Wireshark-dev: [Wireshark-dev] new dissector - dynamic value string table?
From: Max Baker <max@xxxxxxxxxx>
Date: Tue, 26 Feb 2013 18:37:09 -0800
Hi All,

I've created a new dissector for USB PTP
(http://en.wikipedia.org/wiki/Picture_Transfer_Protocol) .  This is the
protocol most digital cameras speak over USB.   I've gotten far enough
to do the basic dissection, and I'm pretty stoked on the results!

The problem I have now is I have different possible values for a
value_string list, but they are data-dependent.   
Contrived Example :
    0x1 = 'Capture'  if Nikon
    0x1 = 'Erase' if Canon

To get around this I created a new typedef that I call
value_string_masked.  There is a third entry in each row that gives a
mask specifying the type of camera that value is valid for.  Shown in
this snippit:

typedef struct _value_string_masked {
  guint32       mask;
  guint32       value;
  const gchar   *strptr;
} value_string_masked;

static const value_string_masked usb_ptp_dpc_vals[] = {
   {USB_PTP_FLAVOR_NIKON     , 0xd010, "ShootingBank"},
   {USB_PTP_FLAVOR_CANON     , 0xd010, "MeteringMode"}
};


My question regarding creating and using a value_string list on the
fly.   Somewhere in the packet stream I'll figure out if it's a Nikon or
a Canon.

1. I need to store that information in an attribute on the USB host.  
I'm not sure where to store local values with relation to the data
coming from packet-usb.c

2. I need to create a value_string[]  that has only the values that
match my mask, and use that for dissecting.

Can someone recommend an existing dissector I can use as sample code for
this?   
I apologize if this is covered in the dev docs already, I'm still
"drinking from the firehose".

Thanks,
-m