cyberchef_corpus_diff
Compare sets of encrypted samples to infer field structures from byte/bit variance, identify repeated cipher blocks, and reveal nonce reuse with XOR evidence.
Instructions
Compute statistics ACROSS a set of samples — what a recipe cannot express, since Fork runs each branch separately and nothing combines them. Infers record structure from per-offset byte AND bit variance, grouping adjacent offsets into fields; finds repeated cipher blocks (ECB and any other diffusion-free mode) and reports WHERE they sit; and finds nonce reuse, emitting the XOR of the two bodies, which is both the evidence and the way in. Assumes fixed-length or left-aligned samples.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| samples | Yes | The samples to compare. At least two; more is better for every statistic. | |
| analyses | No | Which analyses to run. All of them by default. | |
| block_size | No | Cipher block size for the ECB check. 16 for AES; 8 for DES and Blowfish. | |
| input_format | No | How the samples are encoded. | Hex |
| nonce_prefix_bytes | No | Leading bytes to treat as the nonce or IV. 12 for GCM, 16 for a CBC IV, 8 for ChaCha20. 0 disables the check. |