Potential Bug Report/Feature Request: Subsection and Merge
n1073645 opened this issue · comments
There is an interesting piece of work in relation to the subsection and similar operations (Fork and Merge).
If I call two subsections and then a merge it will totally reset and operate on the whole input again.
I expected that it would only reset the previous layer so I would be operating on the first subsection again.
What it does currently:
If I have an input "testTESTtestTEST" and a subsection for "TEST", with a following subsection for "ES" then when I merge it will revert back to the entire input again.
Potential work:
In the above example, the merge would only revert to the previous subsection layer of "TEST".
Example:
Lets say we have binary data, something like the following:
qufnfqieunviweubhvn48656cNmM2ZjU3NmY=726c64ioejubfinjijshhbvdvaksjj
As we can see, there is a hex string with a base64 string inside of it surrounded by random data.
If we call a subsection on that with a regex for <hex><base64><hex>
Then a subsection on that for <base64>
From Base64 produces "6c6f576f"
The binary data is now qufnfqieunviweubhvn48656c6c6f576f726c64ioejubfinjijshhbvdvaksjj
This is where the potential merge/merge-like operation would occur to rewind to the previous subsection.
Then From Hex to produce qufnfqieunviweubhvnHelloWorldioejubfinjijshhbvdvaksjj
This might be infeasible currently due to how CyberChef is tracking the sizes of the match groups which then change (in the From Base64). It is also worth noting that the hex string after the From Base64 now does not match the regex in the first subsection which makes this piece of work more challenging.
In the example I have chosen, it is possible to Merge and then write a subsection to operate on the hex but in other examples that may not be desired.
So, after looking at it for a bit, the input/outputs are encapsulated inside the dish(s) hence the input changing size etc doesn't make a difference. The interesting piece of work is still there for the Merge operation to potentially match against a respective subsection/fork