归档分析脚本到 analysis/reverse_tools（compare_live/verify_nuc/verify_full/parse_ddt/parse_pcap），更新 session_state 引用路径

analysis/reverse_tools/parse_pcap.py

@@ -0,0 +1,31 @@
+import struct, sys
+
+# parse usbpcap file, extract bulk transfer payloads on EP 0x81,
+# find 0x1bb1b11b markers and dump tail words
+path = r"C:\Project\MAG160C\analysis\captures\official_hand.pcap"
+data = open(path, "rb").read()
+magic = data[:4]
+print("pcap magic:", magic.hex())
+# USBPcap: linktype 249? global header 24 bytes: magic, vMaj, vMin, tz, sigfigs, snaplen, linktype
+lt = struct.unpack_from("<I", data, 20)[0]
+print("linktype:", lt)
+
+# find all occurrences of the frame marker
+idx = 0
+count = 0
+frames = []
+while True:
+    i = data.find(b"\x1b\xb1\xb1\x1b", idx)
+    if i < 0: break
+    idx = i + 4
+    count += 1
+    if count <= 3 or count % 50 == 0:
+        if i + 0x9640 < len(data):
+            # header
+            hdr = struct.unpack_from("<8I", data, i)
+            # tail words
+            tail = struct.unpack_from("<8I", data, i + 0x1c + hdr[2])
+            frames.append((i, hdr, tail))
+            print(f"frame@{i:#x} hdr={[hex(x) for x in hdr[:5]]} tail[0:8]={[hex(x) for x in tail]}")
+    if count > 120: break
+print("total markers scanned:", count)