valid RTF file");
|
||||||
|
} else {
|
||||||
|
openTags++;
|
||||||
|
}
|
||||||
|
|
||||||
|
while (openTags > 0 && stream.hasMore()) {
|
||||||
|
switch (stream.readInt(1, "be")) {
|
||||||
|
case 0x7b: // {
|
||||||
|
openTags++;
|
||||||
|
break;
|
||||||
|
case 0x7d: // }
|
||||||
|
openTags--;
|
||||||
|
break;
|
||||||
|
case 0x5c: // \
|
||||||
|
// Consume any more escapes and then skip over the next character
|
||||||
|
stream.consumeIf(0x5c);
|
||||||
|
stream.position++;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return stream.carve();
|
||||||
|
}
|
||||||
|
|
Loading…
Reference in a new issue