From d62be280a151883866554e9ea00a5efed2fa593a Mon Sep 17 00:00:00 2001 From: Mosder Date: Wed, 17 Jun 2026 22:55:55 +0200 Subject: feat: added simple reading of packets from file and printing the payloads. TODO: utilize TCP sequence number to make sure the stream is read in order and parse the packets without reassemblying the entire stream (which might be enormous), but keeping in mind that entire fight result might be accross multiple segments --- Makefile | 10 ++++++++-- analyzer/analyzer.c | 36 ++++++++++++++++++++++++++++++++++++ analyzer/analyzer.h | 7 +++++++ analyzer/utils/pcap.c | 36 ++++++++++++++++++++++++++++++++++++ analyzer/utils/pcap.h | 13 +++++++++++++ main.c | 9 +-------- 6 files changed, 101 insertions(+), 10 deletions(-) create mode 100644 analyzer/analyzer.c create mode 100644 analyzer/analyzer.h create mode 100644 analyzer/utils/pcap.c create mode 100644 analyzer/utils/pcap.h diff --git a/Makefile b/Makefile index a85df64..d0a760e 100644 --- a/Makefile +++ b/Makefile @@ -4,13 +4,19 @@ global: compile local: compile mv branal ${HOME}/.local/bin -compile: utils capture - gcc *.o main.c -o branal +compile: utils capture analyzer + gcc *.o main.c -lpcap -o branal rm *.o utils: gcc -c analyzer/utils/fs.c gcc -c analyzer/utils/time.c + gcc -c analyzer/utils/pcap.c capture: gcc -c analyzer/capture.c + +analyzer: + gcc -c analyzer/analyzer.c + +.PHONY: analyzer diff --git a/analyzer/analyzer.c b/analyzer/analyzer.c new file mode 100644 index 0000000..7790f41 --- /dev/null +++ b/analyzer/analyzer.c @@ -0,0 +1,36 @@ +#include "analyzer.h" + +#include + +#include "utils/pcap.h" + +void analyze_file(char *path) { + // open the file + char errbuf[PCAP_ERRBUF_SIZE]; + pcap_t *handle = pcap_open_offline(path, errbuf); + + // handle errors + if (handle == NULL) { + printf("Couldn't open the specified file:\n%s\n", errbuf); + return; + } + + struct pcap_pkthdr *packet_data; + const unsigned char *packet; + const unsigned char *payload; + + // read packets from the file + while (pcap_next_ex(handle, &packet_data, &packet) == 1) { + int payload_len; + payload = get_payload_from_packet(packet, packet_data, &payload_len); + if (payload_len > 0) { + printf("\n----------------\n"); + printf("Payload length: %d\n", payload_len); + printf("Payload:\n"); + fflush(stdout); + write(STDOUT_FILENO, payload, payload_len); + } + } + + pcap_close(handle); +} diff --git a/analyzer/analyzer.h b/analyzer/analyzer.h new file mode 100644 index 0000000..1b8d2f9 --- /dev/null +++ b/analyzer/analyzer.h @@ -0,0 +1,7 @@ +// analyzer.h +// functions for analyzing the packets received from the game server + +// analyze file +// params: +// - path - path to the file to analyze +extern void analyze_file(char *path); diff --git a/analyzer/utils/pcap.c b/analyzer/utils/pcap.c new file mode 100644 index 0000000..cdefba7 --- /dev/null +++ b/analyzer/utils/pcap.c @@ -0,0 +1,36 @@ +#include "pcap.h" + +#include +#include +#include + +const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len) { + // get Ethernet header + const struct ether_header *eth_header = (const struct ether_header *)packet; + int eth_header_len = sizeof(struct ether_header); + + // check if it's IP + if (ntohs(eth_header->ether_type) != ETHERTYPE_IP) { + *payload_len = -1; + return NULL; + } + + // get IP header + const struct ip *ip_header = (const struct ip *)(packet + eth_header_len); + int ip_header_len = ip_header->ip_hl * 4; + + // check if it's TCP + if (ip_header->ip_p != IPPROTO_TCP) { + *payload_len = -1; + return NULL; + } + + // get TCP header + const struct tcphdr *tcp_header = (const struct tcphdr *)(packet + eth_header_len + ip_header_len); + int tcp_header_len = tcp_header->th_off * 4; + + // get payload + int total_header_len = eth_header_len + ip_header_len + tcp_header_len; + *payload_len = packet_data->caplen - total_header_len; + return packet + total_header_len; +} diff --git a/analyzer/utils/pcap.h b/analyzer/utils/pcap.h new file mode 100644 index 0000000..d31b961 --- /dev/null +++ b/analyzer/utils/pcap.h @@ -0,0 +1,13 @@ +// utils/pcap.h +// helper functions for usage of libpcap + +#include + +// get payload from a TCP/IP packet +// params: +// - packet - captured packet +// - packet_data - metadata about packet +// - payload_len - pointer to save the payload length to or -1 if not a correct packet +// returns: +// pointer to the payload or NULL if not a correct packet +extern const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len); diff --git a/main.c b/main.c index 456b590..eadb516 100644 --- a/main.c +++ b/main.c @@ -1,6 +1,7 @@ #include #include +#include "analyzer/analyzer.h" #include "analyzer/capture.h" #include "analyzer/utils/fs.h" @@ -22,14 +23,6 @@ void start_live_analyzer() { printf("Not implemented\n"); } -// analyzes the specified file -// params: -// - file_path - path to the .pcap file to be analyzed -void analyze_file(char *file_path) { - // TODO: implement - printf("Not implemented\n"); -} - int main(int argc, char *argv[]) { create_necessary_directories(); -- cgit v1.2.3