关键词:电路板,协议,二进制,逆向
协议设计的三要素,即协议语法,语义和时序。参考《协议规范挖掘综述》
1. 搜索固定字段,频繁序列
分割数据流,解决帧的定界问题。
2. 数据挖掘,特征序列,类型标识符
字符串模式匹配,BF算法,KMP算法等
统计筛选,所有可能的特征序列。
3. 关联规则
Apriori算法发现规则
报文结构字段分析脚本:
import sys
import re
import string
from datetime import date,datetime
commands_array = []
commands_uniq = {}
dict_cache = []
def Needleman_Wunsch(str1,str2):
if str1=='' or str2=='':
return ''
#字符串长度
m=len(str1)
n=len(str2)
#初始化
lcs=[[i*(-2)] for i in range(0,m+1)]
lcs[0]=[j*(-2) for j in range(0,n+1)]
#
for i in range(m):
for j in range(n):
lcs[i+1].append(
max(
lcs[i][j]+(1 if str1[i] == str2[j] else -1),
lcs[i][j+1]-2,
lcs[i+1][j]-2,
)
)
i=m-1
j=n-1
common_substr1 = u''
common_substr2 = u''
common_substr1 = u"%s%s" % (str1[i], common_substr1)
common_substr2 = u"%s%s" % (str2[j], common_substr2)
#回溯
while True:
if i == 0 and j == 0:
break
if str1[i] == str2[j]:
if lcs[i-1][j-1]+1>lcs[i-1][j]-2 and lcs[i-1][j-1]+1>lcs[i][j-1]-2:
i = i - 1
j = j -1
common_substr1 = u"%s%s" % (str1[i], common_substr1)
common_substr2 = u"%s%s" % (str2[j], common_substr2)
else:
if lcs[i][j+1] > lcs[i+1][j]:
i = i-1
common_substr1 = u"%s%s" % (str1[i], common_substr1)
common_substr2 = u"%s%s" % ('-', common_substr2)
else:
j = j-1
common_substr1 = u"%s%s" % ('-', common_substr1)
common_substr2 = u"%s%s" % (str2[j], common_substr2)
else:
if lcs[i-1][j-1]+1>lcs[i-1][j]-2 and lcs[i-1][j-1]+1>lcs[i][j-1]-2:
i = i - 1
j = j -1
common_substr1 = u"%s%s" % (str1[i], common_substr1)
common_substr2 = u"%s%s" % (str2[j], common_substr2)
else:
if lcs[i][j+1] > lcs[i+1][j]:
i = i-1
common_substr1 = u"%s%s" % (str1[i], common_substr1)
common_substr2 = u"%s%s" % ('-', common_substr2)
else:
j = j-1
common_substr1 = u"%s%s" % ('-', common_substr1)
common_substr2 = u"%s%s" % (str2[j], common_substr2)
#print common_substr1
#print common_substr2
global dict_cache
global commands_uniq
if len(common_substr1) < len(common_substr2):
len1 = len(common_substr1)
else:
len1 = len(common_substr2)
for k in range(0, len1):
if common_substr1[k] != common_substr2[k] :
if common_substr1[k] == ' ' or common_substr2[k] == ' ':
common_substr1 = common_substr1[:k] + ' ' + common_substr1[k+1:]
else:
common_substr1 = common_substr1[:k] + '-' + common_substr1[k+1:]
x = common_substr1
if x not in dict_cache:
dict_cache.append(x)
commands_uniq[x] = "1"
else:
if x in commands_uniq.keys():
counter1 = string.atoi(commands_uniq[x])
counter1 += 1
commands_uniq[x] = '%d'%counter1
def analyzefeature(datalist):
global commands_uniq
print " datalist length: " + '%d'%len(datalist)
for j in range(0, len(datalist)-2):
command1 = re.sub(r'\s+', ' ', datalist[j])
command1 = command1.strip()
#print command1
command2 = re.sub(r'\s+', ' ', datalist[j+1])
command2 = command2.strip()
Needleman_Wunsch(command1, command2)
command3 = re.sub(r'\s+', ' ', datalist[j+2])
command3 = command3.strip()
Needleman_Wunsch(command1, command3)
print " \n longest match -- \n "
for d,x in commands_uniq.items():
print d, "counts: ", x
return 0
datalist 保存协议的二进制帧数据。
分析的结果示例:
datalist length: 73
longest match --
1B C1 -2 06 -4 0- -4 04 04 54 -- -- D- -- -- counts: 20
1B C1 92 06 34 04 04 04 54 D4 F8 counts: 120
1B C1 -- 0- -4 -- -- -- -- -- -- -- -D -- -4 -- -- -- counts: 2
参考
面向比特流数据的无人机测控协议逆向解析_曾令元.caj