search

kaitai-io / kaitai_struct_formats

Kaitai Struct: library of binary file formats (.ksy)
http://formats.kaitai.io
712 stars 203 forks source link

Email or SMTP #595

Open lovejotd opened 2 years ago

lovejotd commented 2 years ago

I am looking for a way to process email or smtp data from a pcap file, has anyone done this before? Do you have any insight? Thanks!

dgelessus commented 2 years ago

Hi! Both email messages and SMTP are text-based formats/protocols, which are not really the main focus of Kaitai Struct. Text formats often have a free-form structure that requires lookahead or backtracking during parsing, whereas Kaitai Struct is intended for formats with a fixed structure that can be parsed unambiguously. Although some text formats can be parsed using Kaitai Struct, in many cases it doesn't work very well (or at all). You could try writing KSYs for SMTP and email, but it would probably be easier to use an existing email handling library for your programming language.

We have KSYs for pcap files, IPv4, IPv6, and TCP, which you could use to extract the raw SMTP communication from a pcap file - but that would require a lot of manual work, because you would have to find the relevant packets in the pcap file, reassemble TCP segments, etc. Again, there are probably other tools and libraries that can do that with much less manual work than using Kaitai Struct. (I can't recommend any particular tool/library, sorry - I don't work with network captures very often.)

KOLANICH commented 2 years ago

@lovejotd, also feel free to repurpose https://github.com/KOLANICH-tools/USBPcapOdinDumper for your needs. When I need to unpack something from pcap, I usually clone that repo and edit slightly.