binpac to bro script types

Well, I think you're on the right track. You need to do something like
this line in smb-time.pac:

Val* bro_ts = new Val(secs, TYPE_TIME);

The Val constructor with a type of time takes a double of seconds since
the epoch (UNIX time) and gives you the Bro script timestamp val. How
you actually convert whatever format you're working to UNIX time is up
to you and dependent on the format.

Does that make sense? If you can provide more information on how the
timestamp is actually stored, someone might be able to help figure out
how to convert it.

  --Vlad

"Bortoli, Tomas" <tomas.bortoli@sit.fraunhofer.de> writes:

That solution looks good but I am stuck with the encoding of the timestamp.

It's a 64 bit timestamp but I don't know how to interpret it. Picture attaced.

Thanks,
Tomas

That solution looks good but I am stuck with the encoding of the timestamp.

It's a 64 bit timestamp but I don't know how to interpret it. Picture attaced.

Thanks,
Tomas

Well, that's protocol specific, but I did some digging:

>>> TIME_FIXUP_CONSTANT
11644473600
>>> hex(filetime)
'0x01d238cc0f66a007'
>>> filetime/10000000.
13122978809.960194
>>> _-TIME_FIXUP_CONSTANT
1478505209.9601936
>>> datetime.datetime.fromtimestamp(1478505209.9601936).strftime('%Y-%m-%d %H:%M:%S')
'2016-11-07 01:53:29'

This is already implemented in smb-time.pac:
https://github.com/bro/bro/blob/master/src/analyzer/protocol/smb/smb-time.pac#L13

You could try just adding this to your PAC file and then you'll be able
to use that function:

%include ../smb/smb-time.pac

Check out krb-asn1.pac for an example of including another PAC file:
https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-asn1.pac

  --Vlad

Thank you very much Vlad!
I finally also solve it in a very similar way in the end (conversion + offset)

Tomas