分类: LINUX
2009-06-23 15:03:09
BinPAC is a high level language for describing protocol parsers. The BinPAC compiler generates C++ code. We have written a few Bro protocol analyzers using BinPAC, including CIFS/SMB, DCE/RPC, HTTP, DNS, NCP, and Sun/RPC. The BinPAC-based parsers have almost same performance as the hand-written ones. On the other hand, writing parsers in BinPAC is easier and the code is more maintainable.
BinPAC is open-source with the same licence Bro has. The newest version is released with Bro 1.2.
Finally, while the BinPAC compiler is released with Bro, it is designed to be general-purpose and so can be used to generate parsers for other programs as well.
More information on BinPAC can be found in our IMC '06 paper:
BinPAC: a yacc for Writing Application Protocol Parsers,
Ruoming Pang, Vern Paxson, Robin Sommer, and Larry Peterson (PDF,ACM).
In this guide we show how to build a BinPAC-based SMTP parser from scratch. We start with a most primitive version and refine it step-by-step. Are you ready? Let's start!
An attempt to capture binpac's language/methodology as well as development direction. Take a look