static void Main(string[] args)
{
string inputFile = @"test.pcap";
using (BinaryReader PcapFile = new BinaryReader(File.Open(inputFile, FileMode.Open, FileAccess.Read)))
{
// Read libpcap Global Header.
GlobalHeader pcapHeader = (GlobalHeader)GetObjectFromBytes(PcapFile.ReadBytes(24), typeof(GlobalHeader));
// Read Packets
int packetNo = 0;
int offset = 24;
while (offset < PcapFile.BaseStream.Length)
{
packetNo++;
PacketHeader packetHeader = (PacketHeader)GetObjectFromBytes(PcapFile.ReadBytes(16), typeof(PacketHeader));
int packetLength = (int)packetHeader.incl_len;
byte[] packet = PcapFile.ReadBytes(packetLength);
offset += 16 + packetLength;
}
Console.WriteLine(packetNo + " packets read..");
Console.WriteLine("Complete.");
Console.ReadKey();
}
}
public static BigArchive FromBytes(byte[] data, Action <string> writeLog = null)
{
if (writeLog == null)
{
writeLog = NullLogger.Write;
}
BigArchive bf = new BigArchive();
//load global header
bf.GlobalHeader = GlobalHeader.FromBytes(data);
writeLog("header loaded...");
//load the index
FileIndex fi = FileIndex.FromBytes(data, bf.GlobalHeader);
writeLog("index loaded...");
//there's some junk after the index: "L225" or "L231" plus 4 or 5 bytes of padding
//Music.big also has some weird junk in between the end of the index and the mystery junk, but I'm not sure if it's intended or not
//we can probably ignore that when loading but not when saving
//we will probably just try "L231" plus four bytes at least initially
//load files from index
writeLog("\nloading files");
foreach (var indexEntry in fi.Entries)
{
byte[] fileData = data[(int)indexEntry.DataPosition..(int)(indexEntry.DataPosition + indexEntry.DataSize)];
public IGlobalHeader GetGlobalHeader()
{
int startIndex = Array.IndexOf(_headerLines, Constants.HeaderDelimiters.GlobalHeaderStart);
int endIndex = Array.IndexOf(_headerLines, Constants.HeaderDelimiters.GlobalHeaderEnd);
GlobalHeader header = new GlobalHeader();
for (int i = startIndex; i < endIndex; i++)
{
header.ParseLine <GlobalHeader, DATGlobalHeaderIdentifications>(_headerLines[i]);
}
return(header);
}
public static void MinimalExample()
{
using (var parser = new DATReader(Shared.DAT_File_Path)) {
// global header including: title, author, etc.
GlobalHeader header = parser.GetGlobalHeader() as GlobalHeader;
// channel header: channel-name, data-file location, datatype, min, max
IEnumerable <ChannelHeader> headers = parser.GetChannelHeaders().Cast <ChannelHeader>();
// parses the actual channel data
double[] data = parser.GetChannelData <double>(headers.First()).ToArray();
Assert.NotEmpty(data);
}
}
GlobalHeader ReadGlobalHeader(Stream strm)
{
GlobalHeader hd = new GlobalHeader();
BinaryReader rd = new BinaryReader(strm);
byte[] buf;
hd.Version = rd.ReadUInt32();
hd.DirSetOffset = rd.ReadUInt32();
hd.FileSetOffset = rd.ReadUInt32();
hd.IndexSize = rd.ReadUInt32();
hd.DataOffset = rd.ReadUInt32();
hd.ProductVersion = new byte[12];
rd.Read(hd.ProductVersion, 0, 12);
hd.MinimumVersion = new byte[12];
rd.Read(hd.MinimumVersion, 0, 12);
hd.Priority = rd.ReadUInt32();
hd.Flags = rd.ReadUInt32();
buf = new byte[4];
rd.Read(buf, 0, 4);
hd.CreatorId = Encoding.ASCII.GetString(buf, 0, 4);
hd.Guid = new byte[16];
rd.Read(hd.Guid, 0, 16);
hd.IndexCRC = rd.ReadUInt32();
hd.DataCRC = rd.ReadUInt32();
hd.BuildTime.Year = rd.ReadInt16();
hd.BuildTime.Month = rd.ReadInt16();
hd.BuildTime.DayOfWeek = rd.ReadInt16();
hd.BuildTime.Day = rd.ReadInt16();
hd.BuildTime.Hour = rd.ReadInt16();
hd.BuildTime.Minute = rd.ReadInt16();
hd.BuildTime.Second = rd.ReadInt16();
hd.BuildTime.Milliseconds = rd.ReadInt16();
buf= new byte[200];
rd.Read(buf, 0, 200);
hd.CopyrightText = Encoding.Unicode.GetString(buf, 0, 200);
hd.CopyrightText = hd.CopyrightText.Substring(0, hd.CopyrightText.IndexOf('\0'));
rd.Read(buf, 0, 200);
hd.BuildText = Encoding.Unicode.GetString(buf, 0, 200);
hd.BuildText = hd.BuildText.Substring(0, hd.BuildText.IndexOf('\0'));
rd.Read(buf, 0, 200);
hd.TitleText = Encoding.Unicode.GetString(buf, 0, 200);
hd.TitleText = hd.TitleText.Substring(0, hd.TitleText.IndexOf('\0'));
rd.Read(buf, 0, 80);
hd.AuthorText = Encoding.Unicode.GetString(buf, 0, 80);
hd.AuthorText = hd.AuthorText.Substring(0, hd.AuthorText.IndexOf('\0'));
// skip remaining text (2 byte chars!)
hd.AdditionalHeaderStringLength = rd.ReadInt16();
strm.Seek(2 * hd.AdditionalHeaderStringLength, SeekOrigin.Current);
return hd;
}
/*
* static Ipv4Header? ReadNextIPV4Packet(System.Func<long, byte[]> ReadData)
* {
*
* }
*/
public static void ParseNextPacket(System.Func <long, byte[]> ReadData, GlobalHeader GlobalHeader, System.Action <byte[], ulong, string> EnumPacket, bool StreamNameIsDestinationPort, System.Action <string> Debug)
{
List <byte> FinalPacketData = new List <byte>();
Ipv4Header? FinalIpv4Header = null;
PacketHeader?FinalPacketHeader = null;
List <int> PacketSizes = new List <int>();
System.Func <long, byte[]> PopFinalPacketData = (long Length) =>
{
var Popped = FinalPacketData.GetRange(0, (int)Length);
FinalPacketData.RemoveRange(0, (int)Length);
PacketSizes[0] -= (int)Length; // if this goes negative we should subtract from next
return(Popped.ToArray());
};
// gr: safety loop
for (int i = 0; i < 100; i++)
{
var IsFirstPacket = i == 0;
var MorePackets = false;
var PacketHeader = GetStruct <PacketHeader>(ReadData);
if (!FinalPacketHeader.HasValue)
{
FinalPacketHeader = PacketHeader;
}
// this includes headers
var PacketData = ReadData(PacketHeader.FilePacketSize);
//Debug.Log("Packet size " + PacketHeader.FilePacketSize);
long HeaderSize = 0;
System.Func <long, byte[]> ReadPacketData = (Length) =>
{
var SubData = PacketData.SubArray(HeaderSize, Length);
HeaderSize += Length;
return(SubData);
};
var Ipv4Size = 0;
var ExpectedPosition = 0; // for following-fragments, this is where it's position should be in the combined packet, so this can check if some data is missing
//Debug.Log("Packet size " + PacketHeader.FilePacketSize);
if (GlobalHeader.NetworkLinkType == GlobalHeader.NetworkLinkType_Ethernet)
{
var EthernetHeader = GetStruct <EthernetHeader>(ReadPacketData);
if (EthernetHeader.EthernetType == EthernetHeader.EthernetType_Ipv4)
{
var Ipv4Header = GetStruct <Ipv4Header>(ReadPacketData);
if (Ipv4Header.VersionNumber != 4)
{
throw new System.Exception("IPV4 packet header version not 4, is " + Ipv4Header.VersionNumber);
}
if (!FinalIpv4Header.HasValue)
{
FinalIpv4Header = Ipv4Header;
}
MorePackets = Ipv4Header.HasMoreFragments;
ExpectedPosition = Ipv4Header.NextFragmentOffset;
Ipv4Size = Ipv4Header.TotalLength;
// length includes IPV4 header, but there may be extra data not in the struct, so pop it off
var SizeOfIpv4Header = Marshal.SizeOf(Ipv4Header);
var ExtendedHeaderLength = Ipv4Header.HeaderLength - SizeOfIpv4Header;
if (ExtendedHeaderLength > 0)
{
var ExtendedHeaderData = ReadPacketData(ExtendedHeaderLength);
}
// gr: pop ou the IPV4 protocol header from the assembled packet, not here.
// that way, pcap's total data sizes align
}
else
{
// non ipv4
//StreamName += "NonIpV4 " + EthernetHeader.DestinationMacAddress.ToHexString();
}
}
else
{
//StreamName = "Non-Ethernet Stream <" + GlobalHeader.NetworkLinkType + ">";
}
//Debug.Log("Packet size " + PacketHeader.FilePacketSize);
var RawData = ReadPacketData(PacketHeader.FilePacketSize - HeaderSize);
//if (RawData.Length != 1000)
// throw new System.Exception("Expected Rawdata=1000 ; " + RawData.Length);
if (FinalPacketData.Count != ExpectedPosition)
{
Debug("New packet data expected to be at " + ExpectedPosition + " but current total is " + FinalPacketData.Count);
}
FinalPacketData.AddRange(RawData);
PacketSizes.Add(RawData.Length);
if (!MorePackets)
{
break;
}
}
if (!FinalIpv4Header.HasValue)
{
throw new System.Exception("Non-IPV4 packet, ignored x" + FinalPacketData.Count);
}
var StreamName = GetIpAddress(FinalIpv4Header.Value.DestinationAddress);
var FinalIpv4Header_ = FinalIpv4Header.Value;
// gr: this only occurs once at the start
if (FinalIpv4Header_.Protocol == Ipv4Header.Protocol_Udp)
{
var UdpHeader = GetStruct <UdpHeader>(PopFinalPacketData);
StreamName = "Port" + UdpHeader.DestinationPort;
}
var TotalSize = 0;
foreach (var ps in PacketSizes)
{
TotalSize += ps;
}
Debug("Packet " + StreamName + " x" + TotalSize + " [" + string.Join(",", PacketSizes) + "]");
ulong TimeMs = (ulong)FinalPacketHeader.Value.TimestampSecs * 1000;
TimeMs += (ulong)FinalPacketHeader.Value.TimestampMicroSecs / 1000;
EnumPacket(FinalPacketData.ToArray(), TimeMs, StreamName);
}
public DashboardPage()
{
GlobalHeader = new GlobalHeader();
}
