diff options
| -rw-r--r-- | Makefile | 10 | ||||
| -rw-r--r-- | analyzer/analyzer.c | 36 | ||||
| -rw-r--r-- | analyzer/analyzer.h | 7 | ||||
| -rw-r--r-- | analyzer/utils/pcap.c | 36 | ||||
| -rw-r--r-- | analyzer/utils/pcap.h | 13 | ||||
| -rw-r--r-- | main.c | 9 |
6 files changed, 101 insertions, 10 deletions
@@ -4,13 +4,19 @@ global: compile local: compile mv branal ${HOME}/.local/bin -compile: utils capture - gcc *.o main.c -o branal +compile: utils capture analyzer + gcc *.o main.c -lpcap -o branal rm *.o utils: gcc -c analyzer/utils/fs.c gcc -c analyzer/utils/time.c + gcc -c analyzer/utils/pcap.c capture: gcc -c analyzer/capture.c + +analyzer: + gcc -c analyzer/analyzer.c + +.PHONY: analyzer diff --git a/analyzer/analyzer.c b/analyzer/analyzer.c new file mode 100644 index 0000000..7790f41 --- /dev/null +++ b/analyzer/analyzer.c @@ -0,0 +1,36 @@ +#include "analyzer.h" + +#include <unistd.h> + +#include "utils/pcap.h" + +void analyze_file(char *path) { + // open the file + char errbuf[PCAP_ERRBUF_SIZE]; + pcap_t *handle = pcap_open_offline(path, errbuf); + + // handle errors + if (handle == NULL) { + printf("Couldn't open the specified file:\n%s\n", errbuf); + return; + } + + struct pcap_pkthdr *packet_data; + const unsigned char *packet; + const unsigned char *payload; + + // read packets from the file + while (pcap_next_ex(handle, &packet_data, &packet) == 1) { + int payload_len; + payload = get_payload_from_packet(packet, packet_data, &payload_len); + if (payload_len > 0) { + printf("\n----------------\n"); + printf("Payload length: %d\n", payload_len); + printf("Payload:\n"); + fflush(stdout); + write(STDOUT_FILENO, payload, payload_len); + } + } + + pcap_close(handle); +} diff --git a/analyzer/analyzer.h b/analyzer/analyzer.h new file mode 100644 index 0000000..1b8d2f9 --- /dev/null +++ b/analyzer/analyzer.h @@ -0,0 +1,7 @@ +// analyzer.h +// functions for analyzing the packets received from the game server + +// analyze file +// params: +// - path - path to the file to analyze +extern void analyze_file(char *path); diff --git a/analyzer/utils/pcap.c b/analyzer/utils/pcap.c new file mode 100644 index 0000000..cdefba7 --- /dev/null +++ b/analyzer/utils/pcap.c @@ -0,0 +1,36 @@ +#include "pcap.h" + +#include <netinet/if_ether.h> +#include <netinet/ip.h> +#include <netinet/tcp.h> + +const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len) { + // get Ethernet header + const struct ether_header *eth_header = (const struct ether_header *)packet; + int eth_header_len = sizeof(struct ether_header); + + // check if it's IP + if (ntohs(eth_header->ether_type) != ETHERTYPE_IP) { + *payload_len = -1; + return NULL; + } + + // get IP header + const struct ip *ip_header = (const struct ip *)(packet + eth_header_len); + int ip_header_len = ip_header->ip_hl * 4; + + // check if it's TCP + if (ip_header->ip_p != IPPROTO_TCP) { + *payload_len = -1; + return NULL; + } + + // get TCP header + const struct tcphdr *tcp_header = (const struct tcphdr *)(packet + eth_header_len + ip_header_len); + int tcp_header_len = tcp_header->th_off * 4; + + // get payload + int total_header_len = eth_header_len + ip_header_len + tcp_header_len; + *payload_len = packet_data->caplen - total_header_len; + return packet + total_header_len; +} diff --git a/analyzer/utils/pcap.h b/analyzer/utils/pcap.h new file mode 100644 index 0000000..d31b961 --- /dev/null +++ b/analyzer/utils/pcap.h @@ -0,0 +1,13 @@ +// utils/pcap.h +// helper functions for usage of libpcap + +#include <pcap.h> + +// get payload from a TCP/IP packet +// params: +// - packet - captured packet +// - packet_data - metadata about packet +// - payload_len - pointer to save the payload length to or -1 if not a correct packet +// returns: +// pointer to the payload or NULL if not a correct packet +extern const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len); @@ -1,6 +1,7 @@ #include <stdio.h> #include <string.h> +#include "analyzer/analyzer.h" #include "analyzer/capture.h" #include "analyzer/utils/fs.h" @@ -22,14 +23,6 @@ void start_live_analyzer() { printf("Not implemented\n"); } -// analyzes the specified file -// params: -// - file_path - path to the .pcap file to be analyzed -void analyze_file(char *file_path) { - // TODO: implement - printf("Not implemented\n"); -} - int main(int argc, char *argv[]) { create_necessary_directories(); |