I may or may not look at Airmedia software and communication again. Depends on how bored I get.
More information about Crestorn AirMedia:
First, I nmapped the IP address.
Port 80 and 443 are for downloading application (which allows you to share your screen), management, and remote view (you don't have to look at the TV screen, you can also view shared screen via browser)
I started doing packet capturing and filtering some of the stuff.
I noticed that ports 3268 and 289 were used by the desktop app to communicate. The desktop app sent wppaliveROCK and the server replied with wppaliveROLL.
Port 515 is used by the server to receive screen/screen updates from user's computer.
Their datasheet or configuration document has more information about these ports.
Here's the correct code being sent. This doesn't really matter because as soon as the person disconnects, the code changes.
Computer starts using port 515 after the connection is done. At the time, I was new to forensics or any type of file analysis. I noticed JFIF, instead of realizing it was jpg, I Googled it and found out that it was jpg.
I decided to figure out how to extract images automatically.
I was familiar with python and had heard of scapy before.
I knew that part was 515 and I learned about binascii library while researching.
from scapy.all import * import binascii pcap=rdpcap("correct_pcap.pcap") allthestuff = "" for i in range(len(pcap)): if (pcap[i].dport == 515): dstpacket = pcap[i] if Raw in dstpacket: allthestuff = allthestuff + str(pcap[i].load) startaddr = '' endaddr = '' startaddrlist =  endaddrlist =  for i in range(len(allthestuff)): if (i > len(allthestuff)-4): break else: if (binascii.hexlify(allthestuff[i] + allthestuff[i+1] + allthestuff[i+2] + allthestuff[i+3]) == "ffd8ffe0"): startaddr = i elif (binascii.hexlify(allthestuff[i] + allthestuff[i+1]) == "ffd9"): endaddr = i+2 startaddrlist.append(startaddr) endaddrlist.append(endaddr) for i in range(len(startaddrlist)): outfile = open("img"+str(i)+".jpg", "w") outfile.write(allthestuff[startaddrlist[i]:endaddrlist[i]]) outfile.close() print "done extracting images"
Here's the output: