IIP+IIQ+IIU

[JerryDerik]

Good day. Have you figured out a frame merge mechanism to get a full IP,
аnd how to unite on the counter?

[Sec42]

I did some more investigation and got more insights, but it's not yet in a releasable state. Was busy with porting stuff for gr3.8 / python3, so it will take a little longer.

[JerryDerik]

Look forward to))). While trying to adapt the system for Windows.

[muaddib1984]

I've written a simple script to collect all the IIP messages as hex and ascii, then put them into typical hexdump format. Was hoping to use text2pcap but its obviously not that simple. I'm specifically interested in how to get the session into wireshark. Is it possible to offer a brief explanation of how you manually reassembled the HTTP packets shown in the HOPE talk?

[JerryDerik]

So, I transferred the project to Windows. I will not say that this is the easiest solution, but if necessary, I will provide instructions on how to do it.

[JerryDerik]

If there is at least some understanding of what to do with IIQ packet data, I would be very grateful for a hint.

[Sec42]

No, sorry. I didn't spend any time with them in the last years, so there's no new info that I have.

[muaddib1984]

Would it be possible to provide the manual process used to reassemble the IIP sessions shown in the original talk? I’ve scratched my head on this for quite a while and can’t seem to re-create your work there.<end transmission>On Feb 25, 2023, at 04:00, Sec ***@***.***> wrote: No, sorry. I didn't spend any time with them in the last years, so there's no new info that I have. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: ***@***.***>

[Sec42]

Honestly, it's been long since i did this, i don't remember enough to describe it without spending more time on this.
I'm leaving this issue open as a reminder to myself to re-visit this, but don't count on it happening soon.
Sorry

[JerryDerik]

I can provide algoritm for reassembling IP without IIQ frames.

[muaddib1984]

@JerryDerik Sounds good. Can you provide it somewhere please?

@Sec42 No worries, I completely understand. Thanks so much!

[JerryDerik]

Next week i will send link. 20 трав. 2023 р. 22:46 muaddib1984 ***@***.***> пише: @JerryDerik Sounds good. Can you provide it somewhere please? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[dimany4ka1111]

Next week i will send link. 20 трав. 2023 р. 22:46 muaddib1984 @.> пише: @JerryDerik Sounds good. Can you provide it somewhere please? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: @.>

Hello, can you send me, please, this algorithm???

[JerryDerik]

Convert frames in one type of data, found the counter and agregate by it.

[JerryDerik]

If you cut counter, you could find standart file signatures, like Zip or PDF (if you lucky), and after you can cut it to begin and get information.

[JerryDerik]

Look. On IIQ-CC you can see that what you call HDLC. But its not. Its like Control Chanel with "Padding with zeros". Information transmitting in fields with counter in first two bytes minus three first bits.

[JerryDerik]

You need something like this editor
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://github.com/WerWolv/ImHex&ved=2ahUKEwjj_NmNuuaJAxXEgSoKHZeZBoQQFnoECB0QAQ&usg=AOvVaw1tMGmjO3Y8xOSafQkDkzio

Then you must build bits on period 248 (if i right remember). Theh you cut first two bytes, but must manualy separate control chanel from information (counter in first two bytes help you).

P. S. Just intrest for my self, wher are you from?)
If dont want to answer just ignore this)

[dimany4ka1111]

I am from Latvia

[dimany4ka1111]

And you, if it isn’t secret)

[JerryDerik]

And you, if it isn’t secret)

Ukraine.

[JerryDerik]

Thx, but I have mine bits editor
So there is, that I get
After getting all hex raw packets in one packet and converts into bits on the period 248 bits
I think, this is wrong😂

I see this is wrong period, try to calculate size of packet from hex. Do you use Delta like bit viewer?

[JerryDerik]

Yes, it is

So use autoperiod, or manualy search the period from 200+

[JerryDerik]

Here my Signal, to not spam here.
https://signal.me/#eu/Hv9XcoJwug8J2baxwLHcT_IwHB1UDGLGQLtezAG-C5JIdphdJS1Kdrrrh-y-_zfb