public static bool Parser(ref TreeNodeCollection mNode,
byte [] PacketData,
ref int Index,
ref ListViewItem LItem)
{
TreeNode mNodex;
string Tmp = "";
int kk = 0;
byte NNumber = 0;
PACKET_NETBIOS PNetBios;
mNodex = new TreeNode();
mNodex.Text = "NETBIOS ( Netbios Protocol )";
kk = Index;
try
{
PNetBios.Length = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Length :" + Function.ReFormatString(PNetBios.Length, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.Delimeter = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Delimeter :" + Function.ReFormatString(PNetBios.Delimeter, GetDelimeterString(PNetBios.Delimeter));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.Command = PacketData[Index++];
Tmp = "Command :" + Function.ReFormatString(PNetBios.Command, GetCommandString(PNetBios.Command));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
switch (PNetBios.Command)
{
case Const.NB_ADD_GROUP:
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.NameToAdd = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Name to Add : " + PNetBios.NameToAdd;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
break;
case Const.NB_ADD_NAME:
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.NameToAdd = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Name To Add : " + PNetBios.NameToAdd;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
break;
case Const.NB_NAME_IN_CONFLICT:
PNetBios.NameInConflict = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Name in Conflict : " + PNetBios.NameInConflict;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
break;
case Const.NB_STATUS_QUERY:
PNetBios.StatusRequest = PacketData[Index++];
Tmp = "Status Request : " + Function.ReFormatString(PNetBios.StatusRequest, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.Data2 = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.ReceiversName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Receiver's Name : " + PNetBios.ReceiversName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
break;
case Const.NB_TERMINATE_TRACE_R:
break;
case Const.NB_DATAGRAM:
while (PacketData[Index] == 0)
{
Index++;
}
PNetBios.ReceiversName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Receiver's Name : " + PNetBios.ReceiversName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
if (Function.CheckBytesForZero(PacketData, Index, 10))
{
Index += 10;
PNetBios.SendersName = Function.GetMACAddress(PacketData, ref Index);
Tmp = "Sender's MAC Address : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 6, 6, false);
}
else
{
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
}
break;
case Const.NB_DATAGRAM_BCAST:
if (Function.CheckBytesForZero(PacketData, Index, 10))
{
Index += 10;
PNetBios.SendersName = Function.GetMACAddress(PacketData, ref Index);
Tmp = "Sender's MAC Address : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 6, 6, false);
}
else
{
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
}
break;
case Const.NB_NAME_QUERY:
Index++;
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.CallNameType = PacketData[Index++];
Tmp = "Call Name Type : " + Function.ReFormatString(PNetBios.CallNameType, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
Index += 2;
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.QueryName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Query Name : " + PNetBios.QueryName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
if (PNetBios.LocalSessionNumber != 0)
{
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
}
break;
case Const.NB_ADD_NAME_RESP:
PNetBios.Data1 = PacketData[Index++];
Tmp = "Data 1 : " + Function.ReFormatString(PNetBios.Data1, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.Data2 = PacketData[Index++];
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
Index++;
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
Index += 2;
PNetBios.ReceiversName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Receiver's Name : " + PNetBios.ReceiversName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
break;
case Const.NB_NAME_RESP:
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.CallNameType = PacketData[Index++];
Tmp = "Call Name Type : " + Function.ReFormatString(PNetBios.CallNameType, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
if (PNetBios.LocalSessionNumber != 0x00 && PNetBios.LocalSessionNumber != 0xFF)
{
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
}
PNetBios.ReceiversName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Receiver's Name : " + PNetBios.ReceiversName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
if (PNetBios.LocalSessionNumber != 0x00 && PNetBios.LocalSessionNumber != 0xFF)
{
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
}
break;
case Const.NB_STATUS_RESP:
PNetBios.StatusResponse = PacketData[Index++];
Tmp = "Status Response : " + Function.ReFormatString(PNetBios.StatusResponse, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.Data2 = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
Index--;
PNetBios.CallNameType = PacketData[Index++];
Tmp = "Call Name Type : " + Function.ReFormatString(PNetBios.CallNameType, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
Index += 2;
PNetBios.ReceiversName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Receiver's Name : " + PNetBios.ReceiversName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
PNetBios.SendersName = Function.GetNetBiosNameSerial(PacketData, ref Index, ref NNumber);
Tmp = "Sender's Name : " + PNetBios.SendersName;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 16, 16, false);
break;
case Const.NB_TERMINATE_TRACE_LR:
break;
case Const.NB_DATA_ACK:
Index += 5;
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_DATA_FIRST_MIDDLE:
PNetBios.DataFirstMidleFlags = PacketData[Index++];
Tmp = "Data First Midle Flags : " + Function.ReFormatString(PNetBios.DataFirstMidleFlags, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.ResyncIndicator = PacketData[Index++];
Tmp = "Resync Indicator : " + Function.ReFormatString(PNetBios.ResyncIndicator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
Index++;
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_DATA_ONLY_LAST:
PNetBios.DataOnlyFlags = PacketData[Index++];
Tmp = "Data Only Flags : " + Function.ReFormatString(PNetBios.DataOnlyFlags, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.ResyncIndicator = PacketData[Index++];
Tmp = "Resync Indicator : " + Function.ReFormatString(PNetBios.ResyncIndicator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
Index++;
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_SESSION_CONFIRM:
PNetBios.SessionConfirmFlags = PacketData[Index++];
Tmp = "Session Confirm Flags : " + Function.ReFormatString(PNetBios.SessionConfirmFlags, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.Data2 = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_SESSION_END:
Index++;
PNetBios.Data2 = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
Index += 4;
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_SESSION_INIT:
PNetBios.SessionInitFlags = PacketData[Index++];
Tmp = "Session Init Number : " + Function.ReFormatString(PNetBios.SessionInitFlags, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.Data2 = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.ResponseCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Response Correlator : " + Function.ReFormatString(PNetBios.ResponseCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_NO_RECEIVE:
PNetBios.NoReceiveFlags = PacketData[Index++];
Tmp = "No Receive Flags : " + Function.ReFormatString(PNetBios.NoReceiveFlags, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.Data2 = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
Index += 2;
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_RECEIVE_OUTSTANDING:
Index++;
PNetBios.Data2 = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Data 2 : " + Function.ReFormatString(PNetBios.Data2, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
Index += 2;
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_RECEIVE_CONTINUE:
Index += 5;
PNetBios.XmitCorrelator = Function.Get2Bytes(PacketData, ref Index, Const.VALUE);
Tmp = "Xmit Correlator : " + Function.ReFormatString(PNetBios.XmitCorrelator, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.NB_KEEP_ALIVE:
Index += 7;
PNetBios.RemoteSessionNumber = PacketData[Index++];
Tmp = "Remote Session Number : " + Function.ReFormatString(PNetBios.RemoteSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNetBios.LocalSessionNumber = PacketData[Index++];
Tmp = "Local Session Number : " + Function.ReFormatString(PNetBios.LocalSessionNumber, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
}
Function.SetPosition(ref mNodex, kk, Index - kk, true);
mNode.Add(mNodex);
if ((Index + 4) < PacketData.Length)
{
if ((PacketData[Index] == 0xff) &&
(PacketData[Index + 1] == 0x53) &&
(PacketData[Index + 2] == 0x4d) &&
(PacketData[Index + 3] == 0x42))
{
PacketSMB.Parser(ref mNode, PacketData, ref Index, ref LItem);
}
}
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "NETBIOS";
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Netbios";
}
catch (Exception Ex)
{
mNode.Add(mNodex);
Tmp = "[ Malformed NETBIOS packet. Remaining bytes don't fit an NETBIOS packet. Possibly due to bad decoding ]";
mNode.Add(Tmp);
Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]";
mNode.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed NETBIOS packet. Remaining bytes don't fit an NETBIOS packet. Possibly due to bad decoding ]";
return(false);
}
return(true);
}
public static bool Parser(ref TreeNodeCollection mNode,
byte [] PacketData,
ref int Index,
ref ListViewItem LItem)
{
TreeNode mNodex;
string Tmp = "";
int kk = 0;
byte NNumber = 0;
PACKET_NBDS PNbds;
string [] MessageTypeList = new string[24];
string [] YesNoList = new string[2];
string [] NodeTypeList = new string[4];
string [] ErrorCodeList = new string[3];
int i = 0;
for (i = 0; i < 17; i++)
{
MessageTypeList[i] = "Unknown";
}
MessageTypeList[Const.NBDS_DIRECT_UNIQUE] = "Direct_unique datagram";
MessageTypeList[Const.NBDS_DIRECT_GROUP] = "Direct_group datagram";
MessageTypeList[Const.NBDS_BROADCAST] = "Broadcast datagram";
MessageTypeList[Const.NBDS_ERROR] = "Datagram error";
MessageTypeList[Const.NBDS_QUERY_REQUEST] = "Datagram query request";
MessageTypeList[Const.NBDS_POS_QUERY_RESPONSE] = "Datagram positive query response";
MessageTypeList[Const.NBDS_NEG_QUERY_RESPONSE] = "Datagram negative query response";
YesNoList[1] = "Yes";
YesNoList[0] = "No";
NodeTypeList[0] = "B node";
NodeTypeList[1] = "P node";
NodeTypeList[2] = "M node";
NodeTypeList[3] = "NBDD";
ErrorCodeList[0] = "Destination name not present"; // + 0x82;
ErrorCodeList[1] = "Invalid source name format";
ErrorCodeList[2] = "Invalid destination name format";
mNodex = new TreeNode();
mNodex.Text = "NBDS ( Netbios Datagram Service )";
kk = Index;
try
{
PNbds.MessageType = PacketData[Index++];
Tmp = "Message Type :" + Function.ReFormatString(PNbds.MessageType, MessageTypeList[PNbds.MessageType]);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNbds.Flags = PacketData[Index++];
Tmp = "Flags :" + Function.ReFormatString(PNbds.Flags, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
Tmp = "More fragments fallow :" + YesNoList[PNbds.Flags & 1];
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
Tmp = "This is first fragment :" + YesNoList[(PNbds.Flags & 2) >> 1];
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
Tmp = "Node Type :" + NodeTypeList[(PNbds.Flags & 12) >> 2];
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
PNbds.DatagramId = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Datagram Id :" + Function.ReFormatString(PNbds.DatagramId, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNbds.SourceIp = Function.GetIpAddress(PacketData, ref Index);
Tmp = "Source Ip : " + PNbds.SourceIp;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 4, 4, false);
PNbds.SourcePort = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Source Port :" + Function.ReFormatString(PNbds.SourcePort, Const.GetPortStr(PNbds.SourcePort));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
switch (PNbds.MessageType)
{
case Const.NBDS_DIRECT_UNIQUE:
case Const.NBDS_DIRECT_GROUP:
case Const.NBDS_BROADCAST:
PNbds.DataLength = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Datagram Length :" + Function.ReFormatString(PNbds.DataLength, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNbds.PacketOffset = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Packet Offset :" + Function.ReFormatString(PNbds.PacketOffset, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
PNbds.SourceName = Function.GetNetBiosName(PacketData, ref Index, ref NNumber);
Tmp = "Source Name :" + PNbds.SourceName + " ( " + Const.GetNetBiosNames(NNumber) + " )";
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 34, 34, false);
PNbds.DestinationName = Function.GetNetBiosName(PacketData, ref Index, ref NNumber);
Tmp = "Destination Name :" + PNbds.DestinationName + " ( " + Const.GetNetBiosNames(NNumber) + " )";
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 34, 34, false);
break;
case Const.NBDS_ERROR:
PNbds.ErrorCode = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Error Code :" + Function.ReFormatString(PNbds.ErrorCode, ErrorCodeList[PNbds.ErrorCode - 0x82]);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
break;
case Const.NBDS_QUERY_REQUEST:
case Const.NBDS_POS_QUERY_RESPONSE:
case Const.NBDS_NEG_QUERY_RESPONSE:
PNbds.DestinationName = Function.GetNetBiosName(PacketData, ref Index, ref NNumber);
Tmp = "Destination Name :" + PNbds.DestinationName + " ( " + Const.GetNetBiosNames(NNumber) + " )";
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 34, 34, false);
break;
}
Function.SetPosition(ref mNodex, kk, Index - kk, true);
mNode.Add(mNodex);
if ((Index + 4) < PacketData.Length)
{
if ((PacketData[Index] == 0xff) &&
(PacketData[Index + 1] == 0x53) &&
(PacketData[Index + 2] == 0x4d) &&
(PacketData[Index + 3] == 0x42))
{
PacketSMB.Parser(ref mNode, PacketData, ref Index, ref LItem);
}
}
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "NBDS";
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Netbios datagram service";
}
catch (Exception Ex)
{
mNode.Add(mNodex);
Tmp = "[ Malformed NBDS packet. Remaining bytes don't fit an NBDS packet. Possibly due to bad decoding ]";
mNode.Add(Tmp);
Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]";
mNode.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed NBDS packet. Remaining bytes don't fit an NBDS packet. Possibly due to bad decoding ]";
return(false);
}
return(true);
}
public static bool Parser(ref TreeNodeCollection mNode,
byte [] PacketData,
ref int Index,
ref ListViewItem LItem,
bool IsCifs)
{
TreeNode mNodex;
TreeNode mNode1;
string Tmp = "";
int kk = 0;
byte NNumber = 0;
PACKET_NBSS PNbss;
mNodex = new TreeNode();
mNodex.Text = "NBSS ( Netbios Session Service )";
kk = Index;
try
{
if (Index >= PacketData.Length)
{
Tmp = "Continuation message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "NBSS";
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
mNode.Add(mNodex);
}
else
{
PNbss.MessageType = PacketData[Index++];
Tmp = "Message Type :" + Function.ReFormatString(PNbss.MessageType, GetMessageTypeString(PNbss.MessageType));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
if (IsCifs)
{
PNbss.Flags = 0;
mNode1 = new TreeNode();
Tmp = "Flags :" + Function.ReFormatString(PNbss.Flags, null);
mNode1.Text = Tmp;
Function.SetPosition(ref mNode1, Index - 1, 1, true);
mNode1.Nodes.Add(Function.DecodeBitField(PNbss.Flags, 0x1, "Add 65536 to length", "Add 0 to length"));
Function.SetPosition(ref mNode1, Index - 1, 1, false);
mNodex.Nodes.Add(mNode1);
Index++;
PNbss.Length = Function.Get4Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Length :" + Function.ReFormatString(PNbss.Length, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 4, 4, false);
}
else
{
PNbss.Flags = PacketData[Index++];
mNode1 = new TreeNode();
Tmp = "Flags :" + Function.ReFormatString(PNbss.Flags, null);
mNode1.Text = Tmp;
Function.SetPosition(ref mNode1, Index - 1, 1, true);
mNode1.Nodes.Add(Function.DecodeBitField(PNbss.Flags, 0x1, "Add 65536 to length", "Add 0 to length"));
Function.SetPosition(ref mNode1, Index - 1, 1, false);
mNodex.Nodes.Add(mNode1);
PNbss.Length = (uint)Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
if ((PNbss.Flags & Const.NBSS_FLAGS_E) > 0)
{
PNbss.Length += 65536;
}
Tmp = "Length :" + Function.ReFormatString(PNbss.Length, null);
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
}
if ((PNbss.Flags & (~Const.NBSS_FLAGS_E)) != 0)
{
// A bogus flag was set; assume it's a continuation.
Tmp = "Continuation Message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
goto LabelMe;
}
switch (PNbss.MessageType)
{
case Const.SESSION_REQUEST:
if ((PNbss.Length < 2) || (PNbss.Length > 256))
{
Tmp = "Continuation Message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
goto LabelMe;
}
PNbss.CalledName = Function.GetNetBiosName(PacketData, ref Index, ref NNumber);
Tmp = "Called Name :" + PNbss.CalledName + " ( " + Const.GetNetBiosNames(NNumber) + " )";
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 34, 34, false);
PNbss.CallingName = Function.GetNetBiosName(PacketData, ref Index, ref NNumber);
Tmp = "Calling Name :" + PNbss.CallingName + " ( " + Const.GetNetBiosNames(NNumber) + " )";
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 34, 34, false);
break;
case Const.POSITIVE_SESSION_RESPONSE:
if (PNbss.Length != 0)
{
Tmp = "Continuation Message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
goto LabelMe;
}
break;
case Const.NEGATIVE_SESSION_RESPONSE:
if (PNbss.Length != 1)
{
Tmp = "Continuation Message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
goto LabelMe;
}
PNbss.ErrorCode = PacketData[Index++];
Tmp = "Error Code :" + Function.ReFormatString(PNbss.ErrorCode, GetErrorCodeString(PNbss.ErrorCode));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 1, 1, false);
break;
case Const.SESSION_KEEP_ALIVE:
if (PNbss.Length != 0)
{
Tmp = "Continuation Message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
goto LabelMe;
}
break;
case Const.RETARGET_SESSION_RESPONSE:
if (PNbss.Length != 6)
{
Tmp = "Continuation Message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
goto LabelMe;
}
PNbss.ReTargetIpAddress = Function.GetIpAddress(PacketData, ref Index);
Tmp = "Retarget Ip Address :" + PNbss.ReTargetIpAddress;
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 4, 4, false);
PNbss.ReTargetPort = Function.Get2Bytes(PacketData, ref Index, Const.NORMAL);
Tmp = "Retarget Port :" + Function.ReFormatString(PNbss.ReTargetPort, Const.GetPortStr(PNbss.ReTargetPort));
mNodex.Nodes.Add(Tmp);
Function.SetPosition(ref mNodex, Index - 2, 2, false);
break;
case Const.SESSION_MESSAGE:
if (PNbss.Length == 0)
{
Tmp = "Continuation Message";
mNodex.Nodes.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "Continuation message";
goto LabelMe;
}
break;
}
LabelMe :;
Function.SetPosition(ref mNodex, kk, Index - kk, true);
mNode.Add(mNodex);
LItem.SubItems[Const.LIST_VIEW_PROTOCOL_INDEX].Text = "NBSS";
if (PNbss.MessageType == Const.SESSION_MESSAGE)
{
if ((Index + 4) < PacketData.Length)
{
if ((PacketData[Index] == 0xff) &&
(PacketData[Index + 1] == 0x53) &&
(PacketData[Index + 2] == 0x4d) &&
(PacketData[Index + 3] == 0x42))
{
PacketSMB.Parser(ref mNode, PacketData, ref Index, ref LItem);
}
}
}
}
}
catch (Exception Ex)
{
mNode.Add(mNodex);
Tmp = "[ Malformed NBSS packet. Remaining bytes don't fit an NBSS packet. Possibly due to bad decoding ]";
mNode.Add(Tmp);
Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]";
mNode.Add(Tmp);
LItem.SubItems[Const.LIST_VIEW_INFO_INDEX].Text = "[ Malformed NBSS packet. Remaining bytes don't fit an NBSS packet. Possibly due to bad decoding ]";
return(false);
}
return(true);
}