Skip to main content

Posts

[scapy] Linux-Cooked pcap to ethernet

# The pcap file formatted by "Linux cooked" # tcpdump -r myfile.pcap -nn reading from file event1.pcap, link-type LINUX_SLL (Linux cooked) ... ... # step1. read myfile.pcap pkts = rdpcap("myfile.pcap"); # step2. read myfile.pcap pkts = [Ether(src='00:11:22:33:44:55', dst='22:33:44:55:66:77')/pkt[1:] for pkt in pkts] # step3. modify IP address and recalculate chksum for pkt in pkts:  pkt[1].dst='192.168.1.10';  pkt[1].src='192.168.1.1';  del pkt[IP].chksum  del pkt[UDP].chksum # step4. packet send sendp(pkts[0]); # step5. save pcap  wrpcap("output.pcap",pkts); # tcpdump -r output.pcap -nn reading from file output.pcap, link-type EN10MB (Ethernet) ... ... # pkt[1:] : It means IP layer 1) Before: Linux cooked / IP / UDP / UDP-Data 2) After: Ethernet / IP / UDP / UDP-Data

[bash-script] get_info.sh print cpu allocation infomation of threads

1) way1 ps xH -o 'pid tid cmd comm pcpu psr' 2) way2 #!/bin/bash TMP_FILE=$(mktemp /tmp/abc-script.XXXXXX) echo ${TMP_FILE} ps xH -o 'pid tid cmd comm pcpu ' > ${TMP_FILE} function make_header() {   echo -n "$1"   echo " psr" } function make_values() {   echo -n "$1"   STATUS_FILE=/proc/${2}/task/${3}/status   if [ -f ${STATUS_FILE} ] ; then     CPU_SET=`cat ${STATUS_FILE}  |grep Cpus_allowed_list |awk ' { print $2 } '`   else     CPU_SET="None"   fi   echo " ${CPU_SET}" } let IDX=0 while IFS='' read -r line || [[ -n "$line" ]]; do    LINE_SEP=( $line )    MY_PID=${LINE_SEP[0]}    MY_TID=${LINE_SEP[1]}    if [ ${IDX} -eq 0 ]; then      SZ_HEADER=`make_header "$line"`      echo ${SZ_HEADER}    else      SZ_VALUES=`make_values "$line" ${MY_PID} ${MY_TID}`      echo ${SZ_VALUES}    fi #   echo ${IDX}   let IDX=${IDX}+1 done < "

[AWK] C struct to fprintf script

example code #!/bin/bash awk ' { if ($1 == "u_int" ) FORMAT="%u"; \ else if ($1 == "u_short" ) FORMAT="%u"; \ else if ($1 == "uint64_t" ) FORMAT="%lu"; \ else if ($1 == "int" ) FORMAT="%d"; \ else if ($1 == "int32_t" ) FORMAT="%d"; \ else if ($1 == "int64_t" ) FORMAT="%ld"; \ else if ($1 == "u_char" ) FORMAT="%s"; \ else if ($1 == "char" ) FORMAT="%s"; \ else FORMAT="ERROR"; \ if ( substr($2,length($2),1) == ";" ) KEY=substr($2,0, length($2)-1); else KEY=$2; \ print "fprintf(stdout, \"" KEY "= [" FORMAT "]\\n\", p_x->" KEY " );" } ' a.dat # a.dat typedef struct {       u_int    m1;       int myport;       u_short  ushort2;       u_int    int1;       u_short  data;       u_char   dummy[8];       uint64_t length;

[Linux/vi] multi search string

[1stString] : First string to find. [2ndString] : Second string to find Or Search ( Use "\|" ) /[1stString]\|[2ndString] And Search (Use ".*" ) /[1stString].*[2ndString]/ Reference: http://www.linuxquestions.org/questions/linux-software-2/searching-multiple-patterns-through-vi-editor-725155/

linux file system recovery

1. broken hdd disk backup  1) remote-server nc -v -l [port] > hdd_backup.img  2) equipment of broken hdd dd if=/dev/sda | nc -v [remote-server IP] [port]   ex)  1) remote-server nc -v -l 2222 > hdd_backup.img  2) equipment of broken hdd dd if=/dev/sda | nc -v 1.1.1.1 2222 2. use recovery tool  testdisk (http://www.cgsecurity.org/wiki/TestDisk_Download) 3. run fsck from img file  # losetup --offset 32256 /dev/loop2 harddrive.img  # fsck /dev/loop2  and again testdisk reference: https://major.io/2010/12/14/mounting-a-raw-partition-file-made-with-dd-or-dd_rescue-in-linux/ https://bbs.archlinux.org/viewtopic.php?id=136766

run dosbox on windows10 tablet

My windows tablet with dosbox had erros.  "SDL: DirectInputDevice::SetDataFormat: Invalid parameters" Solution-1 download vcredist_x86.exe file and install Solution-2 download and install Touch Enabled SDL. ==>  SDL.dll  Reference:   http://www.ppomppu.co.kr/ zboard/view.php?id=wintab&no= 11258 http://zhengxu.tistory.com/276