parse portmon logs
authorDobrica Pavlinusic <dpavlin@rot13.org>
Sun, 26 Oct 2014 10:52:36 +0000 (11:52 +0100)
committerDobrica Pavlinusic <dpavlin@rot13.org>
Sun, 26 Oct 2014 10:52:36 +0000 (11:52 +0100)
dumps/portmon-parse.pl [new file with mode: 0755]

diff --git a/dumps/portmon-parse.pl b/dumps/portmon-parse.pl
new file mode 100755 (executable)
index 0000000..5cc0706
--- /dev/null
@@ -0,0 +1,29 @@
+#!/usr/bin/perl
+use warnings;
+use strict;
+
+my $in_read = 0;
+my $wait = 0;
+my $read = '';
+
+while(<>) {
+       s/[\n\r]+$//;
+       if ( /IRP_MJ_WRITE.*:\s*(.*)/ ) {
+               print "> $1\n";
+       } elsif ( /(IRP_MJ_READ|IOCTL_SERIAL_WAIT_ON_MASK)/ ) {
+               $in_read++;
+               print "#[$in_read] $_\n";
+       } elsif (  $in_read && /SUCCESS\s+Length\s+\d+:\s*([0-9a-fA-F\s]+)/ ) {
+               $read .= $1;
+               print "#<$in_read $_\n";
+               my $len = hex($1) if ( $read =~ m/^([0-9a-f]{2})/i );
+               print "#< $read [$len]\n";
+               if ( length($read) >= ( $len * 3 - 1 ) ) {
+                       print "< $read\n";
+                       $in_read = 0;
+                       $read = '';
+               }
+       } else {
+               print "# $_\n";
+       }
+}