def decode(s, tag=False):
f = StringIO(s)
attrs = {}
attrs['version'] = unpack('!B', read_exactly(f, 1))[0]
attrs['total_length'] = unpack24(read_exactly(f, 3))
flags = unpack('!B', read_exactly(f, 1))[0]
if flags & 0x80: attrs['R'] = True
if flags & 0x40: attrs['P'] = True
if flags & 0x20: attrs['E'] = True
if flags & 0x10: attrs['T'] = True
reserved = flags & 0x0f
if reserved: attrs['reserved'] = reserved
attrs['code'] = unpack24(read_exactly(f, 3))
attrs['app_id'] = unpack('!L', read_exactly(f, 4))[0]
attrs['h2h_id'] = unpack('!L', read_exactly(f, 4))[0]
attrs['e2e_id'] = unpack('!L', read_exactly(f, 4))[0]
length = attrs['total_length']
length -= 20
if length < 0: raise MsgInvalidLength()
avps = []
data = read_exactly(f, length)
while True:
a = Avp.decode(data)
avps.append(a)
assert(a.padded_length % 4 == 0)
data = data[a.padded_length:]
if len(data) == 0:
break
attrs['avps'] = avps
m = Msg(**attrs)
if tag:
Directory.tag(m)
return m
#!/usr/bin/python
from Dia import Directory
from cPickle import dump
from datetime import datetime
print('creating Directory instance, this might take a while ...')
start = datetime.now()
d = Directory()
stop = datetime.now()
print('created in %s dumping to .dia-cache' % (stop-start))
print('contains the following applications:')
for app in d.apps:
print('%s\t\t%d (0x%x)' % (app.name, app.id, app.id))
with open('.dia-cache', 'wb') as f:
dump(d, f)
scenario = load_scenario(args.scenario, local_hostname, local_realm)
except:
print >> sys.stderr, "%s - [ERROR] Unable to load given scenario: %s" % (
time.ctime(), args.scenario)
sys.exit(-1)
vendor = args.vendor
mode = args.mode
host = args.target
port = args.port
if mode == 'client':
# Test the scenario once without fuzzing
msgs = testScn(host, port, scenario)
for (m, is_sent) in msgs:
Directory.tag(m)
start = time.ctime()
startT = time.time()
print("Scan started on %s..." % time.ctime())
for (i, fuzz) in analyze(msgs, vendor, args.min, args.max):
endT = time.time()
m, s = divmod(endT - startT, 60)
h, m = divmod(m, 60)
elapsedT = (h, m, s)
if i % 1000 == 0 and i > args.min:
percent = ((i - args.min) * 100.0) / (
(args.max - args.min) * 1.0)
print(
"%s - [INFO] %f%% : AVP %d to %d scanned (over %d) in %d:%d:%d..."
% (time.ctime(), percent, i - 1000, i, args.max,