BinPAC

From BroWiki

What's BinPAC?

BinPAC is a high level language for describing protocol parsers. The BinPAC compiler generates C++ code. We have written a few Bro protocol analyzers using BinPAC, including CIFS/SMB, DCE/RPC, HTTP, DNS, NCP, and Sun/RPC. The BinPAC-based parsers have almost same performance as the hand-written ones. On the other hand, writing parsers in BinPAC is easier and the code is more maintainable.

BinPAC is open-source with the same licence Bro has. The newest version is released with Bro 1.2.

Finally, while the BinPAC compiler is released with Bro, it is designed to be general-purpose and so can be used to generate parsers for other programs as well.

More information on BinPAC can be found in our IMC '06 paper:

BinPAC: a yacc for Writing Application Protocol Parsers,
Ruoming Pang, Vern Paxson, Robin Sommer, and Larry Peterson (PDF,ACM).

Userguide (In Progress)

An attempt to capture binpac's language/methodology as well as development direction. Take a look