public object applyOn(SpotterFRPC spotter)
{
var msg = new MailMsg();
foreach (var item in spotter.Items)
{
var methodCall = item as FRPCparser.FRPCMethodCall;
if (methodCall == null || !methodCall.Name.Equals("user.message.send"))
{
continue;
}
foreach (var param in methodCall.Parameters)
{
var email = param as FRPCparser.FRPCStruct;
if (email == null)
{
continue;
}
foreach (var it in email.Items)
{
if (it.Key.Equals("subject"))
{
var itSubj = it.Value as FRPCparser.FRPCString;
msg.Subject = itSubj?.Value;
}
else if (it.Key.Equals("body"))
{
var itBody = it.Value as FRPCparser.FRPCString;
msg.Body = itBody?.Value;
}
else if (it.Key.Equals("to"))
{
var recips = it.Value as FRPCparser.FRPCArray;
if (recips != null)
{
msg.To = GetAddresses(recips);
}
}
else if (it.Key.Equals("from"))
{
var senders = it.Value as FRPCparser.FRPCArray;
if (senders != null)
{
msg.From = GetAddresses(senders);
}
}
}
}
}
return(msg);
}
public void TestSpotterFRPC()
{
this.FrameworkController.ProcessCapture(this.PrepareCaptureForProcessing(SnoopersPcaps.Default.webmail_webmail_seznam_pcapng));
var conversations = this.L7Conversations.ToArray();
var pk = File.ReadAllText(PrivateKeys.Default.pk_pem);
foreach (var conversation in conversations)
{
conversation.Key = new CypherKey();
conversation.Key.ServerPrivateKey = pk;
}
this.FrameworkController.ExportData(this.AvailableSnoopers.Where(x => x is SnooperHTTP.SnooperHTTP), conversations, this.CurrentTestBaseDirectory, true);
var msgObject = this.SnooperExports.ToArray()[0].ExportObjects[14] as SnooperExportedDataObjectHTTP;
Assert.AreNotEqual(null, msgObject);
var msg = msgObject.Message;
var spotter = new SpotterFRPC();
spotter.Init(msg);
/* verify true states */
Assert.AreEqual(true, spotter.IsSpottable());
Assert.AreEqual(true, spotter.ContainsOneOf(new[] { "nieco", "subject" }, SpotterBase.SpotterContext.ContentKey));
Assert.AreEqual(true, spotter.Contains("user.message.send", SpotterBase.SpotterContext.AllKey));
Assert.AreEqual(true, spotter.ContainsKeyValuePair("subject", "Re: test opera", SpotterBase.SpotterContext.ContentPair));
/* verify false states */
Assert.AreEqual(false, spotter.ContainsOneOf(new[] { "nieco", "ine" }, SpotterBase.SpotterContext.ContentKey));
Assert.AreEqual(false, spotter.Contains("hocico", SpotterBase.SpotterContext.AllKey));
Assert.AreEqual(false, spotter.ContainsKeyValuePair("subject", "Confidentioal", SpotterBase.SpotterContext.AllPair));
}
public object applyOn(SpotterFRPC spotter)
{
var list = new List <MailMsg>();
foreach (var item in spotter.Items)
{
var methodResponse = item as FRPCparser.FRPCMethodRespone;
if (methodResponse == null)
{
continue;
}
foreach (var data in methodResponse.Data)
{
var msgStruct = data as FRPCparser.FRPCStruct;
if (msgStruct == null)
{
continue;
}
foreach (var msgItem in msgStruct.Items)
{
if (!msgItem.Key.Equals("messages"))
{
continue;
}
var msgArray = msgItem.Value as FRPCparser.FRPCArray;
if (msgArray == null)
{
continue;
}
foreach (var msg in msgArray.Items)
{
var mailMsg = new MailMsg();
var email = msg as FRPCparser.FRPCStruct;
if (email == null)
{
continue;
}
foreach (var it in email.Items)
{
if (it.Key.Equals("subject"))
{
var itSubj = it.Value as FRPCparser.FRPCString;
mailMsg.Subject = itSubj?.Value;
}
else if (it.Key.Equals("abstract"))
{
var itBody = it.Value as FRPCparser.FRPCString;
mailMsg.Body = itBody?.Value;
}
else if (it.Key.Equals("to"))
{
var recips = it.Value as FRPCparser.FRPCArray;
if (recips != null)
{
mailMsg.To = SeznamGetNewMessage.GetAddresses(recips);
}
}
else if (it.Key.Equals("from"))
{
var senders = it.Value as FRPCparser.FRPCArray;
if (senders != null)
{
mailMsg.From = SeznamGetNewMessage.GetAddresses(senders);
}
}
else if (it.Key.Equals("folder"))
{
var folder = it.Value as FRPCparser.FRPCInteger8;
if (folder != null)
{
mailMsg.SourceFolder = folder.Value.ToString();
}
}
}
list.Add(mailMsg);
}
}
}
}
return(list);
}
public object applyOn(SpotterFRPC spotter)
{
throw new NotImplementedException();
}