2 Unix SMB/CIFS implementation.
3 Utility to extract pcap files from samba (log level 10) log files
5 Copyright (C) Jelmer Vernooij 2003
6 Thanks to Tim Potter for the genial idea
8 Example use: log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
30 #define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
32 void print_packet(FILE *out, unsigned char *data, long length)
34 long i,cur = 0;int tmp;
36 fprintf(out, "%06X ", cur);
37 for(i = cur; i < length && i < cur + 16; i++) {
38 fprintf(out, "%02x ", data[i]);
46 unsigned char *curpacket = NULL;
47 long curpacket_len = 0;
49 void read_log_msg(FILE *in, unsigned char **_buffer, long *buffersize, long *data_offset, long *data_length)
51 unsigned char *buffer;
53 assert(fscanf(in, " size=%d\n", buffersize));
54 *buffersize+=4; /* for netbios */
55 buffer = malloc(*buffersize);
56 memset(buffer, 0, *buffersize);
60 memcpy(buffer+2, &buffersize, 2);
65 assert(fscanf(in, " smb_com=0x%x\n", &tmp)); buffer[smb_com] = tmp;
66 assert(fscanf(in, " smb_rcls=%d\n", &tmp)); buffer[smb_rcls] = tmp;
67 assert(fscanf(in, " smb_reh=%d\n", &tmp)); buffer[smb_reh] = tmp;
68 assert(fscanf(in, " smb_err=%d\n", &tmp)); memcpy(buffer+smb_err, &tmp, 2);
69 assert(fscanf(in, " smb_flg=%d\n", &tmp)); buffer[smb_flg] = tmp;
70 assert(fscanf(in, " smb_flg2=%d\n", &tmp)); memcpy(buffer+smb_flg2, &tmp, 2);
71 assert(fscanf(in, " smb_tid=%d\n", &tmp)); memcpy(buffer+smb_tid, &tmp, 2);
72 assert(fscanf(in, " smb_pid=%d\n", &tmp)); memcpy(buffer+smb_pid, &tmp, 2);
73 assert(fscanf(in, " smb_uid=%d\n", &tmp)); memcpy(buffer+smb_uid, &tmp, 2);
74 assert(fscanf(in, " smb_mid=%d\n", &tmp)); memcpy(buffer+smb_mid, &tmp, 2);
75 assert(fscanf(in, " smt_wct=%d\n", &tmp)); buffer[smb_wct] = tmp;
76 for(i = 0; i < buffer[smb_wct]; i++) {
77 assert(fscanf(in, " smb_vwv[%*2d]=%*5d (0x%X)\n", &tmp));
78 memcpy(buffer+smb_vwv+i*2, &tmp, 2);
81 *data_offset = smb_vwv+buffer[smb_wct]*2;
82 assert(fscanf(in, " smb_bcc=%d\n", data_length)); buffer[(*data_offset)] = *data_length;
87 void read_log_data(FILE *in, unsigned char *buffer, long data_length)
89 long i, addr; char real[2][16]; int ret;
91 for(i = 0; i < data_length; i++) {
93 if(i != 0) { /* Read data after each line */
94 assert(fscanf(in, "%8s %8s", real[0], real[1]) == 2);
96 ret = fscanf(in, " [%03X]", &addr);
98 if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i);
103 if(!fscanf(in, "%02X", &tmp)) {
104 if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1);
111 int main (int argc, char **argv)
113 const char *infile, *outfile;
119 long data_offset, data_length;
121 struct poptOption long_options[] = {
123 { "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" },
127 pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
128 POPT_CONTEXT_KEEP_FIRST);
129 poptSetOtherOptionHelp(pc, "[<infile> [<outfile>]]");
132 while((opt = poptGetNextOpt(pc)) != -1) {
137 poptGetArg(pc); /* Drop argv[0], the program name */
139 infile = poptGetArg(pc);
142 in = fopen(infile, "r");
149 outfile = poptGetArg(pc);
152 out = fopen(outfile, "w+");
155 fprintf(stderr, "Can't find %s, using stdout...\n", outfile);
159 if(!outfile) out = stdout;
162 fgets(buffer, sizeof(buffer), in);
163 if(buffer[0] == '[') { /* Header */
164 if(strstr(buffer, "show_msg")) {
166 if(in_packet == 1)continue;
167 read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
168 } else if(in_packet && strstr(buffer, "dump_data")) {
169 read_log_data(in, curpacket+data_offset, data_length);
172 print_packet(out, curpacket, curpacket_len);