十六进制字符串wireshark pcap

Question

我有一个十六进制字符串，我想转换成Wireshark pcap。 Wireshark的接受以下格式的十六进制转储：

0000 00 00 00 00 00 aa 00 00 00 00 00 01 88 47 00 3e 
0010 80 0a 00 00 d1 0a 10 00 89 02 20 01 05 46 00 00 
0020 00 01 00 02 04 03 6d 64 31 02 03 6d 61 57 00 00 
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0060 00 00 00 00 00 

我有以下流：

0000000000AA0000000000018847003E800A0000D10A100089022001054600000001000204036D643102036D615700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 

我一直od -Ax -tc1 -v命令在Linux中进行实验，但似乎无法得到正确的输出。有谁知道这可以做到吗？

谢谢。

Answer 1

您可以使用以下脚本。这只是一个解决方法。 od和hexdump会将0解释为字符'0'，并使用字节48，因此您可能无法获得正确的输出。该脚本读取16个字符的两个字符，并相应地增加偏移量。很容易理解我猜:)

#!/bin/bash 
off=0 
while [ 1 ] 
do 
     printf "%04x " $off 
     for ((i=0;i<16;i++)) 
     do 
       read -n 2 a 
       [ $? -ne 0 ] && echo && exit 
       echo -n "$a " 
     done 
     echo 
     off=`expr $off + 16` 
done <test 

其中test是持有流的文件。我为您的输入提供了以下输出。

0000 00 00 00 00 00 AA 00 00 00 00 00 01 88 47 00 3E 
0010 80 0A 00 00 D1 0A 10 00 89 02 20 01 05 46 00 00 
0020 00 01 00 02 04 03 6D 64 31 02 03 6D 61 57 00 00 
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0060 00 00 00 00 00