p
/
hex
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

pcap.lua: slight cleanup 

Should be a tiny bit faster, too.
This commit is contained in:
Přemysl Eric Janouch 2017-01-27 00:03:26 +01:00
parent aff07bc63d
commit 9d81b137e7
Signed by: p
GPG Key ID: B715679E3A361BE6
1 changed files with 43 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
plugins/pcap.lua
View File

@ -182,34 +182,19 @@ end
hex.register { type="pcap", detect=detect, decode=decode }
-- As described by https://github.com/pcapng/pcapng
local decode_ng = function (c)
assert (c.position == 1)
if not detect_ng (c ()) then error ("not a PCAPNG file") end
local block_types = {
[0x0a0d0d0a] = "Section Header Block",
[0x00000001] = "Interface Description Block",
[0x00000003] = "Simple Packet Block",
[0x00000004] = "Name Resolution Block",
[0x00000005] = "Interface Statistics Block",
[0x00000006] = "Enhanced Packet Block",
c.endianity = "le"
c (9):u32 ("byte-order magic: %s", function (u32)
if u32 == 0x1a2b3c4d then return "little-endian" end
[0x00000BAD] = "Custom Block",
[0x40000BAD] = "Custom Block"
}
c.endianity = "be"
return "big-endian"
end)
local function decode_block_type (u32)
if u32 == 0x0a0d0d0a then return "Section Header Block" end
if u32 == 0x00000001 then return "Interface Description Block" end
if u32 == 0x00000003 then return "Simple Packet Block" end
if u32 == 0x00000004 then return "Name Resolution Block" end
if u32 == 0x00000005 then return "Interface Statistics Block" end
if u32 == 0x00000006 then return "Enhanced Packet Block" end
if u32 == 0x00000BAD or u32 == 0x40000BAD then
return "Custom Block"
end
return "unknown: %d", u32
end
local function decode_shb (c)
local decode_shb = function (c)
local magic = c:u32 ()
local p, vmajor, vminor = c.position, c:u16 (), c:u16 ()
c (p, c.position - 1):mark ("PCAPNG version: %d.%d", vmajor, vminor)
@ -227,19 +212,37 @@ local decode_ng = function (c)
end
end
local block_decoders = {
-- TODO: also decode other types of blocks
[0x0a0d0d0a] = decode_shb
}
-- As described by https://github.com/pcapng/pcapng
local decode_ng = function (c)
assert (c.position == 1)
if not detect_ng (c ()) then error ("not a PCAPNG file") end
c.endianity = "le"
c (9):u32 ("byte-order magic: %s", function (u32)
if u32 == 0x1a2b3c4d then return "little-endian" end
c.endianity = "be"
return "big-endian"
end)
while not c.eof do
local block_start = c.position
local block_type = c:u32 ("PCAPNG block type: %s", decode_block_type)
local block_type = c:u32 ("PCAPNG block type: %s", function (u32)
local name = block_types[u32]
if name then return name end
return "unknown: %d", u32
end)
local block_len = c:u32 ("PCAPNG block length: %d")
local data_start = c.position
c.position = block_start + block_len - 4
local data = c (data_start, c.position - 1)
-- TODO: also decode other types of blocks
if block_type == 0x0a0d0d0a then decode_shb (data) end
local shb_len_end = c:u32 ("PCAPNG trailing block length: %d")
local decoder = block_decoders[block_type]
if decoder then decoder (c (data_start, c.position - 1)) end
c:u32 ("PCAPNG trailing block length: %d")
end
end