static void Main(string[] args) { string inputFile = @"test.pcap"; using (BinaryReader PcapFile = new BinaryReader(File.Open(inputFile, FileMode.Open, FileAccess.Read))) { // Read libpcap Global Header. GlobalHeader pcapHeader = (GlobalHeader)GetObjectFromBytes(PcapFile.ReadBytes(24), typeof(GlobalHeader)); // Read Packets int packetNo = 0; int offset = 24; while (offset < PcapFile.BaseStream.Length) { packetNo++; PacketHeader packetHeader = (PacketHeader)GetObjectFromBytes(PcapFile.ReadBytes(16), typeof(PacketHeader)); int packetLength = (int)packetHeader.incl_len; byte[] packet = PcapFile.ReadBytes(packetLength); offset += 16 + packetLength; } Console.WriteLine(packetNo + " packets read.."); Console.WriteLine("Complete."); Console.ReadKey(); } }
public static BigArchive FromBytes(byte[] data, Action <string> writeLog = null) { if (writeLog == null) { writeLog = NullLogger.Write; } BigArchive bf = new BigArchive(); //load global header bf.GlobalHeader = GlobalHeader.FromBytes(data); writeLog("header loaded..."); //load the index FileIndex fi = FileIndex.FromBytes(data, bf.GlobalHeader); writeLog("index loaded..."); //there's some junk after the index: "L225" or "L231" plus 4 or 5 bytes of padding //Music.big also has some weird junk in between the end of the index and the mystery junk, but I'm not sure if it's intended or not //we can probably ignore that when loading but not when saving //we will probably just try "L231" plus four bytes at least initially //load files from index writeLog("\nloading files"); foreach (var indexEntry in fi.Entries) { byte[] fileData = data[(int)indexEntry.DataPosition..(int)(indexEntry.DataPosition + indexEntry.DataSize)];
public IGlobalHeader GetGlobalHeader() { int startIndex = Array.IndexOf(_headerLines, Constants.HeaderDelimiters.GlobalHeaderStart); int endIndex = Array.IndexOf(_headerLines, Constants.HeaderDelimiters.GlobalHeaderEnd); GlobalHeader header = new GlobalHeader(); for (int i = startIndex; i < endIndex; i++) { header.ParseLine <GlobalHeader, DATGlobalHeaderIdentifications>(_headerLines[i]); } return(header); }
public static void MinimalExample() { using (var parser = new DATReader(Shared.DAT_File_Path)) { // global header including: title, author, etc. GlobalHeader header = parser.GetGlobalHeader() as GlobalHeader; // channel header: channel-name, data-file location, datatype, min, max IEnumerable <ChannelHeader> headers = parser.GetChannelHeaders().Cast <ChannelHeader>(); // parses the actual channel data double[] data = parser.GetChannelData <double>(headers.First()).ToArray(); Assert.NotEmpty(data); } }
GlobalHeader ReadGlobalHeader(Stream strm) { GlobalHeader hd = new GlobalHeader(); BinaryReader rd = new BinaryReader(strm); byte[] buf; hd.Version = rd.ReadUInt32(); hd.DirSetOffset = rd.ReadUInt32(); hd.FileSetOffset = rd.ReadUInt32(); hd.IndexSize = rd.ReadUInt32(); hd.DataOffset = rd.ReadUInt32(); hd.ProductVersion = new byte[12]; rd.Read(hd.ProductVersion, 0, 12); hd.MinimumVersion = new byte[12]; rd.Read(hd.MinimumVersion, 0, 12); hd.Priority = rd.ReadUInt32(); hd.Flags = rd.ReadUInt32(); buf = new byte[4]; rd.Read(buf, 0, 4); hd.CreatorId = Encoding.ASCII.GetString(buf, 0, 4); hd.Guid = new byte[16]; rd.Read(hd.Guid, 0, 16); hd.IndexCRC = rd.ReadUInt32(); hd.DataCRC = rd.ReadUInt32(); hd.BuildTime.Year = rd.ReadInt16(); hd.BuildTime.Month = rd.ReadInt16(); hd.BuildTime.DayOfWeek = rd.ReadInt16(); hd.BuildTime.Day = rd.ReadInt16(); hd.BuildTime.Hour = rd.ReadInt16(); hd.BuildTime.Minute = rd.ReadInt16(); hd.BuildTime.Second = rd.ReadInt16(); hd.BuildTime.Milliseconds = rd.ReadInt16(); buf= new byte[200]; rd.Read(buf, 0, 200); hd.CopyrightText = Encoding.Unicode.GetString(buf, 0, 200); hd.CopyrightText = hd.CopyrightText.Substring(0, hd.CopyrightText.IndexOf('\0')); rd.Read(buf, 0, 200); hd.BuildText = Encoding.Unicode.GetString(buf, 0, 200); hd.BuildText = hd.BuildText.Substring(0, hd.BuildText.IndexOf('\0')); rd.Read(buf, 0, 200); hd.TitleText = Encoding.Unicode.GetString(buf, 0, 200); hd.TitleText = hd.TitleText.Substring(0, hd.TitleText.IndexOf('\0')); rd.Read(buf, 0, 80); hd.AuthorText = Encoding.Unicode.GetString(buf, 0, 80); hd.AuthorText = hd.AuthorText.Substring(0, hd.AuthorText.IndexOf('\0')); // skip remaining text (2 byte chars!) hd.AdditionalHeaderStringLength = rd.ReadInt16(); strm.Seek(2 * hd.AdditionalHeaderStringLength, SeekOrigin.Current); return hd; }
/* * static Ipv4Header? ReadNextIPV4Packet(System.Func<long, byte[]> ReadData) * { * * } */ public static void ParseNextPacket(System.Func <long, byte[]> ReadData, GlobalHeader GlobalHeader, System.Action <byte[], ulong, string> EnumPacket, bool StreamNameIsDestinationPort, System.Action <string> Debug) { List <byte> FinalPacketData = new List <byte>(); Ipv4Header? FinalIpv4Header = null; PacketHeader?FinalPacketHeader = null; List <int> PacketSizes = new List <int>(); System.Func <long, byte[]> PopFinalPacketData = (long Length) => { var Popped = FinalPacketData.GetRange(0, (int)Length); FinalPacketData.RemoveRange(0, (int)Length); PacketSizes[0] -= (int)Length; // if this goes negative we should subtract from next return(Popped.ToArray()); }; // gr: safety loop for (int i = 0; i < 100; i++) { var IsFirstPacket = i == 0; var MorePackets = false; var PacketHeader = GetStruct <PacketHeader>(ReadData); if (!FinalPacketHeader.HasValue) { FinalPacketHeader = PacketHeader; } // this includes headers var PacketData = ReadData(PacketHeader.FilePacketSize); //Debug.Log("Packet size " + PacketHeader.FilePacketSize); long HeaderSize = 0; System.Func <long, byte[]> ReadPacketData = (Length) => { var SubData = PacketData.SubArray(HeaderSize, Length); HeaderSize += Length; return(SubData); }; var Ipv4Size = 0; var ExpectedPosition = 0; // for following-fragments, this is where it's position should be in the combined packet, so this can check if some data is missing //Debug.Log("Packet size " + PacketHeader.FilePacketSize); if (GlobalHeader.NetworkLinkType == GlobalHeader.NetworkLinkType_Ethernet) { var EthernetHeader = GetStruct <EthernetHeader>(ReadPacketData); if (EthernetHeader.EthernetType == EthernetHeader.EthernetType_Ipv4) { var Ipv4Header = GetStruct <Ipv4Header>(ReadPacketData); if (Ipv4Header.VersionNumber != 4) { throw new System.Exception("IPV4 packet header version not 4, is " + Ipv4Header.VersionNumber); } if (!FinalIpv4Header.HasValue) { FinalIpv4Header = Ipv4Header; } MorePackets = Ipv4Header.HasMoreFragments; ExpectedPosition = Ipv4Header.NextFragmentOffset; Ipv4Size = Ipv4Header.TotalLength; // length includes IPV4 header, but there may be extra data not in the struct, so pop it off var SizeOfIpv4Header = Marshal.SizeOf(Ipv4Header); var ExtendedHeaderLength = Ipv4Header.HeaderLength - SizeOfIpv4Header; if (ExtendedHeaderLength > 0) { var ExtendedHeaderData = ReadPacketData(ExtendedHeaderLength); } // gr: pop ou the IPV4 protocol header from the assembled packet, not here. // that way, pcap's total data sizes align } else { // non ipv4 //StreamName += "NonIpV4 " + EthernetHeader.DestinationMacAddress.ToHexString(); } } else { //StreamName = "Non-Ethernet Stream <" + GlobalHeader.NetworkLinkType + ">"; } //Debug.Log("Packet size " + PacketHeader.FilePacketSize); var RawData = ReadPacketData(PacketHeader.FilePacketSize - HeaderSize); //if (RawData.Length != 1000) // throw new System.Exception("Expected Rawdata=1000 ; " + RawData.Length); if (FinalPacketData.Count != ExpectedPosition) { Debug("New packet data expected to be at " + ExpectedPosition + " but current total is " + FinalPacketData.Count); } FinalPacketData.AddRange(RawData); PacketSizes.Add(RawData.Length); if (!MorePackets) { break; } } if (!FinalIpv4Header.HasValue) { throw new System.Exception("Non-IPV4 packet, ignored x" + FinalPacketData.Count); } var StreamName = GetIpAddress(FinalIpv4Header.Value.DestinationAddress); var FinalIpv4Header_ = FinalIpv4Header.Value; // gr: this only occurs once at the start if (FinalIpv4Header_.Protocol == Ipv4Header.Protocol_Udp) { var UdpHeader = GetStruct <UdpHeader>(PopFinalPacketData); StreamName = "Port" + UdpHeader.DestinationPort; } var TotalSize = 0; foreach (var ps in PacketSizes) { TotalSize += ps; } Debug("Packet " + StreamName + " x" + TotalSize + " [" + string.Join(",", PacketSizes) + "]"); ulong TimeMs = (ulong)FinalPacketHeader.Value.TimestampSecs * 1000; TimeMs += (ulong)FinalPacketHeader.Value.TimestampMicroSecs / 1000; EnumPacket(FinalPacketData.ToArray(), TimeMs, StreamName); }
public DashboardPage() { GlobalHeader = new GlobalHeader(); }