Forum Discussion
Michael_Koyfma1
Cirrus
CirrusPayload manipulation question
Basically, once I have the payload, I need to identify a piece that starts with FO followed by 5 digits, then three spaces, and then B. I need the send back the payload back to the client, only I need to insert three digits instead of spaces in the pattern that I am looking for above.
So, I thought I could do something like this:
regexp -all "(\*)(FO\*)(B\*)" [TCP::payload] $first_part $second_part $third_part
This way I should be able to capture part of the payload that starts with FO and ends just before B.
The question becomes now how do I replace the contents of $second_part from let say FO00001 to FO00001113?
2 Replies
- Hi Michael -
Looks like you're OK with using a wildcard to identify the 8 characters between "FO" & "B", so following your approach, you would actually want to break up the match string into /4/ chunks, and only replace the whitespace, using regsub instead of regexp to perform the inline substitution. This code would do the trick:set payload [TCP::payload] set new_digits "" regsub -all "(FO)(.*)( )(B)" $payload "\\1\\2$new_digits\\4" payload TCP::payload replace 0 [TCP::payload length] $payload
HTH
/deb - Actually one better, let's only look for digits with that wildcard:
regsub -all "(FO)(\[0-9\]*)( )(B)" $payload "\\1\\2$replace_digits\\4" payload
/d
