Magic

Category: Analysis

Status: Registered and callable in the CyberChef 11.3.0 compatibility inventory.

Input / output: ArrayBuffer → JSON

Background: https://github.com/gchq/CyberChef/wiki/Automatic-detection-of-encoded-data-using-CyberChef-Magic

What it does

The Magic operation attempts to detect various properties of the input data and suggests which operations could help to make more sense of it. Options Depth: If an operation appears to match the data, it will be run and the result will be analysed further. This argument controls the maximum number of levels of recursion. Intensive mode: When this is turned on, various operations like XOR, bit rotates, and character encodings are brute-forced to attempt to detect valid data underneath. To improve performance, only the first 100 bytes of the data is brute-forced. Extensive language support: At each stage, the relative byte frequencies of the data will be compared to average frequencies for a number of languages. The default set consists of ~40 of the most commonly used languages on the Internet. The extensive list consists of 284 languages and can result in many languages matching the data if their byte frequencies are similar. Optionally enter a regular expression to match a string you expect to find to filter results (crib).

Note

Status here means the operation name is implemented and callable. It does not by itself promise byte-for-byte parity for every upstream option. See Compatibility and current status for the verified scope and known boundaries.

Arguments and options

Arguments are positional. Keep their order when using bake() or Pipeline.then().

Index	Name	UI type	PyChef default	Accepted values / format
`0`	Depth	`number`	`3`	A Python integer or floating-point value
`1`	Intensive mode	`boolean`	`False`	`True` or `False`
`2`	Extensive language support	`boolean`	`False`	`True` or `False`
`3`	Crib (known plaintext string or regex)	`string`	`''`	`''`

Recipe template

Important

This is a call template built from the documented defaults. Replace placeholder values such as empty keys, paths, patterns, or lookup data before running it.

from pychef import bake

input_value = b"example"
args = [3, False, False, '']
result = bake(input_value, [{"op": 'Magic', "args": args}])
print(result)

Pipeline example

from pychef import Pipeline

args = [3, False, False, '']
transform = Pipeline().then('Magic', *args)
result = transform(b"example")

Dedicated operation module

The registered entry point lives in pychef.operations.by_operation.magic. Direct calls receive the input value and a positional argument tuple:

from pychef.operations.by_operation.magic import run

result = run(b"example", tuple([3, False, False, '']))

pychef.operations.by_operation.magic.run(value, args)

Run this operation using its shared internal implementation.

Parameters:

value (str | bytes)
args (Sequence[Any])

Return type:

str | bytes