diff --git a/processor.py b/processor.py new file mode 100644 index 0000000..6f0b564 --- /dev/null +++ b/processor.py @@ -0,0 +1,18 @@ +import os + +def read_from_pipe(pipe_path='/tmp/tshark_pipe'): + if not os.path.exists(pipe_path): + print(f"Error: The named pipe {pipe_path} does not exist. Make sure that TsharkLive has created it.") + return + + try: + with open(pipe_path, 'r') as pipe: + for line in pipe: + print(f"{line.strip()}") + except KeyboardInterrupt: + print("\n") + except Exception as e: + print(f"Error: {e}") + +if __name__ == "__main__": + read_from_pipe() diff --git a/src/main.py b/src/main.py index 959b2da..4b0ad43 100644 --- a/src/main.py +++ b/src/main.py @@ -65,6 +65,8 @@ def main(): modules.add_argument('--info', action = 'store_true', help = 'Read generic information about the baseband device.') modules.add_argument('--pcap-dump', metavar = 'PCAP_FILE', type = FileType('ab'), help = 'Generate a PCAP file containing GSMTAP frames for 2G/3G/4G, to be loaded using Wireshark.') + modules.add_argument('--tshark', action = 'store_true', help = 'Same as --pcap-dump, but directly spawn tshark.') + modules.add_argument('--analyze', action = 'store_true', help = 'Same as --pcap-dump, but send the output to a named pipe.') modules.add_argument('--wireshark-live', action = 'store_true', help = 'Same as --pcap-dump, but directly spawn a Wireshark instance.') # modules.add_argument('--efs-dump', metavar = 'OUTPUT_DIR', help = 'Dump the internal EFS filesystem of the device.') modules.add_argument('--memory-dump', metavar = 'OUTPUT_DIR', help = 'Dump the memory of the device (may not or partially work with recent devices).') @@ -73,7 +75,7 @@ def main(): 'To be used in combination with --adb.') modules.add_argument('--decoded-sibs-dump', action = 'store_true', help = 'Print decoded SIBs to stdout (experimental, requires pycrate).') - pcap_options = parser.add_argument_group(title = 'PCAP generation options', description = 'To be used along with --pcap-dump or --wireshark-live.') + pcap_options = parser.add_argument_group(title = 'PCAP generation options', description = 'To be used along with --pcap-dump, --wireshark-live, --tshark or --analyze.') pcap_options.add_argument('--reassemble-sibs', action = 'store_true', help = 'Include reassembled UMTS SIBs as supplementary frames, also embedded fragmented in RRC frames.') pcap_options.add_argument('--decrypt-nas', action = 'store_true', help = 'Include unencrypted LTE NAS as supplementary frames, also embedded ciphered in RRC frames.') @@ -154,6 +156,12 @@ def parse_modules_args(args): if args.wireshark_live: from .modules.pcap_dump import WiresharkLive diag_input.add_module(WiresharkLive(diag_input, args.reassemble_sibs, args.decrypt_nas, args.include_ip_traffic)) + if args.analyze and not args.tshark: + from .modules.pcap_dump import ExternalAnalyze + diag_input.add_module(ExternalAnalyze(diag_input, args.reassemble_sibs, args.decrypt_nas, args.include_ip_traffic)) + if args.tshark and not args.analyze: + from .modules.pcap_dump import TsharkLive + diag_input.add_module(TsharkLive(diag_input, args.reassemble_sibs, args.decrypt_nas, args.include_ip_traffic)) if args.json_geo_dump: diag_input.add_module(JsonGeoDumper(diag_input, args.json_geo_dump)) if args.decoded_sibs_dump: diff --git a/src/modules/pcap_dump.py b/src/modules/pcap_dump.py index f41f214..c17748f 100644 --- a/src/modules/pcap_dump.py +++ b/src/modules/pcap_dump.py @@ -9,14 +9,14 @@ from logging import warning from sys import platform import gzip - +import sys +import os from ..modules._enable_log_mixin import EnableLogMixin, TYPES_FOR_RAW_PACKET_LOGGING from ..modules.decoded_sibs_dump import DecodedSibsDumper MODULES_DIR = realpath(dirname(__file__)) SRC_WIRESHARK_PLUGIN_DIR = realpath(MODULES_DIR + '/wireshark_plugin') - try: from os import setpgrp, getenv, setresgid, setresuid, setgroups, getgrouplist from pwd import getpwuid @@ -37,17 +37,17 @@ """ class PcapDumper(DecodedSibsDumper): - + def __init__(self, diag_input, pcap_file, reassemble_sibs, decrypt_nas, include_ip_traffic): - + self.pcap_file = pcap_file - + """ Write a PCAP file header - https://wiki.wireshark.org/Development/LibpcapFileFormat#File_Format """ - + if not self.pcap_file.appending_to_file: - + self.pcap_file.write(pack('