CyberChef icon indicating copy to clipboard operation
CyberChef copied to clipboard

Fix: Correctly parse xxd odd byte hexdumps

Open ThomasNotTom opened this issue 10 months ago • 2 comments

Description

xxd produces hex bytes in pairs. However when an odd number of bytes are present, the final byte is not parsed and is therefore not included in the output.

This fixes issue #2033

Fix

The fix involves altering the RegEx to, in the final segment of bytes, include either 2 or 4 character segments (IE 1 or 2 bytes).

ThomasNotTom avatar Jun 05 '25 23:06 ThomasNotTom

Seems to work for xxd hexdumps but no longer toHexdump dumps, will look into now

ThomasNotTom avatar Jun 05 '25 23:06 ThomasNotTom

The inner of the 3 byte segment RegEx checks (which matches 2 byte segments IE 6162 6364), was adjusted to match 2 byte segments ending in a single byte (IE 6162 63). However due to the structure of the RegEx the first two bytes could be matched 0 or more times. This meant that single byte segments (IE 61) were being matched and returned early (as the adjusted version only matched a single byte, only appearing once).

The fix was to adjust the 2 byte segments to match 1 or more times (not 0 or more) and then have an optional match at the end for a single byte. For RegExs that fail the '2 byte segments appearing 1 or more times' will be handled by the other 2 cases in the RegEx that handle single bytes, spaced apart (IE 61 62 63).

With these adjustments the RegEx handles 2 byte segments ending with a single byte, without interfering with the other cases.

ThomasNotTom avatar Jun 06 '25 00:06 ThomasNotTom