Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Convert Userdata to hex in Wireshark Dissector

I'm coding Wireshark Dissector lua script now.

How to convert userdata to hex string?
I want to get output like this 0102030405060708000a0b0c0d0e0f10

I can convert hex string using tostring.
But it omits long data. Output Image

How to convert userdata to hex string without omit long data?

proto = Proto("Test", "My Test Protocol")

function proto.dissector(buffer, pinfo, tree)
  print(tostring(buffer()))
  -- "userdata"
  -- print(type(buffer()))
end

tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1234, proto)

Environment

  • Wireshark 3.2.1
like image 926
bugggy Avatar asked Oct 20 '25 09:10

bugggy


1 Answers

I'm not very familiar with Wireshark, but from a quick look into the manual I get that buffer is a Tvb

and buffer() is equivalent to buffer:range() which returns a TvbRange

There is a Tvb:__tostring function which claims to

Convert the bytes of a Tvb into a string. This is primarily useful for debugging purposes since the string will be truncated if it is too long.

Printing a TvbRange is truncated to 24 bytes.

I'd try to get a ByteArray from your Tvb and obtain the hex string of that ByteArray using

11.8.1.14. bytearray:tohex([lowercase], [separator]) Obtain a Lua string of the bytes in a ByteArray as hex-ascii, with given separator

So your code might look something like

proto = Proto("Test", "My Test Protocol")
function proto.dissector(buffer, pinfo, tree)
  print(buffer:bytes():tohex())
  -- or print(buffer():bytes():tohex())
  -- but I guess if you don't give a range in buffer()
  -- it will be pretty much the same as buffer.
end
like image 199
Piglet Avatar answered Oct 22 '25 03:10

Piglet



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!