| 
									
										
										
										
											2023-01-29 09:38:05 -08:00
										 |  |  | #!/bin/python3 | 
					
						
							|  |  |  | import argparse | 
					
						
							|  |  |  | import pcapng | 
					
						
							|  |  |  | import zipfile | 
					
						
							|  |  |  | import hashlib | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | def extract_packets(pcap_file): | 
					
						
							|  |  |  |     """Reads a wireshark packet capture and extracts the binary packets""" | 
					
						
							|  |  |  |     packets = [] | 
					
						
							|  |  |  |     with open(pcap_file, 'rb') as fp: | 
					
						
							|  |  |  |         scanner = pcapng.FileScanner(fp) | 
					
						
							|  |  |  |         for block in scanner: | 
					
						
							|  |  |  |             if isinstance(block, pcapng.blocks.EnhancedPacket): | 
					
						
							|  |  |  |                 packets.append(block.packet_data) | 
					
						
							|  |  |  |     return packets | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | def build_corpus_zip(zip_file_output, packets): | 
					
						
							|  |  |  |     """Builds a zip file with a file per packet
 | 
					
						
							| 
									
										
										
										
											2023-03-17 16:12:49 +07:00
										 |  |  | 
 | 
					
						
							| 
									
										
										
										
											2023-01-29 09:38:05 -08:00
										 |  |  |     The structure of this zip corpus is a simple content addressable storage | 
					
						
							|  |  |  |     i.e. seed_file_name == sha256_digest(packet). | 
					
						
							|  |  |  |     """
 | 
					
						
							|  |  |  |     with zipfile.ZipFile(zip_file_output, 'a') as out: | 
					
						
							|  |  |  |         for packet in packets: | 
					
						
							|  |  |  |             hash = hashlib.sha256(packet).hexdigest() | 
					
						
							|  |  |  |             if hash not in out.namelist(): | 
					
						
							|  |  |  |                 out.writestr(hash, packet) | 
					
						
							| 
									
										
										
										
											2023-03-17 16:12:49 +07:00
										 |  |  | 
 | 
					
						
							| 
									
										
										
										
											2023-01-29 09:38:05 -08:00
										 |  |  | 
 | 
					
						
							|  |  |  | def main(pcap_file, output_zip_file): | 
					
						
							|  |  |  |     packets = extract_packets(pcap_file) | 
					
						
							|  |  |  |     build_corpus_zip(output_zip_file, packets) | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | if __name__ == "__main__": | 
					
						
							|  |  |  |     parser = argparse.ArgumentParser( | 
					
						
							|  |  |  |         prog = "pcapng_to_corpus.py", | 
					
						
							|  |  |  |         description="""Converts a wireshark capture to a zip of binary packet
 | 
					
						
							| 
									
										
										
										
											2023-03-17 16:12:49 +07:00
										 |  |  |                     files suitable for an oss-fuzz corpus. In the case the | 
					
						
							|  |  |  |                     zip corpus already exists, this script will modify | 
					
						
							| 
									
										
										
										
											2023-01-29 09:38:05 -08:00
										 |  |  |                     the zip file in place adding seed entries.""")
 | 
					
						
							|  |  |  |     parser.add_argument('pcapng_capture_file') | 
					
						
							|  |  |  |     parser.add_argument('oss_fuzz_corpus_zip') | 
					
						
							|  |  |  |     args = parser.parse_args() | 
					
						
							|  |  |  |     main(args.pcapng_capture_file, args.oss_fuzz_corpus_zip) |