mirror of
https://github.com/wader/fq.git
synced 2024-12-23 05:13:30 +03:00
8e0dde03d0
This will allow passing both cli options and format options to sub decoder. Ex: pass keylog option to a tls decoder when decoding a pcap. Ex: pass decode options to a format inside a http body inside a pcap. Add ArgAs method to lookup argument based on type. This also makes the format decode function have same signature as sub decoders in the decode API. This change decode.Format a bit: DecodeFn is now just func(d *D) any DecodeInArg renamed to DefaultInArg
30 lines
674 B
Go
30 lines
674 B
Go
package fairplay
|
|
|
|
// https://github.com/easonlin404/ksm/blob/master/ksm.go
|
|
|
|
import (
|
|
"github.com/wader/fq/format"
|
|
"github.com/wader/fq/pkg/decode"
|
|
"github.com/wader/fq/pkg/interp"
|
|
)
|
|
|
|
func init() {
|
|
interp.RegisterFormat(decode.Format{
|
|
Name: format.FAIRPLAY_SPC,
|
|
Description: "FairPlay Server Playback Context",
|
|
DecodeFn: fairPlaySPCDecode,
|
|
})
|
|
}
|
|
|
|
func fairPlaySPCDecode(d *decode.D) any {
|
|
d.FieldU32("version")
|
|
d.FieldRawLen("reserved", 32)
|
|
d.FieldRawLen("iv", 16*8)
|
|
d.FieldRawLen("aes_key_oaep", 128*8)
|
|
d.FieldRawLen("certificate_hash", 20*8)
|
|
payloadLen := d.FieldU32("payload_length")
|
|
d.FieldRawLen("payload", int64(payloadLen)*8)
|
|
|
|
return nil
|
|
}
|