根据进程连接提取报文

#coding=utf-8
import os
import socket
import struct
class get_app():
def init(self,file):
self.len1=4
self.len2=0
self.dic1={}
self.file=file

def get_connect(self):  
    app1='[bee.exe]'
    app2='[TangChat.exe]'
    app_list=[] 
    with open(self.file,'r') as f:

        s=f.readlines()
        #print(len(s))
        while (self.len1 < len(s)):

            if s[self.len1].split()== []:
                self.len1=self.len1+1

            elif s[self.len1].split()[0] == 'TCP' or s[self.len1].split()[0] == 'UDP':
                app_list.append(s[self.len1])
                self.len1=self.len1+1

            elif s[self.len1].split()[0] == app1 or s[self.len1].split()[0] == app2:
                for k in app_list:
                    srcport=k.split()[1].split(':')[1]
                    dstip=k.split()[2].split(':')[0]
                    self.dic1[srcport]=dstip
                app_list=[]
                self.len1=self.len1+1   
            else:
                app_list=[]
                self.len1=self.len1+1              

    return self.dic1

class pcap():
def init(self, file):
self.file = file
self.i=self.file.split(’/’)[-1].split(’.’)[0]# 取路径中的文件名
self.file_pcap=open(‘D:/python/pcap1/target.pcap’,‘ab+’)
def db_log(self):
#search_word = b’\x01\x01\x01\x0D\x00\x0A\x00\x00\x00\x01\x00\x04\x00\x00\x00\x00\x00\x03\x00\x04\xC0\xA8\x65\x1D\x00\x04\x00\x04\xC0\xA8\x64\x1F\x00\x05\x00\x02\xCA\xEC\x00\x06\x00\x02\x05\xF1\x00\x07\x00\x04\x5E\x78\x14\x1A\x00\x5B\x00\x01\x02\x00\x5D\x00\x02\x00\x02\x00\x11\x00\x02\x00\x03\x00\x43\x00\x78\x28\x20\x3A\x70\x61\x72\x61\x6D\x36\x20\x2C\x31\x2C\x31\x30\x30\x30\x29\x2C\x20\x3A\x70\x61\x72\x61\x6D\x37\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x38\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x39\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x31\x30\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x31\x31\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x31\x32\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x31\x33\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x31\x34\x20\x2C\x20\x3A\x70\x61\x72\x61\x6D\x31\x35\x20\x2C\x31\x29\x00\x00\x00\x00\x44\x00\x18\x32\x31\x38\x36\x35\x30\x39\x36\x36\x35\x31\x35\x38\x34\x39\x32\x36\x39\x37\x38\x00\x00\x00\x00\x00\x45\x00\x08\x53\x55\x43\x43\x45\x53\x53\x00\x00\x5C\x00\x18\x30\x32\x30\x35\x30\x30\x32\x39\x64\x31\x34\x31\x30\x30\x30\x35\x31\x36\x39\x30\x30\x35\x00\x00\x00\x71\x00\x04\x31\x00\x00\x00’
#b’\x61\x6d\x31\x30\x20\x2c\x20\x3a\x70\x61\x72\x61\x6d\x31\x31\x20’
#35 33 39 2D 65 63 34 63 2D 34 31 36 31 2D 39 35 66 31
#srcport1=‘9518’
#dstip1=‘192.168.100.81’
f=open(self.file,‘rb’)
pcap_file = f.read()
if count==0:
pcap_file_header=pcap_file[0:24]
self.file_pcap.write(pcap_file_header)
#print(srcbytearr.find(magic_number,0))
#print(srcbytearr)
#print(srcbytearr[0:36])
#print(srcbytearr[16:20])
#packet_len=struct.unpack(‘I’,pcap_file[32:36])[0]
#print(srcbytearr[36:40])

    #startindex=0
    j=24
    len1=24
    len2=0
    #print(len(pcap_file))
    while (j<len(pcap_file)) :
        packet_len=struct.unpack('I',pcap_file[j+12:j+16])[0]
        #print(packet_len)
        len2=len1+16+packet_len
        #print(len1)
        #print(len2)
        s=pcap_file[len1:len2]
        dstip=struct.unpack('I',s[46:50])[0]
        srcport=str(struct.unpack('>H',s[50:52])[0])
        dstport=str(struct.unpack('>H',s[52:54])[0])
        #print(srcport)
        dstip=socket.inet_ntoa(struct.pack("!I",socket.htonl(dstip)))
        #print(dstip)
       #print(srcport1)
        #print(srcport)

        #print(s.hex())
        for key in dic2:
            #print(key,dic2[key],len(key))
            #print(srcport,dstport,dstip,len(dstip))
            if key==srcport or key==dstport:
                #print('111111111111111111')
                self.file_pcap.write(s)
                len1=len2
                j=len2   
            else: 
                #print('000000000000000')
                continue                   
                
        len1=len2
        j=len2
        #print(len2)

if name == ‘main’:

file ='c:/1.txt'
s=get_app(file)
dic2=s.get_connect()
print(dic2)
count=0
for fpathe,dirs,fs in   os.walk('D:/python/pcap/'):#路径可修改
    for fl in fs:
        print(fl)
        s=pcap(os.path.join(fpathe,fl))
        s.db_log()    
        count=count+1