Wireshark-dev: Re: [Wireshark-dev] Idea for process image dissection
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 14 Oct 2013 11:40:24 -0700
On Oct 13, 2013, at 1:17 AM, Roland Knall <rknall@xxxxxxxxx> wrote:

> For such a dissection, we need to tell a dissector, how to dissect a
> specific payload.
> 
> I would like to implement a new field type (FT_PIMAGE) and allow the
> user using a dialog, to specify a filter and a mapping to dissect the
> field.

Would the payload consist either of one big FT_PIMAGE field or a sequence of nothing but FT_PIMAGE fields?

If so, then...

> For instance one definition might be:

...another definition might be

	http://wsgd.free.fr

if the goal is to avoid requiring C/C++ code to be written to dissect the payload.

Adding a UI to allow construction of wsgd descriptions would be useful here.

> The definition for each field mapping must be also session specific,
> as it will definitely change between dissections.

Multiple registered wsgd descriptions, and a session-specific selection of a description, should handle that.