DBeaver登录informix报文分析-HEX

SelectDebeaver作为客户端—自动下载驱动：Select语句------------（六个字节开始）------------（六/七个字节结束）以00020000开始，紧跟两个字节select语句长度（不包含包头和包尾），最后以00160031000c-----SQL长度为偶数或0000160031000c---------SQL长度为奇数保证报文整体为偶数字节，结束。通过报文头00020000以及报文尾00160031000c判断报文为select语句报文。（有的以00020000开头，不以00160031000c结尾的报文不是selcet语句报文）。WinSQL作为客户端—IBMinformixclient4.10驱动：0000015100010000003c73656c65637420313a3a.....select1::00000161736d616c6c666c6f61742066726f6d20smallfloatfrom00000171696e666f726d69782e7379737461626cinformix.systabl000001816573207768657265207461626964203deswheretabid=000001912031006f00310003000b666c6f6174631.o.1....floatc000001A17572736f72000006000900800000000bursor...........000001B1000c..其它的select语句规则与Dbeaver登录一样000001B300020000002d73656c65637420646973.....-selectdis000001C374696e6374206f776e65722066726f6dtinctownerfrom000001D320696e666f726d69782e737973746162informix.systab000001E36c65730000160031000cles....1..包头登录第二条报文select标识不为000200SQL长度包尾Inser、create、dropDebeaver作为客户端：以------------（六个字节开始，五六位为语句长度n）n个字节语句--------------（八n为偶数/九n为奇数，个字节结束）。Drop语句000038A100010000001164726f70207461626c65......droptable000038B12064626d6431380000160007000b000cdbmd18.........Insert语句000004E700010000002c696e7365727420696e74.....,insertint000004F76f2064626d6431352076616c75657328odbmd15values(00000507202027696e666f726d6978272c275427'informix','T'00000517202900160007000b000c)........Create语句000003850001000000596372656174652074656d.....Ycreatetem0000039570207461626c652064626d6431352820ptabledbmd15(000003A520205441424c455f534348454d202020TABLE_SCHEM000003B576617263686172283835292c20202074varchar(85),t000003C561627479706520202063686172283129abtypechar(1)000003D520292077697468206e6f206c6f673b00)withnolog;.000003E500160007000b000c........登录Debeaver作为客户端：包头包尾SQL长度登录报文第一二个字节表示整个登录报文的长度，包含报头、包尾、登录内容等信息。第81个字节开始用户名，用户密码，其中81个字节表示用户名的长度（包含第81位），用户名之后跟两个字节--零（0000），之后一个字节表示用户密码长度（包含长度这个字节），WinSQL作为客户端—IBMinformixclient4.10驱动：000000000151013c0000006400650000003d0006.Q....d.e...=..00000010494545454900006c73716c6578656300IEEEI..lsqlexec.00000020000000000006392e32303100000c5244......9.201...RD0000003053235230303030303000000573716c69S#R000000...sqli0000004000000001310000000000000000000100....1...........0000005009696e666f726d6978000009696e666f.informix...info00000060726d6978006f6c000000000000000000rmix.ol.........000000703d746c69746370000000000001006800=tlitcp.......h.000000800b0000000300106f6c5f696e666f726d.......ol_inform0000009069783132313000000d64646d5f696e66ix1210...ddm_inf000000A06f726d6978000000000000000000006aormix..........j000000B0000a000c4946585f5550444445534300....IFX_UPDDESC.000000C000023100000a534b494e484942495400..1...SKINHIBIT.000000D000023000000c53494e474c454c455645..0...SINGLELEVE000000E04c0000036e6f0000094c4b4e4f544946L...no...LKNOTIF000000F059000004796573000007534b53484f57Y...yes...SKSHOW0000010000000230000006534b414c4c00000230...0...SKALL...0000001100000094c4f434b444f574e0000036e6f...LOCKDOWN...no000001200000074442444154450000064d445934...DBDATE...MDY4000001302f0000094e4f4445464441430000036e/...NODEFDAC...n000001406f0000074442504154480000022e0000o...DBPATH......000001507f.报文长度、用户名、密码位置及结构与Dbeaver登录一样。登录报文长度密码长度用户名用户名长度密码