public void HexDumpFloat(float inputFloat, string expectedResult)
{
string result = HexDumper.ConvertToHexDump(inputFloat);
expectedResult = expectedResult.Replace("\n", Environment.NewLine);
Assert.Equal(expectedResult, result);
}
public void HexDumpDouble(double inputDouble, string expectedResult)
{
string result = HexDumper.ConvertToHexDump(inputDouble);
expectedResult = expectedResult.Replace("\n", Environment.NewLine);
Assert.Equal(expectedResult, result);
}
public void HexDumpUint64(UInt64 inputUint64, string expectedResult)
{
string result = HexDumper.ConvertToHexDump(inputUint64);
expectedResult = expectedResult.Replace("\n", Environment.NewLine);
Assert.Equal(expectedResult, result);
}
public void HexDumpByteArray(byte[] bytes, string expectedResult)
{
string result = HexDumper.ConvertToHexDump(bytes);
expectedResult = expectedResult.Replace("\n", Environment.NewLine);
Assert.Equal(expectedResult, result);
}
public void HexDumpLong(long inputLong, string expectedResult)
{
string result = HexDumper.ConvertToHexDump(inputLong);
expectedResult = expectedResult.Replace("\n", Environment.NewLine);
Assert.Equal(expectedResult, result);
}
public void HexDumpString(string inputString, string expectedResult)
{
string result = HexDumper.ConvertToHexDump(inputString);
expectedResult = expectedResult.Replace("\n", Environment.NewLine);
Assert.Equal("utf-8", Encoding.Default.WebName);
Assert.Equal(expectedResult, result);
}
internal static string DumpConfig(this AudioStreamInfo audioConf)
{
StringBuilder sb = new StringBuilder();
sb.AppendLine("AudioStreamInfo:");
sb.Append("\tmimeType = ");
sb.AppendLine(audioConf.mimeType.ToString());
sb.Append("\tsampleRate = ");
sb.AppendLine(audioConf.sampleRate.ToString());
sb.Append("\tchannels = ");
sb.AppendLine(audioConf.channels.ToString());
sb.AppendLine("\tCodec Data:");
sb.AppendLine(HexDumper.HexDump(audioConf.codecData));
return(sb.ToString());
}
internal static string DumpConfig(this VideoStreamInfo videoConf)
{
StringBuilder sb = new StringBuilder();
sb.AppendLine("VideoStreamInfo:");
sb.Append("\tmimeType = ");
sb.AppendLine(videoConf.mimeType.ToString());
sb.Append("\tWidth / Max = ");
sb.Append(videoConf.width);
sb.Append(" / ");
sb.AppendLine(videoConf.maxWidth.ToString());
sb.Append("\tHeight / Max = ");
sb.Append(videoConf.height);
sb.Append(" / ");
sb.AppendLine(videoConf.maxHeight.ToString());
sb.Append("\tFrameRate = ");
sb.Append(videoConf.num + "/");
sb.Append(videoConf.den);
sb.AppendLine(" (" + (videoConf.num / (videoConf.den == 0 ? 1 : videoConf.den)) + ")");
sb.AppendLine("\tCodec Data:");
sb.AppendLine(HexDumper.HexDump(videoConf.codecData));
return(sb.ToString());
}
public override string ToString()
{
return("\tCodecData:\n" + HexDumper.HexDump(CodecExtraData));
}
public void Run(IScriptableComponent component)
{
int i = 0, j = 0, hits = 0;
Form1 f = component.Parent;
string C2 = f.InputBox("Enter the C2 IP to decode data for (can be partial string but be unique)", "Set C2", "");
if (C2.Length == 0)
{
return;
}
string pDir = Path.GetDirectoryName(f.txtPcap.Text);
string rep = pDir + "\\decoder_x_output.txt";
if (File.Exists(rep))
{
File.Delete(rep);
}
StreamWriter w = File.AppendText(rep);
foreach (TreeNode n in f.tv.Nodes)
{
i++; j = 0;
f.setpb(i, f.tv.Nodes.Count, 1);
TcpRecon recon = (TcpRecon)n.Tag;
//both ips are embedded in dump file name
//you can also use recon.Client[Address|Port] recon.Server[Address|Port]
if (recon.dumpFile.IndexOf(C2) == -1)
{
continue;
}
foreach (TreeNode nn in n.Nodes)
{
j++;
f.setpb(j, n.Nodes.Count, 2);
DataBlock db = (DataBlock)nn.Tag;
w.WriteLine(n.Text + " : " + nn.Text + "\r\n------------------------------------------------");
if (!db.LoadData())
{
w.WriteLine("Failed to load data...\r\n");
continue;
}
byte[] buf = null;
//in this example we will only process raw binary transfers (no http)
if (db.DataType == DataBlock.DataTypes.dtBinary)
{
buf = db.data;
}
/*else if(db.DataType == DataBlock.DataTypes.dtHttpReq) //if you wanted to process http request
* {
* buf = db.GetBinaryBody();
* }*/
//DataBlock Source and Dest addresses are set per packet,
//you can also filter based on db.SourcePort && db.DestPort
//
//example to handle client requests to server port 9000:
// if(db.SourceAddress == recon.ClientAddress && db.DestPort == 9000)
//
//Note: this for loop only runs if we matched target server because of continue above...
if (buf != null && buf.Length > 0)
{
hits++;
decode(buf);
w.WriteLine(HexDumper.HexDump(buf));
w.WriteLine("\r\n");
}
db.FreeData();
}
}
f.pb.Value = 0;
f.pb2.Value = 0;
w.Close();
if (hits > 0)
{
MessageBox.Show(hits.ToString() + " packets decoded.\nSaved as: " + rep);
}
else
{
MessageBox.Show("No binary data packets found from the C2 you entered: " + C2);
}
}
