[Bro] binpac to bro script types

[Bortoli, Tomas]

Thank you very much Vlad!
I finally also solve it in a very similar way in the end (conversion + offset)

Tomas
________________________________________
From: Vlad Grigorescu [vladg at illinois.edu]
Sent: Wednesday, May 31, 2017 9:13 PM
To: Bortoli, Tomas; bro at bro.org
Subject: RE: [Bro] binpac to bro script types

Well, that's protocol specific, but I did some digging:

> >>> TIME_FIXUP_CONSTANT
> 11644473600
> >>> hex(filetime)
> '0x01d238cc0f66a007'
> >>> filetime/10000000.
> 13122978809.960194
> >>> _-TIME_FIXUP_CONSTANT
> 1478505209.9601936
> >>> datetime.datetime.fromtimestamp(1478505209.9601936).strftime('%Y-%m-%d %H:%M:%S')
> '2016-11-07 01:53:29'

This is already implemented in smb-time.pac:
https://github.com/bro/bro/blob/master/src/analyzer/protocol/smb/smb-time.pac#L13

You could try just adding this to your PAC file and then you'll be able
to use that function:

> %include ../smb/smb-time.pac

Check out krb-asn1.pac for an example of including another PAC file:
https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-asn1.pac

  --Vlad