88 lines
2 KiB
Text
88 lines
2 KiB
Text
NAME="pcap info"
|
|
FILE=bins/pcap/sample0.pcap
|
|
CMDS=i
|
|
EXPECT=<<EOF
|
|
fd 6
|
|
file bins/pcap/sample0.pcap
|
|
size 0xd4b64
|
|
humansz 850.8K
|
|
mode -r--
|
|
format pcap
|
|
iorw false
|
|
blksz 0x0
|
|
block 0x100
|
|
type tcpdump capture file - version 2.4 (Ethernet, capture length 262144)
|
|
EOF
|
|
RUN
|
|
|
|
NAME="pcap file header"
|
|
FILE=bins/pcap/sample0.pcap
|
|
CMDS=<<EOF
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
;-- tcpdump capture file - version 2.4 (Ethernet, capture length 262144):
|
|
0x00000000 d4 invalid
|
|
EOF
|
|
RUN
|
|
|
|
NAME="pcap frame header"
|
|
FILE=bins/pcap/sample0.pcap
|
|
CMDS=<<EOF
|
|
s 0x18
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
;-- 0x18: Frame 1, 74 bytes on wire, 74 bytes captured:
|
|
0x00000018 3e87ce xchg esi, ecx
|
|
EOF
|
|
RUN
|
|
|
|
NAME="pcap ethernet header"
|
|
FILE=bins/pcap/sample0.pcap
|
|
CMDS=<<EOF
|
|
s 0x28
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
;-- 0x28: Ethernet, Src: 00:00:00:00:00:00, Dst: 00:00:00:00:00:00:
|
|
0x00000028 0000 add byte [rax], al
|
|
EOF
|
|
RUN
|
|
|
|
NAME="pcap ipv4 header"
|
|
FILE=bins/pcap/sample0.pcap
|
|
CMDS=<<EOF
|
|
s 0x36
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
;-- 0x36: IPV4, Src: 127.0.0.1, Dst: 127.0.0.1:
|
|
0x00000036 450000 add byte [r8], r8b
|
|
EOF
|
|
RUN
|
|
|
|
NAME="pcap tcp header"
|
|
FILE=bins/pcap/sample0.pcap
|
|
CMDS=<<EOF
|
|
s 0x4a
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
;-- 0x4a: Transmission Control Protocol, Src Port: 58728, Dst port: 8888, Len: 0:
|
|
0x0000004a e568 in eax, 0x68 ; 'h'
|
|
EOF
|
|
RUN
|
|
|
|
NAME="pcap tcp string data"
|
|
FILE=bins/pcap/sample0.pcap
|
|
CMDS=<<EOF
|
|
s 0x3f3
|
|
pd 2
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000003f3 ~ d09824715375 rcr byte [rax + 0x75537124], 1
|
|
;-- str._qSupported:multiprocess__swbreak__hwbreak__qRelocInsn__fork_events__vfork_events__exec_events__vContSupported__QThreadEvents__no_resumed__xmlRegisters_i386_6a:
|
|
0x000003f5 .string "$qSupported:multiprocess+;swbreak+;hwbreak+;qRelocInsn+;fork-events+;vfork-events+;exec-events+;vContSupported+;QThreadEvents+;no-resumed+;xmlRegisters=i386#6a" ; len=160
|
|
EOF
|
|
RUN
|