CyberChef icon indicating copy to clipboard operation
CyberChef copied to clipboard

Cannot decode a CBOR string

Open jumpjack opened this issue 2 years ago • 4 comments

This string:

¢H90hÍÚ&

equivalent to

a2 04 48 39 30 17 68 cd da 05 13 01 26

Should decode to

A2                     # map(2)
   04                  # unsigned(4)
   48                  # bytes(8)
      39301768CDDA0513 # string
   01                  # unsigned(1)
   26                  # negative(6)

according to http://cbor.me/ , but it decodes to {}, i.e. nothing.

jumpjack avatar Nov 03 '21 15:11 jumpjack

Here is more interesting fact:

Encoding the decoding result (that seems empty) yields some meaningful data (with the order swapped):

From Hex, CBOR Decode, CBOR Encode, To Hex - CyberChef

Result:

a2 01 26 04 48 39 30 17 68 cd da 05 13

While encoding simple empty ({}) yields an empty result:

CBOR Encode, To Hex - CyberChef

Result:

a0

Therefore, this looks like an issue in not decoding but displaying of the decoded result.

My guess is this issue is related to the fact that only strings (no numbers) are allowed as the keys in JSON objects.

An example of input using only string key (the decoding result is successfully shown):

A1       # map(1)
   61    # text(1)
      31 # "1"
   02    # unsigned(2)

Find / Replace, From Hex, CBOR Decode - CyberChef

Result:

{
    "1": 2
}

An example of input using an integer key (the decoding result is shown as empty):

A2       # map(2)
   61    # text(1)
      31 # "1"
   02    # unsigned(2)
   03    # unsigned(3)
   04    # unsigned(4)

Find / Replace, From Hex, CBOR Decode - CyberChef

Result:

{}

mikecat avatar Nov 04 '21 10:11 mikecat

Highlighted whats goes wrong:

source: a2 04 48 39 30 17 68 cd da 05 13 01 26
decode: ¢H90hÍÚ&
encode: ¢&H90hÍÚ
tohex: a2 01 26 04 48 39 30 17 68 cd da 05 13

"01 26" is moved from end to beginning:


source:  a2       04 48 39 30 17 68 cd da 05 13 01 26
tohex:   a2 01 26 04 48 39 30 17 68 cd da 05 13

jumpjack avatar Nov 04 '21 12:11 jumpjack

If I remember correctly, 0x26 character causes stop in printing of a text string.

jumpjack avatar Nov 04 '21 12:11 jumpjack

Fmmm, 0x26 doesn't seem causing stop.

Example Input:

A3       # map(3)
   61    # text(1)
      26 # "&"
   03    # unsigned(3)
   61    # text(1)
      41 # "A"
   26    # negative(6)
   61    # text(1)
      42 # "B"
   07    # unsigned(7)

Example Output (decode):

{
    "&": 3,
    "A": -7,
    "B": 7
}

Find / Replace, From Hex, CBOR Decode - CyberChef

Example Output (re-encoded):

a3 61 26 03 61 41 26 61 42 07

Find / Replace, 4 more - CyberChef

mikecat avatar Nov 07 '21 22:11 mikecat

This is related to a known issue that JSON cannot have numeric key in an object

And CyberChef expect the CBOR decode result to be a JSON https://github.com/gchq/CyberChef/blob/a3b873fd96111fe2dbcb62a1e037987669290a13/src/core/operations/CBORDecode.mjs#L26

https://github.com/hildjj/node-cbor/issues/42#issuecomment-264544977

richardfan1126 avatar Oct 17 '22 07:10 richardfan1126