Wireshark-users: Re: [Wireshark-users] How to re-assemble contents of a USB upload?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Svenn Are Bjerkem <svenn.bjerkem@xxxxxxxxxxxxxx>
Date: Tue, 28 Jun 2011 23:30:16 +0200
On 28 June 2011 23:14, Svenn Are Bjerkem <svenn.bjerkem@xxxxxxxxxxxxxx> wrote:
> tshark -r capfile -R "usb.transfer_type == 2 && usb.data_len == 512"
> -T fields -e usb.capdata

Eager to test my new knowledge, I found that using
-e usb.setup.wValue -e usb.capdata
nicely gave me the base address in front of each chunk.

I also tested with usb.bmRequestType == 0x40 instead of usb.data_len
== 512, but that also gave me the final CPU release which fxload sends
after end of hex file. At least I know what to do.

Cheers,
-- 
Svenn