gchq / gchq/CyberChef

Feature Request: Add Thrift Serialization / Deserialization operations

Open
#2,374 1 comment 0 reactions 0 assignees View on GitHub
feature help wanted
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Is your feature request related to a problem? Please describe.**

> I'm always frustrated when I need to analyze or debug Thrift-encoded binary payloads (e.g., captured from network traffic or RPC calls). Currently, there is no built-in way in CyberChef to decode or encode Apache Thrift serialized data, which forces me to write custom scripts or use external tools just to inspect the content.

---

**Describe the solution you'd like**

> Add two new operations to CyberChef:
>
> - **Thrift Deserialize** – Takes a Thrift binary blob (TBinaryProtocol or TCompactProtocol) as input and outputs a human-readable JSON representation of the decoded fields (field ID, type, value).
> - **Thrift Serialize** – Takes a JSON-structured input and encodes it into Thrift binary format.
>
> Ideally, the operation should support the following protocols via a dropdown option:
>
> - `TBinaryProtocol` (standard)
> - `TCompactProtocol` (compact variable-length encoding)
> - `TJSONProtocol`
>
> Since no IDL/`.thrift` schema file is available at runtime, the deserializer should work in **schema-less mode** (similar to how Protobuf Decode works in CyberChef), inferring field types from the wire encoding.

---

**Describe alternatives you've considered**

> - **Writing a custom Python/Node.js script**: Works but is inconvenient and not portable — CyberChef's appeal is having everything in one place in the browser.
> - **Using online Thrift decoders**: Very few exist, none are as flexible or composable as CyberChef operations.
> - **Protobuf Decode (existing CyberChef op)**: Protobuf and Thrift are similar in concept, but their wire formats are incompatible. The existing Protobuf operation cannot handle Thrift data.

---

**Additional context**

> - Apache Thrift is widely used in microservices, internal RPC frameworks, and some open protocols (e.g., Cassandra, HBase, Scribe).
> - This feature would be particularly valuable for **security researchers and CTF players** analyzing binary network traffic.
> - A JavaScript/Node.js Thrift library ([`thrift`](https://www.npmjs.com/package/thrift)) is available on npm and could serve as the implementation basis.
> - Reference specs:
> - [Thrift Binary Encoding](https://github.com/apache/thrift/blob/master/doc/specs/thrift-binary-encoding.md)
> - [Thrift Compact Protocol](https://github.com/apache/thrift/blob/master/doc/specs/thrift-compact-protocol.md)
> - This would complement existing serialization ops: **Protobuf Decode**, **From MessagePack**, **From CBOR**, etc.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing CyberChef's existing Protobuf Decode, From MessagePack, and From CBOR operations, then read the linked Thrift Binary, Compact, and JSON protocol specifications. Done means adding Thrift Serialize and Thrift Deserialize operations with the requested protocol choices and a defined schema-less JSON representation for encoded fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
data, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.