Ejemplo n.º 1
0
        static void Main(string[] args)
        {
            var streams = new Dictionary <int, TCPConnection>();

            if (args.Count() < 1)
            {
                Console.WriteLine("Give me a .pcapng file captured while playing Anarchy Online.");
                Console.WriteLine("I'll try to extract data important for historical preservation of AO, like NPC");
                Console.WriteLine("dialog.");
                //TODO link to site
                return;
            }

            var reader = new Reader(args[0]);

            foreach (var block in reader.AllBlocks)
            {
                byte[] data = null;
                if (block is SimplePacketBlock)
                {
                    data = ((SimplePacketBlock)block).Data;
                }
                else if (block is EnhancedPacketBlock)
                {
                    data = ((EnhancedPacketBlock)block).Data;
                }

                if (data != null && data.Length > 0)
                {
                    //Dirty Ethernet+IP+TCP parser

                    //Assumes that data is Ethernet.  If this is a problem, see LinkType: http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionidb

                    var stream  = new MemoryStream(data);
                    var breader = new BinaryReader(stream);

                    try
                    {
                        //skip mac addresses
                        breader.BaseStream.Seek(12, SeekOrigin.Current);

                        int etherType = breader.ReadInt16();

                        if (etherType != 0x0008)  //Check if IPv4
                        {
                            continue;
                        }

                        int ipVersionThenLength = breader.ReadByte();

                        if ((ipVersionThenLength >> 4) != 0x04) //IPv4?
                        {
                            continue;
                        }

                        int ipHeaderLength = (ipVersionThenLength & 0x0F) * 4;

                        int dscp = breader.ReadByte();

                        UInt16 ipTotalLength = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());

                        int offsetBetweenLengthAndProtoField = 5;

                        breader.BaseStream.Seek(offsetBetweenLengthAndProtoField, SeekOrigin.Current);
                        int dataProto = breader.ReadByte();

                        if (dataProto != 0x06)
                        {
                            continue;
                        }

                        //Skip rest of IP header
                        breader.BaseStream.Seek(ipHeaderLength - offsetBetweenLengthAndProtoField - 1 - 1 - 3, SeekOrigin.Current); //-1: length field, already read.
                        //We assume port pairs will be enough to identify connections and their direction (i.e. only one interface per trace, no locally hosted AO server)


                        UInt16 srcPort          = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadUInt16());
                        UInt16 dstPort          = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadUInt16());
                        UInt32 seqNo            = (UInt32)IPAddress.NetworkToHostOrder((Int32)breader.ReadUInt32());
                        UInt32 ackNo            = (UInt32)IPAddress.NetworkToHostOrder((Int32)breader.ReadUInt32());
                        int    tcpHeaderLength  = 4 * (breader.ReadByte() >> 4);
                        int    flags            = breader.ReadByte();
                        int    windowSize       = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());
                        int    checksum         = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());
                        int    urgentPointerLol = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());

                        bool ack = (flags & (1 << 4)) != 0;
                        bool psh = (flags & (1 << 3)) != 0;
                        bool rst = (flags & (1 << 2)) != 0;
                        bool syn = (flags & (1 << 1)) != 0;
                        bool fin = (flags & (1 << 0)) != 0;


                        breader.BaseStream.Seek(tcpHeaderLength - 20, SeekOrigin.Current);

                        int           localPort;
                        TCPConnection tcpStream;

                        if (srcPort == 7511 || dstPort == 7511)
                        {
                            bool gotStream = streams.TryGetValue(dstPort, out tcpStream);

                            uint tcpDataLength = (uint)(ipTotalLength - ipHeaderLength - tcpHeaderLength);

                            if (ipTotalLength - ipHeaderLength - tcpHeaderLength > 0)
                            {
                                if (!gotStream)
                                {
                                    tcpStream = new TCPConnection(dstPort, srcPort);
                                    streams.Add(dstPort, tcpStream);
                                }

                                if (!tcpStream.receivingStreamOpen)
                                {
                                    //first packet we've seen
                                    tcpStream.receivingSequenceNumber = seqNo;
                                    tcpStream.dataParser = new MessageSerializer();
                                }

                                if (tcpStream.receivingSequenceNumber == seqNo)
                                {
                                    Stream    finalPDU;
                                    SubStream tcpPDU = new SubStream(stream, tcpDataLength);

                                    if (tcpStream.decompressor != null)
                                    {
                                        tcpStream.decompressor.BaseStream.Position = 0;
                                        tcpStream.decompressor.BaseStream.SetLength(0);
                                        tcpPDU.CopyTo(tcpStream.decompressor.BaseStream);
                                        tcpStream.decompressor.BaseStream.Position = 0;
                                        tcpStream.decompressor.nomoreinput         = false;

                                        finalPDU = new MemoryStream(4096);
                                        byte[] buffer = new byte[2048];
                                        int    decompressedBytesRead = 0;
                                        while ((decompressedBytesRead = tcpStream.decompressor.read(buffer, 0, 2048)) > 0)   //don't call capital R Read!
                                        {
                                            finalPDU.Write(buffer, 0, decompressedBytesRead);
                                            //Use this instead to help debug end of stream exceptions: finalPDU.Write(buffer, 0, 2048);
                                        }
                                    }
                                    else
                                    {
                                        finalPDU = tcpPDU;
                                    }

                                    Message message   = null;
                                    bool    exception = false;
                                    try {
                                        message = ((MessageSerializer)tcpStream.dataParser).Deserialize(finalPDU);
                                    } catch (Exception e) {
                                        Console.Write(srcPort + " EXCEPTION");
                                        if (e.Data.Contains("aoPacketType"))
                                        {
                                            Console.Write(", packet type: " + e.Data["aoPacketType"]);
                                        }
                                        Console.WriteLine();
                                    }

                                    if (!exception)
                                    {
                                        savePacket(srcPort, message, finalPDU);
                                    }

                                    if (message != null && message.Body is SmokeLounge.AOtomation.Messaging.Messages.InitiateCompressionMessage)
                                    {
                                        if (message.Header.Sender == 0x01000000)
                                        {
                                            Console.WriteLine("Server wants compression!"); //the AOCell code says that 03 is compression, but I think it's the other way around
                                            tcpStream.decompressor           = new ZInputStream(new MemoryStream(1450));
                                            tcpStream.decompressor.FlushMode = zlibConst.Z_NO_FLUSH;
                                            //I should let the TCPConnection handle the decompression, and give it lambda that hands back data
                                            //Also, it would be good to have a zlib library that doesn't expect a single stream when decompressing
                                        }
                                    }
                                    tcpStream.receivingSequenceNumber += tcpDataLength;

                                    //See if the next packet has already arrived
                                    while (tcpStream.outOfOrderPackets.Count > 0 && tcpStream.outOfOrderPackets.First().Key == seqNo)
                                    {
                                        TCPPacket outOfOrderPacket = tcpStream.outOfOrderPackets.First().Value;
                                        SubStream tcpPDU2          = new SubStream(outOfOrderPacket.packet, outOfOrderPacket.dataLength);
                                        Message   message2         = ((MessageSerializer)tcpStream.dataParser).Deserialize(tcpPDU2);
                                        savePacket(srcPort, message2, tcpPDU2);
                                        tcpStream.receivingSequenceNumber += outOfOrderPacket.dataLength;
                                    }
                                }
                                else if (tcpStream.receivingSequenceNumber < seqNo)
                                {
                                    //This packet arrived before its predecessor
                                    tcpStream.outOfOrderPackets.Add(seqNo, new TCPPacket(tcpDataLength, breader.BaseStream));  //UM, CAN A TCP STACK DECIDE TO RESEND A DIFFIRENT PORTION OF THE STREAM?  probably not, since the ack could have been lost and the packet read by the other end.  Then the other would have to start splitting packet, I doubt they made the protocol that complicate for no reason.
                                    if (tcpStream.outOfOrderPackets.Count() == 15)
                                    {
                                        Console.WriteLine("Out-of-order-packet queue is getting big!  Is this capture missing a packet?");
                                        //To find out, we'd need to analyze ACKs.
                                    }
                                    else if (tcpStream.outOfOrderPackets.Count() > 25)
                                    {
                                        Console.WriteLine("This capture is probably missing a packet.  Aborting.");
                                        return;
                                    }
                                }
                            }
                        }
                    }

                    /*catch (Exception e)
                     * {
                     *  Console.WriteLine("Weird packet?");
                     * }*/
                    finally
                    {
                        stream.Close();
                    }
                }
            }
        }
Ejemplo n.º 2
0
        static void Main(string[] args)
        {
            var streams = new Dictionary<int,TCPConnection>();

            if (args.Count() < 1){
                Console.WriteLine("Give me a .pcapng file captured while playing Anarchy Online.");
                Console.WriteLine("I'll try to extract data important for historical preservation of AO, like NPC");
                Console.WriteLine("dialog.");
                //TODO link to site
                return;
            }

            var reader = new Reader(args[0]);

            foreach (var block in reader.AllBlocks)
            {
                byte[] data = null;
                if(block is SimplePacketBlock){
                    data = ((SimplePacketBlock)block).Data;
                }else if (block is EnhancedPacketBlock){
                    data = ((EnhancedPacketBlock)block).Data;
                }

                if (data != null && data.Length > 0){
                    //Dirty Ethernet+IP+TCP parser

                    //Assumes that data is Ethernet.  If this is a problem, see LinkType: http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionidb

                    var stream = new MemoryStream(data);
                    var breader = new BinaryReader(stream);

                    try
                    {
                        //skip mac addresses
                        breader.BaseStream.Seek(12, SeekOrigin.Current);

                        int etherType = breader.ReadInt16();

                        if (etherType != 0x0008) {//Check if IPv4
                            continue;
                        }

                        int ipVersionThenLength = breader.ReadByte();

                        if ((ipVersionThenLength >> 4) != 0x04){//IPv4?
                            continue;
                        }

                        int ipHeaderLength = (ipVersionThenLength & 0x0F) * 4;

                        int dscp = breader.ReadByte();

                        UInt16 ipTotalLength = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());

                        int offsetBetweenLengthAndProtoField = 5;

                        breader.BaseStream.Seek(offsetBetweenLengthAndProtoField, SeekOrigin.Current);
                        int dataProto = breader.ReadByte();

                        if (dataProto != 0x06) {
                            continue;
                        }

                        //Skip rest of IP header
                        breader.BaseStream.Seek(ipHeaderLength - offsetBetweenLengthAndProtoField - 1 - 1 - 3, SeekOrigin.Current); //-1: length field, already read.
                        //We assume port pairs will be enough to identify connections and their direction (i.e. only one interface per trace, no locally hosted AO server)

                        UInt16 srcPort = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadUInt16());
                        UInt16 dstPort = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadUInt16());
                        UInt32 seqNo = (UInt32)IPAddress.NetworkToHostOrder((Int32)breader.ReadUInt32());
                        UInt32 ackNo = (UInt32)IPAddress.NetworkToHostOrder((Int32)breader.ReadUInt32());
                        int tcpHeaderLength = 4 * (breader.ReadByte() >> 4);
                        int flags = breader.ReadByte();
                        int windowSize = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());
                        int checksum = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());
                        int urgentPointerLol = (UInt16)IPAddress.NetworkToHostOrder((short)breader.ReadInt16());

                        bool ack = (flags & (1 << 4)) != 0;
                        bool psh = (flags & (1 << 3)) != 0;
                        bool rst = (flags & (1 << 2)) != 0;
                        bool syn = (flags & (1 << 1)) != 0;
                        bool fin = (flags & (1 << 0)) != 0;

                        breader.BaseStream.Seek(tcpHeaderLength - 20, SeekOrigin.Current);

                        int localPort;
                        TCPConnection tcpStream;

                        if (srcPort == 7511 || dstPort == 7511){
                            bool gotStream = streams.TryGetValue(dstPort, out tcpStream);

                            uint tcpDataLength = (uint)(ipTotalLength-ipHeaderLength-tcpHeaderLength);

                            if (ipTotalLength-ipHeaderLength-tcpHeaderLength > 0) {
                                if (!gotStream){
                                    tcpStream = new TCPConnection(dstPort, srcPort);
                                    streams.Add(dstPort, tcpStream);
                                }

                                if (!tcpStream.receivingStreamOpen){
                                    //first packet we've seen
                                    tcpStream.receivingSequenceNumber = seqNo;
                                    tcpStream.dataParser = new MessageSerializer();
                                }

                                if (tcpStream.receivingSequenceNumber == seqNo) {
                                    Stream finalPDU;
                                    SubStream tcpPDU = new SubStream(stream, tcpDataLength);

                                    if (tcpStream.decompressor != null) {
                                        tcpStream.decompressor.BaseStream.Position = 0;
                                        tcpStream.decompressor.BaseStream.SetLength(0);
                                        tcpPDU.CopyTo(tcpStream.decompressor.BaseStream);
                                        tcpStream.decompressor.BaseStream.Position = 0;
                                        tcpStream.decompressor.nomoreinput = false;

                                        finalPDU = new MemoryStream(4096);
                                        byte[] buffer = new byte[2048];
                                        int decompressedBytesRead = 0;
                                        while ((decompressedBytesRead = tcpStream.decompressor.read(buffer, 0, 2048)) > 0) { //don't call capital R Read!
                                            finalPDU.Write(buffer, 0, decompressedBytesRead);
                                            //Use this instead to help debug end of stream exceptions: finalPDU.Write(buffer, 0, 2048);
                                        }

                                    } else {
                                        finalPDU = tcpPDU;
                                    }

                                    Message message = null;
                                    bool exception = false;
                                    try {
                                        message = ((MessageSerializer)tcpStream.dataParser).Deserialize(finalPDU);
                                    } catch (Exception e) {
                                        Console.Write(srcPort + " EXCEPTION");
                                        if (e.Data.Contains("aoPacketType")) {
                                            Console.Write(", packet type: " + e.Data["aoPacketType"]);
                                        }
                                        Console.WriteLine();
                                    }

                                    if(!exception){
                                        savePacket(srcPort, message, finalPDU);
                                    }

                                    if (message!=null && message.Body is SmokeLounge.AOtomation.Messaging.Messages.InitiateCompressionMessage) {
                                        if (message.Header.Sender == 0x01000000) {
                                            Console.WriteLine("Server wants compression!"); //the AOCell code says that 03 is compression, but I think it's the other way around
                                            tcpStream.decompressor = new ZInputStream(new MemoryStream(1450));
                                            tcpStream.decompressor.FlushMode = zlibConst.Z_NO_FLUSH;
                                            //I should let the TCPConnection handle the decompression, and give it lambda that hands back data
                                            //Also, it would be good to have a zlib library that doesn't expect a single stream when decompressing
                                        }
                                    }
                                    tcpStream.receivingSequenceNumber += tcpDataLength;

                                    //See if the next packet has already arrived
                                    while(tcpStream.outOfOrderPackets.Count > 0  && tcpStream.outOfOrderPackets.First().Key == seqNo){
                                        TCPPacket outOfOrderPacket = tcpStream.outOfOrderPackets.First().Value;
                                        SubStream tcpPDU2 = new SubStream(outOfOrderPacket.packet, outOfOrderPacket.dataLength);
                                        Message message2 = ((MessageSerializer)tcpStream.dataParser).Deserialize(tcpPDU2);
                                        savePacket(srcPort, message2, tcpPDU2);
                                        tcpStream.receivingSequenceNumber += outOfOrderPacket.dataLength;
                                    }
                                } else if(tcpStream.receivingSequenceNumber < seqNo){
                                    //This packet arrived before its predecessor
                                    tcpStream.outOfOrderPackets.Add(seqNo, new TCPPacket(tcpDataLength, breader.BaseStream));  //UM, CAN A TCP STACK DECIDE TO RESEND A DIFFIRENT PORTION OF THE STREAM?  probably not, since the ack could have been lost and the packet read by the other end.  Then the other would have to start splitting packet, I doubt they made the protocol that complicate for no reason.
                                    if (tcpStream.outOfOrderPackets.Count() == 15) {
                                        Console.WriteLine("Out-of-order-packet queue is getting big!  Is this capture missing a packet?");
                                        //To find out, we'd need to analyze ACKs.
                                    }else if(tcpStream.outOfOrderPackets.Count() > 25){
                                        Console.WriteLine("This capture is probably missing a packet.  Aborting.");
                                        return;
                                    }
                                }
                            }
                        }

                    }
                    /*catch (Exception e)
                    {
                        Console.WriteLine("Weird packet?");
                    }*/
                    finally
                    {
                        stream.Close();
                    }

                }
            }
        }