/ Macwelt 4 / Macwelt DVD 4.cdr / Internet / Internet-Utilities / Mac-OS X / darkstat-2.2 / src / spylog.c

< prev

next >

MacOS 8.1

Win98

DOS

browse contents

view JSON data

view as text

+--------+-------------------------+-------------------------+--------+--------+
|00000000| 00 08 73 70 79 6c 6f 67 | 2e 63 00 00 00 00 00 00 |..spylog|.c......|
|00000010| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000020| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000030| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000040| 00 00 00 00 00 00 00 00 | 00 01 00 00 00 00 00 00 |........|........|
|00000050| 00 00 00 00 00 14 bf 00 | 00 01 1e b9 b4 75 2a b9 |........|.....u*.|
|00000060| b4 75 2a 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |.u*.....|........|
|00000070| 00 00 00 00 00 00 00 00 | 00 00 81 81 4a 6d 00 00 |........|....Jm..|
|00000080| 0a 2f 2a 20 64 61 72 6b | 73 74 61 74 3a 20 61 20 |./* dark|stat: a |
|00000090| 6e 65 74 77 6f 72 6b 20 | 74 72 61 66 66 69 63 20 |network |traffic |
|000000a0| 61 6e 61 6c 79 7a 65 72 | 0a 20 2a 20 28 63 29 20 |analyzer|. * (c) |
|000000b0| 32 30 30 31 2d 32 30 30 | 32 2c 20 45 6d 69 6c 20 |2001-200|2, Emil |
|000000c0| 4d 69 6b 75 6c 69 63 2e | 0a 20 2a 2f 0a 0a 23 69 |Mikulic.|. */..#i|
|000000d0| 6e 63 6c 75 64 65 20 22 | 73 70 79 6c 6f 67 2e 68 |nclude "|spylog.h|
|000000e0| 22 0a 23 69 6e 63 6c 75 | 64 65 20 22 70 6f 72 74 |".#inclu|de "port|
|000000f0| 5f 64 62 2e 68 22 0a 0a | 23 69 6e 63 6c 75 64 65 |_db.h"..|#include|
|00000100| 20 3c 70 74 68 72 65 61 | 64 2e 68 3e 0a 23 69 6e | <pthrea|d.h>.#in|
|00000110| 63 6c 75 64 65 20 3c 73 | 74 64 69 6f 2e 68 3e 0a |clude <s|tdio.h>.|
|00000120| 23 69 6e 63 6c 75 64 65 | 20 3c 74 69 6d 65 2e 68 |#include| <time.h|
|00000130| 3e 0a 23 69 6e 63 6c 75 | 64 65 20 3c 70 63 61 70 |>.#inclu|de <pcap|
|00000140| 2e 68 3e 0a 23 69 6e 63 | 6c 75 64 65 20 3c 73 74 |.h>.#inc|lude <st|
|00000150| 72 69 6e 67 2e 68 3e 0a | 0a 46 49 4c 45 20 2a 73 |ring.h>.|.FILE *s|
|00000160| 70 79 6c 6f 67 20 3d 20 | 4e 55 4c 4c 3b 0a 74 69 |pylog = |NULL;.ti|
|00000170| 6d 65 5f 74 20 6e 65 78 | 74 5f 72 6f 74 61 74 65 |me_t nex|t_rotate|
|00000180| 20 3d 20 30 3b 0a 69 6e | 74 20 73 70 79 5f 6c 69 | = 0;.in|t spy_li|
|00000190| 6e 6b 74 79 70 65 20 3d | 20 30 3b 0a 70 63 61 70 |nktype =| 0;.pcap|
|000001a0| 5f 74 20 2a 73 70 79 5f | 63 61 70 20 3d 20 4e 55 |_t *spy_|cap = NU|
|000001b0| 4c 4c 3b 0a 0a 23 64 65 | 66 69 6e 65 20 46 41 49 |LL;..#de|fine FAI|
|000001c0| 4c 28 29 20 7b 20 75 70 | 5f 73 70 79 20 3d 20 30 |L() { up|_spy = 0|
|000001d0| 3b 20 70 74 68 72 65 61 | 64 5f 65 78 69 74 28 20 |; pthrea|d_exit( |
|000001e0| 28 76 6f 69 64 2a 29 45 | 58 49 54 5f 46 41 49 4c |(void*)E|XIT_FAIL|
|000001f0| 20 29 3b 20 7d 0a 23 64 | 65 66 69 6e 65 20 53 55 | ); }.#d|efine SU|
|00000200| 43 43 45 45 44 28 29 20 | 7b 20 75 70 5f 73 70 79 |CCEED() |{ up_spy|
|00000210| 20 3d 20 30 3b 20 70 74 | 68 72 65 61 64 5f 65 78 | = 0; pt|hread_ex|
|00000220| 69 74 28 20 28 76 6f 69 | 64 2a 29 45 58 49 54 5f |it( (voi|d*)EXIT_|
|00000230| 53 55 43 43 45 53 53 20 | 29 3b 20 7d 0a 0a 0a 0a |SUCCESS |); }....|
|00000240| 73 74 61 74 69 63 20 76 | 6f 69 64 20 73 70 79 6c |static v|oid spyl|
|00000250| 6f 67 5f 72 6f 74 61 74 | 65 28 74 69 6d 65 5f 74 |og_rotat|e(time_t|
|00000260| 20 6e 6f 77 29 0a 7b 0a | 09 73 74 72 75 63 74 20 | now).{.|.struct |
|00000270| 74 6d 20 2a 74 6d 20 3d | 20 6c 6f 63 61 6c 74 69 |tm *tm =| localti|
|00000280| 6d 65 28 26 6e 6f 77 29 | 3b 0a 09 63 68 61 72 20 |me(&now)|;..char |
|00000290| 2a 66 6e 61 6d 65 3b 0a | 0a 09 66 6e 61 6d 65 20 |*fname;.|..fname |
|000002a0| 3d 20 62 75 69 6c 64 5f | 73 74 72 28 22 25 73 22 |= build_|str("%s"|
|000002b0| 20 53 50 59 4c 4f 47 5f | 46 49 4c 45 5f 4e 41 4d | SPYLOG_|FILE_NAM|
|000002c0| 45 20 22 2e 25 30 34 64 | 25 30 32 64 25 30 32 64 |E ".%04d|%02d%02d|
|000002d0| 22 2c 0a 09 09 09 66 70 | 72 65 66 69 78 2c 20 31 |",....fp|refix, 1|
|000002e0| 39 30 30 2b 74 6d 2d 3e | 74 6d 5f 79 65 61 72 2c |900+tm->|tm_year,|
|000002f0| 20 74 6d 2d 3e 74 6d 5f | 6d 6f 6e 2c 20 74 6d 2d | tm->tm_|mon, tm-|
|00000300| 3e 74 6d 5f 6d 64 61 79 | 29 3b 0a 0a 09 69 66 20 |>tm_mday|);...if |
|00000310| 28 73 70 79 6c 6f 67 29 | 20 66 63 6c 6f 73 65 28 |(spylog)| fclose(|
|00000320| 73 70 79 6c 6f 67 29 3b | 0a 09 73 70 79 6c 6f 67 |spylog);|..spylog|
|00000330| 20 3d 20 66 6f 70 65 6e | 28 66 6e 61 6d 65 2c 20 | = fopen|(fname, |
|00000340| 22 61 22 29 3b 0a 09 69 | 66 20 28 21 73 70 79 6c |"a");..i|f (!spyl|
|00000350| 6f 67 29 0a 09 7b 0a 09 | 09 70 72 69 6e 74 66 28 |og)..{..|.printf(|
|00000360| 22 45 72 72 6f 72 3a 20 | 28 73 70 79 6c 6f 67 29 |"Error: |(spylog)|
|00000370| 20 63 61 6e 27 74 20 61 | 70 70 65 6e 64 20 74 6f | can't a|ppend to|
|00000380| 20 25 73 5c 6e 22 2c 20 | 66 6e 61 6d 65 29 3b 0a | %s\n", |fname);.|
|00000390| 09 09 66 72 65 61 6b 6f | 75 74 28 22 66 61 74 61 |..freako|ut("fata|
|000003a0| 6c 20 6c 6f 67 20 72 6f | 74 61 74 69 6f 6e 20 65 |l log ro|tation e|
|000003b0| 72 72 6f 72 22 29 3b 0a | 09 7d 0a 09 66 72 65 65 |rror");.|.}..free|
|000003c0| 28 66 6e 61 6d 65 29 3b | 0a 0a 09 74 6d 2d 3e 74 |(fname);|...tm->t|
|000003d0| 6d 5f 73 65 63 20 3d 20 | 74 6d 2d 3e 74 6d 5f 6d |m_sec = |tm->tm_m|
|000003e0| 69 6e 20 3d 20 74 6d 2d | 3e 74 6d 5f 68 6f 75 72 |in = tm-|>tm_hour|
|000003f0| 20 3d 20 30 3b 0a 09 6e | 65 78 74 5f 72 6f 74 61 | = 0;..n|ext_rota|
|00000400| 74 65 20 3d 20 6d 6b 74 | 69 6d 65 28 74 6d 29 20 |te = mkt|ime(tm) |
|00000410| 2b 20 38 36 34 30 30 3b | 20 2f 2a 20 74 6f 6d 6f |+ 86400;| /* tomo|
|00000420| 72 72 6f 77 20 2a 2f 0a | 7d 0a 0a 0a 0a 23 64 65 |rrow */.|}....#de|
|00000430| 66 69 6e 65 20 44 49 53 | 54 41 4e 43 45 20 31 32 |fine DIS|TANCE 12|
|00000440| 0a 0a 73 74 61 74 69 63 | 20 76 6f 69 64 20 73 70 |..static| void sp|
|00000450| 79 6c 6f 67 5f 70 61 63 | 6b 65 74 28 62 79 74 65 |ylog_pac|ket(byte|
|00000460| 20 2a 70 61 63 6b 65 74 | 2c 20 77 6f 72 64 20 6c | *packet|, word l|
|00000470| 65 6e 67 74 68 2c 0a 09 | 09 64 77 6f 72 64 20 73 |ength,..|.dword s|
|00000480| 72 63 69 70 2c 20 64 77 | 6f 72 64 20 64 65 73 74 |rcip, dw|ord dest|
|00000490| 69 70 2c 20 77 6f 72 64 | 20 64 65 73 74 70 6f 72 |ip, word| destpor|
|000004a0| 74 29 0a 7b 0a 09 63 68 | 61 72 20 6d 65 74 68 6f |t).{..ch|ar metho|
|000004b0| 64 5b 36 5d 2c 20 2a 75 | 72 6c 2c 20 2a 68 6f 73 |d[6], *u|rl, *hos|
|000004c0| 74 20 3d 20 4e 55 4c 4c | 3b 0a 09 69 6e 74 20 73 |t = NULL|;..int s|
|000004d0| 74 61 72 74 20 3d 20 30 | 2c 20 65 6e 64 2c 20 66 |tart = 0|, end, f|
|000004e0| 6f 75 6e 64 20 3d 20 30 | 3b 0a 09 74 69 6d 65 5f |ound = 0|;..time_|
|000004f0| 74 20 6e 6f 77 3b 0a 09 | 73 74 72 75 63 74 20 74 |t now;..|struct t|
|00000500| 6d 20 2a 74 6d 3b 0a 0a | 09 69 66 20 28 6c 65 6e |m *tm;..|.if (len|
|00000510| 67 74 68 20 3c 20 36 29 | 20 72 65 74 75 72 6e 3b |gth < 6)| return;|
|00000520| 20 2f 2a 20 73 74 72 6c | 65 6e 28 22 67 65 74 20 | /* strl|en("get |
|00000530| 2f 22 29 20 2a 2f 0a 0a | 09 2f 2a 7b 69 6e 74 20 |/") */..|./*{int |
|00000540| 69 3b 66 6f 72 28 69 3d | 30 3b 69 3c 6c 65 6e 67 |i;for(i=|0;i<leng|
|00000550| 74 68 3b 69 2b 2b 29 69 | 66 28 69 73 61 6c 6e 75 |th;i++)i|f(isalnu|
|00000560| 6d 28 70 61 63 6b 65 74 | 5b 69 5d 29 29 70 75 74 |m(packet|[i]))put|
|00000570| 63 68 61 72 28 70 61 63 | 6b 65 74 5b 69 5d 0a 09 |char(pac|ket[i]..|
|00000580| 20 20 29 3b 65 6c 73 65 | 20 70 75 74 63 68 61 72 |  );else| putchar|
|00000590| 28 27 2e 27 29 3b 70 75 | 74 63 68 61 72 28 31 30 |('.');pu|tchar(10|
|000005a0| 29 3b 72 65 74 75 72 6e | 3b 7d 2a 2f 0a 0a 09 2f |);return|;}*/.../|
|000005b0| 2a 20 69 74 20 68 61 73 | 20 74 6f 20 62 65 20 48 |* it has| to be H|
|000005c0| 54 54 50 2c 20 61 6c 6c | 6f 77 20 66 6f 72 20 3c |TTP, all|ow for <|
|000005d0| 44 49 53 54 41 4e 43 45 | 3e 20 62 79 74 65 73 20 |DISTANCE|> bytes |
|000005e0| 6f 66 20 67 61 72 62 61 | 67 65 20 2a 2f 0a 09 77 |of garba|ge */..w|
|000005f0| 68 69 6c 65 20 28 73 74 | 61 72 74 20 2b 20 35 20 |hile (st|art + 5 |
|00000600| 3c 20 6c 65 6e 67 74 68 | 20 26 26 20 73 74 61 72 |< length| && star|
|00000610| 74 20 3c 3d 20 44 49 53 | 54 41 4e 43 45 20 26 26 |t <= DIS|TANCE &&|
|00000620| 20 21 66 6f 75 6e 64 29 | 0a 09 7b 0a 09 09 69 66 | !found)|..{...if|
|00000630| 20 28 73 74 72 6e 63 61 | 73 65 63 6d 70 28 70 61 | (strnca|secmp(pa|
|00000640| 63 6b 65 74 2b 73 74 61 | 72 74 2c 20 20 22 47 45 |cket+sta|rt,  "GE|
|00000650| 54 20 22 2c 20 34 29 20 | 3d 3d 20 30 20 7c 7c 0a |T ", 4) |== 0 ||.|
|00000660| 09 09 20 20 20 20 73 74 | 72 6e 63 61 73 65 63 6d |..    st|rncasecm|
|00000670| 70 28 70 61 63 6b 65 74 | 2b 73 74 61 72 74 2c 20 |p(packet|+start, |
|00000680| 22 48 45 41 44 20 22 2c | 20 35 29 20 3d 3d 20 30 |"HEAD ",| 5) == 0|
|00000690| 20 7c 7c 0a 09 09 20 20 | 20 20 73 74 72 6e 63 61 | ||...  |  strnca|
|000006a0| 73 65 63 6d 70 28 70 61 | 63 6b 65 74 2b 73 74 61 |secmp(pa|cket+sta|
|000006b0| 72 74 2c 20 22 50 4f 53 | 54 20 22 2c 20 35 29 20 |rt, "POS|T ", 5) |
|000006c0| 3d 3d 20 30 29 0a 09 09 | 09 66 6f 75 6e 64 20 3d |== 0)...|.found =|
|000006d0| 20 31 3b 0a 09 09 65 6c | 73 65 0a 09 09 09 73 74 | 1;...el|se....st|
|000006e0| 61 72 74 2b 2b 3b 0a 09 | 7d 0a 0a 09 69 66 20 28 |art++;..|}...if (|
|000006f0| 21 66 6f 75 6e 64 29 20 | 72 65 74 75 72 6e 3b 0a |!found) |return;.|
|00000700| 0a 09 2f 2a 20 2d 2d 20 | 66 69 6e 64 20 6d 65 74 |../* -- |find met|
|00000710| 68 6f 64 20 2a 2f 0a 09 | 65 6e 64 20 3d 20 73 74 |hod */..|end = st|
|00000720| 61 72 74 3b 0a 09 77 68 | 69 6c 65 20 28 65 6e 64 |art;..wh|ile (end|
|00000730| 20 3c 20 6c 65 6e 67 74 | 68 20 26 26 20 70 61 63 | < lengt|h && pac|
|00000740| 6b 65 74 5b 65 6e 64 5d | 20 21 3d 20 27 20 27 29 |ket[end]| != ' ')|
|00000750| 20 65 6e 64 2b 2b 3b 0a | 09 6d 65 6d 63 70 79 28 | end++;.|.memcpy(|
|00000760| 6d 65 74 68 6f 64 2c 20 | 70 61 63 6b 65 74 2b 73 |method, |packet+s|
|00000770| 74 61 72 74 2c 20 65 6e | 64 2d 73 74 61 72 74 29 |tart, en|d-start)|
|00000780| 3b 0a 09 6d 65 74 68 6f | 64 5b 65 6e 64 2d 73 74 |;..metho|d[end-st|
|00000790| 61 72 74 5d 20 3d 20 30 | 3b 0a 0a 09 2f 2a 20 2d |art] = 0|;.../* -|
|000007a0| 2d 20 66 69 6e 64 20 75 | 72 6c 20 2a 2f 0a 09 73 |- find u|rl */..s|
|000007b0| 74 61 72 74 20 3d 20 2b | 2b 65 6e 64 3b 0a 09 77 |tart = +|+end;..w|
|000007c0| 68 69 6c 65 20 28 65 6e | 64 20 3c 20 6c 65 6e 67 |hile (en|d < leng|
|000007d0| 74 68 20 26 26 20 70 61 | 63 6b 65 74 5b 65 6e 64 |th && pa|cket[end|
|000007e0| 5d 20 21 3d 20 27 20 27 | 0a 09 09 09 20 20 20 20 |] != ' '|....    |
|000007f0| 26 26 20 70 61 63 6b 65 | 74 5b 65 6e 64 5d 20 21 |&& packe|t[end] !|
|00000800| 3d 20 27 5c 72 27 0a 09 | 09 09 20 20 20 20 26 26 |= '\r'..|..    &&|
|00000810| 20 70 61 63 6b 65 74 5b | 65 6e 64 5d 20 21 3d 20 | packet[|end] != |
|00000820| 27 5c 6e 27 29 20 65 6e | 64 2b 2b 3b 0a 09 75 72 |'\n') en|d++;..ur|
|00000830| 6c 20 3d 20 28 63 68 61 | 72 2a 29 6d 61 6c 6c 6f |l = (cha|r*)mallo|
|00000840| 63 28 65 6e 64 20 2d 20 | 73 74 61 72 74 20 2b 20 |c(end - |start + |
|00000850| 31 29 3b 0a 09 6d 65 6d | 63 70 79 28 75 72 6c 2c |1);..mem|cpy(url,|
|00000860| 20 70 61 63 6b 65 74 2b | 73 74 61 72 74 2c 20 65 | packet+|start, e|
|00000870| 6e 64 2d 73 74 61 72 74 | 29 3b 0a 09 75 72 6c 5b |nd-start|);..url[|
|00000880| 65 6e 64 2d 73 74 61 72 | 74 5d 20 3d 20 30 3b 0a |end-star|t] = 0;.|
|00000890| 0a 09 2f 2a 20 2d 2d 20 | 66 69 6e 64 20 68 6f 73 |../* -- |find hos|
|000008a0| 74 20 28 6f 70 74 69 6f | 6e 61 6c 29 20 2a 2f 0a |t (optio|nal) */.|
|000008b0| 09 73 74 61 72 74 20 3d | 20 65 6e 64 2b 31 3b 0a |.start =| end+1;.|
|000008c0| 09 77 68 69 6c 65 20 28 | 73 74 61 72 74 20 2b 20 |.while (|start + |
|000008d0| 36 20 3c 20 6c 65 6e 67 | 74 68 20 26 26 20 6d 65 |6 < leng|th && me|
|000008e0| 6d 63 6d 70 28 70 61 63 | 6b 65 74 2b 73 74 61 72 |mcmp(pac|ket+star|
|000008f0| 74 2c 20 22 48 6f 73 74 | 3a 20 22 2c 20 36 29 20 |t, "Host|: ", 6) |
|00000900| 21 3d 20 30 29 0a 09 09 | 73 74 61 72 74 2b 2b 3b |!= 0)...|start++;|
|00000910| 0a 0a 09 69 66 20 28 73 | 74 61 72 74 20 2b 20 36 |...if (s|tart + 6|
|00000920| 20 3c 20 6c 65 6e 67 74 | 68 29 0a 09 7b 0a 09 09 | < lengt|h)..{...|
|00000930| 2f 2a 20 69 74 20 65 78 | 69 73 74 73 20 2d 20 73 |/* it ex|ists - s|
|00000940| 6f 20 65 78 74 72 61 63 | 74 20 69 74 20 2a 2f 0a |o extrac|t it */.|
|00000950| 09 09 73 74 61 72 74 20 | 2b 3d 20 36 3b 0a 09 09 |..start |+= 6;...|
|00000960| 65 6e 64 20 3d 20 73 74 | 61 72 74 3b 0a 09 09 77 |end = st|art;...w|
|00000970| 68 69 6c 65 20 28 65 6e | 64 3c 6c 65 6e 67 74 68 |hile (en|d<length|
|00000980| 20 26 26 20 70 61 63 6b | 65 74 5b 65 6e 64 5d 20 | && pack|et[end] |
|00000990| 21 3d 20 27 5c 72 27 0a | 09 09 09 09 20 20 26 26 |!= '\r'.|....  &&|
|000009a0| 20 70 61 63 6b 65 74 5b | 65 6e 64 5d 20 21 3d 20 | packet[|end] != |
|000009b0| 27 5c 6e 27 29 20 65 6e | 64 2b 2b 3b 0a 0a 09 09 |'\n') en|d++;....|
|000009c0| 68 6f 73 74 20 3d 20 28 | 63 68 61 72 2a 29 6d 61 |host = (|char*)ma|
|000009d0| 6c 6c 6f 63 28 65 6e 64 | 20 2d 20 73 74 61 72 74 |lloc(end| - start|
|000009e0| 20 2b 20 31 29 3b 0a 09 | 09 6d 65 6d 63 70 79 28 | + 1);..|.memcpy(|
|000009f0| 68 6f 73 74 2c 20 70 61 | 63 6b 65 74 2b 73 74 61 |host, pa|cket+sta|
|00000a00| 72 74 2c 20 65 6e 64 2d | 73 74 61 72 74 29 3b 0a |rt, end-|start);.|
|00000a10| 09 09 68 6f 73 74 5b 65 | 6e 64 2d 73 74 61 72 74 |..host[e|nd-start|
|00000a20| 5d 20 3d 20 30 3b 0a 09 | 7d 0a 09 65 6c 73 65 20 |] = 0;..|}..else |
|00000a30| 69 66 20 28 64 65 73 74 | 70 6f 72 74 20 3d 3d 20 |if (dest|port == |
|00000a40| 38 30 29 0a 09 09 68 6f | 73 74 20 3d 20 62 75 69 |80)...ho|st = bui|
|00000a50| 6c 64 5f 73 74 72 28 22 | 25 64 2e 25 64 2e 25 64 |ld_str("|%d.%d.%d|
|00000a60| 2e 25 64 22 2c 0a 09 09 | 09 09 28 64 65 73 74 69 |.%d",...|..(desti|
|00000a70| 70 20 3e 3e 20 32 34 29 | 20 26 20 32 35 35 2c 0a |p >> 24)| & 255,.|
|00000a80| 09 09 09 09 28 64 65 73 | 74 69 70 20 3e 3e 20 31 |....(des|tip >> 1|
|00000a90| 36 29 20 26 20 32 35 35 | 2c 0a 09 09 09 09 28 64 |6) & 255|,.....(d|
|00000aa0| 65 73 74 69 70 20 3e 3e | 20 20 38 29 20 26 20 32 |estip >>|  8) & 2|
|00000ab0| 35 35 2c 0a 09 09 09 09 | 28 64 65 73 74 69 70 20 |55,.....|(destip |
|00000ac0| 20 20 20 20 20 29 20 26 | 20 32 35 35 29 3b 0a 09 |     ) &| 255);..|
|00000ad0| 65 6c 73 65 0a 09 09 68 | 6f 73 74 20 3d 20 62 75 |else...h|ost = bu|
|00000ae0| 69 6c 64 5f 73 74 72 28 | 22 25 64 2e 25 64 2e 25 |ild_str(|"%d.%d.%|
|00000af0| 64 2e 25 64 3a 25 64 22 | 2c 0a 09 09 09 09 28 64 |d.%d:%d"|,.....(d|
|00000b00| 65 73 74 69 70 20 3e 3e | 20 32 34 29 20 26 20 32 |estip >>| 24) & 2|
|00000b10| 35 35 2c 0a 09 09 09 09 | 28 64 65 73 74 69 70 20 |55,.....|(destip |
|00000b20| 3e 3e 20 31 36 29 20 26 | 20 32 35 35 2c 0a 09 09 |>> 16) &| 255,...|
|00000b30| 09 09 28 64 65 73 74 69 | 70 20 3e 3e 20 20 38 29 |..(desti|p >>  8)|
|00000b40| 20 26 20 32 35 35 2c 0a | 09 09 09 09 28 64 65 73 | & 255,.|....(des|
|00000b50| 74 69 70 20 20 20 20 20 | 20 29 20 26 20 32 35 35 |tip     | ) & 255|
|00000b60| 2c 0a 09 09 09 09 64 65 | 73 74 70 6f 72 74 29 3b |,.....de|stport);|
|00000b70| 0a 0a 09 6e 6f 77 20 3d | 20 74 69 6d 65 28 4e 55 |...now =| time(NU|
|00000b80| 4c 4c 29 3b 0a 09 69 66 | 20 28 6e 6f 77 20 3e 20 |LL);..if| (now > |
|00000b90| 6e 65 78 74 5f 72 6f 74 | 61 74 65 29 20 73 70 79 |next_rot|ate) spy|
|00000ba0| 6c 6f 67 5f 72 6f 74 61 | 74 65 28 6e 6f 77 29 3b |log_rota|te(now);|
|00000bb0| 0a 09 74 6d 20 3d 20 6c | 6f 63 61 6c 74 69 6d 65 |..tm = l|ocaltime|
|00000bc0| 28 26 6e 6f 77 29 3b 0a | 0a 09 66 70 72 69 6e 74 |(&now);.|..fprint|
|00000bd0| 66 28 73 70 79 6c 6f 67 | 2c 20 22 25 30 34 64 2d |f(spylog|, "%04d-|
|00000be0| 25 30 32 64 2d 25 30 32 | 64 20 25 30 32 64 3a 25 |%02d-%02|d %02d:%|
|00000bf0| 30 32 64 3a 25 30 32 64 | 20 25 64 2e 25 64 2e 25 |02d:%02d| %d.%d.%|
|00000c00| 64 2e 25 64 20 25 73 20 | 22 0a 09 09 09 22 68 74 |d.%d %s |"...."ht|
|00000c10| 74 70 3a 2f 2f 25 73 25 | 73 5c 6e 22 2c 0a 0a 09 |tp://%s%|s\n",...|
|00000c20| 09 09 31 39 30 30 2b 74 | 6d 2d 3e 74 6d 5f 79 65 |..1900+t|m->tm_ye|
|00000c30| 61 72 2c 20 74 6d 2d 3e | 74 6d 5f 6d 6f 6e 2c 20 |ar, tm->|tm_mon, |
|00000c40| 74 6d 2d 3e 74 6d 5f 6d | 64 61 79 2c 0a 09 09 09 |tm->tm_m|day,....|
|00000c50| 74 6d 2d 3e 74 6d 5f 68 | 6f 75 72 2c 20 74 6d 2d |tm->tm_h|our, tm-|
|00000c60| 3e 74 6d 5f 6d 69 6e 2c | 20 74 6d 2d 3e 74 6d 5f |>tm_min,| tm->tm_|
|00000c70| 73 65 63 2c 0a 0a 09 09 | 09 28 73 72 63 69 70 20 |sec,....|.(srcip |
|00000c80| 3e 3e 20 32 34 29 20 26 | 20 32 35 35 2c 0a 09 09 |>> 24) &| 255,...|
|00000c90| 09 28 73 72 63 69 70 20 | 3e 3e 20 31 36 29 20 26 |.(srcip |>> 16) &|
|00000ca0| 20 32 35 35 2c 0a 09 09 | 09 28 73 72 63 69 70 20 | 255,...|.(srcip |
|00000cb0| 3e 3e 20 20 38 29 20 26 | 20 32 35 35 2c 0a 09 09 |>>  8) &| 255,...|
|00000cc0| 09 28 73 72 63 69 70 20 | 20 20 20 20 20 29 20 26 |.(srcip |     ) &|
|00000cd0| 20 32 35 35 2c 0a 0a 09 | 09 09 6d 65 74 68 6f 64 | 255,...|..method|
|00000ce0| 2c 20 68 6f 73 74 2c 20 | 75 72 6c 29 3b 0a 09 66 |, host, |url);..f|
|00000cf0| 66 6c 75 73 68 28 73 70 | 79 6c 6f 67 29 3b 0a 0a |flush(sp|ylog);..|
|00000d00| 09 69 66 20 28 76 65 72 | 62 6f 73 65 29 20 70 72 |.if (ver|bose) pr|
|00000d10| 69 6e 74 66 28 22 28 53 | 50 59 29 20 68 74 74 70 |intf("(S|PY) http|
|00000d20| 3a 2f 2f 25 73 25 73 5c | 6e 22 2c 20 68 6f 73 74 |://%s%s\|n", host|
|00000d30| 2c 20 75 72 6c 29 3b 0a | 0a 09 66 72 65 65 28 75 |, url);.|..free(u|
|00000d40| 72 6c 29 3b 0a 09 66 72 | 65 65 28 68 6f 73 74 29 |rl);..fr|ee(host)|
|00000d50| 3b 0a 7d 0a 0a 0a 0a 2f | 2a 20 64 69 73 61 73 73 |;.}..../|* disass|
|00000d60| 65 6d 62 6c 65 20 61 20 | 70 61 63 6b 65 74 20 61 |emble a |packet a|
|00000d70| 6e 64 20 6c 6f 6f 6b 20 | 66 6f 72 20 61 6e 20 48 |nd look |for an H|
|00000d80| 54 54 50 20 72 65 71 75 | 65 73 74 20 2a 2f 0a 73 |TTP requ|est */.s|
|00000d90| 74 61 74 69 63 20 76 6f | 69 64 20 73 70 79 5f 70 |tatic vo|id spy_p|
|00000da0| 6b 74 28 62 79 74 65 20 | 2a 75 73 65 72 2c 20 63 |kt(byte |*user, c|
|00000db0| 6f 6e 73 74 20 73 74 72 | 75 63 74 20 70 63 61 70 |onst str|uct pcap|
|00000dc0| 5f 70 6b 74 68 64 72 20 | 2a 70 68 65 61 64 65 72 |_pkthdr |*pheader|
|00000dd0| 2c 20 62 79 74 65 20 2a | 70 64 61 74 61 29 0a 7b |, byte *|pdata).{|
|00000de0| 0a 09 62 79 74 65 09 09 | 2a 70 74 72 3b 0a 09 77 |..byte..|*ptr;..w|
|00000df0| 6f 72 64 09 09 70 6b 74 | 5f 74 79 70 65 3b 0a 09 |ord..pkt|_type;..|
|00000e00| 64 77 6f 72 64 09 09 70 | 6b 74 5f 73 72 63 69 70 |dword..p|kt_srcip|
|00000e10| 2c 20 70 6b 74 5f 64 65 | 73 74 69 70 3b 0a 09 62 |, pkt_de|stip;..b|
|00000e20| 79 74 65 09 09 2a 74 63 | 70 5f 70 74 72 3b 0a 09 |yte..*tc|p_ptr;..|
|00000e30| 77 6f 72 64 09 09 64 65 | 73 74 70 6f 72 74 3b 0a |word..de|stport;.|
|00000e40| 0a 09 2f 2a 20 61 73 73 | 65 72 74 28 73 74 72 63 |../* ass|ert(strc|
|00000e50| 6d 70 28 75 73 65 72 2c | 20 22 64 65 66 22 29 20 |mp(user,| "def") |
|00000e60| 3d 3d 20 30 29 3b 20 2a | 2f 0a 0a 09 69 6e 74 65 |== 0); *|/...inte|
|00000e70| 72 70 72 65 74 5f 6c 69 | 6e 6b 74 79 70 65 28 73 |rpret_li|nktype(s|
|00000e80| 70 79 5f 6c 69 6e 6b 74 | 79 70 65 2c 20 70 64 61 |py_linkt|ype, pda|
|00000e90| 74 61 2c 20 26 70 74 72 | 2c 20 26 70 6b 74 5f 74 |ta, &ptr|, &pkt_t|
|00000ea0| 79 70 65 29 3b 0a 09 70 | 74 72 20 3d 20 65 74 68 |ype);..p|tr = eth|
|00000eb0| 5f 70 6b 74 5f 73 74 72 | 69 70 28 70 74 72 29 3b |_pkt_str|ip(ptr);|
|00000ec0| 0a 0a 09 70 6b 74 5f 73 | 72 63 69 70 20 3d 20 69 |...pkt_s|rcip = i|
|00000ed0| 70 5f 70 6b 74 5f 73 72 | 63 69 70 28 70 74 72 29 |p_pkt_sr|cip(ptr)|
|00000ee0| 3b 0a 09 70 6b 74 5f 64 | 65 73 74 69 70 20 3d 20 |;..pkt_d|estip = |
|00000ef0| 69 70 5f 70 6b 74 5f 64 | 65 73 74 69 70 28 70 74 |ip_pkt_d|estip(pt|
|00000f00| 72 29 3b 0a 0a 09 74 63 | 70 5f 70 74 72 20 3d 20 |r);...tc|p_ptr = |
|00000f10| 69 70 5f 70 6b 74 5f 73 | 74 72 69 70 28 70 74 72 |ip_pkt_s|trip(ptr|
|00000f20| 29 3b 0a 09 64 65 73 74 | 70 6f 72 74 20 3d 20 74 |);..dest|port = t|
|00000f30| 63 70 5f 70 6b 74 5f 64 | 65 73 74 70 6f 72 74 28 |cp_pkt_d|estport(|
|00000f40| 74 63 70 5f 70 74 72 29 | 3b 0a 0a 09 73 70 79 6c |tcp_ptr)|;...spyl|
|00000f50| 6f 67 5f 70 61 63 6b 65 | 74 28 74 63 70 5f 70 74 |og_packe|t(tcp_pt|
|00000f60| 72 20 2b 20 32 30 2c 0a | 09 09 20 20 20 20 20 20 |r + 20,.|..      |
|00000f70| 70 64 61 74 61 20 2b 20 | 70 68 65 61 64 65 72 2d |pdata + |pheader-|
|00000f80| 3e 6c 65 6e 20 2d 20 74 | 63 70 5f 70 74 72 20 2d |>len - t|cp_ptr -|
|00000f90| 20 32 30 2c 0a 09 09 20 | 20 20 20 20 20 70 6b 74 | 20,... |     pkt|
|00000fa0| 5f 73 72 63 69 70 2c 20 | 70 6b 74 5f 64 65 73 74 |_srcip, |pkt_dest|
|00000fb0| 69 70 2c 20 64 65 73 74 | 70 6f 72 74 29 3b 0a 7d |ip, dest|port);.}|
|00000fc0| 0a 0a 0a 0a 76 6f 69 64 | 20 73 70 79 6c 6f 67 5f |....void| spylog_|
|00000fd0| 6d 61 69 6e 28 76 6f 69 | 64 20 2a 73 70 79 64 65 |main(voi|d *spyde|
|00000fe0| 76 29 0a 7b 0a 09 73 74 | 72 75 63 74 20 62 70 66 |v).{..st|ruct bpf|
|00000ff0| 5f 70 72 6f 67 72 61 6d | 20 73 70 79 70 72 6f 67 |_program| spyprog|
|00001000| 3b 0a 09 63 68 61 72 20 | 2a 70 72 6f 67 3b 0a 09 |;..char |*prog;..|
|00001010| 64 77 6f 72 64 20 73 70 | 79 69 70 3b 0a 09 63 68 |dword sp|yip;..ch|
|00001020| 61 72 20 65 72 72 5b 50 | 43 41 50 5f 45 52 52 42 |ar err[P|CAP_ERRB|
|00001030| 55 46 5f 53 49 5a 45 5d | 3b 0a 0a 09 73 70 79 5f |UF_SIZE]|;...spy_|
|00001040| 63 61 70 20 3d 20 70 63 | 61 70 5f 6f 70 65 6e 5f |cap = pc|ap_open_|
|00001050| 6c 69 76 65 28 28 63 68 | 61 72 2a 29 73 70 79 64 |live((ch|ar*)spyd|
|00001060| 65 76 2c 20 35 30 30 2c | 20 70 72 6f 6d 69 73 63 |ev, 500,| promisc|
|00001070| 2c 0a 09 09 50 43 41 50 | 5f 54 49 4d 45 4f 55 54 |,...PCAP|_TIMEOUT|
|00001080| 2c 20 65 72 72 29 3b 0a | 0a 09 69 66 20 28 21 73 |, err);.|..if (!s|
|00001090| 70 79 5f 63 61 70 29 0a | 09 7b 0a 09 09 70 72 69 |py_cap).|.{...pri|
|000010a0| 6e 74 66 28 22 45 72 72 | 6f 72 3a 20 70 63 61 70 |ntf("Err|or: pcap|
|000010b0| 5f 6f 70 65 6e 5f 6c 69 | 76 65 28 25 73 29 3a 20 |_open_li|ve(%s): |
|000010c0| 25 73 5c 6e 22 2c 0a 09 | 09 09 28 63 68 61 72 2a |%s\n",..|..(char*|
|000010d0| 29 73 70 79 64 65 76 2c | 20 65 72 72 29 3b 0a 09 |)spydev,| err);..|
|000010e0| 09 46 41 49 4c 28 29 3b | 0a 09 7d 0a 0a 09 73 70 |.FAIL();|..}...sp|
|000010f0| 79 5f 6c 69 6e 6b 74 79 | 70 65 20 3d 20 70 63 61 |y_linkty|pe = pca|
|00001100| 70 5f 64 61 74 61 6c 69 | 6e 6b 28 73 70 79 5f 63 |p_datali|nk(spy_c|
|00001110| 61 70 29 3b 0a 0a 09 73 | 70 79 69 70 20 3d 20 67 |ap);...s|pyip = g|
|00001120| 65 74 5f 6c 6f 63 61 6c | 5f 69 70 28 28 63 68 61 |et_local|_ip((cha|
|00001130| 72 2a 29 73 70 79 64 65 | 76 29 3b 0a 09 70 72 6f |r*)spyde|v);..pro|
|00001140| 67 20 3d 20 62 75 69 6c | 64 5f 73 74 72 28 22 69 |g = buil|d_str("i|
|00001150| 70 20 70 72 6f 74 6f 20 | 5c 5c 74 63 70 20 61 6e |p proto |\\tcp an|
|00001160| 64 20 6e 6f 74 20 22 0a | 09 09 22 28 64 73 74 20 |d not ".|.."(dst |
|00001170| 68 6f 73 74 20 25 64 2e | 25 64 2e 25 64 2e 25 64 |host %d.|%d.%d.%d|
|00001180| 20 61 6e 64 20 64 73 74 | 20 70 6f 72 74 20 25 75 | and dst| port %u|
|00001190| 29 22 2c 0a 09 09 09 28 | 73 70 79 69 70 20 3e 3e |)",....(|spyip >>|
|000011a0| 20 32 34 29 20 26 20 32 | 35 35 2c 0a 09 09 09 28 | 24) & 2|55,....(|
|000011b0| 73 70 79 69 70 20 3e 3e | 20 31 36 29 20 26 20 32 |spyip >>| 16) & 2|
|000011c0| 35 35 2c 0a 09 09 09 28 | 73 70 79 69 70 20 3e 3e |55,....(|spyip >>|
|000011d0| 20 38 29 20 26 20 32 35 | 35 2c 0a 09 09 09 20 73 | 8) & 25|5,.... s|
|000011e0| 70 79 69 70 20 20 20 20 | 20 20 20 26 20 32 35 35 |pyip    |   & 255|
|000011f0| 2c 0a 09 09 09 20 77 65 | 62 70 6f 72 74 29 3b 0a |,.... we|bport);.|
|00001200| 0a 09 69 66 20 28 70 63 | 61 70 5f 63 6f 6d 70 69 |..if (pc|ap_compi|
|00001210| 6c 65 28 73 70 79 5f 63 | 61 70 2c 20 26 73 70 79 |le(spy_c|ap, &spy|
|00001220| 70 72 6f 67 2c 20 70 72 | 6f 67 2c 20 31 2c 20 30 |prog, pr|og, 1, 0|
|00001230| 29 20 3d 3d 20 2d 31 29 | 0a 09 7b 0a 09 09 70 72 |) == -1)|..{...pr|
|00001240| 69 6e 74 66 28 22 45 72 | 72 6f 72 3a 20 70 63 61 |intf("Er|ror: pca|
|00001250| 70 5f 63 6f 6d 70 69 6c | 65 28 29 3a 20 25 73 5c |p_compil|e(): %s\|
|00001260| 6e 22 2c 20 65 72 72 29 | 3b 0a 09 09 46 41 49 4c |n", err)|;...FAIL|
|00001270| 28 29 3b 0a 09 7d 0a 0a | 09 69 66 20 28 70 63 61 |();..}..|.if (pca|
|00001280| 70 5f 73 65 74 66 69 6c | 74 65 72 28 73 70 79 5f |p_setfil|ter(spy_|
|00001290| 63 61 70 2c 20 26 73 70 | 79 70 72 6f 67 29 20 3d |cap, &sp|yprog) =|
|000012a0| 3d 20 2d 31 29 0a 09 7b | 0a 09 09 70 72 69 6e 74 |= -1)..{|...print|
|000012b0| 66 28 22 45 72 72 6f 72 | 3a 20 70 63 61 70 5f 73 |f("Error|: pcap_s|
|000012c0| 65 74 66 69 6c 74 65 72 | 28 29 3a 20 25 73 5c 6e |etfilter|(): %s\n|
|000012d0| 22 2c 20 65 72 72 29 3b | 0a 09 09 46 41 49 4c 28 |", err);|...FAIL(|
|000012e0| 29 3b 0a 09 7d 0a 0a 23 | 69 66 64 65 66 20 48 41 |);..}..#|ifdef HA|
|000012f0| 56 45 5f 46 52 45 45 43 | 4f 44 45 0a 09 70 63 61 |VE_FREEC|ODE..pca|
|00001300| 70 5f 66 72 65 65 63 6f | 64 65 28 26 73 70 79 70 |p_freeco|de(&spyp|
|00001310| 72 6f 67 29 3b 0a 23 65 | 6e 64 69 66 0a 09 66 72 |rog);.#e|ndif..fr|
|00001320| 65 65 28 70 72 6f 67 29 | 3b 0a 0a 09 2f 2a 20 73 |ee(prog)|;.../* s|
|00001330| 70 79 6c 6f 67 67 69 6e | 67 20 6c 6f 6f 70 20 2a |pyloggin|g loop *|
|00001340| 2f 0a 09 70 72 69 6e 74 | 66 28 22 53 50 59 3a 20 |/..print|f("SPY: |
|00001350| 54 68 72 65 61 64 20 69 | 73 20 75 70 20 61 6e 64 |Thread i|s up and|
|00001360| 20 6c 6f 67 67 69 6e 67 | 2e 5c 6e 22 29 3b 0a 09 | logging|.\n");..|
|00001370| 75 70 5f 73 70 79 20 3d | 20 31 3b 0a 0a 09 77 68 |up_spy =| 1;...wh|
|00001380| 69 6c 65 20 28 21 73 68 | 75 74 74 69 6e 67 5f 64 |ile (!sh|utting_d|
|00001390| 6f 77 6e 29 0a 09 7b 0a | 09 09 73 74 72 75 63 74 |own)..{.|..struct|
|000013a0| 20 70 63 61 70 5f 73 74 | 61 74 20 70 73 3b 0a 0a | pcap_st|at ps;..|
|000013b0| 09 09 69 66 20 28 70 63 | 61 70 5f 64 69 73 70 61 |..if (pc|ap_dispa|
|000013c0| 74 63 68 28 73 70 79 5f | 63 61 70 2c 20 2d 31 2c |tch(spy_|cap, -1,|
|000013d0| 0a 09 09 09 28 70 63 61 | 70 5f 68 61 6e 64 6c 65 |....(pca|p_handle|
|000013e0| 72 29 73 70 79 5f 70 6b | 74 2c 20 22 64 65 66 22 |r)spy_pk|t, "def"|
|000013f0| 29 20 3d 3d 20 2d 31 29 | 0a 09 09 7b 0a 09 09 09 |) == -1)|...{....|
|00001400| 70 72 69 6e 74 66 28 22 | 45 72 72 6f 72 3a 20 70 |printf("|Error: p|
|00001410| 63 61 70 5f 64 69 73 70 | 61 74 63 68 28 29 3a 20 |cap_disp|atch(): |
|00001420| 25 73 5c 6e 22 2c 0a 09 | 09 09 09 70 63 61 70 5f |%s\n",..|...pcap_|
|00001430| 67 65 74 65 72 72 28 73 | 70 79 5f 63 61 70 29 29 |geterr(s|py_cap))|
|00001440| 3b 0a 09 09 09 46 41 49 | 4c 28 29 3b 0a 09 09 7d |;....FAI|L();...}|
|00001450| 0a 0a 09 09 69 66 20 28 | 76 65 72 62 6f 73 65 29 |....if (|verbose)|
|00001460| 0a 09 09 7b 0a 09 09 09 | 70 63 61 70 5f 73 74 61 |...{....|pcap_sta|
|00001470| 74 73 28 73 70 79 5f 63 | 61 70 2c 20 26 70 73 29 |ts(spy_c|ap, &ps)|
|00001480| 3b 0a 09 09 09 70 72 69 | 6e 74 66 28 22 50 61 63 |;....pri|ntf("Pac|
|00001490| 6b 65 74 73 3a 20 72 65 | 63 65 69 76 65 64 20 25 |kets: re|ceived %|
|000014a0| 64 2c 20 64 72 6f 70 70 | 65 64 20 25 64 20 28 73 |d, dropp|ed %d (s|
|000014b0| 70 79 6c 6f 67 29 5c 6e | 22 2c 0a 09 09 09 09 70 |pylog)\n|",.....p|
|000014c0| 73 2e 70 73 5f 72 65 63 | 76 2c 20 70 73 2e 70 73 |s.ps_rec|v, ps.ps|
|000014d0| 5f 64 72 6f 70 29 3b 0a | 09 09 7d 0a 0a 09 7d 0a |_drop);.|..}...}.|
|000014e0| 0a 09 70 63 61 70 5f 63 | 6c 6f 73 65 28 73 70 79 |..pcap_c|lose(spy|
|000014f0| 5f 63 61 70 29 3b 0a 0a | 09 70 72 69 6e 74 66 28 |_cap);..|.printf(|
|00001500| 22 53 50 59 3a 20 54 68 | 72 65 61 64 20 64 6f 77 |"SPY: Th|read dow|
|00001510| 6e 5c 6e 22 29 3b 0a 09 | 53 55 43 43 45 45 44 28 |n\n");..|SUCCEED(|
|00001520| 29 3b 20 2f 2a 20 69 6d | 70 6c 69 65 73 20 75 70 |); /* im|plies up|
|00001530| 5f 73 70 79 20 3d 20 30 | 20 2a 2f 0a 7d 0a 0a 00 |_spy = 0| */.}...|
|00001540| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001550| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001560| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001570| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001580| 00 00 01 00 00 00 01 00 | 00 00 00 00 00 00 00 1e |........|........|
|00001590| 54 68 69 73 20 72 65 73 | 6f 75 72 63 65 20 66 6f |This res|ource fo|
|000015a0| 72 6b 20 69 6e 74 65 6e | 74 69 6f 6e 61 6c 6c 79 |rk inten|tionally|
|000015b0| 20 6c 65 66 74 20 62 6c | 61 6e 6b 20 20 20 00 00 | left bl|ank   ..|
|000015c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001600| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001610| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001620| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001630| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001640| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001650| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001660| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001670| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001680| 00 00 01 00 00 00 01 00 | 00 00 00 00 00 00 00 1e |........|........|
|00001690| 00 00 00 00 00 00 00 00 | 00 1c 00 1e ff ff 00 00 |........|........|
|000016a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000016f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
+--------+-------------------------+-------------------------+--------+--------+