 | 1 | initial version |
I can grab data using the offset,length method for some items but others shift one or two bytes so i can't rely on it. Can you clarify what you mean by this?
If you're trying to add fields to the tree, you can just use
tree:add(p_foo.some_field, buffer(offset, len))
… where the offset is just the offset to the field, which you may need to keep track of as you add fields, and where len is the number of bytes in the buffer comprising the field and could be a fixed value, but not necessarily.
Did you try looking at the various examples on the wiki, such as dissector.lua from the Lua/Examples wiki page?
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.