Data

Toolbox

MyStruct

Length:UBInt16

Value:Bytes(_)

Struct

Integer

Bytes

Struct

05 40 41 42 43 44 11 22 33 44 55 66 77 88 99 aa bb cc dd

length value

MyStruct

File View Tools CaptureWireSnake x_

ipv4ethernet

class MacAddressAdapter(Adapter): … …

ethernet_header = Struct( … … … …)

StructA sequence of …

Parameters: name – … subcons – …

Buffer: 0172996a336c3b62811de6a70806

Result: Conatiner: dst=“01-72-99-6a-33-6c” src = …

Debugger:•Traceback•Context analysis•Playback

Field(6) Field(6) UBInt16Ethernet header

Ethernet header01001001001001… Dest = \x01\x02\x03\x04\x05\x06Source = \x07\x08\x09\x0a\x0b\x0cType = 2054

Field(6) Field(6)

UBInt16Ethernet header

MacAdapter def _decode…def _encode…

MacAdapter MacAdapter

Field(6)

UBInt16Ethernet header

MacAdapter def _decode…def _encode…

MacAdapterMacAddress

MacAddress MacAddress

Field(6)

UBInt16

Ethernet header

MacAdapter def _decode…def _encode…

MacAdapterMacAddress

MacAddress MacAddress

TypeEnumEnum(IP = 0x0806,

ARP = 0x0804)

TypeEnum

Ethernet header01001001001001… Dest = 01.02.03.04.05.06Source = 07.08.09.0a.0b.0cType = IP

UBInt8PascalString Array( )

Field(1)

<number>

PascalString

Array( )

Field(1)

LengthValueAdapterLengthValue

def _decode…def _encode…LengthValueAdapter

StringAdapter

LengthValue

PascalString8 PascalString

UBInt8

PascalStringFoo PascalString

Field(1)