32 lines
1.1 KiB
Python
32 lines
1.1 KiB
Python
import struct, sys
|
|
|
|
# parse usbpcap file, extract bulk transfer payloads on EP 0x81,
|
|
# find 0x1bb1b11b markers and dump tail words
|
|
path = r"C:\Project\MAG160C\analysis\captures\official_hand.pcap"
|
|
data = open(path, "rb").read()
|
|
magic = data[:4]
|
|
print("pcap magic:", magic.hex())
|
|
# USBPcap: linktype 249? global header 24 bytes: magic, vMaj, vMin, tz, sigfigs, snaplen, linktype
|
|
lt = struct.unpack_from("<I", data, 20)[0]
|
|
print("linktype:", lt)
|
|
|
|
# find all occurrences of the frame marker
|
|
idx = 0
|
|
count = 0
|
|
frames = []
|
|
while True:
|
|
i = data.find(b"\x1b\xb1\xb1\x1b", idx)
|
|
if i < 0: break
|
|
idx = i + 4
|
|
count += 1
|
|
if count <= 3 or count % 50 == 0:
|
|
if i + 0x9640 < len(data):
|
|
# header
|
|
hdr = struct.unpack_from("<8I", data, i)
|
|
# tail words
|
|
tail = struct.unpack_from("<8I", data, i + 0x1c + hdr[2])
|
|
frames.append((i, hdr, tail))
|
|
print(f"frame@{i:#x} hdr={[hex(x) for x in hdr[:5]]} tail[0:8]={[hex(x) for x in tail]}")
|
|
if count > 120: break
|
|
print("total markers scanned:", count)
|