1

I have one Pcap File which consist of Some Information.

I need to modify the data in the file.

Example: wireshark details

As you can see There are details of packets and in Additional Record section I have TXT value fn=Room 110

Now please help me to change the TXT value

Example: from TXT: fn=Room 110 to TXT: fn=Room 1234

Example End

Things I have Done So Far

1. Used Scapy and Hex Editor To change the Metadata.

with Scapy I have done changes like Changing Destination address or mac address and ports. But unable to change the TXT records with scapy.

With Hex I am able to change TXT value by converting the String to hex, but I face challenge in different length.

Example: I can Chnage TXT: fn=Room 110 to TXT: fn=Room 123

But Can't Change from TXT: fn=Room 110 to TXT: fn=Room 1234 In this case, the generated pcap gets invalid.

Here is a sample working Screenshot Using Python

Python Program This code Changes The Destination Mac, Source IP and TXT=Room <value:3 digit> And That TXT value is being modified by Checking the HEX Value before and after the "TXT: fn=Room" of the packet.

Any help regarding this Issue is very very appreciated

Thank you.

1 Answer 1

1

I think the reason why this is happening is because of the increased length of fn=Room 1234 compared to fn=Room 110

Inside the packet, the hex digit before the field you have highlighted (fn=Room 110) is 0b which is 11 in decmial:

enter image description here

Since you are adding 1 extra character, the length of the field will increase by one to 12.

Therefore you must change the 0b before the field (highlighted in picture) to 0c, so that it knows the next field's length will be 12 characters. (echo -n "fn=Room 1234" | wc -c). 0c is 12 in hexadecimal.

2
  • Hi! Thanks for helping me out but even after changing the length value, I still get the same error. Malformed Packet: mDNS Here is the screenshot attached below i.ibb.co/xh1Z5QP/Screenshot-from-2022-01-31-14-42-02.png Jan 31, 2022 at 9:14
  • 1
    Probably too late for you, but for others that look this up, the problem is likely a checksum or CRC somewhere that needs to be updated or disabled. Wireshark should tell you if you expand all the fields which one(s) it is. My guess is the UDP checksum (set it to all zeroes) or Ethernet FCS (see if Wireshark will show the expected value, then modify it). May 20, 2022 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .