Jasim Tariq wrote:
I have tried using the function "tvb_get_ephemeral_string" to grab the
complete buffer till the end(using -1 for length) but I get an error in
ethereal that says "Malfunctioned Packet" since I am also using the
buffer to display some other contents of the protocol and after using
this command I cannot access the default buffer "tvb". Nothing is
displayed after that.
Nothing's displayed after that because an exception is thrown, and, once
whatever call you're making tries to get more data from the packet than
is in the packet (which is why you got the "Malformed packet" error),
the exception thrown by that attempt means a longjmp() is done and no
more dissection is done on that packet.
Using the "tvbuff.h" file and its inplementation in "tvbuff.c", I
understand that there are some other functions which will enable me to
create a buffer of type tvbuff_t and then use the "guint8 *realdata"
part of the tvbuff_t obtained to pass into my function. What functions
are those? But this process will require creating another tvbuff_t.
See "dissect_icqv5Client()" in epan/dissectors/packet-icq.c for an
example of code that decrypts data from a tvbuff and constructs a new
tvbuff used to dissect the decrypted data.
I am not using the function "tvb_get_ptr" because there is a comment in
"tvbuff.h" file that says:
* The returned pointer is data that is internal to the tvbuff, so do not
* attempt to free it. Don't modify the data, either, because another tvbuff
* that might be using this tvbuff may have already copied that portion of
* the data (sometimes tvbuff's need to make copies of data, but that's the
* internal implementation that you need not worry about). Assume that the
* guint8* points to read-only data that the tvbuff manages.
What would be a better and effective solution that won't effect the
default tvbuff_t "tvb" in this case. I only need a guint8* to pass into
my function that performs the decompression/decryption.
Use tvb_get_ptr(). You don't need to free that data, and don't need to
modify it, to decompress and decrypt it; you'll be storing the
decompressed, decrypted data in a separate buffer, as you already noted.
