diff options
| author | Xusheng <xusheng@vector35.com> | 2021-07-01 12:34:30 +0800 |
|---|---|---|
| committer | Xusheng Li <xushengli@protonmail.com> | 2021-07-05 10:11:47 +0800 |
| commit | 13ff200ba134b8704f37eca99c42b70dab0d17dc (patch) | |
| tree | 876b3db3c53f704b31152aeaede1f2edc9d27b24 /python/examples/kaitai/microsoft_network_monitor_v2.py | |
| parent | 4039a800349dcd587833d3e27d9137e4649818f4 (diff) | |
Remove snippet and kaitai plugin. Note their individual links.
Diffstat (limited to 'python/examples/kaitai/microsoft_network_monitor_v2.py')
| -rw-r--r-- | python/examples/kaitai/microsoft_network_monitor_v2.py | 306 |
1 files changed, 0 insertions, 306 deletions
diff --git a/python/examples/kaitai/microsoft_network_monitor_v2.py b/python/examples/kaitai/microsoft_network_monitor_v2.py deleted file mode 100644 index be145e11..00000000 --- a/python/examples/kaitai/microsoft_network_monitor_v2.py +++ /dev/null @@ -1,306 +0,0 @@ -# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild - -from pkg_resources import parse_version -from .kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO -from enum import Enum -import collections - - -if parse_version(ks_version) < parse_version('0.7'): - raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version)) - -from . import windows_systemtime -from . import ethernet_frame -class MicrosoftNetworkMonitorV2(KaitaiStruct): - """Microsoft Network Monitor (AKA Netmon) is a proprietary Microsoft's - network packet sniffing and analysis tool. It can save captured - traffic as .cap files, which usually contain the packets and may - contain some additional info - enhanced network info, calculated - statistics, etc. - - There are at least 2 different versions of the format: v1 and - v2. Netmon v3 seems to use the same file format as v1. - - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ee817717.aspx - """ - - class Linktype(Enum): - null_linktype = 0 - ethernet = 1 - ax25 = 3 - ieee802_5 = 6 - arcnet_bsd = 7 - slip = 8 - ppp = 9 - fddi = 10 - ppp_hdlc = 50 - ppp_ether = 51 - atm_rfc1483 = 100 - raw = 101 - c_hdlc = 104 - ieee802_11 = 105 - frelay = 107 - loop = 108 - linux_sll = 113 - ltalk = 114 - pflog = 117 - ieee802_11_prism = 119 - ip_over_fc = 122 - sunatm = 123 - ieee802_11_radiotap = 127 - arcnet_linux = 129 - apple_ip_over_ieee1394 = 138 - mtp2_with_phdr = 139 - mtp2 = 140 - mtp3 = 141 - sccp = 142 - docsis = 143 - linux_irda = 144 - user0 = 147 - user1 = 148 - user2 = 149 - user3 = 150 - user4 = 151 - user5 = 152 - user6 = 153 - user7 = 154 - user8 = 155 - user9 = 156 - user10 = 157 - user11 = 158 - user12 = 159 - user13 = 160 - user14 = 161 - user15 = 162 - ieee802_11_avs = 163 - bacnet_ms_tp = 165 - ppp_pppd = 166 - gprs_llc = 169 - gpf_t = 170 - gpf_f = 171 - linux_lapd = 177 - bluetooth_hci_h4 = 187 - usb_linux = 189 - ppi = 192 - ieee802_15_4 = 195 - sita = 196 - erf = 197 - bluetooth_hci_h4_with_phdr = 201 - ax25_kiss = 202 - lapd = 203 - ppp_with_dir = 204 - c_hdlc_with_dir = 205 - frelay_with_dir = 206 - ipmb_linux = 209 - ieee802_15_4_nonask_phy = 215 - usb_linux_mmapped = 220 - fc_2 = 224 - fc_2_with_frame_delims = 225 - ipnet = 226 - can_socketcan = 227 - ipv4 = 228 - ipv6 = 229 - ieee802_15_4_nofcs = 230 - dbus = 231 - dvb_ci = 235 - mux27010 = 236 - stanag_5066_d_pdu = 237 - nflog = 239 - netanalyzer = 240 - netanalyzer_transparent = 241 - ipoib = 242 - mpeg_2_ts = 243 - ng40 = 244 - nfc_llcp = 245 - infiniband = 247 - sctp = 248 - usbpcap = 249 - rtac_serial = 250 - bluetooth_le_ll = 251 - netlink = 253 - bluetooth_linux_monitor = 254 - bluetooth_bredr_bb = 255 - bluetooth_le_ll_with_phdr = 256 - profibus_dl = 257 - pktap = 258 - epon = 259 - ipmi_hpm_2 = 260 - zwave_r1_r2 = 261 - zwave_r3 = 262 - wattstopper_dlm = 263 - iso_14443 = 264 - SEQ_FIELDS = ["signature", "version_minor", "version_major", "mac_type", "time_capture_start", "frame_table_ofs", "frame_table_len", "user_data_ofs", "user_data_len", "comment_ofs", "comment_len", "statistics_ofs", "statistics_len", "network_info_ofs", "network_info_len", "conversation_stats_ofs", "conversation_stats_len"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['signature']['start'] = self._io.pos() - self.signature = self._io.ensure_fixed_contents(b"\x47\x4D\x42\x55") - self._debug['signature']['end'] = self._io.pos() - self._debug['version_minor']['start'] = self._io.pos() - self.version_minor = self._io.read_u1() - self._debug['version_minor']['end'] = self._io.pos() - self._debug['version_major']['start'] = self._io.pos() - self.version_major = self._io.read_u1() - self._debug['version_major']['end'] = self._io.pos() - self._debug['mac_type']['start'] = self._io.pos() - self.mac_type = KaitaiStream.resolve_enum(self._root.Linktype, self._io.read_u2le()) - self._debug['mac_type']['end'] = self._io.pos() - self._debug['time_capture_start']['start'] = self._io.pos() - self.time_capture_start = windows_systemtime.WindowsSystemtime(self._io) - self.time_capture_start._read() - self._debug['time_capture_start']['end'] = self._io.pos() - self._debug['frame_table_ofs']['start'] = self._io.pos() - self.frame_table_ofs = self._io.read_u4le() - self._debug['frame_table_ofs']['end'] = self._io.pos() - self._debug['frame_table_len']['start'] = self._io.pos() - self.frame_table_len = self._io.read_u4le() - self._debug['frame_table_len']['end'] = self._io.pos() - self._debug['user_data_ofs']['start'] = self._io.pos() - self.user_data_ofs = self._io.read_u4le() - self._debug['user_data_ofs']['end'] = self._io.pos() - self._debug['user_data_len']['start'] = self._io.pos() - self.user_data_len = self._io.read_u4le() - self._debug['user_data_len']['end'] = self._io.pos() - self._debug['comment_ofs']['start'] = self._io.pos() - self.comment_ofs = self._io.read_u4le() - self._debug['comment_ofs']['end'] = self._io.pos() - self._debug['comment_len']['start'] = self._io.pos() - self.comment_len = self._io.read_u4le() - self._debug['comment_len']['end'] = self._io.pos() - self._debug['statistics_ofs']['start'] = self._io.pos() - self.statistics_ofs = self._io.read_u4le() - self._debug['statistics_ofs']['end'] = self._io.pos() - self._debug['statistics_len']['start'] = self._io.pos() - self.statistics_len = self._io.read_u4le() - self._debug['statistics_len']['end'] = self._io.pos() - self._debug['network_info_ofs']['start'] = self._io.pos() - self.network_info_ofs = self._io.read_u4le() - self._debug['network_info_ofs']['end'] = self._io.pos() - self._debug['network_info_len']['start'] = self._io.pos() - self.network_info_len = self._io.read_u4le() - self._debug['network_info_len']['end'] = self._io.pos() - self._debug['conversation_stats_ofs']['start'] = self._io.pos() - self.conversation_stats_ofs = self._io.read_u4le() - self._debug['conversation_stats_ofs']['end'] = self._io.pos() - self._debug['conversation_stats_len']['start'] = self._io.pos() - self.conversation_stats_len = self._io.read_u4le() - self._debug['conversation_stats_len']['end'] = self._io.pos() - - class FrameIndex(KaitaiStruct): - SEQ_FIELDS = ["entries"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['entries']['start'] = self._io.pos() - self.entries = [] - i = 0 - while not self._io.is_eof(): - if not 'arr' in self._debug['entries']: - self._debug['entries']['arr'] = [] - self._debug['entries']['arr'].append({'start': self._io.pos()}) - _t_entries = self._root.FrameIndexEntry(self._io, self, self._root) - _t_entries._read() - self.entries.append(_t_entries) - self._debug['entries']['arr'][len(self.entries) - 1]['end'] = self._io.pos() - i += 1 - - self._debug['entries']['end'] = self._io.pos() - - - class FrameIndexEntry(KaitaiStruct): - """Each index entry is just a pointer to where the frame data is - stored in the file. - """ - SEQ_FIELDS = ["ofs"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['ofs']['start'] = self._io.pos() - self.ofs = self._io.read_u4le() - self._debug['ofs']['end'] = self._io.pos() - - @property - def body(self): - """Frame body itself.""" - if hasattr(self, '_m_body'): - return self._m_body if hasattr(self, '_m_body') else None - - io = self._root._io - _pos = io.pos() - io.seek(self.ofs) - self._debug['_m_body']['start'] = io.pos() - self._m_body = self._root.Frame(io, self, self._root) - self._m_body._read() - self._debug['_m_body']['end'] = io.pos() - io.seek(_pos) - return self._m_body if hasattr(self, '_m_body') else None - - - class Frame(KaitaiStruct): - """A container for actually captured network data. Allow to - timestamp individual frames and designates how much data from - the original packet was actually written into the file. - - .. seealso:: - Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ee831821.aspx - """ - SEQ_FIELDS = ["ts_delta", "orig_len", "inc_len", "body"] - def __init__(self, _io, _parent=None, _root=None): - self._io = _io - self._parent = _parent - self._root = _root if _root else self - self._debug = collections.defaultdict(dict) - - def _read(self): - self._debug['ts_delta']['start'] = self._io.pos() - self.ts_delta = self._io.read_u8le() - self._debug['ts_delta']['end'] = self._io.pos() - self._debug['orig_len']['start'] = self._io.pos() - self.orig_len = self._io.read_u4le() - self._debug['orig_len']['end'] = self._io.pos() - self._debug['inc_len']['start'] = self._io.pos() - self.inc_len = self._io.read_u4le() - self._debug['inc_len']['end'] = self._io.pos() - self._debug['body']['start'] = self._io.pos() - _on = self._root.mac_type - if _on == self._root.Linktype.ethernet: - self._raw_body = self._io.read_bytes(self.inc_len) - io = KaitaiStream(BytesIO(self._raw_body)) - self.body = ethernet_frame.EthernetFrame(io) - self.body._read() - else: - self.body = self._io.read_bytes(self.inc_len) - self._debug['body']['end'] = self._io.pos() - - - @property - def frame_table(self): - """Index that is used to access individual captured frames.""" - if hasattr(self, '_m_frame_table'): - return self._m_frame_table if hasattr(self, '_m_frame_table') else None - - _pos = self._io.pos() - self._io.seek(self.frame_table_ofs) - self._debug['_m_frame_table']['start'] = self._io.pos() - self._raw__m_frame_table = self._io.read_bytes(self.frame_table_len) - io = KaitaiStream(BytesIO(self._raw__m_frame_table)) - self._m_frame_table = self._root.FrameIndex(io, self, self._root) - self._m_frame_table._read() - self._debug['_m_frame_table']['end'] = self._io.pos() - self._io.seek(_pos) - return self._m_frame_table if hasattr(self, '_m_frame_table') else None - - |
