其他
对宝马车载apps协议的逆向分析研究
@@ -0,0 +1,158 @@print("hello world!") local debug_level = { DISABLED = 0, LEVEL_1 = 1, LEVEL_2 = 2}local DEBUG = debug_level.LEVEL_1 local dprint = function() endlocal dprint2 = function() endlocal function resetDebugLevel() current_debug_level = 2 if current_debug_level > debug_level.DISABLED then dprint = function(...) info(table.concat({"Lua: ", ...}," ")) end if current_debug_level > debug_level.LEVEL_1 then dprint2 = dprint end else dprint = function() end dprint2 = dprint endend-- call it nowresetDebugLevel() local bmw_proto = Proto("bmw", "BMW BCL") local hdr_fields ={ val1 = ProtoField.uint16 ("bmw.val1", "Val1", base.HEX), val2 = ProtoField.uint16 ("bmw.val2", "Val2", base.HEX), val3 = ProtoField.uint16 ("bmw.val3", "Val3", base.HEX), len = ProtoField.uint16 ("bmw.len", "Length", base.DEC)}bmw_proto.fields = hdr_fieldsdprint2("bmw_proto ProtoFields registered") local dissect_data = Dissector.get("data") function bmw_proto.init()end local BMW_MSG_HDR_LEN = 8 -- mention future helper methodslocal check_bmw_length function bmw_proto.dissector(tvbuf, pktinfo, root) dprint2("bmw_proto.dissector called") -- check packet length local pktlen = tvbuf:len() local bytes_consumed = 0 while bytes_consumed < pktlen do -- call dissect_packet for this single packet -- it will return a positive number for the amount of bytes consumed -- or a negative number for a request for more bytes -- or 0 for an error local result = dissect_packet(tvbuf, pktinfo, root, bytes_consumed) if result > 0 then -- successfully parsed packet bytes_consumed = bytes_consumed + result elseif result == 0 then -- not a valid packet return 0 else -- need more data to finish parsing pktinfo.desegment_offset = bytes_consumed pktinfo.desegment_len = 0 - result return pktlen end end return bytes_consumedend local function heuristic(tvbuf, pktinfo, root) ETCH_MAGIC = ByteArray.new("de ad be ef") if tvbuf:len() < BMW_MSG_HDR_LEN + 4 then return false end local etch_magic = tvbuf:range(BMW_MSG_HDR_LEN, 4):bytes() return etch_magic == ETCH_MAGICend function dissect_packet(tvbuf, pktinfo, root, offset) dprint2("dissect_packet function called") local length_val, length_tvbf = check_bmw_length(tvbuf, offset) if length_val <= 0 then -- not enough data to get the header return length_val end -- update the packet list info pktinfo.cols.protocol:set("BMW BCL") if string.find(tostring(pktinfo.cols.info), "^BMW") == nil then pktinfo.cols.info:set("BMW BCL") end -- create the protocol tree field local tree = root:add(bmw_proto, tvbuf:range(offset, BMW_MSG_HDR_LEN + length_val)) -- get the vals tree:add(hdr_fields.val1, tvbuf:range(offset, 2)) tree:add(hdr_fields.val2, tvbuf:range(offset+2, 2)) tree:add(hdr_fields.val3, tvbuf:range(offset+4, 2)) tree:add(hdr_fields.len, length_tvbf) remaining_tvb = tvbuf(offset + BMW_MSG_HDR_LEN, length_val):tvb() dissect_data:call(remaining_tvb, pktinfo, root) return BMW_MSG_HDR_LEN + length_valend function check_bmw_length(tvbuf, offset) -- remaining bytes in the packet to look through local msglen = tvbuf:len() - offset -- check if capture was only capturing partial packet size if msglen ~= tvbuf:reported_length_remaining(offset) then -- captured packets are being sliced/cut-off, so don't try to desegment/reassemble dprint2("Captured packet was shorter than original, can't reassemble") return 0 end if msglen < BMW_MSG_HDR_LEN then -- we need more bytes to parse the header dprint2("Need more bytes to look at the header") return -DESEGMENT_ONE_MORE_SEGMENT end -- we have enough to parse the length from the header local length_tvbr = tvbuf:range(offset+6, 2) local length_val = length_tvbr:uint() -- check if we have the whole packet somewhere if msglen < BMW_MSG_HDR_LEN + length_val then dprint2("Need more bytes to desegment full packet") return -(BMW_MSG_HDR_LEN + length_val - msglen) end return length_val, length_tvbrend function enable_dissector() DissectorTable.get("btrfcomm.dlci"):add_for_decode_as(bmw_proto)endenable_dissector() --bmw_proto:register_heuristic("btspp", heuristic)extern crate etch_hash; use etch_hash::*;use std::hash::Hasher; #[test]fn null() { assert_eq!(5381, hash("".as_bytes()));}#[test]fn single_letter() { assert_eq!(0x150a2c9e, hash("c".as_bytes())); assert_eq!(352988316, hash("a".as_bytes()));}#[test]fn all_letters() { assert_eq!(352988316, hash("a".as_bytes())); assert_eq!(1511848646, hash("ab".as_bytes())); assert_eq!(669497117, hash("abc".as_bytes())); assert_eq!(2300776583, hash("abcd".as_bytes())); assert_eq!(3492286878, hash("abcde".as_bytes())); assert_eq!(1266308680, hash("abcdef".as_bytes())); assert_eq!(3915594783, hash("abcdefg".as_bytes())); assert_eq!(2878000137, hash("abcdefgh".as_bytes())); assert_eq!(53556896, hash("abcdefghi".as_bytes())); assert_eq!(4290539978, hash("abcdefghij".as_bytes()));}#[test]fn long_names() { assert_eq!(0x28e34aa1, hash("org.apache.etch.example.binary.binaryExample.f".as_bytes())); assert_eq!(0x0972201e, hash("org.apache.etch.example.binary.binaryExample._result_f".as_bytes())); assert_eq!(0x28e34a7c, hash("org.apache.etch.example.binary.binaryExample.A".as_bytes()));}#[test]fn long_names_iterative() { let result = hash("org.apache.etch.example.binary.binaryExample".as_bytes()); assert_eq!(0x28e34aa1, hash_more(result, ".f".as_bytes())); assert_eq!(0x0972201e, hash_more(result, "._result_f".as_bytes())); assert_eq!(0x28e34a7c, hash_more(result, ".A".as_bytes()));} #[test]fn obj_null() { let mut hasher = EtchHash::new(); hasher.write("".as_bytes()); assert_eq!(5381, hasher.finish());}#[test]fn obj_single_letter() { let mut hasher = EtchHash::new(); hasher.write("c".as_bytes()); assert_eq!(0x150a2c9e, hasher.finish()); hasher = EtchHash::new(); hasher.write("a".as_bytes()); assert_eq!(352988316, hasher.finish());}#[test]fn obj_long_names_iterative() { let mut hasher = EtchHash::new(); hasher.write("org.apache.etch.example.binary.binaryExample".as_bytes()); let mut sub_hasher; sub_hasher = hasher.clone(); sub_hasher.write(".f".as_bytes()); assert_eq!(0x28e34aa1, sub_hasher.finish()); sub_hasher = hasher.clone(); sub_hasher.write("._result_f".as_bytes()); assert_eq!(0x0972201e, sub_hasher.finish()); sub_hasher = hasher.clone(); sub_hasher.write(".A".as_bytes()); assert_eq!(0x28e34a7c, sub_hasher.finish()); sub_hasher = EtchHash::new_with_state(hasher.finish()); sub_hasher.write(".A".as_bytes()); assert_eq!(0x28e34a7c, sub_hasher.finish());}ValueFactoryBMWRemoting.java: private static void a() { a = (Type)hn.get("de.bmw.idrive.BMWRemoting.VersionInfo"); b = (Type)hn.get("de.bmw.idrive.BMWRemoting.SecurityException"); c = (Type)hn.get("de.bmw.idrive.BMWRemoting.ServiceException"); d = (Type)hn.get("de.bmw.idrive.BMWRemoting.IllegalArgumentException"); e = (Type)hn.get("de.bmw.idrive.BMWRemoting.IllegalStateException"); f = (Type)hn.get("de.bmw.idrive.BMWRemoting.ver_getVersion"); g = (Type)hn.get("de.bmw.idrive.BMWRemoting._result_ver_getVersion"); h = (Type)hn.get("de.bmw.idrive.BMWRemoting.info_getSystemInfo"); i = (Type)hn.get("de.bmw.idrive.BMWRemoting._result_info_getSystemInfo"); j = (Type)hn.get("de.bmw.idrive.BMWRemoting.sas_crl"); k = (Type)hn.get("de.bmw.idrive.BMWRemoting._result_sas_crl"); l = (Type)hn.get("de.bmw.idrive.BMWRemoting.sas_certificate"); m = (Type)hn.get("de.bmw.idrive.BMWRemoting._result_sas_certificate"); n = (Type)hn.get("de.bmw.idrive.BMWRemoting.sas_login"); o = (Type)hn.get("de.bmw.idrive.BMWRemoting._result_sas_login");...看雪ID：0xbird
https://bbs.pediy.com/user-823237.htm
推荐文章++++