0

so I am capturing packets with Pydivert. I can print out the full packet payload by using 

print(packet.tcp.payload)

OR

print(packet.payload)

output was

b'\x03\x00\x34\xe2\xd1' //continued like this

same output in both cases. I printed out the type by using

print(type(packet.payload))

This showed the type to be

<class 'byte'>

I would like to take say the first 10 byte positions from the output and type it out and also save it into a variable so when I'm modifying the payload, I exclude the initial bytes and then modify the remaining parts. So I can somehow attach the separated out bytes to my newly created bytes to create a final byte stream like for example:

TotalByteStream = (initial bytes which I separated out) + b'\x03\x00\x34\xe2\xd1\x78\x23\x45\x79' //continued like this as needed
//And then do
packet.payload = TotalByteStream

Is this possible?

RiptimRip
  • 11
  • 1
  • 3

1 Answers1

0

I'm not sure I understand your question, but you can manipulate bytes in a manner similar to strings.

If you have your original payload:

>>> payload_1 = b'\x03\x00\xf4\xe2\xd1'
>>> type(payload_1)
<class 'bytes'>
>>> payload_1
b'\x03\x00\xf4\xe2\xd1'

You can slice of the first few bytes

>>> part = payload_1[:2]
>>> part
b'\x03\x00'

And later create a new payload where you prepend the part variable

>>> payload_2 = part + b'\xf5\xe5\xd5'
>>> payload_2
b'\x03\x00\xf5\xe5\xd5'
>>> payload_1
b'\x03\x00\xf4\xe2\xd1'

So you get a new payload with the same starting bytes. Does this answer your question? Or did I misunderstand your issue?

Ralf
  • 16,086
  • 4
  • 44
  • 68
  • See also [this related question](https://stackoverflow.com/questions/20024490/how-to-split-a-byte-string-into-separate-bytes-in-python) about bytes slicing and interpreting the result – Ralf Apr 25 '19 at 13:03
  • Thanks I later found that out and it did help me, The issue I have right now is that wireshark shows me the payload as 72 02 01 etc. but my pyaivert script shows it like b'\x03\x00' etc. I need to modify the packet and resend it but when I do change the bytes to string and modify then convert back to bytes and send it, wireshark doesn't show it like 72 01 e4 wtc but as x\03 x\45 etc which is incorrect. Don't know how to decode as utf-8 is failing upong encountering a0 – RiptimRip Apr 26 '19 at 10:39