private object serializeRecords(String question, DnsResourceType rType, out int questionStart, int startingQStart, String fullDump)
{
if (rType == DnsResourceType.Query)
{
GeneralRecord gr = new GeneralRecord();
gr.resource_type = rType;
String rest = "";
int iTracker = 0;
lookup_hostname = serializeLabel(out iTracker, question, out rest);
//Get Question type and class
string lastPart = question.Substring(iTracker).Substring(2);
startingQStart += iTracker + 2;
question_type = int.Parse(lastPart.Substring(0, 4), System.Globalization.NumberStyles.HexNumber);
question_class = int.Parse(lastPart.Substring(4, 4), System.Globalization.NumberStyles.HexNumber);
startingQStart += 8;
gr.rName = lookup_hostname;
gr.rClass = question_class;
gr.rType = question_type;
//records.Add(query);
questionStart = startingQStart;
return(gr);
}
else if (rType == DnsResourceType.Answer)
{
AnswerRecord ar = new AnswerRecord();
ar.resource_type = rType;
String rest = "";
int iTracker = 0;
//Read the pointer pointing to the original address
string pointer = question.Substring(2, 2);
int offset = int.Parse(pointer, System.Globalization.NumberStyles.HexNumber);
string hostLabel = fullDump.Substring(offset * 2);
lookup_hostname = serializeLabel(out iTracker, hostLabel, out rest);
//Get Question type and class
string lastPart = question.Substring(4);
question_type = int.Parse(lastPart.Substring(0, 4), System.Globalization.NumberStyles.HexNumber);
question_class = int.Parse(lastPart.Substring(4, 4), System.Globalization.NumberStyles.HexNumber);
ar.rName = lookup_hostname;
ar.rClass = question_class;
ar.rType = question_type;
ar.ttl = int.Parse(lastPart.Substring(8, 8), System.Globalization.NumberStyles.HexNumber);
ar.dataLength = int.Parse(lastPart.Substring(16, 4), System.Globalization.NumberStyles.HexNumber);
if (ar.dataLength == 4 || ar.dataLength == 16)
{
ar.result = serializeIP(lastPart.Substring(20, ar.dataLength * 2)); //ipv4 or ipv6 address
}
else
{
ar.result = serializeLabel(out iTracker, lastPart.Substring(20, ar.dataLength * 2), out rest);
}
if (ar.dataLength == 16)
{
ar.ipv6Hex = lastPart.Substring(20, ar.dataLength * 2);
}
startingQStart += 20 + ar.dataLength * 2;
questionStart = startingQStart;
return(ar);
}
else if (rType == DnsResourceType.Authority)
{
AuthoritiveRecord ar = new AuthoritiveRecord();
ar.resource_type = rType;
String rest = "";
int iTracker = 0;
string lastPart = "";
int sub = 0;
//Get pointer
if (question.Substring(0, 2) == "00")
{
ar.rName = "<Root>";
}
else
{
string pointer = question.Substring(0, 4);
string p1 = pointer.Substring(0, 2);
string p2 = pointer.Substring(2);
int i1 = int.Parse(p1, System.Globalization.NumberStyles.HexNumber);
int i2 = int.Parse(p2, System.Globalization.NumberStyles.HexNumber);
string binary = Convert.ToString((i1 + i2), 2);
binary = binary.Substring(2);
int offset = Convert.ToInt32(binary, 2);
string hostLabel = fullDump.Substring(offset);
if (hostLabel.StartsWith("00"))
{
hostLabel = hostLabel.Substring(2);
}
lookup_hostname = serializeLabel(out iTracker, hostLabel, out rest);
lastPart = question.Substring(4);
sub = 4;
}
if (lastPart == "")
{
lastPart = question.Substring(2);
}
if (sub == 0)
{
sub = 2;
}
question_type = int.Parse(lastPart.Substring(0, 4), System.Globalization.NumberStyles.HexNumber);
question_class = int.Parse(lastPart.Substring(4, 4), System.Globalization.NumberStyles.HexNumber);
ar.rName = lookup_hostname;
ar.rType = question_type;
ar.rClass = question_class;
ar.ttl = int.Parse(lastPart.Substring(8, 8), System.Globalization.NumberStyles.HexNumber);
ar.dataLength = int.Parse(lastPart.Substring(16, 4), System.Globalization.NumberStyles.HexNumber);
string dataPart = lastPart.Substring(20);
String[] parts = multiSplit("00", dataPart);
string pDnsSrv = parts[0];
string rAuthMail = parts[1];
int pdnsl = 0;
if (!containsPointer(pDnsSrv) && !pDnsSrv.EndsWith("00"))
{
pDnsSrv += "00";
pdnsl += 2;
}
ar.primaryNS = serializeLabel(out iTracker, pDnsSrv, out rest, fullDump);
pdnsl += iTracker;
string afterPart = "";
if (containsPointer(pDnsSrv))
{
bool ismailPointer = containsPointer(rest);
ar.authorityMailbox = serializeLabel(out iTracker, rest, out rest, fullDump);
pdnsl += ar.authorityMailbox.Length * 2 + 4;
if (ismailPointer)
{
pdnsl -= (ar.authorityMailbox.Length * 2 + 4);
pdnsl += iTracker;
afterPart = question.Substring(20 + pdnsl + sub);
}
else
{
afterPart = question.Substring(20 + pdnsl + sub);
}
}
else
{
bool ismailPointer = containsPointer(rAuthMail);
ar.authorityMailbox = serializeLabel(out iTracker, rAuthMail, out rest, fullDump);
pdnsl += ar.authorityMailbox.Length * 2 + 4;
if (ismailPointer)
{
pdnsl -= (ar.authorityMailbox.Length * 2 + 4);
pdnsl += iTracker;
afterPart = question.Substring(20 + pdnsl + sub);
}
else
{
afterPart = question.Substring(20 + pdnsl + sub);
}
}
ar.serialNum = int.Parse(afterPart.Substring(0, 8), System.Globalization.NumberStyles.HexNumber);
ar.refreshInterval = int.Parse(afterPart.Substring(8, 8), System.Globalization.NumberStyles.HexNumber);
ar.retryInterval = int.Parse(afterPart.Substring(16, 8), System.Globalization.NumberStyles.HexNumber);
ar.expireLimit = int.Parse(afterPart.Substring(24, 8), System.Globalization.NumberStyles.HexNumber);
ar.minttl = int.Parse(afterPart.Substring(32, 8), System.Globalization.NumberStyles.HexNumber);
startingQStart += 24 + pdnsl + 40;
questionStart = startingQStart;
return(ar);
}
else
{
AdditionalRecord ar = new AdditionalRecord();
ar.resource_type = rType;
ar.hexDump = question;
ar.rName = "-1";
ar.rType = -1;
ar.rClass = -1;
questionStart = question.Length;
return(ar);
}
}
public String deserialize(dnsRequest request)
{
string result = "";
//Append request count
result += reqCount.ToString("X4");
//Build and append flags
int flags = 0;
flags = (response << 15) | (opcode << 11) | (AuthAnswer << 10) | (truncation << 9) | (recursion_desired << 8) | (recursion_available << 7) | (reserved << 4) | return_code;
result += flags.ToString("X4");
//Append resource record counts
result += question_resource_record_count.ToString("X4");
result += answer_resource_record_count.ToString("X4");
result += authority_resource_record_count.ToString("X4");
result += additional_resource_record_count.ToString("X4");
//Deserialize records
foreach (GeneralRecord gr in request.records)
{
if (gr.resource_type == DnsResourceType.Query)
{
string name = deserializeLabel(gr.rName);
string type = gr.rType.ToString("X4");
string rclass = gr.rClass.ToString("X4");
result += name;
result += "00";
result += type;
result += rclass;
}
if (gr.resource_type == DnsResourceType.Answer)
{
AnswerRecord ar = (AnswerRecord)gr;
string name = deserializeLabel(ar.rName);
string type = ar.rType.ToString("X4");
string rclass = ar.rClass.ToString("X4");
string ttl = ar.ttl.ToString("X8");
string aresult = deserializeIP(ar.result, ar.ipv6Hex);
string length = (aresult.Length / 2).ToString("X4");
result += name + "00";
result += type;
result += rclass;
result += ttl;
result += length;
result += aresult;
}
if (gr.resource_type == DnsResourceType.Authority)
{
AuthoritiveRecord ar = (AuthoritiveRecord)gr;
string name = deserializeLabel(ar.rName);
string type = ar.rType.ToString("X4");
string rclass = ar.rClass.ToString("X4");
string ttl = ar.ttl.ToString("X8");
string pDnsSrv = deserializeLabel(ar.primaryNS);
string mailbox = deserializeLabel(ar.authorityMailbox);
string serial = ar.serialNum.ToString("X8");
string refresh = ar.refreshInterval.ToString("X8");
string retry = ar.retryInterval.ToString("X8");
string expire = ar.expireLimit.ToString("X8");
string minttl = ar.minttl.ToString("X8");
string length = ((pDnsSrv.Length + mailbox.Length + 40) / 2).ToString("X4");
result += name + "00";
result += type;
result += rclass;
result += ttl;
result += length;
result += pDnsSrv + "00";
result += mailbox + "00";
result += serial;
result += refresh;
result += retry;
result += expire;
result += minttl;
}
if (gr.resource_type == DnsResourceType.Additional)
{
AdditionalRecord ar = (AdditionalRecord)gr;
result += ar.hexDump;
}
}
//Deserialize done :)
return(result);
}
public void serialize(String hexDump)
{
//Dns request parts reference: https://technet.microsoft.com/en-us/library/dd197470%28v=ws.10%29.aspx
//Get Request Count
reqCount = int.Parse(hexDump.Substring(0, 4), System.Globalization.NumberStyles.HexNumber); //.Substring(2).Substring(0, 2)
//Get the request flags
string ff = hexDump.Substring(4).Substring(0, 4); //ff = flagsField
string binary = Convert.ToString(Convert.ToInt32(ff, 16), 2);
binary = binary.PadLeft(16, '0');
/* Response = 1 bit
* OpCode = 4 bit
* Authoritive answer = 1 bit
* truncation = 1 bit
* rec desired = 1 bit
* rec avail = 1 bit
* reserved = 3 bit (const 0)
* return code = 4 bit
*/
response = Convert.ToInt32(binary.Substring(0, 1), 2);
opcode = Convert.ToInt32(binary.Substring(1, 4), 2);
AuthAnswer = Convert.ToInt32(binary.Substring(5, 1), 2);
truncation = Convert.ToInt32(binary.Substring(6, 1), 2);
recursion_desired = Convert.ToInt32(binary.Substring(7, 1), 2);
if ((DnsResponse)response != DnsResponse.request)
{
recursion_available = Convert.ToInt32(binary.Substring(8, 1), 2);
return_code = Convert.ToInt32(binary.Substring(12, 4), 2);
}
else
{
recursion_available = 0;
return_code = 0;
}
/*int flagCode = int.Parse(ff, System.Globalization.NumberStyles.HexNumber);
* response = (flagCode >> 15);
* if (response != 0) //Message is a request
* {
* return_code = (flagCode >> 3);
* recursion_available = (flagCode >> 7);
* }
* else
* {
* return_code = 0;
* recursion_available = 0;
* }
* recursion_desired = (flagCode >> 8);
* truncation = (flagCode >> 9);
* AuthAnswer = (flagCode >> 10);
* opcode = (flagCode >> 14);*/
//Get resource record counts
question_resource_record_count = int.Parse(hexDump.Substring(8).Substring(0, 4), System.Globalization.NumberStyles.HexNumber);
answer_resource_record_count = int.Parse(hexDump.Substring(12).Substring(0, 4), System.Globalization.NumberStyles.HexNumber);
authority_resource_record_count = int.Parse(hexDump.Substring(16).Substring(0, 4), System.Globalization.NumberStyles.HexNumber);
additional_resource_record_count = int.Parse(hexDump.Substring(20).Substring(0, 4), System.Globalization.NumberStyles.HexNumber);
int questionStart = 24;
for (int q = 0; q < question_resource_record_count; q++)
{
//Get Question hostname
string question = hexDump.Substring(questionStart);
int bytesRead = 0;
GeneralRecord queryResource = (GeneralRecord)serializeRecords(question, DnsResourceType.Query, out bytesRead, 0, hexDump);
questionStart += bytesRead;
records.Add(queryResource);
}
for (int q = 0; q < answer_resource_record_count; q++)
{
//Get Question hostname
string question = hexDump.Substring(questionStart);
int bytesRead = 0;
AnswerRecord answerResource = (AnswerRecord)serializeRecords(question, DnsResourceType.Answer, out bytesRead, 0, hexDump);
questionStart += bytesRead;
records.Add(answerResource);
}
for (int q = 0; q < authority_resource_record_count; q++)
{
//Get Question hostname
string question = hexDump.Substring(questionStart);
int bytesRead = 0;
AuthoritiveRecord authorityResource = (AuthoritiveRecord)serializeRecords(question, DnsResourceType.Authority, out bytesRead, 0, hexDump);
questionStart += bytesRead;
records.Add(authorityResource);
}
for (int q = 0; q < additional_resource_record_count; q++)
{
//Get Question hostname
string question = hexDump.Substring(questionStart);
int bytesRead = 0;
AdditionalRecord additionalResource = (AdditionalRecord)serializeRecords(question, DnsResourceType.Additional, out bytesRead, 0, hexDump);
questionStart += bytesRead;
records.Add(additionalResource);
}
//Serialization Completed!! yay :)
Console.WriteLine("Serialized!");
}
