Wireshark · Ethereal-users: Re: [Ethereal-users] Anyway to add a new column based on informat ion which user wants from the hex

[Guy Harris <guy@xxxxxxxxxxxx>]

And one more step:

8. Add to "fill_in_columns()" in "epan/column-utils.c" a case where, 
for COL_XXX, you set the column's text.  If you only fill it in with 
constant strings, just set "pinfo->cinfo->col_data[i]" to point to the 
appropriate string.  If you fill it in with strings you generate, 
generate them into "pinfo->cinfo->col_buf[i]" with, for example, 
"snprintf()", as is done in other cases in there, and set 
"pinfo->cinfo->col_data[i]" to "pinfo->cinfo->col_buf[i]".

Note that the hex window can have *more than one* set of data in it, if 
any reassembly, decryption, etc. is done on the data.  
"pinfo->data_src" is a GSlist of "data_source" structures (see the GLib 
API documentation:

	http://developer.gnome.org/doc/API/glib/glib-singly-linked-lists.html

for documentation on GSlists).  A "data_source" structure contains a 
pointer to a tvbuff for the data, and a name that is the name for the 
tab in the hex window.  The first data source in the list is the 
link-layer packet data.

To get the raw data for the tvbuff, do

	const guint8 *data;
	guint data_length;

	data_length = tvb_length(tvb)
	data = tvb_get_ptr(tvb, 0, length);

where "tvb" is a pointer to the tvbuff.  "data" will be a pointer to 
the first byte of the data, which will be in a contiguous chunk of 
memory; "data_length" will be the number of bytes of data.