You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Apr 14, 2023. It is now read-only.
I believe there is an issue when writing a fingerprint to extract some data from the end of a packet. The schema for an Extract node is that it should contain a From and a To attribute. The From indicates the index into the data where the extraction begins and the To attribute indicates the index up to which data is extracted. E.g. If the packet contains a stream of numbers... 0123456789
Then to extract the first character the Extract XML should be <Extract From="0" To="1" ...>
To extract the first two characters the Extract XML should be <Extract From="0" To="2" ...>
And then to extract the entire string the Extract XML should be <Extract From="0" To="10" ...>
This XML instructs that the data from index 0 to 9 will be extracted. "To" means up to, but not including index 10. This is fine. However, the extract function in PacketData.java requires that the To value must be less than the payload size. This test always fails and so no data is extracted. I hope this makes sense.
The text was updated successfully, but these errors were encountered:
This does make sense and you are indeed correct. There is an off-by-one error on the end of the range that leaves the last byte inaccessible. The fix for this will be coming in the 3.2.2 patch, which we hope to release before December 2017.
I believe there is an issue when writing a fingerprint to extract some data from the end of a packet. The schema for an Extract node is that it should contain a From and a To attribute. The From indicates the index into the data where the extraction begins and the To attribute indicates the index up to which data is extracted. E.g. If the packet contains a stream of numbers...
0123456789
Then to extract the first character the Extract XML should be
<Extract From="0" To="1" ...>
To extract the first two characters the Extract XML should be
<Extract From="0" To="2" ...>
And then to extract the entire string the Extract XML should be
<Extract From="0" To="10" ...>
This XML instructs that the data from index 0 to 9 will be extracted. "To" means up to, but not including index 10. This is fine. However, the extract function in PacketData.java requires that the To value must be less than the payload size. This test always fails and so no data is extracted. I hope this makes sense.
The text was updated successfully, but these errors were encountered: