def __init__(self, name, entity_class="entity_class", attributes_mask="attributes_mask"): Field.__init__(self, name=name, default=None, fmt='s') self._entity_class = entity_class self._attributes_mask = attributes_mask
def __init__(self, name, default, length_of=None, fmt="<H", adjust=None): Field.__init__(self, name, default, fmt) self.length_of = length_of if adjust is not None: self.adjust = adjust else: self.adjust = lambda pkt, x: self.lengthFromAddrMode(pkt, x)
class RTPSSubMessage_INFO_TS(EPacket): """ 0...2...........7...............15.............23...............31 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | INFO_TS | flags | octetsToNextHeader | +---------------+---------------+---------------+---------------+ | | + Timestamp timestamp [only if T==1] + | | +---------------+---------------+---------------+---------------+ """ name = "RTPS INFO_TS (0x09)" fields_desc = [ XByteField("submessageId", 0x09), FlagsField( "submessageFlags", 0, 8, ["E", "I", "?", "?", "?", "?", "?", "?"]), EField(ShortField("octetsToNextHeader", 0)), ConditionalField( Field("ts_seconds", default=0, fmt="<l"), lambda pkt: str(pkt.submessageFlags).find("I"), ), ConditionalField( Field("ts_fraction", default=0, fmt="<L"), lambda pkt: str(pkt.submessageFlags).find("I"), ), ]
def __init__(self, name, default): # create and compile the regex used to extract the uuid values from str reg = r"^\s*{0}-{1}-{1}-{2}{2}-{2}{2}{2}{2}{2}{2}\s*$".format( "([0-9a-f]{8})", "([0-9a-f]{4})", "([0-9a-f]{2})") self.reg = re.compile(reg, re.I) Field.__init__(self, name, default, fmt="I2H8B")
def __init__(self, name, default, length=11): """Initialize the field with a variable length. The 'machine' representation is a string field and the 'internal' repr. is a numeric value. """ Field.__init__(self, name, default, "%ds" % length) # Stores the length of the field self.length = length # Stores the conversion format between representations self.format = "%" + "%d" % length + "d"
class BTLE_PPI(Packet): name = "BTLE PPI header" fields_desc = [ LEShortField("pfh_type", 30006), LEShortField("pfh_datalen", 24), ByteField("btle_version", 0), LEShortField("btle_channel", None), ByteField("btle_clkn_high", None), LEIntField("btle_clk_100ns", None), Field("rssi_max", None, fmt="b"), Field("rssi_min", None, fmt="b"), Field("rssi_avg", None, fmt="b"), ByteField("rssi_count", None) ]
class ThriftMessage(Packet): fields_desc = [ Field("type", None), Field("method", None), Field("seqid", None), Field('header', None), Field('args', None), StrField("load", ""), ] def __init__(self, pkt=b"", mtype=None, method=None, seqid=None, args=None, header=None): Packet.__init__(self, pkt) self.setfieldval('type', mtype) self.setfieldval('method', method) self.setfieldval('seqid', seqid) self.setfieldval('header', header) self.setfieldval('args', args) self.setfieldval('load', pkt) if args and not isinstance(args, ThriftStruct): raise ValueError('args must be a ThriftStruct instance') if header and not isinstance(header, ThriftStruct): raise ValueError('header must be a ThriftStruct instance') def hashret(self): # The only field both Call and Reply have in common return self.method def __str__(self): header = ', header=%s' % self.header if self.header else '' field = ', fields=%s' % self.args if self.args else '' return 'type=%s, method=%s, seqid=%s%s%s' % (self.type, self.method, self.seqid, header, field) @property def as_dict(self): return { 'type': self.type, 'method': self.method, 'seqid': self.seqid, 'header': self.header.as_dict if self.header else None, 'args': self.args.as_dict if self.args else None, 'length': len(self.load), }
class SAPHDBOptionPartRow(PacketNoPadded): """SAP HANA SQL Command Network Protocol Option Part Row This packet represents a row in an Option Part. Each row is comprised of a key, type and value. """ part_kind = None option_keys = None name = "SAP HANA SQL Command Network Protocol Option Part Row" fields_desc = [ MultiEnumField("key", 0, hdb_option_part_key_vals, depends_on=lambda x: x.part_kind, fmt="<b"), EnumField("type", 0, hdb_data_type_vals, fmt="<b"), ConditionalField(FieldLenField("length", None, length_of="value", fmt="<h"), lambda x: x.type in [29, 30, 33]), MultipleTypeField( [ (LESignedByteField("value", 0), lambda x: x.type == 1), (LESignedShortField("value", 0), lambda x: x.type == 2), (LESignedIntField("value", 0), lambda x: x.type == 3), (LESignedLongField("value", 0), lambda x: x.type == 4), (Field("value", 0, fmt="<d"), lambda x: x.type == 7), (YesNoByteField("value", 0), lambda x: x.type == 28), (StrFixedLenField("value", None, length_from=lambda x: x.length), lambda x: x.type in [29, 30, 33]), ], StrField("value", ""), ), ]
class SAPDPInfo2(Packet): """SAP Dispatcher Info packet This packet is encapsulated inside SAPMS packet and before the MS ADM payload. Kernel 720. """ name = "SAP Dispatcher Info v2" fields_desc = [ ByteEnumKeysField("dp_req_prio", 0x1, dp_prio_values), XByteField("dp_blob_00", 0x2), XByteField("dp_blob_01", 0x80), XByteField("dp_blob_02", 0x21), ShortField("dp_blob_03", 0x0), ShortField("dp_blob_04", 0xffff), StrFixedLenField("dp_blob_05", "\xff\xff\xff\xff\xff", 5), ByteField("dp_addr_from_t", 0x0), StrFixedLenField("dp_blob_06", "\xff\xff", 2), StrFixedLenField("dp_blob_07", "\xff\xff\xff\xff", 4), StrFixedLenField("dp_blob_08", "\xff\xff\xff\xff", 4), StrFixedLenField("dp_blob_09", "\xff\xcc", 2), StrFixedLenField("dp_blob_10", "\x01\x00", 2), ByteField("dp_addr_from_m", 0x0), ByteField("dp_addr_from_u", 0x0), StrFixedLenField("dp_blob_11", "\xff\xff", 2), StrFixedLenField("dp_blob_12", "\xff\xff\xff\xff", 4), StrFixedLenField("dp_blob_13", "", 86), StrFixedLenField("dp_blob_14", "", 5), StrFixedLenField("dp_name_to", "", 40), XByteField("dp_blob_15", 0x0), ByteField("dp_addr_to_t", 0x0), ShortField("dp_addr_to_u", 0x0), ByteField("dp_addr_to_m", 0x0), ByteField("dp_blob_16", 0x0), ShortField("dp_respid_to", 0x0), StrFixedLenField("dp_blob_17", "\xff\xff\xff\xff", 4), StrFixedLenField("dp_blob_18", "\x00\x00\x00\x00", 4), Field("dp_blob_19", 0x1, '<L'), StrFixedLenField("dp_blob_20", "", 12), Field("dp_blob_21", 0x0, '<L'), ]
class BOOTP(Packet): name = "BOOTP" fields_desc = [ ByteEnumField("op", 1, { 1: "BOOTREQUEST", 2: "BOOTREPLY" }), ByteField("htype", 1), ByteField("hlen", 6), ByteField("hops", 0), IntField("xid", 0), ShortField("secs", 0), FlagsField("flags", 0, 16, "???????????????B"), IPField("ciaddr", "0.0.0.0"), IPField("yiaddr", "0.0.0.0"), IPField("siaddr", "0.0.0.0"), IPField("giaddr", "0.0.0.0"), Field("chaddr", b"", "16s"), Field("sname", b"", "64s"), Field("file", b"", "128s"), StrField("options", b"") ] def guess_payload_class(self, payload): if self.options[:len(dhcpmagic)] == dhcpmagic: return DHCP else: return Packet.guess_payload_class(self, payload) def extract_padding(self, s): if self.options[:len(dhcpmagic)] == dhcpmagic: # set BOOTP options to DHCP magic cookie and make rest a payload of DHCP options # noqa: E501 payload = self.options[len(dhcpmagic):] self.options = self.options[:len(dhcpmagic)] return payload, None else: return b"", None def hashret(self): return struct.pack("!I", self.xid) def answers(self, other): if not isinstance(other, BOOTP): return 0 return self.xid == other.xid
class PerPeerHeader(Packet): name = "PEERPEERHEADER" fields_desc = [ ByteField("type", 0), FlagsField("peer_flags", 0, 8, ["NA0", "NA1", "NA2", "NA3", "NA4", "A", "L", "V"]), # How to do a 16 bytes field? Field("peer_distinquisher", 0, fmt="Q"), IP6Field("peer_address", "::/0"), IntField("peer_asn", 0), IntField("peer_bgp_id", 0), IntField("timestamp_seconds", 0), IntField("timestamp_microseconds", 0), ] def extract_padding(self, p): return "", p
def __init__(self, name, default, length_of=None): Field.__init__(self, name, default, ">H") self.length_of = length_of
def __init__(self, name, default): Field.__init__(self, name, None, "8B")
def __init__(self, name, default): Field.__init__(self, name, default, "@H")
def __init__(self, name, default): Field.__init__(self, name, default, "!I") self.sz = 3
def __init__(self, name): Field.__init__(self, name, None, "H")
def __init__(self, name, default, length, to_str, to_id): self.to_str = to_str self.to_id = to_id self.length = length Field.__init__(self, name, default, "%is" % length)
class SAPDPInfo1(Packet): """SAP Dispatcher Info packet This packet is encapsulated inside SAPMS packet and before the MS ADM payload. Kernel 745 """ name = "SAP Dispatcher Info V1" fields_desc = [ ByteEnumKeysField("dp_req_prio", 0x1, dp_prio_values), IntField("dp_user_trace", 0x0), IntField("dp_req_len", 0x0), ShortField("dp_padd3", 0x0), ByteField("dp_padd4", 0x0), ByteEnumKeysField("dp_type_from", 0x2, dp_type_values), StrFixedLenField("dp_fromname", " "*40, 40), ShortField("dp_padd41", 0x0), ByteField("dp_padd42", 0x0), ByteEnumKeysField("dp_agent_type_from", 0x6, dp_agent_type_values), ShortField("dp_padd43", 0x0), ByteField("dp_padd44", 0x0), ByteEnumKeysField("dp_worker_type_from", 0x1, dp_worker_type_values), IntField("dp_worker_from_num", 0x0), ShortField("dp_padd6", 0x0), ShortField("dp_padd7", 0x0), ByteField("dp_addr_from_t", 0xff), ShortField("dp_padd8", 0x0), ShortField("dp_addr_from_u", 0xffff), ByteField("dp_addr_from_m", 0xff), ByteField("dp_padd9", 0x1), IntField("dp_respid_from", 0x0), ShortField("dp_padd10", 0x0), ByteField("dp_padd11", 0x0), ByteEnumKeysField("dp_type_to", 0x2, dp_type_values), StrFixedLenField("dp_toname", " "*40, 40), ShortField("dp_padd51", 0x0), ByteField("dp_padd52", 0x0), ByteEnumKeysField("dp_agent_type_to", 0x6, dp_agent_type_values), ShortField("dp_padd54", 0x0), ByteField("dp_padd55", 0x0), ByteEnumKeysField("dp_worker_type_to", 0x1, dp_worker_type_values), IntField("dp_worker_to_num", 0x0), ShortField("dp_padd01", 0), ShortField("dp_padd02", 0), ByteField("dp_addr_to_t", 0xff), ShortField("dp_padd03", 0x1), ShortField("dp_addr_to_u", 0xffff), ByteField("dp_addr_to_m", 0x0), ByteField("dp_padd21", 0x0), IntField("dp_respid_to", 0), ByteField("dp_padd22", 0), ShortField("dp_padd23", 0), ByteEnumKeysField("dp_req_handler", 40, dp_req_handler_values), IntField("dp_req_rc", 0x0), StrFixedLenField("dp_blob_padding", None, 224), Field("dp_blob_56", 6, '<L'), Field("dp_blob_57", 1, '<L'), Field("dp_blob_worker_from_num", 0, '<L'), ByteField("dp_blob_worker_type_from", 0), StrFixedLenField("dp_blob_62", "", 3), Field("dp_blob_addr_from_t", 0, '<L'), Field("dp_blob_addr_from_u", 0, '<L'), ByteField("dp_blob_worker_type_to", 0), StrFixedLenField("dp_blob_63", "", 3), Field("dp_blob_respid_from", 0, '<L'), StrFixedLenField("dp_blob_64", "", 3), StrFixedLenField("dp_blob_dst", "", 80), ByteField("dp_blob_xx", 0), StrFixedLenField("dp_blob_yy", "", 8), ]
def __init__(self, name, entity_class="entity_class"): Field.__init__(self, name=name, default=None, fmt='s') self._entity_class = entity_class
def getfield(self, pkt, x): if len(x) == 2: Field.__init__(self, self.name, self.default, fmt="!H") return Field.getfield(self, pkt, x)
def __init__(self, name, pad_to): Field.__init__(self, name, 0, 'B') self._pad_to = pad_to self._omci_hdr_len = 4
def __init__(self, name, default, length_from): Field.__init__(self, name, default) self.length_from = length_from
def __init__(self, name, default, count=None): Field.__init__(self, name, default, '<' + 'B' * count) self.count = count
def __init__(self, name, default, length_from): Field.__init__(self, name, default) self.length_from= length_from
def __init__(self, name, default): Field.__init__(self, name, default, "h")
def __init__(self, name, default, endianType): _repr = {0: 'bigEndian', 1: 'littleEndian'} Field.__init__(self, name, default, "16s") self.endianType = _repr[endianType]
def __init__(self, name, default): Field.__init__(self, name, default, fmt="6s")
def __init__(self, name, default): Field.__init__(self, name, default, '<h')
def __init__(self, name): Field.__init__(self, name, None, '!')