0

I have a situation where I need to reverse engineer a TCP request. Using wireshark I copy the request (Binary serialized byte array) as a string into VS. I need to deserialize the string to see what information is being passed.

This is what my string looks like:

0000   d4 81 d7 dd 44 37 00 01 45 03 ec ef 08 00 45 00  ....D7..E.....E.
0010   00 5f 91 b4 40 00 40 06 c2 a6 0a d4 ee 47 0a d4  ._..@.@......G..
0020   e2 4e 04 01 e4 9d 75 98 96 de cb 2a 29 25 50 18  .N....u....*)%P.
0030   27 10 fc f1 00 00 43 50 43 52 00 01 19 00 00 00  '.....CPCR......
0040   37 00 00 00 1e 00 00 00 05 01 05 01 3c 00 00 32  7...........<..2
0050   00 02 ff ff 01 00 4d 54 20 52 61 63 6b 00 00 00  ......MT Rack...
0060   01 04 03 02 41 05 01 00 00 00 00 00 00           ....A........

How do I go about de-serializing it to see the contents?

Sinatr
  • 20,892
  • 15
  • 90
  • 319
RSH
  • 373
  • 1
  • 5
  • 17
  • 3
    Can you save/redirect/dump it as file in wireshark? – Sinatr Sep 28 '17 at 14:17
  • 1
    Of course you can parse that middle part as [hex string](https://stackoverflow.com/q/321370/1997232) with some `Substring`s and `Replace(" ", "")`s for each row. – Sinatr Sep 28 '17 at 14:21
  • How are you copying the string? Manually or using something else? – Sam Marion Sep 28 '17 at 14:32
  • 1
    The right 'column' already has the hex converted to string. Unless you want the funky characters that would result from hex < 20 and hex > 7E – Cory Sep 28 '17 at 14:33

1 Answers1

0

I pasted your string into a file and then ran code below :

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Globalization;

namespace ConsoleApplication7
{
    class Program
    {
        const string FILENAME = @"c:\temp\test.txt";
        static void Main(string[] args)
        {
            StreamReader reader = new StreamReader(FILENAME);

            string input = "";
            List<byte> data = new List<byte>();
            while((input = reader.ReadLine()) != null)
            {
                string byteStr = input.Substring(6, 3 * 16).Trim();
                data.AddRange(byteStr.Split(new char[] {' '}, StringSplitOptions.RemoveEmptyEntries).Select(x => byte.Parse(x, NumberStyles.HexNumber)));
            }

        }
    }

}
jdweng
  • 33,250
  • 2
  • 15
  • 20