macos - Sniff HTTP packets using NKE

Question

I'm trying to read http requests and responses by making a KEXT using NKE. I registered a socket filter, whenever I'm getting data I'm printing mbuf using a code like this:

unsigned char *dataString = mbuf_data(*data);
for (size_t i = 0; i < mbuf_len(*data); i++)
{
    printf("%c", dataString[i]);
}
printf("\n-------------\n");

I can read http requests and some responses data from logs but can't see any HTML content. I was wondering if I'm not correctly reading mbuf or is it some other problem?

Answer 1

mbufs 实际上是内存缓冲区的链接列表，因此如果您只检查列表的头部，这可能就是您看不到所有数据的原因。你想做这样的事情：

for (mbuf_t mb = *data; mb; mb = mbuf_next(mb))
{
  unsigned char* dataString = mbuf_data(mb);
  size_t len = mbuf_len(mb);
  for (size_t i = 0; i < len; i++)
  {
    printf("%c", dataString[i]);
  }
}
printf("\n-------------\n");