Since URL encoding replaces ASCII characters with a '%' followed by two hexadecimal digits we can leverage this logic to decode hexadecimal into ASCII.
To do this you need to parse out each set of hexadecimal digits and place a '%' character in front of them.
Using 'parse regex' with a nodrop option allows you to parse out each set of hexadecimal digits while accounting for short and longer hexadecimals.
Here is an example parsing up to eight sets from a field called 'hex' which would have the whole hexadecimal value, you can add more if needed.
| parse regex field=hex "(?<one>[\d|A-Z]{2})" nodrop
| parse regex field=hex "[\d|A-Z]{2}(?<two>[\d|A-Z]{2})" nodrop
| parse regex field=hex "[\d|A-Z]{4}(?<three>[\d|A-Z]{2})" nodrop
| parse regex field=hex "[\d|A-Z]{6}(?<four>[\d|A-Z]{2})" nodrop
| parse regex field=hex "[\d|A-Z]{8}(?<five>[\d|A-Z]{2})" nodrop
| parse regex field=hex "[\d|A-Z]{10}(?<six>[\d|A-Z]{2})" nodrop
| parse regex field=hex "[\d|A-Z]{12}(?<seven>[\d|A-Z]{2})" nodrop
| parse regex field=hex "[\d|A-Z]{14}(?<eight>[\d|A-Z]{2})" nodrop
Then with these parsed you can use the 'concat' operator to place the '%' characters in front of each set.
| concat("%",one,"%",two,"%",three,"%",four,"%",five,"%",six,"%",seven,"%",eight) as encoded_hex
Now that the hexadecimal digits are URL encoded you can use the 'urldecode' operator to convert it to ASCII.
| urldecode(encoded_hex) as ASCII
Now your ASCII string can be viewed in the field 'ASCII'.
Comments
0 comments
Article is closed for comments.