Wireshark-dev: [Wireshark-dev] Possibility to modify buffer?
From: Christian Gurk <christian.gurk@xxxxxxx>
Date: Wed, 16 Sep 2009 11:00:23 +0200
Hi,
I'm still quite new to using lua as a dissector language. I managed to write a first dissector for our specific messages. The message itself is encrypted so for passing the data to the next layer (dissector) I have to decrypt the data. How do I do that?
My code so far:

function mpiccom7_proto.dissector(buffer,pinfo,tree)

    pinfo.cols.protocol = "com7"	-- fill protocol column

local data = buffer():string() -- string version of the buffer
    local datalen = buffer:len()

    -- fill info pane -----------------------
    local t = tree:add(mpiccom7_proto,buffer())
    t:add(f_len,datalen)
    t:add(f_checksum,buffer(datalen-1,1))

    -- evaluate checksum --------------------
    local framecheck
    framecheck = 0
    for i = 1, data:len()-1     -- for all the chars in buffer string
    do
        framecheck = framecheck + buffer(i,1):uint()
    end
    if framecheck == 0 then 	-- no frameerror! continue!
       t:add(f_frameerror,0)
       ... do some decryption here?!
    else			-- frameerror!
       t:add(f_frameerror,1)
    end
end

That works so far. Now, if the checksum is ok (no frameerror) I would like to decrypt the data and pass it to the next dissector to evaluate the content of the frame further.



--
Christian Gurk
Electronics Working Group / Research & Development
Max-Planck-Insitute for Chemistry, Mainz, Germany
+49-6131-305387 / christian.gurk@xxxxxxx