[Bro] binpac to bro script types
tomas.bortoli at sit.fraunhofer.de
Thu Jun 1 04:57:25 PDT 2017
Thank you very much Vlad!
I finally also solve it in a very similar way in the end (conversion + offset)
From: Vlad Grigorescu [vladg at illinois.edu]
Sent: Wednesday, May 31, 2017 9:13 PM
To: Bortoli, Tomas; bro at bro.org
Subject: RE: [Bro] binpac to bro script types
Well, that's protocol specific, but I did some digging:
> >>> TIME_FIXUP_CONSTANT
> >>> hex(filetime)
> >>> filetime/10000000.
> >>> _-TIME_FIXUP_CONSTANT
> >>> datetime.datetime.fromtimestamp(1478505209.9601936).strftime('%Y-%m-%d %H:%M:%S')
> '2016-11-07 01:53:29'
This is already implemented in smb-time.pac:
You could try just adding this to your PAC file and then you'll be able
to use that function:
> %include ../smb/smb-time.pac
Check out krb-asn1.pac for an example of including another PAC file:
More information about the Bro