utils/log2pcaphex.c

ソースコードを見る。

データ構造
struct	tcpdump_file_header
struct	tcpdump_packet
struct	hdr_ip_t
struct	hdr_tcp_t
関数
static void	print_pcap_header (FILE *out)
static void	print_pcap_packet (FILE *out, unsigned char *data, long length, long caplen)
static void	print_hex_packet (FILE *out, unsigned char *data, long length)
static void	print_netbios_packet (FILE *out, unsigned char *data, long length, long actual_length)
static void	read_log_msg (FILE *in, unsigned char **_buffer, long *buffersize, long *data_offset, long *data_length)
static long	read_log_data (FILE *in, unsigned char *buffer, long data_length)
int	main (int argc, char **argv)
変数
int	quiet = 0
int	hexformat = 0
static hdr_ip_t	HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202}
static hdr_tcp_t	HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0}
unsigned char *	curpacket = NULL
long	curpacket_len = 0

---

関数

static void print_pcap_header

(

FILE *

out

)

[static]

log2pcaphex.c の 99 行で定義されています。

参照先 tcpdump_file_header::linktype・tcpdump_file_header::magic・tcpdump_file_header::major・tcpdump_file_header::minor・tcpdump_file_header::sigfigs・tcpdump_file_header::snaplen・tcpdump_file_header::zone.

参照元 main().

{
        struct tcpdump_file_header h;
        h.magic = TCPDUMP_MAGIC;
        h.major = 2;
        h.minor = 4;
        h.zone = 0;
        h.sigfigs = 0;
        h.snaplen = 102400; /* As long packets as possible */
        h.linktype = 101; /* Raw IP */
        fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
}

static void print_pcap_packet	(	FILE *	out,
		unsigned char *	data,
		long	length,
		long	caplen
	)			[static]

log2pcaphex.c の 112 行で定義されています。

参照先 tcpdump_packet::caplen・tcpdump_packet::len・tcpdump_packet::ts.

参照元 print_netbios_packet().

{
        static int i = 0;
        struct tcpdump_packet p;
        i++;
        p.ts.tv_usec = 0;
        p.ts.tv_sec = 0;
        p.caplen = caplen;
        p.len = length;
        fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
        fwrite(data, sizeof(unsigned char), caplen, out);
}

static void print_hex_packet	(	FILE *	out,
		unsigned char *	data,
		long	length
	)			[static]

log2pcaphex.c の 125 行で定義されています。

参照先 fprintf().

参照元 main().

{
        long i,cur = 0;
        while(cur < length) {
                fprintf(out, "%06lX ", cur);
                for(i = cur; i < length && i < cur + 16; i++) {
                        fprintf(out, "%02x ", data[i]);
                }
        
                cur = i;
                fprintf(out, "\n");
        }
}

static void print_netbios_packet	(	FILE *	out,
		unsigned char *	data,
		long	length,
		long	actual_length
	)			[static]

log2pcaphex.c の 139 行で定義されています。

参照先 HDR_IP・HDR_TCP・hdr_ip_t::packet_length・print_pcap_packet().

参照元 main().

{       
        unsigned char *newdata; long offset = 0;
        long newlen;
        
        newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
        newdata = (unsigned char *)malloc(newlen);

        HDR_IP.packet_length = htons(newlen);
        HDR_TCP.window = htons(0x2000);
        HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);

        memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
        memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
        memcpy(newdata+offset,data,length);
        
        print_pcap_packet(out, newdata, newlen, actual_length+offset);
        free(newdata);
}

static void read_log_msg	(	FILE *	in,
		unsigned char **	_buffer,
		long *	buffersize,
		long *	data_offset,
		long *	data_length
	)			[static]

log2pcaphex.c の 162 行で定義されています。

参照元 main().

{
        unsigned char *buffer;
        int tmp; long i;
        assert(fscanf(in, " size=%ld\n", buffersize));
        *buffersize+=4; /* for netbios */
        buffer = (unsigned char *)malloc(*buffersize);
        memset(buffer, 0, *buffersize);
        /* NetBIOS */
        buffer[0] = 0x00;
        buffer[1] = 0x00;
        memcpy(buffer+2, &buffersize, 2);
        buffer[4] = 0xFF;
        buffer[5] = 'S';
        buffer[6] = 'M';
        buffer[7] = 'B';
        assert(fscanf(in, "  smb_com=0x%x\n", &tmp)); buffer[smb_com] = tmp;
        assert(fscanf(in, "  smb_rcls=%d\n", &tmp)); buffer[smb_rcls] = tmp;
        assert(fscanf(in, "  smb_reh=%d\n", &tmp)); buffer[smb_reh] = tmp;
        assert(fscanf(in, "  smb_err=%d\n", &tmp)); memcpy(buffer+smb_err, &tmp, 2);
        assert(fscanf(in, "  smb_flg=%d\n", &tmp)); buffer[smb_flg] = tmp;
        assert(fscanf(in, "  smb_flg2=%d\n", &tmp)); memcpy(buffer+smb_flg2, &tmp, 2);
        assert(fscanf(in, "  smb_tid=%d\n", &tmp)); memcpy(buffer+smb_tid, &tmp, 2);
        assert(fscanf(in, "  smb_pid=%d\n", &tmp)); memcpy(buffer+smb_pid, &tmp, 2);
        assert(fscanf(in, "  smb_uid=%d\n", &tmp)); memcpy(buffer+smb_uid, &tmp, 2);
        assert(fscanf(in, "  smb_mid=%d\n", &tmp)); memcpy(buffer+smb_mid, &tmp, 2);
        assert(fscanf(in, "  smt_wct=%d\n", &tmp)); buffer[smb_wct] = tmp;
        for(i = 0; i < buffer[smb_wct]; i++) {
                assert(fscanf(in, "  smb_vwv[%*2d]=%*5d (0x%X)\n", &tmp));
                memcpy(buffer+smb_vwv+i*2, &tmp, 2);
        }

        *data_offset = smb_vwv+buffer[smb_wct]*2;
        assert(fscanf(in, "  smb_bcc=%ld\n", data_length)); buffer[(*data_offset)] = *data_length;
        (*data_offset)+=2;
        *_buffer = buffer;
}

static long read_log_data	(	FILE *	in,
		unsigned char *	buffer,
		long	data_length
	)			[static]

log2pcaphex.c の 200 行で定義されています。

参照先 fprintf()・quiet.

参照元 main().

{
        long i, addr; char real[2][16]; int ret;
        unsigned int tmp;
        for(i = 0; i < data_length; i++) {
                if(i % 16 == 0){
                        if(i != 0) { /* Read data after each line */
                                assert(fscanf(in, "%8s %8s", real[0], real[1]) == 2);
                        }
                        ret = fscanf(in, "  [%03lX]", &addr);
                        if(!ret) {
                                if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i);
                                return i-1;
                        }
                        assert(addr == i);
                }
                if(!fscanf(in, "%02X", &tmp)) {
                        if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1);
                        return i-1;
                }
                buffer[i] = tmp;
        }
        return data_length;
}

int main	(	int	argc,
		char **	argv
	)

log2pcaphex.c の 225 行で定義されています。

参照先 curpacket・curpacket_len・fprintf()・hexformat・outfile・poptGetArg()・poptGetContext()・poptGetNextOpt()・poptSetOtherOptionHelp()・print_hex_packet()・print_netbios_packet()・print_pcap_header()・quiet・read_log_data()・read_log_msg().

{
        const char *infile, *outfile;
        FILE *out, *in;
        int opt;
        poptContext pc;
        char buffer[4096];
        long data_offset, data_length;
        long data_bytes_read = 0;
        int in_packet = 0;
        struct poptOption long_options[] = {
                POPT_AUTOHELP
                { "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" },
                { "hex", 'h', POPT_ARG_NONE, &hexformat, 0, "Output format readable by text2pcap" },
                POPT_TABLEEND
        };
        
        pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
                            POPT_CONTEXT_KEEP_FIRST);
        poptSetOtherOptionHelp(pc, "[<infile> [<outfile>]]");
        
        
        while((opt = poptGetNextOpt(pc)) != -1) {
                switch (opt) {
                }
        }

        poptGetArg(pc); /* Drop argv[0], the program name */

        infile = poptGetArg(pc);

        if(infile) {
                in  = fopen(infile, "r");
                if(!in) {
                        perror("fopen");
                        return 1;
                }
        } else in = stdin;
        
        outfile = poptGetArg(pc);

        if(outfile) {
                out = fopen(outfile, "w+");
                if(!out) { 
                        perror("fopen"); 
                        fprintf(stderr, "Can't find %s, using stdout...\n", outfile);
                }
        }

        if(!outfile) out = stdout;

        if(!hexformat)print_pcap_header(out);

        while(!feof(in)) {
                fgets(buffer, sizeof(buffer), in);
                if(buffer[0] == '[') { /* Header */
                        if(strstr(buffer, "show_msg")) {
                                in_packet++;
                                if(in_packet == 1)continue;
                                read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
                        } else if(in_packet && strstr(buffer, "dump_data")) {
                                data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
                        }  else { 
                                if(in_packet){ 
                                        if(hexformat) print_hex_packet(out, curpacket, curpacket_len); 
                                        else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
                                        free(curpacket); 
                                }
                                in_packet = 0;
                        }
                } 
        }

        return 0;
}

---

変数

int quiet = 0

log2pcaphex.c の 39 行で定義されています。

参照元 _cleanup_failures()・clean_exit()・get_auth_data()・main()・read_log_data()・smb_download_dir()・smb_download_file().

int hexformat = 0

log2pcaphex.c の 40 行で定義されています。

参照元 main().

hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202} [static]

log2pcaphex.c の 83 行で定義されています。

参照元 print_netbios_packet().

hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0} [static]

log2pcaphex.c の 97 行で定義されています。

参照元 print_netbios_packet().

unsigned char* curpacket = NULL

log2pcaphex.c の 159 行で定義されています。

参照元 main().

long curpacket_len = 0

log2pcaphex.c の 160 行で定義されています。

参照元 main().

---