Wireshark · Ethereal-dev: [ethereal-dev] New Dissector for Sinec H1

["Gerrit Gehnen" <G.Gehnen@xxxxxxxx>]

Hello,

attached the promised dissector for the Sinec H1 protocol (aka
Siemens Industrial Ethernet) for communication with Siemens S5 PLC's
over Ethernet.
Btw.: The communication standard for the new S7 PLC's is not documented
by Siemens but we have made some investigations and found some details.
What is the official policy on reverse engineering of protocols?

I think, that you have to look at the RCS-Id at the beginning of
the packet-h1.c, because i have no practice with RCS-Id's.....

In addition the packet-osi.c dissector is enhanced by decoding of
the version number ressource in the COPT-Protocol and the detection
of plain-text TSAP's.

  Gerrit Gehnen



-- 
Dr.-Ing. Gerrit Gehnen      Abt. LT
ATR Industrie-Elektronik    Textilstraße 2, 41751 Viersen, Germany
Tel. (+49)2162 485-362      Fax (+49)2162 485-100
http://www.atrie.de

*** packet-osi.c.org	Tue Feb  1 05:56:32 2000
--- packet-osi.c	Thu Feb 24 08:42:06 2000
***************
*** 42,47 ****
--- 42,48 ----
  
  #include <stdio.h>
  #include <string.h>
+ #include <ctype.h>
  #include <glib.h>
  #include "packet.h"
  #include "nlpid.h"
***************
*** 417,423 ****
    } /* tree */
  
    offset += li + 1;
!   dissect_data(pd, offset, fd, tree);
  
    return 0;
  
--- 418,424 ----
    } /* tree */
  
    offset += li + 1;
!   dissect_h1(pd, offset, fd, tree);
  
    return 0;
  
***************
*** 608,613 ****
--- 609,616 ----
    static gchar  str[3][MAX_TSAP_LEN * 2 + 1];
    static gchar *cur;
    gchar tmp[3];
+   int allprintable;
+   int i;
  
    if (cur == &str[0][0]) {
      cur = &str[1][0];
***************
*** 617,630 ****
      cur = &str[0][0];
    }
  
-   /* to do: test if all bytes are printable */
  
    cur[0] = '\0';
    if (length <= 0 || length > MAX_TSAP_LEN) 
      sprintf(cur, "<unsupported TSAP length>");
    else {    
      while (length != 0) {
!       sprintf(tmp, "%02x", *tsap ++);
        strcat(cur, tmp);
        length --;
      }
--- 620,645 ----
      cur = &str[0][0];
    }
  
  
    cur[0] = '\0';
    if (length <= 0 || length > MAX_TSAP_LEN) 
      sprintf(cur, "<unsupported TSAP length>");
    else {    
+     allprintable=TRUE;
+     for (i=0;i<length;i++) {
+ 	if (!isprint(tsap[i])) { // if any byte is not printable	
+ 	  allprintable=FALSE;    // switch to hexdump
+ 	  break;
+ 	  }	 
+ 	}
+     if (!allprintable){
+       strcat(cur,"0x");
+       }
      while (length != 0) {
!       if (allprintable)
! 	sprintf(tmp, "%c", *tsap ++);
!       else
! 	sprintf(tmp, "%02x", *tsap ++);
        strcat(cur, tmp);
        length --;
      }
***************
*** 706,712 ****
  			      "Parameter length: 0x%02x", length);
  	  proto_tree_add_text(cotp_tree, 
  			      offset +  P_VAR_PART_CC + i + 2, length, 
! 			      "Calling TSAP: 0x%s", 
  			      print_tsap(&pd[offset + P_VAR_PART_CC + i + 2],
  					 length));
  	  i += length + 2;
--- 721,727 ----
  			      "Parameter length: 0x%02x", length);
  	  proto_tree_add_text(cotp_tree, 
  			      offset +  P_VAR_PART_CC + i + 2, length, 
! 			      "Calling TSAP: %s", 
  			      print_tsap(&pd[offset + P_VAR_PART_CC + i + 2],
  					 length));
  	  i += length + 2;
***************
*** 721,727 ****
  			      "Parameter length: 0x%02x", length);
  	  proto_tree_add_text(cotp_tree, 
  			      offset +  P_VAR_PART_CC + i + 2, length, 
! 			      "Called TSAP: 0x%s", 
  			      print_tsap(&pd[offset + P_VAR_PART_CC + i + 2],
  					 length));
  	  i += length + 2;
--- 736,742 ----
  			      "Parameter length: 0x%02x", length);
  	  proto_tree_add_text(cotp_tree, 
  			      offset +  P_VAR_PART_CC + i + 2, length, 
! 			      "Called TSAP: %s", 
  			      print_tsap(&pd[offset + P_VAR_PART_CC + i + 2],
  					 length));
  	  i += length + 2;
***************
*** 866,875 ****
  			      "Priority: %d", s);
  	  i += length + 2;
  	  break;
  
  	case VP_REASSIGNMENT: 	  /* todo */
  	case VP_RES_ERROR   :
- 	case VP_VERSION_NR  :
  	case VP_PROTECTION  :
  	case VP_PROTO_CLASS :
  	default             :	  /* no decoding */
--- 881,904 ----
  			      "Priority: %d", s);
  	  i += length + 2;
  	  break;
+ 	
+ 	case VP_VERSION_NR  :
+ 	  length = pd[offset + P_VAR_PART_CC + i + 1];
+ 	  c1 = pd[offset + P_VAR_PART_CC + i + 2];
+ 	  proto_tree_add_text(cotp_tree, 
+ 			      offset +  P_VAR_PART_CC + i, 1, 
+ 			      "Parameter code: 0x%02x (version)", code);
+ 	  proto_tree_add_text(cotp_tree, 
+ 			      offset +  P_VAR_PART_CC + i + 1, 1, 
+ 			      "Parameter length: 0x%02x", length);
+ 	  proto_tree_add_text(cotp_tree, 
+ 			      offset +  P_VAR_PART_CC + i + 2, length,
+ 			      "Version: %d", c1);
+ 	  i += length + 2;
+ 	  break;
  
  	case VP_REASSIGNMENT: 	  /* todo */
  	case VP_RES_ERROR   :
  	case VP_PROTECTION  :
  	case VP_PROTO_CLASS :
  	default             :	  /* no decoding */

Attachment: packet-h1.c
Description: application/unknown-content-type-cfile