packetnetbios.cs

一个抓包工具

						Tmp = "Remote Session Number : " + Function.ReFormatString( PNetBios.RemoteSessionNumber , null );
						mNodex.Nodes.Add( Tmp );
						Function.SetPosition( ref mNodex , Index - 1 , 1 , false );

						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						Tmp = "Local Session Number : " + Function.ReFormatString( PNetBios.LocalSessionNumber , null );
						mNodex.Nodes.Add( Tmp );
						Function.SetPosition( ref mNodex , Index - 1 , 1 , false );
						break;

					case Const.NB_RECEIVE_CONTINUE :
						Index += 5;
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						Tmp = "Xmit Correlator : " + Function.ReFormatString( PNetBios.XmitCorrelator , null );
						mNodex.Nodes.Add( Tmp );
						Function.SetPosition( ref mNodex , Index - 2 , 2 , false );

						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						Tmp = "Remote Session Number : " + Function.ReFormatString( PNetBios.RemoteSessionNumber , null );
						mNodex.Nodes.Add( Tmp );
						Function.SetPosition( ref mNodex , Index - 1 , 1 , false );

						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						Tmp = "Local Session Number : " + Function.ReFormatString( PNetBios.LocalSessionNumber , null );
						mNodex.Nodes.Add( Tmp );
						Function.SetPosition( ref mNodex , Index - 1 , 1 , false );
						break;

					case Const.NB_KEEP_ALIVE :
						Index += 7;
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						Tmp = "Remote Session Number : " + Function.ReFormatString( PNetBios.RemoteSessionNumber , null );
						mNodex.Nodes.Add( Tmp );
						Function.SetPosition( ref mNodex , Index - 1 , 1 , false );

						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						Tmp = "Local Session Number : " + Function.ReFormatString( PNetBios.LocalSessionNumber , null );
						mNodex.Nodes.Add( Tmp );
						Function.SetPosition( ref mNodex , Index - 1 , 1 , false );
						break;

				}

				LItem.SubItems[ Const.LIST_VIEW_PROTOCOL_INDEX ].Text = "NETBIOS";
				LItem.SubItems[ Const.LIST_VIEW_INFO_INDEX ].Text = "Netbios";

				Function.SetPosition( ref mNodex , kk , Index - kk , true );
				mNode.Add( mNodex );
				
			}
			catch( Exception Ex )
			{
				mNode.Add( mNodex );
				Tmp = "[ Malformed NETBIOS packet. Remaining bytes don't fit an NETBIOS packet. Possibly due to bad decoding ]";
				mNode.Add( Tmp );
				Tmp = "[ Exception raised is <" + Ex.GetType().ToString() + "> at packet index <" + Index.ToString() + "> ]";
				mNode.Add( Tmp );
				LItem.SubItems[ Const.LIST_VIEW_INFO_INDEX ].Text = "[ Malformed NETBIOS packet. Remaining bytes don't fit an NETBIOS packet. Possibly due to bad decoding ]";

				return false;
			}

			return true;

		}


		public static bool Parser( byte [] PacketData , 
			ref int Index , 
			ref ListViewItem LItem )
		{
			byte NNumber = 0;
			PACKET_NETBIOS PNetBios;

			try
			{
				PNetBios.Length = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
				PNetBios.Delimeter = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
				PNetBios.Command = PacketData[ Index++ ];


				switch( PNetBios.Command )
				{
					case Const.NB_ADD_GROUP : 
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.NameToAdd = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_ADD_NAME :
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.NameToAdd = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_NAME_IN_CONFLICT :
						PNetBios.NameInConflict = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_STATUS_QUERY :
						PNetBios.StatusRequest = PacketData[ Index ++ ];
						//???nb_data2( hf_netb_status_buffer_len, tvb, offset, tree);
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.ReceiversName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_TERMINATE_TRACE_R :
						break;

					case Const.NB_DATAGRAM :
						while( PacketData[ Index ] == 0 ) Index ++;
						PNetBios.ReceiversName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						if( Function.CheckBytesForZero( PacketData , Index , 10 ) )
						{
							Index += 10;
							PNetBios.SendersName = Function.GetMACAddress( PacketData , ref Index );
						}
						else
							PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_DATAGRAM_BCAST :
						if( Function.CheckBytesForZero( PacketData , Index , 10 ) )
						{
							Index += 10;
							PNetBios.SendersName = Function.GetMACAddress( PacketData , ref Index );
						}
						else
							PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_NAME_QUERY :
						Index ++;
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						PNetBios.CallNameType = PacketData[ Index ++ ];
						Index += 2;
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.QueryName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						if( PNetBios.LocalSessionNumber != 0 )
							PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );

						break;

					case Const.NB_ADD_NAME_RESP :
						PNetBios.Data1 = PacketData[ Index ++ ];
						PNetBios.Data2 = PacketData[ Index ++ ];
						Index ++;
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						Index += 2;
						PNetBios.ReceiversName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_NAME_RESP :
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						PNetBios.CallNameType = PacketData[ Index ++ ];
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						if( PNetBios.LocalSessionNumber != 0x00 && PNetBios.LocalSessionNumber != 0xFF)
							PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.ReceiversName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						if( PNetBios.LocalSessionNumber != 0x00 && PNetBios.LocalSessionNumber != 0xFF) 
							PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );

						break;

					case Const.NB_STATUS_RESP :
						PNetBios.StatusResponse = PacketData[ Index ++ ];
						PNetBios.Data2 = Function.Get2Bytes( PacketData , ref Index , Const.NORMAL );
						Index --;
						PNetBios.CallNameType = PacketData[ Index ++ ];
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						Index += 2;
						PNetBios.ReceiversName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						PNetBios.SendersName = Function.GetNetBiosNameSerial( PacketData , ref Index , ref NNumber );
						break;

					case Const.NB_TERMINATE_TRACE_LR :
						break;

					case Const.NB_DATA_ACK :
						Index += 5;
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_DATA_FIRST_MIDDLE :
						PNetBios.DataFirstMidleFlags = PacketData[ Index ++ ];
						PNetBios.ResyncIndicator = PacketData[ Index ++ ];
						Index ++;
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_DATA_ONLY_LAST :
						PNetBios.DataOnlyFlags = PacketData[ Index ++ ];
						PNetBios.ResyncIndicator = PacketData[ Index ++ ];
						Index ++;
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_SESSION_CONFIRM :
						PNetBios.SessionConfirmFlags = PacketData[ Index ++ ];
						PNetBios.Data2 = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_SESSION_END :
						Index ++;
						PNetBios.Data2 = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						Index += 4;
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_SESSION_INIT :
						PNetBios.SessionInitFlags = PacketData[ Index ++ ];
						PNetBios.Data2 = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.ResponseCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_NO_RECEIVE :
						PNetBios.NoReceiveFlags = PacketData[ Index ++ ];
						PNetBios.Data2 = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						Index += 2;
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_RECEIVE_OUTSTANDING :
						Index ++;
						PNetBios.Data2 = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						Index += 2;
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_RECEIVE_CONTINUE :
						Index += 5;
						PNetBios.XmitCorrelator = Function.Get2Bytes( PacketData , ref Index , Const.VALUE );
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

					case Const.NB_KEEP_ALIVE :
						Index += 7;
						PNetBios.RemoteSessionNumber = PacketData[ Index ++ ];
						PNetBios.LocalSessionNumber = PacketData[ Index ++ ];
						break;

				}


				LItem.SubItems[ Const.LIST_VIEW_PROTOCOL_INDEX ].Text = "NETBIOS";
				LItem.SubItems[ Const.LIST_VIEW_INFO_INDEX ].Text = "Netbios";

			}
			catch
			{
				LItem.SubItems[ Const.LIST_VIEW_INFO_INDEX ].Text = "[ Malformed NETBIOS packet. Remaining bytes don't fit an NETBIOS packet. Possibly due to bad decoding ]";

				return false;
			}

			return true;

		}


	}
}