Base 64 decrypt6/29/2023 ![]() I couldn't find anywhere on the internet where someone had done this before, so it took quite a bit of work to figure all this out. You should dedup your results first as this macro uses a selfjoin to attach the converted values back to the input search results. ![]() I have $arg1$ setup as my input argument. You just pass in a field with the values you want to convert. | rex field=b64x_join "(?.)" max_match=100 |mvexpand asciibin| lookup base64conversion.csv index as asciibin output value as ascii | stats list(ascii) as ascii by $arg1$| nomv ascii |rex field=ascii mode=sed "s/\ //g"| table $arg1$ ascii] | selfjoin $arg1$| sort - $arg1$ ascii | filldown ascii Specify a delimiter to separate hex digits. Limit the output length if you need to extract a certain number of bytes. Select the desired letter case for the hex value. | lookup converstionmatrix.csv base64char as b64x_split OUTPUT base64bin as b64x_bin Hex The result of Base64 decoding will appear here How to convert Base64 to Hex Type or paste your Base64 value into the Base64 field. It is way more useful than just for this example _* Note a duplicate base64bin for 000000 = "=" is added for decoding Create Macro to Decode base64dec(1): arg1 will be your arguments eval b64x_split=split($arg1$,"") ![]() | eval base64bin=if(isnotnull(base64char),substr(bin,3,6),NULL())Ĭoded the above table. | eval base64="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /" ![]() Running with this concept to decode base64 without an appĬreate lookup used as a converstion matrix with fields: ascii base64bin base64char bin dec hex | makeresults ![]()
0 Comments
Leave a Reply. |