Comments (2)
Hi @tanaxer01,
Thank you for your comment. Polymorph is interpreting the values correctly, the problem you have with the display is related to the type of the field.
If you look, the payload
field, it is interpreted by Polymorph as type bytes
, however, the request
and transport
fields of the RTSP layer are interpreted as strings
. When printing on screen the value of these fields as a string, what happens is that special characters such as \r
or \n
are interpreted as such and therefore represented as a line break.
If you want these two fields in the RTSP layer to be interpreted as bytes
, you can change the field type in Polymorph very easily, from the main interface you access the field interface and execute the following command:
PH:cap/t3 > layer RTSP
PH:cap/t3/RTSP> field request
PH:cap/t3/RTSP/request > type -a
1: FT_INT_BE
2: FT_INT_LE
3: FT_STRING
4: FT_BYTES
5: FT_BIN_BE
6: FT_BIN_LE
7: FT_HEX
8: FT_ETHER
9: FT_IPv4
10: FT_IPv6
11: FT_ABSOLUTE_TIME
12: FT_RELATIVE_TIME
13: FT_EUI64
Select the type of the field: 4
New type Ftype.FT_BYTES added to the field.
PH:cap/t3/RTSP/request >
Once this is done, you will see how the special characters appear when you invoke the show
command.
On the other hand, the problem you mentioned about printing the request
and part of the response
, has to do with the way Polymorph works.
When Polymorph generates a template
, it parses the captured network packet and generates a series of fixed positions for the fields in that packet. It then uses these positions to access the network packets it intercepts in real time. However, polymorph does not know which network packet it is intercepting, it only accesses the bytes that are in that fixed position. Therefore, it is the user's job to pre-filter the captured packets to ensure that the fields we are interested in are in those positions.In your example, you should put an if
condition that separates the RTSP network request
packets from the responses
based on another field that you know exists in both. I recommend that you take a look at the simple examples in the wiki.
In addition to your question, there is one more thing you should be aware of that may give you problems if you continue to modify these types of network packets. If the value of the field is variable, i.e. its length can be modified by a user, a system, etc... then we have to tell Polymorph where it can obtain the length of this field, otherwise it will assume that the length of that field is the same as that of the network packet with which the template
was generated, and therefore it may be wrong. This process is explained in this section of the wiki: https://github.com/shramos/polymorph/wiki/Case-Study.-Part-3:-Structs
I hope this solves your problems
from polymorph.
Hi again!
After testing some stuff, I think the reason why some of the fields (Ej Cseq) arent placed in the RTSP layer is because their position varies depending on which packet is sent.
thanks for the help!
from polymorph.
Related Issues (20)
- KeyboardInterrupt when exit from capturing packets HOT 5
- Remove spaces at the end to avoid mistakes HOT 2
- Functions with autocomplete HOT 3
- [ERROR] Parsing field: ipv6.addr HOT 12
- Add version argument HOT 1
- iptables dependency? and ip6tables returned 3 HOT 2
- Issues with mac address values HOT 4
- Known working distro/version?
- RTMPT packet error decode/slice/capture HOT 1
- python importing modules into functions HOT 1
- GOOSE messages not being parsed by function HOT 2
- DNP3 decoding incorrect HOT 1
- FileNotFoundError: [Errno 2] No such file or directory: b'liblibc.a' HOT 2
- Packets are not being modified
- errors while using BPF in filters HOT 1
- problem when trying to intercept traffic in localhost
- No packets have been captured.
- Error Polymorph HOT 2
- 1.20.1 Forge 47.2.7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from polymorph.