private static BlobFrag readFragment(BinaryReader packetReader)
{
BlobFrag newFrag = new BlobFrag();
newFrag.memberHeader_ = BlobFragHeader_t.read(packetReader);
newFrag.dat_ = packetReader.ReadBytes(newFrag.memberHeader_.blobFragSize - 16); // 16 == size of frag header
return(newFrag);
}
private void readPacket(PacketRecord packet, StringBuilder packetTypeStr, BinaryReader packetReader)
{
BlobFrag newFrag = new BlobFrag();
newFrag.memberHeader_ = BlobFragHeader_t.read(packetReader);
newFrag.dat_ = packetReader.ReadBytes(newFrag.memberHeader_.blobFragSize - 16); // 16 == size of frag header
packet.netPacket.fragList_.Add(newFrag);
BinaryReader fragDataReader = new BinaryReader(new MemoryStream(newFrag.dat_));
if (newFrag.memberHeader_.blobNum != 0)
{
packetTypeStr.Append("FragData[");
packetTypeStr.Append(newFrag.memberHeader_.blobNum);
packetTypeStr.Append("]");
}
else
{
PacketOpcode opcode = Util.readOpcode(fragDataReader);
packet.opcodes.Add(opcode);
packetTypeStr.Append(opcode.ToString());
}
}
private static bool readMessageData(BinaryReader binaryReader, long len, uint tsSec, List <PacketRecord> results, Dictionary <ulong, PacketRecord> incompletePacketMap)
{
// Begin reading headers
long packetStartPos = binaryReader.BaseStream.Position;
bool isSend = readNetworkHeaders(binaryReader);
long headersSize = binaryReader.BaseStream.Position - packetStartPos;
// Begin reading non-header packet content
StringBuilder packetHeadersStr = new StringBuilder();
StringBuilder packetTypeStr = new StringBuilder();
PacketRecord packet = null;
byte[] packetData = binaryReader.ReadBytes((int)(len - headersSize));
BinaryReader packetReader = new BinaryReader(new MemoryStream(packetData));
try
{
ProtoHeader pHeader = ProtoHeader.read(packetReader);
uint HAS_FRAGS_MASK = 0x4; // See SharedNet::SplitPacketData
if ((pHeader.header_ & HAS_FRAGS_MASK) != 0)
{
readOptionalHeaders(pHeader.header_, packetHeadersStr, packetReader);
while (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
BlobFrag newFrag = readFragment(packetReader);
ulong blobID = newFrag.memberHeader_.blobID;
if (incompletePacketMap.ContainsKey(blobID))
{
packet = incompletePacketMap[newFrag.memberHeader_.blobID];
}
else
{
packet = new PacketRecord();
incompletePacketMap.Add(blobID, packet);
}
if (newFrag.memberHeader_.blobNum == 0)
{
packet.isSend = isSend;
packet.tsSec = tsSec;
packet.extraInfo = "";
BinaryReader fragDataReader = new BinaryReader(new MemoryStream(newFrag.dat_));
PacketOpcode opcode = Util.readOpcode(fragDataReader);
packet.opcodes.Add(opcode);
packet.packetTypeStr = opcode.ToString();
}
packet.packetHeadersStr += packetHeadersStr.ToString();
packet.frags.Add(newFrag);
if (addPacketIfFinished(results, packet))
{
incompletePacketMap.Remove(blobID);
}
}
if (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
packet.extraInfo = "Didnt read entire packet! " + packet.extraInfo;
}
}
}
catch (OutOfMemoryException e)
{
//MessageBox.Show("Out of memory (packet " + curPacket + "), stopping read: " + e);
return(false);
}
catch (Exception e)
{
packet.extraInfo += "EXCEPTION: " + e.Message + " " + e.StackTrace;
}
return(true);
}
private static PacketRecord readPacketData(BinaryReader binaryReader, long len, uint tsSec, int curPacket)
{
// Begin reading headers
long packetStartPos = binaryReader.BaseStream.Position;
bool isSend = readNetworkHeaders(binaryReader);
long headersSize = binaryReader.BaseStream.Position - packetStartPos;
// Begin reading non-header packet content
StringBuilder packetHeadersStr = new StringBuilder();
StringBuilder packetTypeStr = new StringBuilder();
PacketRecord packet = new PacketRecord();
packet.index = curPacket;
packet.isSend = isSend;
packet.tsSec = tsSec;
packet.extraInfo = "";
packet.data = binaryReader.ReadBytes((int)(len - headersSize));
BinaryReader packetReader = new BinaryReader(new MemoryStream(packet.data));
try
{
ProtoHeader pHeader = ProtoHeader.read(packetReader);
packet.optionalHeadersLen = readOptionalHeaders(pHeader.header_, packetHeadersStr, packetReader);
if (packetReader.BaseStream.Position == packetReader.BaseStream.Length)
{
packetTypeStr.Append("<Header Only>");
}
uint HAS_FRAGS_MASK = 0x4; // See SharedNet::SplitPacketData
if ((pHeader.header_ & HAS_FRAGS_MASK) != 0)
{
while (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
if (packetTypeStr.Length != 0)
{
packetTypeStr.Append(" + ");
}
BlobFrag newFrag = readFragment(packetReader);
packet.frags.Add(newFrag);
if (newFrag.memberHeader_.blobNum != 0)
{
packetTypeStr.Append("FragData[");
packetTypeStr.Append(newFrag.memberHeader_.blobNum);
packetTypeStr.Append("]");
}
else
{
BinaryReader fragDataReader = new BinaryReader(new MemoryStream(newFrag.dat_));
PacketOpcode opcode = Util.readOpcode(fragDataReader);
packet.opcodes.Add(opcode);
packetTypeStr.Append(opcode);
}
}
}
if (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
packet.extraInfo = "Didnt read entire packet! " + packet.extraInfo;
}
}
catch (OutOfMemoryException e)
{
//MessageBox.Show("Out of memory (packet " + curPacket + "), stopping read: " + e);
return(null);
}
catch (Exception e)
{
packet.extraInfo += "EXCEPTION: " + e.Message + " " + e.StackTrace;
}
packet.packetHeadersStr = packetHeadersStr.ToString();
packet.packetTypeStr = packetTypeStr.ToString();
return(packet);
}
private void menuItem_ToolBad_Click(object sender, EventArgs e)
{
FolderBrowserDialog openFolder = new FolderBrowserDialog();
if (openFolder.ShowDialog() != DialogResult.OK)
{
return;
}
List <string> files = new List <string>();
files.AddRange(Directory.GetFiles(openFolder.SelectedPath, "*.pcap", SearchOption.AllDirectories));
files.AddRange(Directory.GetFiles(openFolder.SelectedPath, "*.pcapng", SearchOption.AllDirectories));
OrderedDictionary opcodeOccurrences = new OrderedDictionary();
foreach (PacketOpcode opcode in Enum.GetValues(typeof(PacketOpcode)))
{
opcodeOccurrences[opcode] = 0;
}
foreach (string file in files)
{
loadPcap(file, false);
int curPacket = 0;
int curFragment = 0;
try
{
for (curPacket = 0; curPacket < records.Count; ++curPacket)
{
PacketRecord record = records[curPacket];
for (curFragment = 0; curFragment < record.frags.Count; ++curFragment)
{
BlobFrag frag = record.frags[curFragment];
if (frag.memberHeader_.numFrags > 0)
{
continue;
}
BinaryReader fragDataReader = new BinaryReader(new MemoryStream(frag.dat_));
bool handled = false;
foreach (MessageProcessor messageProcessor in messageProcessors)
{
long readerStartPos = fragDataReader.BaseStream.Position;
bool accepted = messageProcessor.acceptMessageData(fragDataReader, treeView_ParsedData);
if (accepted && handled)
{
throw new Exception("Multiple message processors are handling the same data!");
}
if (accepted)
{
handled = true;
}
fragDataReader.BaseStream.Position = readerStartPos;
}
/*if (!handled) {
* PacketOpcode opcode = Util.readOpcode(fragDataReader);
* treeView_ParsedData.Nodes.Add(new TreeNode("Unhandled: " + opcode));
* }*/
}
}
}
catch (Exception ex)
{
MessageBox.Show("Packet " + curPacket + " Fragment " + curFragment + " EXCEPTION: " + ex.Message);
break;
}
}
}
