| Author | Message | Time |
|---|---|---|
| Barabajagal | So, I'm making a program called BNalyzer, which is a packet sniffer for BNet connections. It currently parses all SID packets with the exception of WARCRAFTGENERAL and WARDEN... I'll be releasing it after I add MCP support (and UDP if anyone wants to help). But, I've run into the raw socket data... I trim off the first 54 bytes of header data from the unparsed text view, and I'm still getting... random junk. Here's what I mean: [code] SEND 63.241.83.13 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.107 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.9 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.110 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.12 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.8 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.7 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.111 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.108 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.11 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.112 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ SEND 63.241.83.109 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ RECV 1.1.1.10 <- 63.241.83.13 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ SEND 63.241.83.13 -> 1.1.1.10 00000000 01 . RECV 1.1.1.10 <- 63.241.83.13 00000000 00 00 7E 5E C7 F7 ..~^Ç÷ SEND 63.241.83.13 -> 1.1.1.10 00000000 FF 50 3A 00 00 00 00 00 36 38 58 49 52 41 54 53 ÿP:.....68XIRATS 00000010 D3 00 00 00 53 55 6E 65 01 01 01 0A A4 01 00 00 Ó...SUne....¤... 00000020 09 04 00 00 09 04 00 00 55 53 41 00 55 6E 69 74 ........USA.Unit 00000030 65 64 20 53 74 61 74 65 73 00 ed States. RECV 1.1.1.10 <- 63.241.83.13 00000000 00 00 C3 12 53 35 ..Ã.S5 RECV 1.1.1.10 <- 63.241.83.107 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.9 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.110 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.12 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.8 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.111 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.7 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.11 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.112 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.109 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.108 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ RECV 1.1.1.10 <- 63.241.83.107 00000000 00 00 40 FC BE 6F ..@ü¾o RECV 1.1.1.10 <- 63.241.83.9 00000000 00 00 86 BF E2 D0 ..†¿âÐ RECV 1.1.1.10 <- 63.241.83.110 00000000 00 00 CF 03 41 74 ..Ï.At RECV 1.1.1.10 <- 63.241.83.12 00000000 00 00 52 7F BE 0F ..R¾. RECV 1.1.1.10 <- 63.241.83.8 00000000 00 00 91 06 BD 94 ..‘.½” RECV 1.1.1.10 <- 63.241.83.111 00000000 00 00 FD F7 9F 71 ..ý÷Ÿq RECV 1.1.1.10 <- 63.241.83.7 00000000 00 00 65 AB DA A5 ..e«Ú¥ RECV 1.1.1.10 <- 63.241.83.11 00000000 00 00 EE EA 66 58 ..îêfX RECV 1.1.1.10 <- 63.241.83.112 00000000 00 00 9B E3 A6 ED ..›ã¦í RECV 1.1.1.10 <- 63.241.83.109 00000000 00 00 5B 2F BA DF ..[/ºß RECV 1.1.1.10 <- 63.241.83.108 00000000 00 00 85 09 43 45 ..….CE RECV 1.1.1.10 <- 63.241.83.107 00000000 00 00 A4 DD 1C AC ..¤Ý.¬ RECV 1.1.1.10 <- 63.241.83.12 00000000 00 00 6E F1 18 91 ..nñ.‘ RECV 1.1.1.10 <- 63.241.83.111 00000000 00 00 71 13 46 AD ..q.F RECV 1.1.1.10 <- 63.241.83.110 00000000 00 00 63 F8 0D 84 ..cø.„ RECV 1.1.1.10 <- 63.241.83.9 00000000 00 00 E6 6F 36 D4 ..æo6Ô RECV 1.1.1.10 <- 63.241.83.8 00000000 00 00 EC 51 F5 E3 ..ìQõã RECV 1.1.1.10 <- 63.241.83.11 00000000 00 00 14 89 7E 6D ...‰~m RECV 1.1.1.10 <- 63.241.83.13 00000000 FF 25 08 00 60 95 45 07 ÿ%..`•E. SEND 63.241.83.13 -> 1.1.1.10 00000000 FF 25 08 00 60 95 45 07 ÿ%..`•E. RECV 1.1.1.10 <- 63.241.83.7 00000000 00 00 93 B5 DA 79 ..“µÚy RECV 1.1.1.10 <- 63.241.83.13 00000000 FF 50 3E 00 00 00 00 00 10 CD 22 D1 FA 24 03 00 ÿP>......Í"Ñú$.. 00000010 00 8B 51 03 70 5F C7 01 6C 6F 63 6B 64 6F 77 6E .‹Q.p_Ç.lockdown 00000020 2D 49 58 38 36 2D 31 36 2E 6D 70 71 00 88 E1 0D -IX86-16.mpq.ˆá. 00000030 25 63 81 AB E0 BF C2 0F FC 06 C8 78 4C 00 %c�«à¿Â.ü.ÈxL. SEND 63.241.83.13 -> 1.1.1.10 00000000 02 04 05 B4 01 03 03 08 01 01 04 02 ...´........ RECV 1.1.1.10 <- 63.241.83.112 00000000 00 00 20 02 82 EF .. .‚ï RECV 1.1.1.10 <- 63.241.83.109 00000000 00 00 97 13 A4 BC ..—.¤¼ RECV 1.1.1.10 <- 63.241.83.108 00000000 00 00 49 35 5D 26 ..I5]& RECV 1.1.1.10 <- 63.241.83.13 00000000 02 04 05 A8 01 01 04 02 03 03 00 01 ...¨........ SEND 63.241.83.13 -> 1.1.1.10 00000000 02 . RECV 1.1.1.10 <- 63.241.83.13 00000000 00 00 03 F7 93 57 ...÷“W SEND 63.241.83.13 -> 1.1.1.10 00000000 35 00 00 01 36 38 58 49 52 41 54 53 00 00 00 00 5...68XIRATS.... 00000010 00 00 00 00 00 00 00 00 00 8B 51 03 70 5F C7 01 .........‹Q.p_Ç. 00000020 6C 6F 63 6B 64 6F 77 6E 2D 49 58 38 36 2D 31 36 lockdown-IX86-16 00000030 2E 6D 70 71 00 .mpq. RECV 1.1.1.10 <- 63.241.83.13 00000000 00 00 AE A8 63 A2 ..®¨c¢ RECV 1.1.1.10 <- 63.241.83.13 00000000 2D 00 00 00 C7 18 00 00 00 00 00 00 00 00 00 00 -...Ç........... 00000010 00 8B 51 03 70 5F C7 01 6C 6F 63 6B 64 6F 77 6E .‹Q.p_Ç.lockdown 00000020 2D 49 58 38 36 2D 31 36 2E 6D 70 71 00 -IX86-16.mpq.[/code] For those of you interested, here's a screenshot of the parsed view (I've added FileTime parsing since that image, though). | March 22, 2009, 1:04 PM |
| bethra | You using winpcap/libpcap to capture the packets? | March 23, 2009, 2:18 AM |
| Yegg | [quote author=Sorc.Polgara link=topic=17853.msg181881#msg181881 date=1237774685] You using winpcap/libpcap to capture the packets? [/quote] I believe he's using some kind of wrapper over winpcap. I could have sworn his post included it the other day, but it does say that he edited his post today. Just not sure why he'd remove that portion. | March 23, 2009, 3:24 AM |
| xpeh | Why don't you just write a plugin for some sniffer? | March 23, 2009, 5:38 AM |
| Barabajagal | Yes, it is a wrapper. I was editing my post last night (adding the screenshot) and my internet cut out on me halfway through the save. I checked it today and realized the end of the packet log and all the text after it had been lost. The point of WinPCap is that it's more of a plugin for your app... | March 23, 2009, 5:55 AM |
| bethra | Can you give the packet log with the packet data before you remove the 54 bytes et al? You might not be filtering with libpcap correctly, it's hard to tell what the problem is without any code. What filters are you using? | March 23, 2009, 3:33 PM |
| PunK | Why not just ignore data that doesn't include the battle.net protocol headers? | March 23, 2009, 6:29 PM |
| Barabajagal | I had tried using a filter of "tcp port 6112", which was mentioned before I broke my first post, but now I've gotten rid of the filter so I can do it all myself. I also rewrote the Ethernet, IP, and TCP header parsers myself... I just added a line that'll only trim off the first 54 bytes of packets with 0xFF at the 55th byte. Here's a new log of a connection using SC (official): [code] SEND 63.241.83.8:6112 -> 1.1.1.10:49561 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 34 28 31 40 00 80 06 00 00 01 01 01 0A 3F F1 .4(1@.€.......?ñ 00000020 53 08 C1 99 17 E0 81 EA 18 AA 00 00 00 00 80 02 S.Á™.à?ê.ª....€. 00000030 20 00 95 2A 00 00 02 04 05 B4 01 03 03 08 01 01 .•*.....´...... 00000040 04 02 .. SEND 63.241.83.112:6112 -> 1.1.1.10:49563 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 34 28 33 40 00 80 06 00 00 01 01 01 0A 3F F1 .4(3@.€.......?ñ 00000020 53 70 C1 9B 17 E0 30 D2 D4 C3 00 00 00 00 80 02 SpÁ›.à0ÒÔÃ....€. 00000030 20 00 95 92 00 00 02 04 05 B4 01 03 03 08 01 01 .•’.....´...... 00000040 04 02 .. SEND 63.241.83.13:6112 -> 1.1.1.10:49565 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 34 28 35 40 00 80 06 00 00 01 01 01 0A 3F F1 .4(5@.€.......?ñ 00000020 53 0D C1 9D 17 E0 3D 46 E8 0D 00 00 00 00 80 02 S.Á?.à=Fè.....€. 00000030 20 00 95 2F 00 00 02 04 05 B4 01 03 03 08 01 01 .•/.....´...... 00000040 04 02 .. SEND 63.241.83.7:6112 -> 1.1.1.10:49567 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 34 28 37 40 00 80 06 00 00 01 01 01 0A 3F F1 .4(7@.€.......?ñ 00000020 53 07 C1 9F 17 E0 BC 58 B9 64 00 00 00 00 80 02 S.ÁŸ.à¼X¹d....€. 00000030 20 00 95 29 00 00 02 04 05 B4 01 03 03 08 01 01 .•).....´...... 00000040 04 02 .. SEND 63.241.83.111:6112 -> 1.1.1.10:49569 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 34 28 39 40 00 80 06 00 00 01 01 01 0A 3F F1 .4(9@.€.......?ñ 00000020 53 6F C1 A1 17 E0 E5 BC A4 0B 00 00 00 00 80 02 SoÁ¡.à弤.....€. 00000030 20 00 95 91 00 00 02 04 05 B4 01 03 03 08 01 01 .•‘.....´...... 00000040 04 02 .. SEND 63.241.83.9:6112 -> 1.1.1.10:49571 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 34 28 3B 40 00 80 06 00 00 01 01 01 0A 3F F1 .4(;@.€.......?ñ 00000020 53 09 C1 A3 17 E0 88 09 C1 43 00 00 00 00 80 02 S.Á£.àˆ.ÁC....€. 00000030 20 00 95 2B 00 00 02 04 05 B4 01 03 03 08 01 01 .•+.....´...... 00000040 04 02 .. RECV 1.1.1.10:49563 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 34 D8 41 40 00 FE 06 0F 16 3F F1 53 70 01 01 .4ØA@.þ...?ñSp.. 00000020 01 0A 17 E0 C1 9B A5 E3 FA 55 30 D2 D4 C4 80 12 ...àÁ›¥ãúU0ÒÔÄ€. 00000030 10 00 4B 5B 00 00 02 04 05 A8 01 01 04 02 03 03 ..K[.....¨...... 00000040 00 01 .. RECV 1.1.1.10:49566 <- 63.241.83.11:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 34 D8 42 40 00 FE 06 0F 7A 3F F1 53 0B 01 01 .4ØB@.þ..z?ñS... 00000020 01 0A 17 E0 C1 9E A5 E6 94 64 81 AE 5A 57 80 12 ...àÁž¥æ”d?®ZW€. 00000030 10 00 DB 3C 00 00 02 04 05 A8 01 01 04 02 03 03 ..Û<.....¨...... 00000040 00 01 .. SEND 63.241.83.11:6112 -> 1.1.1.10:49566 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 40 40 00 80 06 00 00 01 01 01 0A 3F F1 .((@@.€.......?ñ 00000020 53 0B C1 9E 17 E0 81 AE 5A 57 A5 E6 94 65 50 11 S.Áž.à?®ZW¥æ”eP. 00000030 01 04 95 21 00 00 ..•!.. SEND 63.241.83.110:6112 -> 1.1.1.10:49562 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 41 40 00 80 06 00 00 01 01 01 0A 3F F1 .((A@.€.......?ñ 00000020 53 6E C1 9A 17 E0 6B 0D CD F8 A5 E2 FC 51 50 10 SnÁš.àk.Íø¥âüQP. 00000030 01 04 95 84 00 00 ..•„.. RECV 1.1.1.10:49561 <- 63.241.83.8:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 34 D8 44 40 00 FE 06 0F 7B 3F F1 53 08 01 01 .4ØD@.þ..{?ñS... 00000020 01 0A 17 E0 C1 99 A5 E1 F6 4B 81 EA 18 AB 80 12 ...àÁ™¥áöK?ê.«€. 00000030 10 00 BA D2 00 00 02 04 05 A8 01 01 04 02 03 03 ..ºÒ.....¨...... 00000040 00 01 .. SEND 63.241.83.8:6112 -> 1.1.1.10:49561 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 44 40 00 80 06 00 00 01 01 01 0A 3F F1 .((D@.€.......?ñ 00000020 53 08 C1 99 17 E0 81 EA 18 AB A5 E1 F6 4C 50 11 S.Á™.à?ê.«¥áöLP. 00000030 01 04 95 1E 00 00 ..•... SEND 63.241.83.13:6112 -> 1.1.1.10:49565 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 45 40 00 80 06 00 00 01 01 01 0A 3F F1 .((E@.€.......?ñ 00000020 53 0D C1 9D 17 E0 3D 46 E8 0E A5 E5 EE 60 50 10 S.Á?.à=Fè.¥åî`P. 00000030 01 04 95 23 00 00 ..•#.. RECV 1.1.1.10:49564 <- 63.241.83.12:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 34 D8 46 40 00 FE 06 0F 75 3F F1 53 0C 01 01 .4ØF@.þ..u?ñS... 00000020 01 0A 17 E0 C1 9C A5 E4 E0 5A C6 95 5A C9 80 12 ...àÁœ¥äàZÆ•ZÉ€. 00000030 10 00 49 F0 00 00 02 04 05 A8 01 01 04 02 03 03 ..Ið.....¨...... 00000040 00 01 .. SEND 63.241.83.12:6112 -> 1.1.1.10:49564 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 48 40 00 80 06 00 00 01 01 01 0A 3F F1 .((H@.€.......?ñ 00000020 53 0C C1 9C 17 E0 C6 95 5A C9 A5 E4 E0 5B 50 11 S.Áœ.àÆ•ZÉ¥äà[P. 00000030 01 04 95 22 00 00 ..•".. SEND 63.241.83.7:6112 -> 1.1.1.10:49567 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 49 40 00 80 06 00 00 01 01 01 0A 3F F1 .((I@.€.......?ñ 00000020 53 07 C1 9F 17 E0 BC 58 B9 65 A5 E7 92 6A 50 10 S.ÁŸ.à¼X¹e¥ç’jP. 00000030 01 04 95 1D 00 00 ..•... SEND 63.241.83.112:6112 -> 1.1.1.10:49563 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 29 28 4B 40 00 80 06 00 00 01 01 01 0A 3F F1 .)(K@.€.......?ñ 00000020 53 70 C1 9B 17 E0 30 D2 D4 C4 A5 E3 FA 56 50 18 SpÁ›.à0ÒÔÄ¥ãúVP. 00000030 01 04 95 87 00 00 01 ..•‡... SEND 63.241.83.109:6112 -> 1.1.1.10:49568 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 4C 40 00 80 06 00 00 01 01 01 0A 3F F1 .((L@.€.......?ñ 00000020 53 6D C1 A0 17 E0 76 A9 43 FD A5 E8 98 6F 50 10 SmÁ .àv©Cý¥è˜oP. 00000030 01 04 95 83 00 00 ..•ƒ.. RECV 1.1.1.10:49566 <- 63.241.83.11:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 4A 40 00 FE 06 19 7E 3F F1 53 0B 01 01 .(ÎJ@.þ..~?ñS... 00000020 01 0A 17 E0 C1 9E A5 E6 94 65 81 AE 5A 58 50 10 ...àÁž¥æ”e?®ZXP. 00000030 10 00 1A FC 00 00 00 00 DB 0F D5 62 ...ü....Û.Õb RECV 1.1.1.10:49561 <- 63.241.83.8:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 4C 40 00 FE 06 19 7F 3F F1 53 08 01 01 .(ÎL@.þ..?ñS... 00000020 01 0A 17 E0 C1 99 A5 E1 F6 4C 81 EA 18 AC 50 10 ...àÁ™¥áöL?ê.¬P. 00000030 10 00 FA 91 00 00 00 00 DE AC 0E AE ..ú‘....Þ¬.® RECV 1.1.1.10:49564 <- 63.241.83.12:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 4E 40 00 FE 06 19 79 3F F1 53 0C 01 01 .(ÎN@.þ..y?ñS... 00000020 01 0A 17 E0 C1 9C A5 E4 E0 5B C6 95 5A CA 50 10 ...àÁœ¥äà[Æ•ZÊP. 00000030 10 00 89 AF 00 00 00 00 07 C3 11 DD ..‰¯.....Ã.Ý RECV 1.1.1.10:49568 <- 63.241.83.109:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 50 40 00 FE 06 19 16 3F F1 53 6D 01 01 .(ÎP@.þ...?ñSm.. 00000020 01 0A 17 E0 C1 A0 A5 E8 98 6F 76 A9 43 FE 50 10 ...àÁ ¥è˜ov©CþP. 00000030 10 00 37 EB 00 00 00 00 D7 13 FD 6B ..7ë....×.ýk SEND 63.241.83.112:6112 -> 1.1.1.10:49563 00000000 FF 50 3A 00 00 00 00 00 36 38 58 49 52 41 54 53 ÿP:.....68XIRATS 00000010 D3 00 00 00 53 55 6E 65 01 01 01 0A A4 01 00 00 Ó...SUne....¤... 00000020 09 04 00 00 09 04 00 00 55 53 41 00 55 6E 69 74 ........USA.Unit 00000030 65 64 20 53 74 61 74 65 73 00 ed States. RECV 1.1.1.10:49569 <- 63.241.83.111:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 34 CE 53 40 00 FE 06 19 05 3F F1 53 6F 01 01 .4ÎS@.þ...?ñSo.. 00000020 01 0A 17 E0 C1 A1 A5 E9 86 73 E5 BC A4 0C 80 12 ...àÁ¡¥é†s弤.€. 00000030 10 00 3B 00 00 00 02 04 05 A8 01 01 04 02 03 03 ..;......¨...... 00000040 00 01 .. SEND 63.241.83.111:6112 -> 1.1.1.10:49569 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 50 40 00 80 06 00 00 01 01 01 0A 3F F1 .((P@.€.......?ñ 00000020 53 6F C1 A1 17 E0 E5 BC A4 0C A5 E9 86 74 50 11 SoÁ¡.à弤.¥é†tP. 00000030 01 04 95 85 00 00 ..•….. SEND 63.241.83.108:6112 -> 1.1.1.10:49570 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 51 40 00 80 06 00 00 01 01 01 0A 3F F1 .((Q@.€.......?ñ 00000020 53 6C C1 A2 17 E0 2D D5 A2 19 A5 EC B0 79 50 10 SlÁ¢.à-Õ¢.¥ì°yP. 00000030 01 04 95 82 00 00 ..•‚.. RECV 1.1.1.10:49571 <- 63.241.83.9:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 34 CE 55 40 00 FE 06 19 69 3F F1 53 09 01 01 .4ÎU@.þ..i?ñS... 00000020 01 0A 17 E0 C1 A3 A5 ED BE 7D 88 09 C1 44 80 12 ...àÁ£¥í¾}ˆ.ÁD€. 00000030 10 00 43 D1 00 00 02 04 05 A8 01 01 04 02 03 03 ..CÑ.....¨...... 00000040 00 01 .. SEND 63.241.83.9:6112 -> 1.1.1.10:49571 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 54 40 00 80 06 00 00 01 01 01 0A 3F F1 .((T@.€.......?ñ 00000020 53 09 C1 A3 17 E0 88 09 C1 44 A5 ED BE 7E 50 11 S.Á£.àˆ.ÁD¥í¾~P. 00000030 01 04 95 1F 00 00 ..•... SEND 63.241.83.107:6112 -> 1.1.1.10:49572 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 55 40 00 80 06 00 00 01 01 01 0A 3F F1 .((U@.€.......?ñ 00000020 53 6B C1 A4 17 E0 5D 28 6A 81 A5 EE A4 83 50 10 SkÁ¤.à](j?¥î¤ƒP. 00000030 01 04 95 81 00 00 ..•?.. RECV 1.1.1.10:49569 <- 63.241.83.111:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 57 40 00 FE 06 19 0D 3F F1 53 6F 01 01 .(ÎW@.þ...?ñSo.. 00000020 01 0A 17 E0 C1 A1 A5 E9 86 74 E5 BC A4 0D 50 10 ...àÁ¡¥é†t弤.P. 00000030 10 00 7A BF 00 00 00 00 D1 7C 38 66 ..z¿....Ñ|8f RECV 1.1.1.10:49571 <- 63.241.83.9:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 59 40 00 FE 06 19 71 3F F1 53 09 01 01 .(ÎY@.þ..q?ñS... 00000020 01 0A 17 E0 C1 A3 A5 ED BE 7E 88 09 C1 45 50 10 ...àÁ£¥í¾~ˆ.ÁEP. 00000030 10 00 83 90 00 00 00 00 03 52 D0 C8 ..ƒ?.....RÐÈ RECV 1.1.1.10:49566 <- 63.241.83.11:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 5B 40 00 FE 06 19 6D 3F F1 53 0B 01 01 .(Î[@.þ..m?ñS... 00000020 01 0A 17 E0 C1 9E A5 E6 94 65 81 AE 5A 58 50 11 ...àÁž¥æ”e?®ZXP. 00000030 00 00 2A FB 00 00 00 00 CF 0E D5 A0 ..*û....Ï.Õ SEND 63.241.83.11:6112 -> 1.1.1.10:49566 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 57 40 00 80 06 00 00 01 01 01 0A 3F F1 .((W@.€.......?ñ 00000020 53 0B C1 9E 17 E0 81 AE 5A 58 A5 E6 94 66 50 10 S.Áž.à?®ZX¥æ”fP. 00000030 01 04 95 21 00 00 ..•!.. RECV 1.1.1.10:49565 <- 63.241.83.13:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 5D 40 00 FE 06 19 69 3F F1 53 0D 01 01 .(Î]@.þ..i?ñS... 00000020 01 0A 17 E0 C1 9D A5 E5 EE 60 3D 46 E8 0F 50 11 ...àÁ?¥åî`=Fè.P. 00000030 00 00 87 B0 00 00 00 00 F4 96 74 CE ..‡°....ô–tÎ RECV 1.1.1.10:49561 <- 63.241.83.8:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CE 5E 40 00 FE 06 19 6D 3F F1 53 08 01 01 .(Î^@.þ..m?ñS... 00000020 01 0A 17 E0 C1 99 A5 E1 F6 4C 81 EA 18 AC 50 11 ...àÁ™¥áöL?ê.¬P. 00000030 00 00 0A 91 00 00 00 00 DF B8 40 9B ...‘....߸@› RECV 1.1.1.10:49564 <- 63.241.83.12:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CF 12 40 00 FE 06 18 B5 3F F1 53 0C 01 01 .(Ï.@.þ..µ?ñS... 00000020 01 0A 17 E0 C1 9C A5 E4 E0 5B C6 95 5A CA 50 11 ...àÁœ¥äà[Æ•ZÊP. 00000030 00 00 99 AE 00 00 00 00 4F 4A F4 2A ..™®....OJô* RECV 1.1.1.10:49563 <- 63.241.83.112:6112 00000000 FF 25 08 00 66 E7 AE 21 ÿ%..fç®! SEND 63.241.83.109:6112 -> 1.1.1.10:49568 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 5B 40 00 80 06 00 00 01 01 01 0A 3F F1 .(([@.€.......?ñ 00000020 53 6D C1 A0 17 E0 76 A9 43 FE A5 E8 98 70 50 10 SmÁ .àv©Cþ¥è˜pP. 00000030 01 04 95 83 00 00 ..•ƒ.. SEND 63.241.83.7:6112 -> 1.1.1.10:49567 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 5D 40 00 80 06 00 00 01 01 01 0A 3F F1 .((]@.€.......?ñ 00000020 53 07 C1 9F 17 E0 BC 58 B9 66 A5 E7 92 6B 50 10 S.ÁŸ.à¼X¹f¥ç’kP. 00000030 01 04 95 1D 00 00 ..•... RECV 1.1.1.10:49563 <- 63.241.83.112:6112 00000000 FF 50 3E 00 00 00 00 00 33 6C DD 7D 11 6E 06 00 ÿP>.....3lÝ}.n.. 00000010 00 8B 51 03 70 5F C7 01 6C 6F 63 6B 64 6F 77 6E .‹Q.p_Ç.lockdown 00000020 2D 49 58 38 36 2D 31 38 2E 6D 70 71 00 AF 18 92 -IX86-18.mpq.¯.’ 00000030 C6 7B FE 31 15 88 22 21 E6 2A 72 AF 6E 00 Æ{þ1.ˆ"!æ*r¯n. SEND 63.241.83.112:6112 -> 1.1.1.10:49573 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 34 28 62 40 00 80 06 00 00 01 01 01 0A 3F F1 .4(b@.€.......?ñ 00000020 53 70 C1 A5 17 E0 8D 94 93 7C 00 00 00 00 80 02 SpÁ¥.à?”“|....€. 00000030 20 00 95 92 00 00 02 04 05 B4 01 03 03 08 01 01 .•’.....´...... 00000040 04 02 .. SEND 63.241.83.111:6112 -> 1.1.1.10:49569 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 64 40 00 80 06 00 00 01 01 01 0A 3F F1 .((d@.€.......?ñ 00000020 53 6F C1 A1 17 E0 E5 BC A4 0D A5 E9 86 75 50 10 SoÁ¡.à弤.¥é†uP. 00000030 01 04 95 85 00 00 ..•….. SEND 63.241.83.9:6112 -> 1.1.1.10:49571 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 65 40 00 80 06 00 00 01 01 01 0A 3F F1 .((e@.€.......?ñ 00000020 53 09 C1 A3 17 E0 88 09 C1 45 A5 ED BE 7F 50 10 S.Á£.àˆ.ÁE¥í¾P. 00000030 01 04 95 1F 00 00 ..•... RECV 1.1.1.10:49572 <- 63.241.83.107:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 CF 19 40 00 FE 06 18 4F 3F F1 53 6B 01 01 .(Ï.@.þ..O?ñSk.. 00000020 01 0A 17 E0 C1 A4 A5 EE A4 83 5D 28 6A 82 50 11 ...àÁ¤¥î¤ƒ](j‚P. 00000030 00 00 2E CB 00 00 00 00 BF 94 6C 6D ...Ë....¿”lm SEND 63.241.83.107:6112 -> 1.1.1.10:49572 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 67 40 00 80 06 00 00 01 01 01 0A 3F F1 .((g@.€.......?ñ 00000020 53 6B C1 A4 17 E0 5D 28 6A 82 A5 EE A4 84 50 10 SkÁ¤.à](j‚¥î¤„P. 00000030 01 04 95 81 00 00 ..•?.. SEND 63.241.83.112:6112 -> 1.1.1.10:49573 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 68 40 00 80 06 00 00 01 01 01 0A 3F F1 .((h@.€.......?ñ 00000020 53 70 C1 A5 17 E0 8D 94 93 7D A5 F3 5B 67 50 10 SpÁ¥.à?”“}¥ó[gP. 00000030 01 04 95 86 00 00 ..•†.. RECV 1.1.1.10:49573 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 7A E5 40 00 FE 06 6C 7E 3F F1 53 70 01 01 .(zå@.þ.l~?ñSp.. 00000020 01 0A 17 E0 C1 A5 A5 F3 5B 67 8D 94 93 7E 50 10 ...àÁ¥¥ó[g?”“~P. 00000030 10 00 0E 75 00 00 00 00 FD 06 7E 41 ...u....ý.~A RECV 1.1.1.10:49573 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 7A E6 40 00 FE 06 6C 7D 3F F1 53 70 01 01 .(zæ@.þ.l}?ñSp.. 00000020 01 0A 17 E0 C1 A5 A5 F3 5B 67 8D 94 93 B3 50 10 ...àÁ¥¥ó[g?”“³P. 00000030 10 00 0E 40 00 00 00 00 6F 56 CB 0B ...@....oVË. RECV 1.1.1.10:49573 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 02 40 7A E8 40 00 FE 06 6A 63 3F F1 53 70 01 01 .@zè@.þ.jc?ñSp.. 00000020 01 0A 17 E0 C1 A5 A5 F3 5B 94 8D 94 93 B3 50 10 ...àÁ¥¥ó[”?”“³P. 00000030 10 00 C4 C9 00 00 4D 50 51 1A 20 00 00 00 18 19 ..ÄÉ..MPQ. ..... 00000040 00 00 00 00 03 00 A8 18 00 00 E8 18 00 00 04 00 ......¨...è..... 00000050 00 00 03 00 00 00 68 79 34 45 4A B4 18 0B 09 0B ......hy4EJ´.... 00000060 52 36 8E 1B 80 48 C4 D4 31 A1 88 43 95 86 AA B0 R6Ž.€HÄÔ1¡ˆC•†ª° 00000070 3F 3A 54 AF FF B5 02 3E 23 E2 2C 65 F1 8D 44 C5 ?:T¯ÿµ.>#â,eñ?DÅ 00000080 28 30 A8 44 61 F6 E1 CF 8C 89 05 C4 0B 28 C9 5C (0¨DaöáÏŒ‰.Ä.(É\ 00000090 CC 88 5D 2A BF 1C F9 13 A3 43 05 4E 9A E0 1E AE ̈]*¿.ù.£C.Nšà.® 000000A0 32 26 9C CE C5 DB 77 3F B8 27 8A 88 8F B0 1D 80 2&œÎÅÛw?¸'Šˆ?°.€ 000000B0 9A 68 F0 22 29 E6 64 E3 74 99 C8 FF 97 D1 B0 DC šhð")ædãt™Èÿ—Ñ°Ü 000000C0 B6 83 77 F2 2B 58 25 0B D7 C1 F9 1A C3 F7 A1 07 ¶ƒwò+X%.×Áù.Ã÷¡. 000000D0 8A 5B 03 7F 9E 8D BA 9D AA 6D 08 B2 24 F1 5D EC Š[.ž?º?ªm.²$ñ]ì 000000E0 E2 8F E1 9D AA E0 EF 25 7E 08 16 CB 43 22 93 BC â?á?ªàï%~..ËC"“¼ 000000F0 E4 EC 1F 38 8E 31 69 A7 2C C8 AA D7 4C 3C 92 9F äì.8Ž1i§,Ȫ×L<’Ÿ 00000100 ED 71 BB 5D 0E F9 0B 90 48 BE B6 DF 20 4E 93 B8 íq»].ù.?H¾¶ß N“¸ 00000110 C7 E6 3B BB F8 83 C6 31 EB 48 17 F9 B4 8B D5 1D Çæ;»øƒÆ1ëH.ù´‹Õ. 00000120 D1 E1 A3 9C BF 80 76 DC 36 86 A7 66 89 D7 9E DD Ñᣜ¿€vÜ6†§f‰×žÝ 00000130 D5 A6 40 87 A7 5E 61 6B 40 D0 62 85 DF 1B 2F E1 Õ¦@‡§^ak@Ðb…ß./á 00000140 25 DD 17 7F A6 12 65 BA 76 56 0A 25 23 58 42 77 %Ý.¦.eºvV.%#XBw 00000150 8F B3 02 0D 37 BA E0 00 57 52 C8 8D 3B 3F FB 88 ?³..7ºà.WRÈ?;?ûˆ 00000160 24 B0 07 14 AC ED 3E 91 21 8E 3C 50 90 CA 15 36 $°..¬í>‘!Ž<P?Ê.6 00000170 62 93 98 7E 7B 28 16 F2 25 62 7A 5A F4 D3 6D D2 b“˜~{(.ò%bzZôÓmÒ 00000180 31 A7 B4 7A D8 4D FC 26 A5 70 33 C9 54 76 00 EA 1§´zØMü&¥p3ÉTv.ê 00000190 55 75 2A 66 BC 56 DC 2B 56 A4 55 A8 3D 9B 24 D8 Uu*f¼VÜ+V¤U¨=›$Ø 000001A0 06 66 C0 D6 77 90 A0 51 22 DB EC 18 40 26 E6 E4 .fÀÖw? Q"Ûì.@&æä 000001B0 86 C7 59 F2 05 AC EC BB BB 3F 0A C7 47 EA 92 05 †ÇYò.¬ì»»?.ÇGê’. 000001C0 78 B3 67 10 47 6D 13 83 A6 16 A4 70 50 7D 14 59 x³g.Gm.ƒ¦.¤pP}.Y 000001D0 65 33 C6 05 C3 E3 85 67 B7 B4 CF F9 24 84 D2 8A e3Æ.Ãã…g·´Ïù$„ÒŠ 000001E0 81 8B A7 62 5B A8 F5 D0 8E 1A ED E8 89 A5 23 0B ?‹§b[¨õÐŽ.í艥#. 000001F0 B5 BA D8 CF E7 72 99 B2 04 D3 12 8A B9 DD 21 F8 µºØÏçr™².Ó.Š¹Ý!ø 00000200 6B AA FA BF 6E 1F B3 B6 EF 86 EC 19 7F 09 3E 71 kªú¿n.³¶ï†ì..>q 00000210 ED 91 E0 4F B2 E0 52 C7 34 85 B6 17 5D 06 9B C3 í‘àO²àRÇ4…¶.].›Ã 00000220 54 77 34 BF 75 9B 64 D1 9B 43 09 59 3E 98 30 A7 Tw4¿u›dÑ›C.Y>˜0§ 00000230 27 A1 83 AC 47 D1 BE 19 BD 94 B8 DB C7 CB ED 5C '¡ƒ¬GѾ.½”¸ÛÇËí\ 00000240 3C 91 A1 8D 8C F5 05 1D 85 0B 50 B3 36 7D <‘¡?Œõ..….P³6} RECV 1.1.1.10:49573 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 05 D0 7A E9 40 00 FE 06 66 D2 3F F1 53 70 01 01 .Ðzé@.þ.fÒ?ñSp.. 00000020 01 0A 17 E0 C1 A5 A5 F3 5D AC 8D 94 93 B3 50 18 ...àÁ¥¥ó]¬?”“³P. 00000030 10 00 84 67 00 00 2F 44 85 D1 E6 14 34 E8 E5 8E ..„g../D…Ñæ.4èåŽ 00000040 B2 93 1F 04 C8 20 3E 4E B6 DD 12 BF C1 F8 0D C2 ²“..È >N¶Ý.¿Áø. 00000050 C6 33 F1 78 51 56 3D D2 0F 3C BC 50 15 7E 78 B9 Æ3ñxQV=Ò.<¼P.~x¹ 00000060 9A E8 42 90 AA 7B 70 27 B1 9D D1 DB 3B B7 A1 54 šèB?ª{p'±?ÑÛ;·¡T 00000070 A3 43 DE BD 51 05 3F 23 77 EA 22 47 D3 9C 37 15 £CÞ½Q.?#wê"GÓœ7. 00000080 99 58 DF EC 1A 6C 44 CF BB DD 24 FD 4E 31 D4 28 ™Xßì.lDÏ»Ý$ýN1Ô( 00000090 ED 81 54 C6 B6 CB B9 09 B2 4A F3 F7 66 F1 A9 6B í?Tƶ˹.²Jó÷fñ©k 000000A0 6F 94 C8 1A 42 52 DB E6 0B 50 F1 F2 8C 65 D3 AD o”È.BRÛæ.PñòŒeÓ 000000B0 E8 43 A4 DC B3 82 EE 6A 14 50 77 37 58 34 CA 72 èC¤Ü³‚îj.Pw7X4Êr 000000C0 81 0B E7 8E D3 62 D8 E0 D5 91 D2 D0 DB C7 D1 2B ?.çŽÓbØàÕ‘ÒÐÛÇÑ+ 000000D0 4F 62 20 48 3E 13 A5 30 2E A6 C1 A2 04 7C 05 C6 Ob H>.¥0.¦Á¢.|.Æ 000000E0 78 53 0C 1C 9F C2 C9 C6 89 22 DC 71 7F A4 D1 4C xS..ŸÂÉƉ"Üq¤ÑL 000000F0 BE 53 C6 41 EC 44 E4 CC 6C CC C5 61 D6 82 1F 8F ¾SÆAìDäÌlÌÅaÖ‚.? 00000100 4E 16 50 FB 68 DD FF 53 21 5A E8 9E A3 2D B0 62 N.PûhÝÿS!Z螣-°b 00000110 F2 43 75 8D 53 3D 5B C2 CF 80 43 B7 D2 09 7F 26 òCu?S=[ÂÏ€C·Ò.& 00000120 27 49 C0 7D 2E 71 62 CA 43 76 50 11 88 8D 74 A4 'IÀ}.qbÊCvP.ˆ?t¤ 00000130 60 64 39 DF D3 3F 24 2D D9 8E 03 5A AA 8E FE 0B `d9ßÓ?$-ÙŽ.ZªŽþ. 00000140 8E 09 95 3F 6E FD D1 81 7B 01 75 3D 8F 75 5F C8 Ž.•?nýÑ?{.u=?u_È 00000150 10 0B 08 CA B0 53 87 7F 86 6D C7 37 1E 5A E4 74 ...Ê°S‡†mÇ7.Zät 00000160 4C 79 28 93 20 3F A9 F4 EE 18 15 24 01 14 0B 11 Ly(“ ?©ôî..$.... 00000170 FE 77 63 76 36 55 3D 7F CA 5B F4 A3 36 1F DF C7 þwcv6U=Ê[ô£6.ßÇ 00000180 68 DC 87 41 C6 4F 94 7C 52 06 1C 12 1D 96 1C B7 h܇AÆO”|R....–.· 00000190 B3 9B 99 37 D4 F8 B6 4E 99 68 5D F7 E4 BB 45 15 ³›™7Ôø¶N™h]÷ä»E. 000001A0 26 FC B6 54 FB 2E DA 01 82 FC BC 5C 64 F7 52 5C &ü¶Tû.Ú.‚ü¼\d÷R\ 000001B0 6F 93 26 15 02 47 43 10 47 F5 02 53 95 60 AF 4A o“&..GC.Gõ.S•`¯J 000001C0 0D 3A AD 94 32 1B 4B 7F 99 57 71 63 F5 46 2B 61 .:”2.K™WqcõF+a 000001D0 A1 A5 5E F0 15 FA A8 FD 53 59 67 D9 FE 37 43 0E ¡¥^ð.ú¨ýSYgÙþ7C. 000001E0 62 1B 22 61 86 98 AF 94 F3 6B 84 21 74 19 78 F9 b."a†˜¯”ók„!t.xù 000001F0 18 91 EB DE 8F 96 28 4F 93 0D DA F1 82 FD A5 BC .‘ëÞ?–(O“.Úñ‚ý¥¼ 00000200 EA E9 6F C2 AE 1E C1 0C 44 99 FE 58 20 B0 3E 34 êéo®.Á.D™þX °>4 00000210 25 E7 34 70 2E 94 E4 C5 AA 3F CE 05 62 AE 43 BB %ç4p.”äŪ?Î.b®C» 00000220 D3 10 69 F6 48 B3 A2 00 F4 29 6A 43 06 7A D5 45 Ó.iöH³¢.ô)jC.zÕE 00000230 CF 13 58 DF EB 56 4D 93 2C 55 C4 F7 FE 13 D4 4D Ï.XßëVM“,UÄ÷þ.ÔM 00000240 54 1D 9E BE B3 F4 FD A6 2B B5 1F 5E C8 D7 69 CD T.ž¾³ôý¦+µ.^È×iÍ 00000250 75 49 A1 1B F2 DC 33 44 9F 99 57 77 FA 86 7B 77 uI¡.òÜ3DŸ™Wwú†{w 00000260 86 51 3C AC B9 54 BD E8 16 D2 63 0B 12 1B 32 29 †Q<¬¹T½è.Òc...2) 00000270 4B B3 A8 75 D9 04 22 90 BE 96 54 B4 48 A1 B9 7D K³¨uÙ."?¾–T´H¡¹} 00000280 C2 29 80 63 3C E9 46 D9 FD FB B3 80 09 83 A6 3B Â)€c<éFÙýû³€.ƒ¦; 00000290 DF F3 3B 0B 2B 05 00 A6 4B BD 36 D8 BE 8F A7 C3 ßó;.+..¦K½6ؾ?§Ã 000002A0 29 E2 DC C9 18 BD 5F 41 07 64 11 80 23 46 65 DF )âÜÉ.½_A.d.€#Feß 000002B0 39 8C 93 61 D2 C8 E5 69 CE 8E 87 DF 3C 27 2C BD 9Œ“aÒÈåiÎŽ‡ß<',½ 000002C0 6B 69 73 AF 04 25 BC 49 63 AF 57 E8 B9 60 1E 4A kis¯.%¼Ic¯Wè¹`.J 000002D0 93 BC AC 91 0E A2 5C 94 F9 4E 45 B5 C7 67 DD 7D “¼¬‘.¢\”ùNEµÇgÝ} 000002E0 82 2E F8 12 C2 CE BC A4 60 CF D4 4E 7C EA E1 1E ‚.ø.Âμ¤`ÏÔN|êá. 000002F0 A2 C0 66 35 D7 1A 45 55 32 85 91 2E F0 6F E4 7E ¢Àf5×.EU2…‘.ðoä~ 00000300 8A 80 DA 5C D2 83 80 0E 33 14 BB 5E E3 AD 0F F3 Š€Ú\Òƒ€.3.»^ã.ó 00000310 71 F9 BE 49 6A 63 5A B0 6E 6A 42 E9 52 42 8A 5D qù¾IjcZ°njBéRBŠ] 00000320 E0 EE FC E8 47 4B 3F 0D 23 F2 D4 D5 32 2D 3A 1C àîüèGK?.#òÔÕ2-:. 00000330 66 A6 02 DD E6 3C C1 BB A9 DD 0F C1 37 66 80 2E f¦.Ýæ<Á»©Ý.Á7f€. 00000340 39 8A 68 72 45 50 65 F8 FB 0F E0 2E 55 70 FA EA 9ŠhrEPeøû.à.Upúê 00000350 25 D1 AA 70 9A FD B1 DD F0 F2 56 E8 76 CE 49 9E %Ѫpšý±ÝðòVèvÎIž 00000360 2B 45 C2 4A 74 30 A0 4D 06 91 C4 77 C7 92 3B 75 +EÂJt0 M.‘ÄwÇ’;u 00000370 7C FF 94 12 D3 9D 1C 37 85 DB B1 79 6E 46 4F 3B |ÿ”.Ó?.7…Û±ynFO; 00000380 06 BC 10 3E 37 B7 AB 6B 48 27 D7 85 89 97 31 98 .¼.>7·«kH'×…‰—1˜ 00000390 FF 6F 20 A0 F3 D5 D0 B2 69 A9 DA E5 2A 7D 89 23 ÿo óÕвi©Úå*}‰# 000003A0 18 34 74 6F 4C 11 2A 5C F5 A5 B1 0E CC 81 AA 5F .4toL.*\õ¥±.Ì?ª_ 000003B0 5D C4 F0 B4 0D 5E 08 57 D6 8C 6C EC 9E 8B B2 16 ]Äð´.^.WÖŒlìž‹². 000003C0 D5 0A 8D 07 6C 99 D0 3C A1 07 22 42 B5 15 0D 54 Õ.?.l™Ð<¡."Bµ..T 000003D0 D1 75 AC 5C 0D BA A3 F3 66 9F AC 32 0B AF 55 8F Ñu¬\.º£ófŸ¬2.¯U? 000003E0 E4 97 35 7D 71 9C 99 FA 87 D6 03 19 F8 98 10 AC ä—5}qœ™ú‡Ö..ø˜.¬ 000003F0 F1 51 CC D5 B9 C2 C2 01 21 04 D0 F1 6E 02 57 32 ñQÌÕ¹ÂÂ.!.Ðñn.W2 00000400 A3 64 3F E6 AF 1B 25 58 1B 97 88 8B A9 94 34 F5 £d?æ¯.%X.—ˆ‹©”4õ 00000410 19 E3 08 67 1C 0C 64 85 E3 3F 79 5A 5F 9B 53 E5 .ã.g..d…ã?yZ_›Så 00000420 60 35 BA 36 EF 01 D6 40 DB 98 73 4F 21 79 11 D2 `5º6ï.Ö@Û˜sO!y.Ò 00000430 50 C4 50 3D A2 6A 5D DB 04 2E BF C9 CC C0 E5 C3 PÄP=¢j]Û..¿ÉÌÀåà 00000440 EE 1F 67 A4 BB 50 AB 48 F6 AD F6 CE 00 68 DB 0A î.g¤»P«HööÎ.hÛ. 00000450 F7 40 50 A8 06 47 58 E8 A0 B6 9C A9 6F BB 30 AF ÷@P¨.GXè ¶œ©o»0¯ 00000460 9D 5F AD 0A A3 FE 05 85 FA 34 DF A7 2A 4F 85 F0 ?_.£þ.…ú4ߧ*O…ð 00000470 08 FB 27 52 54 F9 F8 94 54 91 0B DF 16 8D C2 EF .û'RTùø”T‘.ß.?Âï 00000480 3F B5 A7 65 52 16 1E 87 FB FC 5B 34 63 30 61 9C ?µ§eR..‡ûü[4c0aœ 00000490 82 27 40 01 F4 72 19 A0 FF 92 54 4E 61 75 C2 13 ‚'@.ôr. ÿ’TNauÂ. 000004A0 86 DA 2C 87 E4 73 7B E2 C2 E8 35 77 E5 2C 83 2B †Ú,‡äs{âÂè5wå,ƒ+ 000004B0 BE 81 44 D9 1F 74 AA 43 07 E5 DB D1 D0 F2 23 FB ¾?DÙ.tªC.åÛÑÐò#û 000004C0 3A 56 8F 30 E4 7F 5D 2A 69 C5 80 09 F9 FE 30 88 :V?0ä]*iÅ€.ùþ0ˆ 000004D0 3D 6E 8F AC C4 01 04 77 8E 8B 0B 4C 36 75 A1 0F =n?¬Ä..wŽ‹.L6u¡. 000004E0 C0 4D F3 42 16 94 6D 14 84 89 FB EE AD 7B E4 74 ÀMóB.”m.„‰ûî{ät 000004F0 53 18 1C F5 A2 26 91 84 7B C1 4A F9 FA CF AF 5D S..õ¢&‘„{ÁJùúϯ] 00000500 91 2D E3 64 55 CB 27 97 04 87 7A 27 32 D1 1E 07 ‘-ãdUË'—.‡z'2Ñ.. 00000510 2D 27 CC D6 75 42 EC 3A AB 29 3B 13 AC A9 BB B0 -'ÌÖuBì:«);.¬©»° 00000520 BC FC 11 45 E6 4C 67 D6 79 4C BD EB AC 8E F9 17 ¼ü.EæLgÖyL½ë¬Žù. 00000530 B7 8B 03 D3 2B 7B 29 5D 69 CC 6E D9 F2 AC 32 DA ·‹.Ó+{)]iÌnÙò¬2Ú 00000540 AF 68 46 FE B8 CD B0 D9 41 68 92 B4 48 5B 82 8E ¯hFþ¸Í°ÙAh’´H[‚Ž 00000550 93 35 D3 75 C0 70 01 88 F5 DC 08 0F 98 43 E0 91 “5ÓuÀp.ˆõÜ..˜Cà‘ 00000560 C6 B7 D0 EA FE 37 5D 72 D0 A6 10 29 9D 90 C4 BB Æ·Ðêþ7]rЦ.)??Ä» 00000570 38 00 13 36 11 F0 61 6D 30 A6 6E 8A 12 AB CA B4 8..6.ðam0¦nŠ.«Ê´ 00000580 DE 3F 9B 20 BF 70 3A FA 07 50 61 28 55 CD E6 EC Þ?› ¿p:ú.Pa(UÍæì 00000590 36 70 D6 AA 66 C6 36 41 B3 82 C5 ED B8 1C C3 BC 6pÖªfÆ6A³‚Åí¸.ü 000005A0 8F 5A 57 86 23 C5 9B 31 58 52 DF 4F 20 F8 08 99 ?ZW†#Å›1XRßO ø.™ 000005B0 EA 1F 78 E1 06 AE 3A 66 0E 74 DE 4B 1D EC DE 94 ê.xá.®:f.tÞK.ìÞ” 000005C0 DF 9E 87 2A 47 73 6B 29 37 F4 21 2E BA D2 05 02 ßž‡*Gsk)7ô!.ºÒ.. 000005D0 73 03 03 7C A1 7B D8 BC 28 2D 6E 0F E4 75 s..|¡{ؼ(-n.äu SEND 63.241.83.112:6112 -> 1.1.1.10:49573 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 6C 40 00 80 06 00 00 01 01 01 0A 3F F1 .((l@.€.......?ñ 00000020 53 70 C1 A5 17 E0 8D 94 93 B3 A5 F3 68 FC 50 10 SpÁ¥.à?”“³¥óhüP. 00000030 01 04 95 86 00 00 ..•†.. RECV 1.1.1.10:49573 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 05 D0 01 5A 40 00 FE 06 E0 61 3F F1 53 70 01 01 .Ð.Z@.þ.àa?ñSp.. 00000020 01 0A 17 E0 C1 A5 A5 F3 6C 54 8D 94 93 B3 50 18 ...àÁ¥¥ólT?”“³P. 00000030 10 00 56 C6 00 00 FA 77 A4 8E D6 9D BB 3F 88 CB ..VÆ..úw¤ŽÖ?»?ˆË 00000040 9F 8C B3 C1 83 92 2D 66 5B 14 AE 0B BE 3A 6D 4D ŸŒ³Áƒ’-f[.®.¾:mM 00000050 C0 7B 1A FF 39 72 36 FE FD 5E 11 9C 48 26 FB CD À{.ÿ9r6þý^.œH&ûÍ 00000060 4B 32 24 E1 C6 4C 44 01 8A 7D 85 A4 31 44 13 F2 K2$áÆLD.Š}…¤1D.ò 00000070 8C 51 5F F3 B8 A5 DC 82 57 7C CE D7 A6 91 77 89 ŒQ_ó¸¥Ü‚W|Îצ‘w‰ 00000080 52 12 BE D9 8F 93 77 08 40 0D D4 6A 23 A4 8E C0 R.¾Ù?“w.@.Ôj#¤ŽÀ 00000090 E2 9C FF C7 32 A3 39 A8 30 5E 5D D9 52 59 44 0D âœÿÇ2£9¨0^]ÙRYD. 000000A0 0F F0 00 3F 88 68 58 FF B3 63 62 81 88 14 22 B8 .ð.?ˆhXÿ³cb?ˆ."¸ 000000B0 FF 63 D8 1E 4A 42 27 1A A7 72 BF 60 F1 2E E5 15 ÿcØ.JB'.§r¿`ñ.å. 000000C0 46 C2 DF C9 15 94 97 84 C8 5E 02 E6 8B B6 AD FA FÂßÉ.”—„È^.拶ú 000000D0 97 BF 61 F8 43 74 32 A8 F5 35 6A A0 7D 1F 42 70 —¿aøCt2¨õ5j }.Bp 000000E0 C2 EE 9D 5D F7 EC 18 47 F6 43 AF 4D 82 16 5D 38 Âî?]÷ì.GöC¯M‚.]8 000000F0 BB ED 55 88 D3 C6 8F D8 27 57 73 AD 23 45 D3 0D »íUˆÓÆ?Ø'Ws#EÓ. 00000100 86 82 D4 DC D4 A8 A1 D9 17 E9 0A EC 24 50 BE 2E †‚ÔÜÔ¨¡Ù.é.ì$P¾. 00000110 18 4B 23 63 F7 E1 82 99 2E 3F 00 FA EC 26 98 F8 .K#c÷á‚™.?.úì&˜ø 00000120 C9 52 93 CE 13 A2 B3 CB 6F A6 E6 E2 C5 1F 28 DC ÉR“Î.¢³Ëo¦æâÅ.(Ü 00000130 15 E6 65 B9 A7 44 1C ED FA 95 5B 9C A4 00 D6 2D .æe¹§D.íú•[œ¤.Ö- 00000140 AE C6 0C 4C D5 85 6F B4 05 4A F9 AA 8E 8B AB 9F ®Æ.LÕ…o´.JùªŽ‹«Ÿ 00000150 0F 08 CB 92 40 A9 6A 7B 02 39 EF 2C 7B F8 1C C4 ..Ë’@©j{.9ï,{ø.Ä 00000160 C1 2C 98 53 C5 41 97 C6 CE 3A 74 75 06 24 33 E9 Á,˜SÅA—ÆÎ:tu.$3é 00000170 95 46 59 64 B7 EA 87 D1 7E 15 01 C3 DE 42 48 D3 •FYd·ê‡Ñ~..ÃÞBHÓ 00000180 2F 9C A8 F2 B2 35 46 6E 3E B9 CC 37 46 8C 8F E7 /œ¨ò²5Fn>¹Ì7FŒ?ç 00000190 A9 3E 65 B5 7F 38 27 56 BA EC 62 56 73 25 3F 37 ©>eµ8'VºìbVs%?7 000001A0 B7 8F 1E 9B 40 75 AC 4D 87 22 B5 FF 18 11 22 14 ·?.›@u¬M‡"µÿ..". 000001B0 F4 E0 B7 3A 96 34 81 C6 57 BC 6A A2 EB D9 00 36 ôà·:–4?ÆW¼j¢ëÙ.6 000001C0 27 6E 52 4B D0 EC 80 88 59 C7 7D A6 51 07 44 63 'nRKÐ쀈YÇ}¦Q.Dc 000001D0 95 94 7A 53 FD ED 0B D8 5F 56 C0 2D 41 DD 4F B3 •”zSýí.Ø_VÀ-AÝO³ 000001E0 17 9A 27 17 FD 80 1D DC FE DF DF 82 94 6A 87 AF .š'.ý€.Üþßß‚”j‡¯ 000001F0 3D 40 EA 48 59 39 BD B7 A8 76 00 3C 3C 64 64 26 =@êHY9½·¨v.<<dd& 00000200 7C E9 67 1D 9C EC 27 EB 87 DA 49 F3 D7 B0 5A 75 |ég.œì'ë‡ÚIó×°Zu 00000210 C4 03 E8 6B D9 48 82 AA 49 D8 53 6B EF E4 66 65 Ä.èkÙH‚ªIØSkïäfe 00000220 E5 88 35 D4 E4 63 45 56 AF 65 B3 19 AE B7 43 77 åˆ5ÔäcEV¯e³.®·Cw 00000230 28 10 81 46 04 FF DE A5 AE 20 8A 64 B1 C7 F1 6C (.?F.ÿÞ¥® Šd±Çñl 00000240 69 FE 16 99 8B F7 BF 33 C2 3A 13 B8 96 60 0F 78 iþ.™‹÷¿3Â:.¸–`.x 00000250 07 35 53 92 6F E7 1D 63 FD 93 6B 34 90 C1 56 D4 .5S’oç.cý“k4?ÁVÔ 00000260 51 30 06 DF 16 8C C6 94 27 66 FC B3 52 E1 58 EC Q0.ß.ŒÆ”'fü³RáXì 00000270 F3 DC 1A 97 64 3D 1D 86 1B F2 AF 86 2E 0B D9 78 óÜ.—d=.†.ò¯†..Ùx 00000280 B2 43 8C A7 9F 9C 91 9E 45 26 40 D3 A1 9A 1C D2 ²CŒ§Ÿœ‘žE&@Ó¡š.Ò 00000290 A0 3C 06 27 6C 2B D7 2E D4 C7 75 B2 CE 82 EE 76 <.'l+×.ÔÇu²Î‚îv 000002A0 48 F4 EF 4A 3F 33 64 C1 93 7A C6 9F F5 F6 58 AF HôïJ?3dÁ“zÆŸõöX¯ 000002B0 DA 67 A9 A7 84 0C 08 62 BE 38 84 84 26 54 7C FA Úg©§„..b¾8„„&T|ú 000002C0 A5 AB BA C4 1B DB A7 A1 8C F8 55 C1 BC 59 BF 2D ¥«ºÄ.Û§¡ŒøUÁ¼Y¿- 000002D0 B6 A6 AC AE 24 80 A3 6A 8A 5D 4D 04 03 7A 43 FD ¶¦¬®$€£jŠ]M..zCý 000002E0 81 CF 54 51 CE 91 71 9F A8 F3 94 11 29 91 F3 88 ?ÏTQΑqŸ¨ó”.)‘óˆ 000002F0 A7 02 43 32 11 FA 66 E9 4F 6B 9E 80 70 16 82 A2 §.C2.úféOkž€p.‚¢ 00000300 D6 35 39 35 20 52 43 31 15 37 BA 2A 47 1F 97 81 Ö595 RC1.7º*G.—? 00000310 BC 8A F3 F0 32 4B 1B CA CF 67 29 39 BE 1A 88 96 ¼Šóð2K.ÊÏg)9¾.ˆ– 00000320 E5 1F 84 95 79 AA B2 04 8C A4 CA 08 73 4C 75 65 å.„•yª².Œ¤Ê.sLue 00000330 CE C6 21 B7 0D 41 81 D9 61 2E 2D 55 16 F9 E5 82 ÎÆ!·.A?Ùa.-U.ùå‚ 00000340 52 3C D5 C8 76 D2 85 DB C2 0E 42 E5 AE 73 DC E4 R<ÕÈvÒ…ÛÂ.Bå®sÜä 00000350 A2 D2 BC C4 DF 9F 41 E1 B3 98 F8 EE 50 91 C6 82 ¢Ò¼ÄߟA᳘øîP‘Æ‚ 00000360 7B 29 46 17 C3 1D 38 44 A1 85 C4 C2 15 C1 77 4C {)F.Ã.8D¡…ÄÂ.ÁwL 00000370 54 88 53 20 7A 96 28 69 9E 37 1E 0E 8D B9 DF 3A TˆS z–(iž7..?¹ß: 00000380 29 E9 A5 26 76 F6 65 41 9A 13 61 F0 BF 89 44 F5 )é¥&vöeAš.að¿‰Dõ 00000390 9A DA BA AA 23 B4 23 C5 0E 01 11 33 10 BC 4B 40 šÚºª#´#Å...3.¼K@ 000003A0 4B D4 94 30 BF 5A BC 8C 5C 36 98 CD 4A 85 B1 1F KÔ”0¿Z¼Œ\6˜ÍJ…±. 000003B0 FB AD 15 96 43 98 F4 A7 AA 46 B4 F2 47 B9 54 EF û.–C˜ô§ªF´òG¹Tï 000003C0 9B DB 9B C2 ED 7D 2B D3 47 C9 D9 34 03 AA ED A4 ›Û›Âí}+ÓGÉÙ4.ªí¤ 000003D0 B7 CD E6 3B 8B 20 F3 B8 87 04 08 47 AC 8C EB C9 ·Íæ;‹ ó¸‡..G¬ŒëÉ 000003E0 6B F0 11 E8 E7 A9 0B EE 6E C7 FF A9 4D 79 DE 68 kð.èç©.înÇÿ©MyÞh 000003F0 E4 E1 06 0B ED 01 E6 E5 1B 48 76 47 CB 4F A7 B2 äá..í.æå.HvGËO§² 00000400 62 51 47 66 B2 93 84 D6 FD 26 5E 43 38 C5 BE CE bQGf²“„Öý&^C8žΠ00000410 1E 10 FF FC C0 A2 14 92 BC F9 A1 A7 B3 76 D3 5E ..ÿüÀ¢.’¼ù¡§³vÓ^ 00000420 F1 14 6E 88 7F 81 CF 23 8D 4B 74 70 70 DE 67 68 ñ.nˆ?Ï#?KtppÞgh 00000430 AE CC 85 0F B5 DB 04 60 27 B0 B7 8B A9 90 C7 C7 ®Ì….µÛ.`'°·‹©?ÇÇ 00000440 43 DE 1A 42 40 28 6C EA 56 CE 47 D5 BA 51 8C BB CÞ.B@(lêVÎGÕºQŒ» 00000450 05 1F C4 66 ED E7 C1 D9 08 C1 F9 C7 5B 46 65 31 ..ÄfíçÁÙ.ÁùÇ[Fe1 00000460 D5 F7 6D 9C 58 FA A0 0B BC FB 4B A2 36 AA 8F 9E Õ÷mœXú .¼ûK¢6ª?ž 00000470 69 D7 D1 48 F7 09 8A E2 08 E0 10 69 67 55 94 66 i×ÑH÷.Šâ.à.igU”f 00000480 9E BE 92 45 D3 3B 76 ED 2D 87 02 46 35 EF 92 E9 ž¾’EÓ;ví-‡.F5ï’é 00000490 6D 87 86 D7 E7 66 F0 AE 15 90 2D 10 B0 50 30 97 m‡†×çfð®.?-.°P0— 000004A0 E7 50 0B BB 5A 12 8D 46 0A CE 64 BD 41 DA 6A 38 çP.»Z.?F.Îd½AÚj8 000004B0 F5 9D C0 25 0C 20 4B E2 E0 34 B8 17 00 41 0D 81 õ?À%. Kâà4¸..A.? 000004C0 1C 78 11 A1 64 18 C8 5A D9 68 B3 22 0E 78 DB D4 .x.¡d.ÈZÙh³".xÛÔ 000004D0 7A 00 9B E6 F0 37 6E 2A 80 46 19 09 66 4A 90 CE z.›æð7n*€F..fJ?Î 000004E0 83 D4 8B FF DD 7F 87 3D B6 A2 75 5F A7 EC 04 FC ƒÔ‹ÿ݇=¶¢u_§ì.ü 000004F0 03 30 5D 32 DD 5F 8D 40 C2 B5 29 B8 70 B7 28 FD .0]2Ý_?@µ)¸p·(ý 00000500 97 F9 FF FA A5 7C C5 A6 62 78 9D 77 57 EE 6C 80 —ùÿú¥|Ŧbx?wWîl€ 00000510 DE 45 53 E4 0A 0E CE 66 35 EC EF 7B BB 5C 06 09 ÞESä..Îf5ìï{»\.. 00000520 9D A2 FE 5C 1E 48 68 F9 4C 81 E6 AB 4F B3 0E E7 ?¢þ\.HhùL?æ«O³.ç 00000530 0E 13 23 CA 85 22 76 3E 71 9B 1C 48 09 8F 76 B0 ..#Ê…"v>q›.H.?v° 00000540 2A E2 C5 8F 7E D3 54 E9 A8 02 33 E8 9D A1 26 ED *âÅ?~ÓTé¨.3è?¡&í 00000550 53 75 FE 54 B1 89 0A 04 FD 0A C8 75 47 F5 A3 2E SuþT±‰..ý.ÈuGõ£. 00000560 BC 47 FC AA 1F 48 37 B6 55 CA 6F 30 26 8A D0 D4 ¼Güª.H7¶UÊo0&ŠÐÔ 00000570 39 6D 2E BD 56 C1 41 F9 5C 70 05 BC 35 DF 95 18 9m.½VÁAù\p.¼5ß•. 00000580 B8 63 CD 93 BD CC FA 59 F9 C2 8D E7 34 8F 63 81 ¸cÍ“½ÌúYùÂ?ç4?c? 00000590 05 53 F0 76 61 BE FE A6 B6 CD FB F2 BC 7D 48 92 .Sðva¾þ¦¶Íûò¼}H’ 000005A0 82 7B 16 A9 CF AD FC F7 A5 6E EC BA 1A CF B8 6D ‚{.©Ïü÷¥nìº.ϸm 000005B0 AC 35 B7 14 15 05 E9 B0 F8 DA 80 CC EA 72 31 13 ¬5·...é°øÚ€Ìêr1. 000005C0 64 A7 91 70 4A 4C B4 B6 F1 F1 27 D8 92 73 F1 F4 d§‘pJL´¶ññ'Ø’sñô 000005D0 34 D5 FF 20 B6 23 E6 13 EB 99 00 0D B9 5F 4Õÿ ¶#æ.ë™..¹_ RECV 1.1.1.10:49573 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 02 D8 01 5B 40 00 FE 06 E3 58 3F F1 53 70 01 01 .Ø.[@.þ.ãX?ñSp.. 00000020 01 0A 17 E0 C1 A5 A5 F3 71 FC 8D 94 93 B3 50 18 ...àÁ¥¥óqü?”“³P. 00000030 10 00 46 21 00 00 15 F4 66 1D 08 15 5F E7 85 52 ..F!...ôf..._ç…R 00000040 71 08 11 4A 42 ED 6F 3E 5A 74 26 26 60 79 9D E2 q..JBío>Zt&&`y?â 00000050 45 4D DC DC B6 74 C9 46 7C 91 41 F9 7B 15 A9 D0 EMÜܶtÉF|‘Aù{.©Ð 00000060 77 6C F7 5B 71 C1 FC 0E 46 3C A1 90 F2 BF FD 9E wl÷[qÁü.F<¡?ò¿ýž 00000070 C0 58 F2 60 EB 84 9C 08 F4 4B 24 8C 11 CC 44 59 ÀXò`ë„œ.ôK$Œ.ÌDY 00000080 64 DD D1 20 95 BB 59 20 BB C3 78 85 F3 72 5B 1C dÝÑ •»Y »Ãx…ór[. 00000090 24 83 D6 AE 1E 46 5E 00 9D 34 76 DB F7 CE BB 80 $ƒÖ®.F^.?4vÛ÷λ€ 000000A0 08 6C 8A 68 99 8C CC A3 C0 0E 63 A8 18 41 5C 1C .lŠh™ŒÌ£À.c¨.A\. 000000B0 05 2F FB DC BB 6D 4C 36 81 70 EA EA 2A EB 62 0A ./ûÜ»mL6?pêê*ëb. 000000C0 ED FE 68 1F BC F3 B3 D7 E8 47 69 F3 5C 40 1E AD íþh.¼ó³×èGió\@. 000000D0 9B 7F B2 3D 5C DC 37 92 B6 4D 6E 49 11 84 2D FC ›²=\Ü7’¶MnI.„-ü 000000E0 AD 2E 08 91 AA 0E 2C 57 37 24 B8 25 56 F1 CC E4 ..‘ª.,W7$¸%VñÌä 000000F0 55 57 20 1A 66 CB B4 BD 81 60 EA 4A 7E FC AB 9E UW .fË´½?`êJ~ü«ž 00000100 F4 4A A6 56 58 BE 44 49 93 AC DC DA CF C0 A3 3E ôJ¦VX¾DI“¬ÜÚÏÀ£> 00000110 8B 55 1B 01 20 F1 11 DA A1 F8 3D AD 70 61 1C A2 ‹U.. ñ.Ú¡ø=pa.¢ 00000120 35 60 4C 2B 63 D4 19 FD 3D 3F 66 68 2E 72 78 F9 5`L+cÔ.ý=?fh.rxù 00000130 18 A3 43 A9 E5 AD 9A 39 7E 23 F4 01 74 92 33 2C .£C©åš9~#ô.t’3, 00000140 31 16 9C 02 09 CD 97 92 35 AA A0 22 13 55 99 31 1.œ..Í—’5ª ".U™1 00000150 C3 BB 99 60 87 BB 22 11 10 D6 EE D8 91 D5 BD BA û™`‡»"..ÖîØ‘Õ½º 00000160 AA A7 CD 8B 98 4C 6C 0C C9 EE D6 1E 0F A0 A1 B9 ª§Í‹˜Ll.ÉîÖ.. ¡¹ 00000170 B4 ED E9 6D FD E3 F4 08 36 74 21 6E 87 48 7C 92 ´íémýãô.6t!n‡H|’ 00000180 93 87 8D 34 91 48 D9 98 1E B7 60 94 84 FE 2D 4A “‡?4‘HÙ˜.·`”„þ-J 00000190 03 CF 76 4F FB ED 2D F2 53 D5 D0 DA 39 AE CF 7C .ÏvOûí-òSÕÐÚ9®Ï| 000001A0 AA ED F3 23 A1 AE 6D 94 7B FA D0 A1 6F 6D 4A 41 ªíó#¡®m”{úСomJA 000001B0 CC A5 C1 4A B1 99 C2 CA 24 16 B9 78 4D 22 C2 F6 Ì¥ÁJ±™ÂÊ$.¹xM"Âö 000001C0 9E 7E 6D 52 8B 1E AA 80 24 D5 1B 62 FE 34 42 E6 ž~mR‹.ª€$Õ.bþ4Bæ 000001D0 2A F7 D1 49 B6 01 59 07 00 0B E0 AE 93 A3 34 B1 *÷ÑI¶.Y...ஓ£4± 000001E0 D7 D2 F3 41 A9 B8 37 20 F5 45 BF A2 C5 02 07 48 ×ÒóA©¸7 õE¿¢Å..H 000001F0 D1 9E CB 15 A9 64 EA 1A 00 FD 04 8E 49 A8 E3 FA ÑžË.©dê..ý.ŽI¨ãú 00000200 77 F5 29 DC 51 B1 BC 33 7F 88 83 74 1F 07 C7 DB wõ)ÜQ±¼3ˆƒt..ÇÛ 00000210 C7 AB FE FE 06 31 C1 74 6A E4 A8 1A F4 90 7A FB Ç«þþ.1Átjä¨.ô?zû 00000220 13 DB 8B EB FF D0 5D 24 FC B6 A3 60 99 20 00 00 .Û‹ëÿÐ]$ü¶£`™ .. 00000230 00 00 00 00 00 00 07 1C CA 04 21 87 90 29 21 95 ........Ê.!‡?)!• 00000240 00 61 7D 2C 76 49 D1 18 C2 5C 6E 85 00 23 3C FE .a},vIÑ.Â\n….#<þ 00000250 C2 AE DD E2 ED 76 6A 55 6F E6 D6 BC 2F F8 52 1B ®ÝâívjUoæÖ¼/øR. 00000260 19 A8 9F 12 DF 33 46 90 CA 16 31 00 08 EE 5C B9 .¨Ÿ.ß3F?Ê.1..î\¹ 00000270 A3 05 AB 10 B9 00 33 30 C3 79 28 D9 32 98 BC 73 £.«.¹.30Ãy(Ù2˜¼s 00000280 6F 9F B2 88 4E E9 F8 24 9E 86 EB A0 3D 7C 75 74 oŸ²ˆNéø$ž†ë =|ut 00000290 34 60 EC C7 9C 90 FF 99 CA DB C6 5C BC BA D2 73 4`ìÇœ?ÿ™ÊÛÆ\¼ºÒs 000002A0 75 36 66 92 FD 3E 79 AC 4E 70 1A B5 9D A5 3C ED u6f’ý>y¬Np.µ?¥<í 000002B0 CB F8 A9 7B D2 E6 AB 67 48 3D 82 CB 08 CA F6 F8 Ëø©{Òæ«gH=‚Ë.Êöø 000002C0 35 F8 4C B9 37 E8 80 B2 0F B3 7F 38 A8 FB BB 0B 5øL¹7耲.³8¨û». 000002D0 B8 55 01 1A 64 16 99 38 63 1D 33 12 73 43 DE 49 ¸U..d.™8c.3.sCÞI 000002E0 DE 86 9A 99 CA C9 Þ†š™ÊÉ RECV 1.1.1.10:49573 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 01 5C 40 00 FE 06 E6 07 3F F1 53 70 01 01 .(.\@.þ.æ.?ñSp.. 00000020 01 0A 17 E0 C1 A5 A5 F3 74 AC 8D 94 93 B4 50 10 ...àÁ¥¥ót¬?”“´P. 00000030 10 00 F4 F9 00 00 00 00 C5 F5 77 B6 ..ôù....Åõw¶ RECV 1.1.1.10:49563 <- 63.241.83.112:6112 00000000 04 08 15 16 23 42 00 13 10 10 1A 5A 08 00 45 00 ....#B.....Z..E. 00000010 00 28 01 5D 40 00 FE 06 E6 06 3F F1 53 70 01 01 .(.]@.þ.æ.?ñSp.. 00000020 01 0A 17 E0 C1 9B A5 E3 FA 9C 30 D2 D5 62 50 10 ...àÁ›¥ãúœ0ÒÕbP. 00000030 10 00 8A 37 00 00 00 00 E8 ED DC E3 ..Š7....èíÜã SEND 63.241.83.112:6112 -> 1.1.1.10:49573 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 71 40 00 80 06 00 00 01 01 01 0A 3F F1 .((q@.€.......?ñ 00000020 53 70 C1 A5 17 E0 8D 94 93 B4 A5 F3 74 AD 50 10 SpÁ¥.à?”“´¥ótP. 00000030 01 01 95 86 00 00 ..•†.. SEND 63.241.83.112:6112 -> 1.1.1.10:49563 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 72 40 00 80 06 00 00 01 01 01 0A 3F F1 .((r@.€.......?ñ 00000020 53 70 C1 9B 17 E0 30 D2 D5 62 A5 E3 FA AC 50 10 SpÁ›.à0ÒÕb¥ãú¬P. 00000030 01 03 95 86 00 00 ..•†.. SEND 63.241.83.112:6112 -> 1.1.1.10:49563 00000000 00 13 10 10 1A 5A 04 08 15 16 23 42 08 00 45 00 .....Z....#B..E. 00000010 00 28 28 76 40 00 80 06 00 00 01 01 01 0A 3F F1 .((v@.€.......?ñ 00000020 53 70 C1 9B 17 E0 30 D2 D5 62 A5 E3 FA AC 50 14 SpÁ›.à0ÒÕb¥ãú¬P. 00000030 00 00 95 86 00 00 ..•†..[/code] | March 23, 2009, 9:37 PM |
| Barabajagal | I don't like to double post, but it seems more sensible due to what happened last time I tried editing my post when it had a lot of packet data... so: Here's the basic analyze loop: [code]Private Sub Analyze() Dim sPacket As String Dim bBuff() As Byte Dim pHd As PacketHeader Dim rVal As Byte On Error GoTo Erred Do While Sniffing ReDim bBuff(32767) As Byte rVal = vpCapture(bBuff(), pHd) If rVal > 0 Then sPacket = String$(pHd.caplen, 0) RtlMoveMemory ByVal sPacket, bBuff(0), pHd.caplen AnalyzePacket sPacket End If Erase bBuff() DoEvents Loop Exit Sub Erred: If ErrorHandler("frmMain", "Sub Analyze") Then Resume Next End Sub Private Sub AnalyzePacket(ByVal sPacket As String) Dim cPacket As New clsPacket Dim cTCPIP As New clsTCPIP On Error GoTo Erred cPacket.SetData sPacket cPacket.SwapEndian cTCPIP.Decode cPacket If cTCPIP.EthHeader.iType = &H800 Then 'IP If cTCPIP.IPHeader.bProto = 6 Then 'TCP If cTCPIP.TCPHeader.iSrcPort = 6112 Or cTCPIP.TCPHeader.iDestPort = 6112 Then If LenB(sPacket) >= 54 Then DisplayData (cTCPIP.IPHeader.sSrcIP = LocalIP), _ cTCPIP.IPHeader.sDestIP & ":" & cTCPIP.TCPHeader.iDestPort, _ cTCPIP.IPHeader.sSrcIP & ":" & cTCPIP.TCPHeader.iSrcPort, _ cPacket.GetNull End If End If End If End If Exit Sub Erred: If ErrorHandler("frmMain", "Sub AnalyzePacket") Then Resume Next End Sub[/code] And here's my TCPIP header parser: [code]Public Sub Decode(ByRef cPacket As clsPacket) On Error GoTo Erred ethData.sDestMAC = Replace$(StH(cPacket.GetString(6), True), " ", ":") ethData.sSrcMAC = Replace$(StH(cPacket.GetString(6), True), " ", ":") ethData.iType = cPacket.GetWORD Select Case ethData.iType Case Is <= &H5DC ethData.sType = "[Ethernet IEEE 802.3]" ethData.bLLCDSAP = cPacket.GetByte ethData.bLLCSNAP = cPacket.GetByte ethData.bLLCCTRL = cPacket.GetByte If ethData.bLLCDSAP = ethData.bLLCSNAP Then Select Case ethData.bLLCDSAP Case &HF0 ethData.sType = ethData.sType & " [NETBIOS LLC Encapsulation]" Case &HFF ethData.sType = ethData.sType & " [IPX RAW 802.3 Encapsulation]" End Select End If Case &H800 ethData.sType = "[IPv4]" Case &H806 ethData.sType = "[Arp]" Case &H8035 ethData.sType = "[Rarp]" Case &H8137 ethData.sType = "[Novell Netware IPX]" Case &H86DD ethData.sType = "[IPv6]" Case &H8037 ethData.sType = "[IPX]" Case &H809B ethData.sType = "[Ethertalk]" Case &H814C ethData.sType = "[SNMP over Ethernet]" Case Else ethData.sType = "Unknown (0x" & BufferHex(ethData.iType, 4) & ")" End Select If ethData.iType = &H800 Then ipData.bVer = ((cPacket.PeekByte And &HF0) / 16) ipData.bIHL = (cPacket.GetByte And &HF) ipData.bTOS = cPacket.GetByte ipData.iLength = cPacket.GetWORD ipData.iID = cPacket.GetWORD ipData.bFlags = ((cPacket.PeekByte And &HE0) / 32) ipData.iFrag = (cPacket.GetWORD And &H1FFF) ipData.bTTL = cPacket.GetByte ipData.bProto = cPacket.GetByte ipData.iCSum = cPacket.GetWORD ipData.sSrcIP = cPacket.GetByte & "." & cPacket.GetByte & "." & cPacket.GetByte & "." & cPacket.GetByte ipData.sDestIP = cPacket.GetByte & "." & cPacket.GetByte & "." & cPacket.GetByte & "." & cPacket.GetByte If ipData.bProto = 6 Then tcpData.iSrcPort = cPacket.GetWORD tcpData.iDestPort = cPacket.GetWORD tcpData.lSeqNum = cPacket.GetDWORD tcpData.lAckNum = cPacket.GetDWORD tcpData.bHLEN = (cPacket.GetByte And &HF0) / 16 tcpData.bFlags = cPacket.GetByte tcpData.iWindow = cPacket.GetWORD tcpData.iCSum = cPacket.GetWORD tcpData.iUgntPtr = cPacket.GetWORD Else 'MsgBox "Not TCP: " & ipData.bProto End If Else 'MsgBox "Not IP: " & BufferHex(ethData.iType, 4) End If Exit Sub Erred: If ErrorHandler("clsTCPIP", "Sub Decode") Then Resume Next End Sub[/code] @PunK: Because that would be ignoring the problem, not learning something new. Edit: Oh, and yes, my MAC address is 04:08:15:16:23:42. I had some weird problems with the version of the wrapper I was using, so I switched to a different version that I found. It doesn't lose packets, and it lets me run my app in the IDE, so I'm a lot happier about that. I'm still getting weird packets, though! | March 23, 2009, 9:42 PM |
| xpeh | Hello! Some1 wanna make a sniffer plugin instead of cheap console shit? | March 24, 2009, 9:14 PM |
| BreW | [quote author=xpeh link=topic=17853.msg181896#msg181896 date=1237929255] Hello! Some1 wanna make a sniffer plugin instead of cheap console shit? [/quote] What the hell? Seriously. Your posts are useless. All of them. Do us a favor, https://davnit.net/bnet/vL/index.php?action=profile;u=4937;sa=deleteAccount. | March 24, 2009, 10:15 PM |
| BreW | Andy, most of those "junk" packets in your first post seem to be TCP_CONNECTs or keepalives. You know, stuff the application layer typically can't see. I ended up plainly posting it as opposed to just pasting a link to the TCP RFC 793, which explains it just as well. | March 24, 2009, 10:17 PM |
| Barabajagal | Okay, I'll have to look into it and find a way to filter it out pleasantly. Edit: I forgot to handle Options and Flags (control bits). The extra crap's gone. If you want to try it out, I have a version with SID (Except for WCG and WDN, as stated in the first post), MCP, and BNLS parsing complete. Not every packet has been tested, so if anyone notices some bad parsing, missing packets, etc... please let me know! Here's the download: BNalyzer. WinPCap 4+ is required. The new version (0.0.2) includes menus with New, Open, and Save abilties, handling for large packets (I'm learning a lot about TCP!), and built in statstring reading for characters and games. As usual, let me know if you find any bugs, typos, or anything of the sort! | March 24, 2009, 10:49 PM |
| Sixen | Some more suggestions: *Duration of logging under Statistics *When selecting a packet in one view, auto-select it in the other view *Minimize to systray option (perhaps in settings checkbox for either systray or taskbar) *Auto-scroll with text on Parsed-View *Right-click on parsed-view packet copy option *Botnet Support Done: *Allow the buffer-size to be edited manually (change the label to a text box?) | March 25, 2009, 11:25 PM |
| xpeh | [quote author=brew link=topic=17853.msg181898#msg181898 date=1237932933] [quote author=xpeh link=topic=17853.msg181896#msg181896 date=1237929255] Hello! Some1 wanna make a sniffer plugin instead of cheap console shit? [/quote] What the hell? Seriously. Your posts are useless. All of them. Do us a favor, https://davnit.net/bnet/vL/index.php?action=profile;u=4937;sa=deleteAccount. [/quote] Give a proof or GTFO. Do you even know what a sniffer plugin is? And why is what you want to do better? | March 27, 2009, 5:55 PM |
| BreW | [me=brew]chuckles[/me] | March 27, 2009, 7:09 PM |
| Barabajagal | Wow... So, I guess I just got proven wrong. Brew, I'm sorry I thought you were the biggest idiot to regular the forum. | March 27, 2009, 8:01 PM |
| BreW | I guess I just got proven wrong as well. Idiots sometimes do learn. EDIT* check this out fellows: [quote] [05:28:06 PM] <me> I must give you credit though [05:28:15 PM] <me> you're pretty ballzy [05:28:17 PM] <RealityRipple> for what? [05:28:22 PM] <me> for doing what you did [05:28:27 PM] <RealityRipple> ? [05:28:29 PM] <RealityRipple> what did i did? [05:28:34 PM] <me> that's what you did [/quote] | March 27, 2009, 8:43 PM |
| Barabajagal | Version 0.0.3 released. Changes include SID_WARCRAFTGENERAL parsing, bug fixes, the ability to type numbers in when you select the buffer size scrollbar, and restrictions on what you can type in for the four protocol ports in Settings. I need some help with WARCRAFTGENERAL, though! If anyone has an account with enough wins to change icons, I'd like a packet log of the entire thing (from viewing your profile to returning to chat after changing your icon). Also, any tournament games, arranged team games, clan games, or solo games that you'd care to log would be helpful as well! | March 29, 2009, 2:32 AM |
| Sixen | [quote author=RealityRipple link=topic=17853.msg181942#msg181942 date=1238293970] Version 0.0.3 released. Changes include SID_WARCRAFTGENERAL parsing, bug fixes, the ability to type numbers in when you select the buffer size scrollbar, and restrictions on what you can type in for the four protocol ports in Settings. I need some help with WARCRAFTGENERAL, though! If anyone has an account with enough wins to change icons, I'd like a packet log of the entire thing (from viewing your profile to returning to chat after changing your icon). Also, any tournament games, arranged team games, clan games, or solo games that you'd care to log would be helpful as well! [/quote] I do! :). | March 29, 2009, 7:34 AM |
