/// <summary>
/// Sets the timestamp on the packet to the same as the PCAP.
/// This is used to set the Login pcap in time with the PCAP
/// </summary>
private static PacketRecord UpdateTimestamp(PacketRecord packet)
{
packet.tsHigh = Records[0].tsHigh;
packet.tsLow = Records[0].tsLow;
packet.tsSec = Records[0].tsSec;
packet.tsUsec = Records[0].tsUsec;
return(packet);
}
private static PacketRecord UpdateGUID(PacketRecord packet)
{
packet.data[4] = (byte)(CharacterGUID & 0xFF);
packet.data[5] = (byte)(CharacterGUID >> 8 & 0xFF);
packet.data[6] = (byte)(CharacterGUID >> 16 & 0xFF);
packet.data[7] = (byte)(CharacterGUID >> 24 & 0xFF);
return(packet);
}
private static bool addPacketIfFinished(List <PacketRecord> finishedRecords, PacketRecord record)
{
record.frags.Sort(new FragNumComparer());
// Make sure all fragments are present
if (record.frags.Count < record.frags[0].memberHeader_.numFrags ||
record.frags[0].memberHeader_.blobNum != 0 ||
record.frags[record.frags.Count - 1].memberHeader_.blobNum !=
record.frags[0].memberHeader_.numFrags - 1)
{
return(false);
}
record.index = finishedRecords.Count;
// Remove duplicate fragments
int index = 0;
while (index < record.frags.Count - 1)
{
if (record.frags[index].memberHeader_.blobNum == record.frags[index + 1].memberHeader_.blobNum)
{
record.frags.RemoveAt(index);
}
else
{
index++;
}
}
int totalMessageSize = 0;
foreach (BlobFrag frag in record.frags)
{
totalMessageSize += frag.dat_.Length;
}
record.data = new byte[totalMessageSize];
int offset = 0;
foreach (BlobFrag frag in record.frags)
{
Buffer.BlockCopy(frag.dat_, 0, record.data, offset, frag.dat_.Length);
offset += frag.dat_.Length;
}
finishedRecords.Add(record);
return(true);
}
private static DateTime GetTimestamp(PacketRecord record)
{
if (IsPcapPng)
{
long microseconds = record.tsHigh;
microseconds = (microseconds << 32) | record.tsLow;
var ticks = Convert.ToInt64(microseconds * 10);
var time = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc).AddTicks(ticks);
return(time);
}
else
{
var ticks = Convert.ToInt64(record.tsUsec * 10);
var time = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc).AddSeconds(record.tsSec).AddTicks(ticks);
return(time);
}
}
private static bool readMessageData(BinaryReader binaryReader, long len, uint ts1, uint ts2,
List <PacketRecord> results, Dictionary <ulong, PacketRecord> incompletePacketMap)
{
// Begin reading headers
long packetStartPos = binaryReader.BaseStream.Position;
bool isSend = readNetworkHeaders(binaryReader);
long headersSize = binaryReader.BaseStream.Position - packetStartPos;
// Begin reading non-header packet content
StringBuilder packetHeadersStr = new StringBuilder();
StringBuilder packetTypeStr = new StringBuilder();
PacketRecord packet = null;
byte[] packetData = binaryReader.ReadBytes((int)(len - headersSize));
using (BinaryReader packetReader = new BinaryReader(new MemoryStream(packetData)))
{
try
{
ProtoHeader pHeader = ProtoHeader.read(packetReader);
uint HAS_FRAGS_MASK = 0x4; // See SharedNet::SplitPacketData
if ((pHeader.header_ & HAS_FRAGS_MASK) != 0)
{
readOptionalHeaders(pHeader.header_, packetHeadersStr, packetReader);
while (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
BlobFrag newFrag = readFragment(packetReader);
ulong blobID = newFrag.memberHeader_.blobID;
if (incompletePacketMap.ContainsKey(blobID))
{
packet = incompletePacketMap[newFrag.memberHeader_.blobID];
}
else
{
packet = new PacketRecord();
incompletePacketMap.Add(blobID, packet);
}
if (newFrag.memberHeader_.blobNum == 0)
{
packet.isSend = isSend;
if (IsPcapPng)
{
packet.tsLow = ts1;
packet.tsHigh = ts2;
}
else
{
packet.tsSec = ts1;
packet.tsUsec = ts2;
}
packet.extraInfo = "";
using (BinaryReader fragDataReader = new BinaryReader(new MemoryStream(newFrag.dat_)))
{
PacketOpcode opcode = Util.readOpcode(fragDataReader);
packet.opcodes.Add(opcode);
packet.packetTypeStr = opcode.ToString();
}
}
packet.packetHeadersStr += packetHeadersStr.ToString();
packet.frags.Add(newFrag);
if (addPacketIfFinished(results, packet))
{
incompletePacketMap.Remove(blobID);
}
}
if (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
packet.extraInfo = "Didnt read entire packet! " + packet.extraInfo;
}
}
}
catch (OutOfMemoryException)
{
//MessageBox.Show("Out of memory (packet " + curPacket + "), stopping read: " + e);
return(false);
}
catch (Exception e)
{
packet.extraInfo += "EXCEPTION: " + e.Message + " " + e.StackTrace;
}
}
return(true);
}
private static PacketRecord readPacketData(BinaryReader binaryReader, long len, uint ts1, uint ts2,
int curPacket)
{
// Begin reading headers
long packetStartPos = binaryReader.BaseStream.Position;
bool isSend = readNetworkHeaders(binaryReader);
long headersSize = binaryReader.BaseStream.Position - packetStartPos;
// Begin reading non-header packet content
StringBuilder packetHeadersStr = new StringBuilder();
StringBuilder packetTypeStr = new StringBuilder();
PacketRecord packet = new PacketRecord()
{
index = curPacket,
isSend = isSend,
extraInfo = "",
data = binaryReader.ReadBytes((int)(len - headersSize))
};
if (IsPcapPng)
{
packet.tsLow = ts1;
packet.tsHigh = ts2;
}
else
{
packet.tsSec = ts1;
packet.tsUsec = ts2;
}
using (BinaryReader packetReader = new BinaryReader(new MemoryStream(packet.data)))
{
try
{
ProtoHeader pHeader = ProtoHeader.read(packetReader);
packet.optionalHeadersLen = readOptionalHeaders(pHeader.header_, packetHeadersStr, packetReader);
if (packetReader.BaseStream.Position == packetReader.BaseStream.Length)
{
packetTypeStr.Append("<Header Only>");
}
uint HAS_FRAGS_MASK = 0x4; // See SharedNet::SplitPacketData
if ((pHeader.header_ & HAS_FRAGS_MASK) != 0)
{
while (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
if (packetTypeStr.Length != 0)
{
packetTypeStr.Append(" + ");
}
BlobFrag newFrag = readFragment(packetReader);
packet.frags.Add(newFrag);
packet.queueID = newFrag.memberHeader_.queueID;
if (newFrag.memberHeader_.blobNum != 0)
{
packetTypeStr.Append("FragData[");
packetTypeStr.Append(newFrag.memberHeader_.blobNum);
packetTypeStr.Append("]");
}
else
{
using (BinaryReader fragDataReader = new BinaryReader(new MemoryStream(newFrag.dat_)))
{
PacketOpcode opcode = Util.readOpcode(fragDataReader);
packet.opcodes.Add(opcode);
packetTypeStr.Append(opcode);
}
}
}
}
if (packetReader.BaseStream.Position != packetReader.BaseStream.Length)
{
packet.extraInfo = "Didnt read entire packet! " + packet.extraInfo;
}
}
catch (OutOfMemoryException)
{
//MessageBox.Show("Out of memory (packet " + curPacket + "), stopping read: " + e);
return(null);
}
catch (Exception e)
{
packet.extraInfo += "EXCEPTION: " + e.Message + " " + e.StackTrace;
}
}
packet.packetHeadersStr = packetHeadersStr.ToString();
packet.packetTypeStr = packetTypeStr.ToString();
return(packet);
}