CODEWITHSUNDEEP
luawiresharkwireshark-dissectorlua-userdata
bugggy
bugggy

Reputation: 338

Convert Userdata to hex in Wireshark Dissector

I'm coding Wireshark Dissector lua script now.

How to convert userdata to hex string?
I want to get output like this 0102030405060708000a0b0c0d0e0f10

I can convert hex string using tostring.
But it omits long data. Output Image

How to convert userdata to hex string without omit long data?

proto = Proto("Test", "My Test Protocol")

function proto.dissector(buffer, pinfo, tree)
  print(tostring(buffer()))
  -- "userdata"
  -- print(type(buffer()))
end

tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1234, proto)

Environment

Upvotes: 3

Views: 3058

Answers (1)

Piglet
Piglet

Reputation: 28950

I'm not very familiar with Wireshark, but from a quick look into the manual I get that buffer is a Tvb

and buffer() is equivalent to buffer:range() which returns a TvbRange

There is a Tvb:__tostring function which claims to

Convert the bytes of a Tvb into a string. This is primarily useful for debugging purposes since the string will be truncated if it is too long.

Printing a TvbRange is truncated to 24 bytes.

I'd try to get a ByteArray from your Tvb and obtain the hex string of that ByteArray using

11.8.1.14. bytearray:tohex([lowercase], [separator]) Obtain a Lua string of the bytes in a ByteArray as hex-ascii, with given separator

So your code might look something like

proto = Proto("Test", "My Test Protocol")
function proto.dissector(buffer, pinfo, tree)
  print(buffer:bytes():tohex())
  -- or print(buffer():bytes():tohex())
  -- but I guess if you don't give a range in buffer()
  -- it will be pretty much the same as buffer.
end

Upvotes: 3

Related Questions