/* Intrushield sigfile reader */ #include #include #include #include #include #include #include #include #include #include #include #include "bytesex.h" static const uint8_t *mapfile(int fd, size_t *len) { struct stat st; const uint8_t *map; *len = 0; if ( fstat(fd, &st) ) return NULL; map = mmap(NULL, st.st_size, PROT_READ, MAP_SHARED, fd, 0); if ( map == MAP_FAILED ) return NULL; *len = st.st_size; return map; } static void hex_dump(const uint8_t *tmp, size_t len, size_t llen) { size_t i, j; size_t line; for(j=0; j len ) { line=len-j; }else{ line=llen; } printf("%05x : ", j); for(i=0; i end ) break; printf("[%i] len=%u a=%u b=0x%.8x\n", idx, l, buf[8], le_32(len[0])); hex_dump(buf + 9, l, 16); hex_dump(buf + 9 + l, l, 16); buf += 9 + (l * 2); len = (uint32_t *)buf; } printf("\n"); return 1; } static int print_strings(const uint8_t *buf, const uint8_t *end) { unsigned int idx; int i; for(idx=0; (buf < end) && (*buf != '\0'); idx++) { printf("[%u] ", idx); i = printf("%s\n", buf); buf += i; } printf("\n"); return 1; } int main(int argc, char **argv) { const uint8_t *buf, *end; size_t len; buf = mapfile(STDIN_FILENO, &len); if ( mapfile == NULL ) return EXIT_FAILURE; end = buf + len; /* We have a bunch of different segments * acl-segment * dynamic-acl-segment * protocol conf * fixed field test table * half duplex ports? * nonstd-port-map table * vids-network-spec? * vids-dos-spec? * policy acl */ printf("Signature names:\n"); //print_strings(buf + 0x26e124, end); printf("Fixed Field Test Table:\n"); print_strings(buf + 0x28e4ee, end); printf("Unknown structure alpha:\n"); print_alpha(buf + 0x1b648b - 26, end); print_alpha(buf + 0x1c41c9, end); print_alpha(buf + 0x18c07b, end); return EXIT_SUCCESS; }