4 files changed, 92 insertions, 0 deletions
diff --git a/analyzer/analyzer.c b/analyzer/analyzer.c
new file mode 100644
index 0000000..7790f41
--- /dev/null
+++ b/analyzer/analyzer.c
@@ -0,0 +1,36 @@
+#include "analyzer.h"
+
+#include <unistd.h>
+
+#include "utils/pcap.h"
+
+void analyze_file(char *path) {
+    // open the file
+    char errbuf[PCAP_ERRBUF_SIZE];
+    pcap_t *handle = pcap_open_offline(path, errbuf);
+
+    // handle errors
+    if (handle == NULL) {
+        printf("Couldn't open the specified file:\n%s\n", errbuf);
+        return;
+    }
+
+    struct pcap_pkthdr *packet_data;
+    const unsigned char *packet;
+    const unsigned char *payload;
+
+    // read packets from the file
+    while (pcap_next_ex(handle, &packet_data, &packet) == 1) {
+        int payload_len;
+        payload = get_payload_from_packet(packet, packet_data, &payload_len);
+        if (payload_len > 0) {
+            printf("\n----------------\n");
+            printf("Payload length: %d\n", payload_len);
+            printf("Payload:\n");
+            fflush(stdout);
+            write(STDOUT_FILENO, payload, payload_len);
+        }
+    }
+
+    pcap_close(handle);
+}
diff --git a/analyzer/analyzer.h b/analyzer/analyzer.h
new file mode 100644
index 0000000..1b8d2f9
--- /dev/null
+++ b/analyzer/analyzer.h
@@ -0,0 +1,7 @@
+// analyzer.h
+// functions for analyzing the packets received from the game server
+
+// analyze file
+// params:
+//      - path - path to the file to analyze
+extern void analyze_file(char *path);
diff --git a/analyzer/utils/pcap.c b/analyzer/utils/pcap.c
new file mode 100644
index 0000000..cdefba7
--- /dev/null
+++ b/analyzer/utils/pcap.c
@@ -0,0 +1,36 @@
+#include "pcap.h"
+
+#include <netinet/if_ether.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+
+const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len) {
+    // get Ethernet header
+    const struct ether_header *eth_header = (const struct ether_header *)packet;
+    int eth_header_len = sizeof(struct ether_header);
+
+    // check if it's IP
+    if (ntohs(eth_header->ether_type) != ETHERTYPE_IP) {
+        *payload_len = -1;
+        return NULL;
+    }
+
+    // get IP header
+    const struct ip *ip_header = (const struct ip *)(packet + eth_header_len);
+    int ip_header_len = ip_header->ip_hl * 4;
+
+    // check if it's TCP
+    if (ip_header->ip_p != IPPROTO_TCP) {
+        *payload_len = -1;
+        return NULL;
+    }
+
+    // get TCP header
+    const struct tcphdr *tcp_header = (const struct tcphdr *)(packet + eth_header_len + ip_header_len);
+    int tcp_header_len = tcp_header->th_off * 4;
+
+    // get payload
+    int total_header_len = eth_header_len + ip_header_len + tcp_header_len;
+    *payload_len = packet_data->caplen - total_header_len;
+    return packet + total_header_len;
+}
diff --git a/analyzer/utils/pcap.h b/analyzer/utils/pcap.h
new file mode 100644
index 0000000..d31b961
--- /dev/null
+++ b/analyzer/utils/pcap.h
@@ -0,0 +1,13 @@
+// utils/pcap.h
+// helper functions for usage of libpcap
+
+#include <pcap.h>
+
+// get payload from a TCP/IP packet
+// params:
+//      - packet - captured packet
+//      - packet_data - metadata about packet
+//      - payload_len - pointer to save the payload length to or -1 if not a correct packet
+// returns:
+//      pointer to the payload or NULL if not a correct packet
+extern const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len);