specific type of Hex conversion

[Kifah Abbad]

Hi guys,

i found a proggie, to convert packets captured (by libpcap) to hex
format...to pass them to dnet-application.

Now the proggie shows results as following:
4500003ca92e00002001c96a0a0a0a0b0a0a0a0a08007ca40100cfb76162636465666768696a6b6c6d6e6f7071727374757677616263646566676869

(please go to bottom for code)

While i need the result to look as follows:

\x45\x00\x00\x3c\xa9\x2e\x00\x00\x20\x01\xc9\x6a\x0a\x0a\x0a\x0b\x0a\x0a\x0a\x0a\x08\x00\x7c\xa4\x01\x00\xcf\xb7\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x61\x62\x63\x64\x65\x66\x67\x68\x69

I tried to manipulate the values, but it still showed the numbers as a
block of 4 (for example \x4500) instead of a block of 2 (for example
\x45\x00).

Here is the code of the proggie, maybe someone would help me align it
as i want to?

///////////////

void
print_hex(u_char *packet, u_short len)
{
int i, s_cnt;
u_short *p;

p = (u_short *)packet;
s_cnt = len / sizeof(u_short);

for (i = 0; --s_cnt >= 0; i++)
{
if ((!(i % 60)))
{
if (i != 0)
{
printf("\n");
}

}
printf("%04x", ntohs(*(p++)));



}

if (len & 1)
{
if ((!(i % 8)))
{
//printf("\n%02x\t", (i * 2));
}
printf("%02x ", *(u_char *)p);
}
printf("\n");
}

 

[Alexander Bartolich]

begin Kifah Abbad:

4500003ca92e00002001c96a0a0a0a0b0a0a0a0a08007 [...]

While i need the result to look as follows:

\x45\x00\x00\x3c\xa9\x2e\x00\x00\x20\x01\xc9 [...]

Transform this:

printf("%04x", ntohs(*(p++)));

to

{ short tmp = ntohs(*(p++));
printf("\\x%02x\\x%02x", tmp >> 8, tmp & 0xFF); }

and this

 

[Simon Biber]

(nothing, according to my newsreader)

Can you please remove the "begin Kifah Abbad:" line from
the beginning of your messages, as it is highly confusing
my newsreader, creating an attachment called "Kifah Abbad_"
which is unreadable (probably been wrongly decoded).

I can read your messages with the command to view the raw
message source (Ctrl-F3), but that is not ideal.

 

[Barry Schwarz]

Hi guys,

i found a proggie, to convert packets captured (by libpcap) to hex
format...to pass them to dnet-application.

Now the proggie shows results as following:
4500003ca92e00002001c96a0a0a0a0b0a0a0a0a08007ca40100cfb76162636465666768696a6b6c6d6e6f7071727374757677616263646566676869

(please go to bottom for code)

While i need the result to look as follows:

\x45\x00\x00\x3c\xa9\x2e\x00\x00\x20\x01\xc9\x6a\x0a\x0a\x0a\x0b\x0a\x0a\x0a\x0a\x08\x00\x7c\xa4\x01\x00\xcf\xb7\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x61\x62\x63\x64\x65\x66\x67\x68\x69

I tried to manipulate the values, but it still showed the numbers as a
block of 4 (for example \x4500) instead of a block of 2 (for example
\x45\x00).

Here is the code of the proggie, maybe someone would help me align it
as i want to?

///////////////

void
print_hex(u_char *packet, u_short len)
{
int i, s_cnt;
u_short *p;

p = (u_short *)packet;

How do you know that the value in packet is properly aligned to be the
address of a u_short (which I assume is an unsigned short int).

s_cnt = len / sizeof(u_short);

for (i = 0; --s_cnt >= 0; i++)
{
if ((!(i % 60)))
{
if (i != 0)
{
printf("\n");
}

}
printf("%04x", ntohs(*(p++)));



}

if (len & 1)
{
if ((!(i % 8)))
{
//printf("\n%02x\t", (i * 2));
}
printf("%02x ", *(u_char *)p);
}
printf("\n");
}

<<Remove the del for email>>

 

[CBFalconer]

(nothing, according to my newsreader)

Can you please remove the "begin Kifah Abbad:" line from
the beginning of your messages, as it is highly confusing
my newsreader, creating an attachment called "Kifah Abbad_"
which is unreadable (probably been wrongly decoded).

He is probably someone with the messianic impulse to expose the
shortcomings of Outhouse Expletive whenever possible. Of course,
if you got rid of that alleged newsreader you would probably have
no difficulty.

 

[TheClap]

On Sun, 21 Dec 2003 02:16:40 GMT, in @news.optusnet.com.au "Simon Biber" said

(nothing, according to my newsreader)

Can you please remove the "begin Kifah Abbad:" line from
the beginning of your messages, as it is highly confusing
my newsreader, creating an attachment called "Kifah Abbad_"
which is unreadable (probably been wrongly decoded).

I can read your messages with the command to view the raw
message source (Ctrl-F3), but that is not ideal.

He's just some fuckhead that likes to make other people suffer.
Don't pay any attention to him and the other whining kikes like him.

 

[Richard Heathfield]

(nothing, according to my newsreader)

Can you please remove the "begin Kifah Abbad:" line from
the beginning of your messages, as it is highly confusing
my newsreader, creating an attachment called "Kifah Abbad_"
which is unreadable (probably been wrongly decoded).

Have you considered getting a working newsreader?

I can read your messages with the command to view the raw
message source (Ctrl-F3), but that is not ideal.

No, it's not ideal. You shouldn't have any major difficulty finding a
newsreader that works, for free download off the Net. Or, if you have a few
decades to spare, you can wait for me to finish writing mine[1].


[1] No, I have no immediate plans to start one.

 

[Mark McIntyre]

(nothing, according to my newsreader)

Can you please remove the "begin Kifah Abbad:" line from
the beginning of your messages,

while I agree that starting a message with the opening remark from a
UUEncoding is unusual and probably daft, your newsreader should not
object.

 

[Kifah Abbad]

Alright guys...with your help, i managed to get a decent function:

void print_hex(u_char *packet, u_short len)
{
int i, s_cnt;
u_short *p, w;

p = (u_short *)packet;
s_cnt = len / sizeof(u_short);

for (i = 0; --s_cnt >= 0; ++i, ++p)
{
if ((!(i % 60)) && i != 0)
printf("\n");
w = ntohs(*p);
printf("\\x%02x", (w>>8)&0xff);
printf("\\x%02x", w&0xff);
}

if (len & 1)
printf("\\x%02x ", *(u_char *)p);
printf("\n");
}


if (len & 1)
{
if ((!(i % 8)))
{
//printf("\n%02x\t", (i * 2));
}
printf("\\x%02x ", *(u_char *)p);
}
printf("\n");
}

I get following string as a result printed out,which is what i
intended:

\x45\x00\x00\x48\x37\x34\x00\....etc

Any1 can give me a hint, how i can save all what gets printed out,
into a char variable? i mean exactly what gets printed out,and not
part of it....is it playing with snprintf?

 

[Alexander Bartolich]

begin Kifah Abbad:

Any1 can give me a hint, how i can save all what gets printed out,
into a char variable? i mean exactly what gets printed out,and not
part of it....is it playing with snprintf?

The really easy way is to use fprintf and a temporary file.
One additional argument, trivial changes to the code.

Working with sprintf is unsafe, but not difficult to implemented.
Only additional argument, little change to the code.

char sz[0x1000];
char* buffer = sz;
buffer += sprintf(buffer, ....)
/* the next sprintf */

The Only Decent Solution (TM) with snprintf is more complicated.
First of all the return value of snprintf in case of overflow varies
through history. Unlike other things that where later on fixed by
the standard this one is so subtle that it might get unnoticed.

Anyway, the basic structure:

{ int result = snprintf(buffer, buffer_size, ...)
if (result >= buffer_size)
/* error */
buffer += result; buffer_size -= result; }

 

[Mark McIntyre]

begin Kifah Abbad:

Hi
Its REALLY not a good idea to start your posts with "begin". This is
the opening phrase from a uuencoded document and may confuse many
newsreaders not to mention humans.

Also, it doesn't make any sense in english. You probably mean
Kifah Abbad said:
or
Kifah Abbad began:

I don't think that even in German one can say "Anfangst Alexander". Or
maybe you can, but in English its gibberish.

The really easy way is to use fprintf and a temporary file.

an easier way would be to use OS specific functionality to pipe stdout
to a file.

 

[Richard Heathfield]

Hi
Its REALLY not a good idea to start your posts with "begin".

It's hardly a /bad/ idea.

This is
the opening phrase from a uuencoded document and may confuse many
newsreaders

I don't think so. I think it may confuse one particular newsreader, and I
think that may be exactly why he's doing it.

not to mention humans.

Not really. I read his article, and didn't even notice the begin-thing until
other people started pointing it out. But then, my newsreader isn't broken
(in that particular way).

 

[Gary Labowitz]

What's this antisemitic flood all about? Does this quaify as spam?

 

[Kifah Abbad]

begin Kifah Abbad:

Any1 can give me a hint, how i can save all what gets printed out,
into a char variable? i mean exactly what gets printed out,and not
part of it....is it playing with snprintf?

The really easy way is to use fprintf and a temporary file.
One additional argument, trivial changes to the code.

Working with sprintf is unsafe, but not difficult to implemented.
Only additional argument, little change to the code.

char sz[0x1000];
char* buffer = sz;
buffer += sprintf(buffer, ....)
/* the next sprintf */

Well, i have been experminting with sprintf all day.

And concentrated on the loop:
for (i = 0; --s_cnt >= 0; ++i, ++p)
{
if ((!(i % 60)) && i != 0)
printf("\n");
w = ntohs(*p);

sprintf(stringo1,"\\x%02x", (w>>8)&0xff);
sprintf(stringo2,"\\x%02x", w&0xff);
sprintf(stringo_final,"%s%s", stringo1,stringo2);
printf("%s",stringo_final);


}

Now if pull the last line out of the loop,
(printf("%s",stringo_final) i get as a results of the proggie:
\x68\x69 only (the last part handled by the loop).

so i need to have something, that keeps adding the strings, and
presents them out of the loop...I need to look under append string or
something like that.

 

[Alexander Bartolich]

begin followup to Kifah Abbad:

so i need to have something, that keeps adding the strings, and
presents them out of the loop...I need to look under append string or
something like that.

Please look again at my scribble of code.
Think about the return value of sprintf.
Try to imagine what "buffer += sprintf" is about.

 

[=?iso-8859-1?Q?Jos=E9_Mar=EDa?= Mateos]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

What's this antisemitic flood all about? Does this quaify as spam?

It qualifies as off-topic braindead flood. Not that I agree or
disagree with the content of those messages, but this is surely not the
place for discussing such topics.

Followup to soc.culture.jewish just in case someone wants to
continue/start the flame far away from here.

Regards.
- --
My real e-mail address: chema (AT) chema.homelinux.org
http://EuropeSwPatentFree.hispalinux.es - EuropeSwPatentFree
I don't read HTML posts / No leo mensajes en HTML
Blog Overflow: http://chema.homelinux.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/5f2C9P6GbSlI+hkRAklxAKCheybrp7orfqSGI6fwbz/sfHYz7ACeOEOQ
fubvjLss1VVERNPv4mPHlIM=
=eGIT
-----END PGP SIGNATURE-----

 

[Kelsey Bjarnason]

Hi
Its REALLY not a good idea to start your posts with "begin". This is
the opening phrase from a uuencoded document and may confuse many
newsreaders not to mention humans.

FWIW, it's generally intentional; the only known newsreader to screw up
consistently is Outlook Express, which also happens to have a few other
annoying habits. By doing this, the poster is essentially saying "If you
want to play with the big boys, get a real client."

Not condoning, just clarifying.

 

[CBFalconer]

.... snip ...

so i need to have something, that keeps adding the strings, and
presents them out of the loop...I need to look under append
string or something like that.

unsigned int index;
char carray[MAX];

index = 0;
while (someconditions) {
/* setup FORMAT and data etc. */
index += sprintf(&carray[index], FORMAT, data);
}

and somewhere you are ensuring that you don't overwrite carray.

 

[Mark McIntyre]

It's hardly a /bad/ idea.

Well, YMMV, but I tend to find that its often a nongood idea (if you
prefer that to bad) to use confusing constructs that can appear to be
other than they are, especially when writing in plain english.

I don't think so. I think it may confuse one particular newsreader,

I'm just thinking how many times I've heard people argue against html
because even if it breaks only one newsreader, its still one too many.

and I
think that may be exactly why he's doing it.

Anyone who does something so childish is clearly an idiot, and not to
be taken seriously.... :-(

 

[Richard Heathfield]

Well, YMMV, but I tend to find that its often a nongood idea (if you
prefer that to bad) to use confusing constructs that can appear to be
other than they are, especially when writing in plain english.

So unconfusing was this construct that I didn't even notice it when it was
first posted. I skipped right past it to the article.

I'm just thinking how many times I've heard people argue against html
because even if it breaks only one newsreader, its still one too many.

<shrug> That's not my reasoning at all, wrt HTML. I think it's important
that articles should be readable in a vanilla text client without the
reader having to jump through mental parsing hoops. The "begin" thing,
then, clearly isn't an issue for me, whereas HTML is far more suited to Web
browsers than to Usenet.

Anyone who does something so childish is clearly an idiot, and not to
be taken seriously.... :-(

Well, yes and no. I mean yes, I see your point, but on the other hand he's
drawing attention to what some people consider to be a serious flaw in one
particular newsreader. Ideally, the effect ought to be that the maintainers
of that application should fix their bug. Regrettably, this seems unlikely
to happen. Failing that, at least the practice raises awareness amongst
users of that application that the bug exists.