Wireshark · Wireshark-dev: Re: [Wireshark-dev] Possibility to modify buffer?

[Reinhard Speyerer <rspmn@xxxxxxxx>]

Guy Harris wrote:

> You would need to allocate a new tvbuff, and a blob big enough to hold  
> all the decrypted data, and decrypt the data into the blob and attach  
> that blob to the tvbuff, and hand *that* tvbuff to the next  
> dissector.  You cannot modify the data in a tvbuff handed to you.
> 
> I don't know the details of how to do that in a Lua dissector.

I use the following Lua code for this (SyncML example):

        local xmltvb = ByteArray.new(hexxml):tvb("application/vnd.syncml+wbxml")
        local subtree = tree:add(rls_syncml_wbxml_proto, xmltvb())
        syncml_xml_dissector:call(xmltvb, pinfo, subtree)

where hexxml contains the XML in hex ("3C...") and syncml_xml_dissector is

  local syncml_xml_dissector = Dissector.get("xml")

Regards,
Reinhard