[Bro] binpac to bro script types
vladg at illinois.edu
Wed May 31 12:13:39 PDT 2017
Well, that's protocol specific, but I did some digging:
> >>> TIME_FIXUP_CONSTANT
> >>> hex(filetime)
> >>> filetime/10000000.
> >>> _-TIME_FIXUP_CONSTANT
> >>> datetime.datetime.fromtimestamp(1478505209.9601936).strftime('%Y-%m-%d %H:%M:%S')
> '2016-11-07 01:53:29'
This is already implemented in smb-time.pac:
You could try just adding this to your PAC file and then you'll be able
to use that function:
> %include ../smb/smb-time.pac
Check out krb-asn1.pac for an example of including another PAC file:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 800 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170531/81f50ede/attachment.bin
More information about the Bro