mirror of
https://github.com/wader/fq.git
synced 2024-12-23 13:22:58 +03:00
8e0dde03d0
This will allow passing both cli options and format options to sub decoder. Ex: pass keylog option to a tls decoder when decoding a pcap. Ex: pass decode options to a format inside a http body inside a pcap. Add ArgAs method to lookup argument based on type. This also makes the format decode function have same signature as sub decoders in the decode API. This change decode.Format a bit: DecodeFn is now just func(d *D) any DecodeInArg renamed to DefaultInArg
88 lines
2.0 KiB
Go
88 lines
2.0 KiB
Go
package bitcoin
|
|
|
|
// https://learnmeabitcoin.com/technical/blkdat
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/wader/fq/format"
|
|
"github.com/wader/fq/pkg/decode"
|
|
"github.com/wader/fq/pkg/interp"
|
|
"github.com/wader/fq/pkg/scalar"
|
|
)
|
|
|
|
var bitcoinTranscationFormat decode.Group
|
|
|
|
func init() {
|
|
interp.RegisterFormat(decode.Format{
|
|
Name: format.BITCOIN_BLOCK,
|
|
Description: "Bitcoin block",
|
|
Dependencies: []decode.Dependency{
|
|
{Names: []string{format.BITCOIN_TRANSACTION}, Group: &bitcoinTranscationFormat},
|
|
},
|
|
DecodeFn: decodeBitcoinBlock,
|
|
DefaultInArg: format.BitCoinBlockIn{
|
|
HasHeader: false,
|
|
},
|
|
})
|
|
}
|
|
|
|
var rawHexReverse = scalar.BitBufFn(func(s scalar.BitBuf) (scalar.BitBuf, error) {
|
|
return scalar.RawSym(s, -1, func(b []byte) string {
|
|
decode.ReverseBytes(b)
|
|
return fmt.Sprintf("%x", b)
|
|
})
|
|
})
|
|
|
|
func decodeBitcoinBlock(d *decode.D) any {
|
|
var bbi format.BitCoinBlockIn
|
|
d.ArgAs(&bbi)
|
|
|
|
size := d.BitsLeft()
|
|
|
|
if bbi.HasHeader {
|
|
magic := d.PeekBits(32)
|
|
switch magic {
|
|
case 0xf9beb4d9,
|
|
0x0b110907,
|
|
0xfabfb5da:
|
|
d.FieldU32("magic", scalar.UintMapSymStr{
|
|
0xf9beb4d9: "mainnet",
|
|
0x0b110907: "testnet3",
|
|
0xfabfb5da: "regtest",
|
|
}, scalar.UintHex)
|
|
size = int64(d.FieldU32LE("size")) * 8
|
|
default:
|
|
d.Fatalf("unknown magic %x", magic)
|
|
}
|
|
}
|
|
|
|
d.Endian = decode.LittleEndian
|
|
|
|
d.FramedFn(size, func(d *decode.D) {
|
|
d.FieldStruct("header", func(d *decode.D) {
|
|
d.FieldU32("version", scalar.UintHex)
|
|
d.FieldRawLen("previous_block_hash", 32*8, rawHexReverse)
|
|
d.FieldRawLen("merkle_root", 32*8, rawHexReverse)
|
|
d.FieldU32("time", scalar.UintActualUnixTime(time.RFC3339))
|
|
d.FieldU32("bits", scalar.UintHex)
|
|
d.FieldU32("nonce", scalar.UintHex)
|
|
})
|
|
|
|
// TODO: remove? support header only decode this way?
|
|
if d.BitsLeft() == 0 {
|
|
return
|
|
}
|
|
|
|
txCount := d.FieldUintFn("tx_count", decodeVarInt)
|
|
d.FieldArray("transactions", func(d *decode.D) {
|
|
for i := uint64(0); i < txCount; i++ {
|
|
d.FieldFormat("transaction", bitcoinTranscationFormat, nil)
|
|
}
|
|
})
|
|
})
|
|
|
|
return nil
|
|
}
|