#!/usr/bin/env python3
"""
Extract last byte from each packet
"""

import struct

def parse_pcap_with_data(filename):
    with open(filename, 'rb') as f:
        f.read(24)
        packets = []
        
        while True:
            packet_header = f.read(16)
            if len(packet_header) < 16:
                break
            
            ts_sec, ts_usec, incl_len, orig_len = struct.unpack('IIII', packet_header)
            packet_data = f.read(incl_len)
            if len(packet_data) < incl_len:
                break
            
            packets.append(packet_data)
        
        return packets

packets = parse_pcap_with_data('sniffed.pcap')

print(f"Total packets: {len(packets)}\n")

# Extract last byte from each packet
print("=" * 80)
print("LAST BYTE OF EACH PACKET:")
print("=" * 80)

last_bytes = []
for i, pkt in enumerate(packets):
    if len(pkt) > 0:
        last_byte = pkt[-1]
        last_bytes.append(last_byte)
        char = chr(last_byte) if 32 <= last_byte <= 126 else f"[{last_byte}]"
        if i < 50:  # Print first 50
            print(f"Packet {i+1:3d}: 0x{last_byte:02x} = {last_byte:3d} -> {char}")

# Decode as ASCII
message = ''.join([chr(b) if 32 <= b <= 126 else '?' for b in last_bytes])
print(f"\n{'=' * 80}")
print("MESSAGE FROM LAST BYTES:")
print("=" * 80)
print(message)

if 'HTB{' in message:
    start = message.find('HTB{')
    end = message.find('}', start) + 1
    flag = message[start:end]
    print(f"\n🚩🚩🚩 FLAG FOUND: {flag} 🚩🚩🚩")
elif '}' in message:
    # Flag might be reversed
    reversed_msg = message[::-1]
    print(f"\nReversed: {reversed_msg}")
    if 'HTB{' in reversed_msg:
        start = reversed_msg.find('HTB{')
        end = reversed_msg.find('}', start) + 1
        flag = reversed_msg[start:end]
        print(f"\n🚩🚩🚩 FLAG FOUND (REVERSED): {flag} 🚩🚩🚩")