Does WireShark use developer plugins?

asked 2023-06-26 13:53:00 +0000

Mininno
1 ●2

updated 2023-06-26 14:43:27 +0000

I believe the answer is no, if no then my hackers have added the plugin to the Wireshark application. I also show an alias version of Wireshark downloaded 4 days after I downloaded from Wireshark and that's when this plugin was implemented. I have zero control over my Apple MacBook Air as well as my iPhone and my children iPhone. Apple only will suggest to reset everything but I can't even open a file without the admin login which they changed my passwords for. So if anyone would like to investigate the activity I am describing please review the attachment. I have tried IC3 reports the local sheriff and no one will deal with it even though I can show access to my accounts and remote services to all devices. It's like a military operation to sum it up.

the file is encrypted for the most part but you can read what I am trying to ask. pg.2 shows the ipv6 Lengthspacket_lengthsDelineated Pg.3-4 shows the plug-in information. Pg.7 shows WireShark Developer

Thank you Mininno I apparently cannot upload the PDF so I will copy and paste some items.

Page 2.

RangeRange of packet sizes to countipip_hostsip_srcdstptypedestsipv6ipv6_hostsipv6_srcdstipv6_ptypei pv6_destsframeplenstat_treeStats TreePacket Lengthspacket_lengthsDelineated packet sizes to countIPv4 Statistics/ All AddressesIPv4 Statistics/Source and Destination AddressesSource IPv4 AddressesDestination IPv4 AddressesIPv4 Statistics/IP Protocol TypesIPv4 Statistics/Destinations and Ports%uIPv6 Statistics/All AddressesIPv6 Statistics/Source and Destination AddressesSource IPv6 AddressesDestination IPv6 AddressesIPv6 Statistics/IP Protocol TypesIPv6 Statistics/Destinations and Ports%u and greaterInvalid range string,,ARBRDQ@_uat_fld_chk_rangeQrê@dyld_stub_binderqêr@_address_to_s trêr@_g_freeêr@_g_strdupêr@_g_strndupêr @_port_type_to_strêr(@_prefs_register_statêr0@_prefs_register_uat_pref erenceêr8@_range_convert_rangeêr@@_range_convert_strêrH@_range_copyêrP @_snprintfêrX@_stats_tree_create_nodeêr@_stats_tree_create_pivotêrh@_ stats_tree_create_range_node_stringêrp@_stats_tree_manip_node_intêrx@_ stats_tree_register_pluginêrÄ@_stats_tree_register_with_groupêrà@_stat s_tree_tick_pivotêrê@_stats_tree_tick_rangeêrò@_strlenêr†@_tap_registe r_pluginêr®@_uat_add_recordêr∞@_uat_newêr∏@_wmem_allocêr¿@_wmem_freeêr »@_wmem_strdup_printfê_plugin_ register)version.want_m3åXúyajorAinorF§y®yåXúTX§0Ãú@(0§0Ãú@(0hÄ4LZ

Page 3-4

‰ ̇+Pkáßæ’›Ú*5I≥¥μ∂∑∏π∫aoΩæø¿¡¬√ƒ≈∆«» ÀÃÕŒ≥¥μ∂∑∏π∫aoΩæø¿¡¬√ƒ≈∆«» ÀÃÕ _plugin_register_plugin_version_plugin_want_major_plugin_want_minor_ad dress_to_str_g_free_g_strdup_g_strndup_port_type_to_str_prefs_register _stat_prefs_register_uat_preference_range_convert_range_range_convert_str_range_copy_snprintf_stats_tree_create_node_stats_tree_create_pivot _stats_tree_create_range_node_string_stats_tree_manip_node_int_stats_t ree_register_plugin_stats_tree_register_with_group_stats_tree_tick_piv ot_stats_tree_tick_range_strlen_tap_register_plugin_uat_add_record_uat _fld_chk_range_uat_new_wmem_alloc_wmem_free_wmem_strdup_printfdyld_stu b_binder_register_tap_listener_pinfo_stat_tree_uat_plen_records_packet _range_set_cb_uat_plen_records_packet_range_tostr_cb_ipv4_hosts_stats_ tree_packet_ipv4_hosts_stats_tree_init_ipv4_srcdst_stats_tree_packet_i pv4_srcdst_stats_tree_init_ipv4_ptype_stats_tree_packet_ipv4_ptype_sta ts_tree_init_ipv4_dsts_stats_tree_packet_ipv4_dsts_stats_tree_init_ipv 6_hosts_stats_tree_packet_ipv6_hosts_stats_tree_init_ipv6_srcdst_stats _tree_packet_ipv6_srcdst_stats_tree_init_ipv6_ptype_stats_tree_packet_ ipv6_ptype_stats_tree_init_ipv6_dsts_stats_tree_packet_ipv6_dsts_stats _tree_init_plen_stats_tree_packet_plen_stats_tree_init_uat_plen_record _copy_cb_uat_plen_record_update_cb_uat_plen_record_free_cb_uat_plen_re cord_post_update_cb__dyld_private_register_tap_listener_pinfo_stat_tre e.plen_uat_flds_st_node_ipv4_st_node_ipv4_src_st_node_ipv4_dst_st_node _ipv4_ptype_st_node_ipv4_dsts_st_node_ipv6_st_node_ipv6_src_st_node_ip v6_dst_st_node_ipv6_ptype_st_node_ipv6_dsts_default_range_plugin_regis ter.plug_pinfo_stat_tree_uat_plen_records_num_plen_uat_plen_uat_dsts_s tats_tree_packet.str/Users/tuexen/builds/MyoG7mz2/0/wireshark/ wireshark/build/plugins/epan/stats_tree/plugin.c/Users/tuexen/builds/ MyoG7mz2/0/wireshark/wireshark/build/plugins/epan/stats_tree/ CMakeFiles/stats_tree.dir/ plugin.c.o_plugin_register_plugin_version_plugin_want_major_plugin_wan t_minor_plugin_register.plug_pinfo_stat_tree/Users/tuexen/builds/ MyoG7mz2/0/wireshark/wireshark/plugins/epan/stats_tree/ pinfo_stats_tree.c/Users/tuexen/builds/MyoG7mz2/0/wireshark/wireshark/ build/plugins/epan/stats_tree/CMakeFiles/stats_tree.dir/ pinfo_stats_tree.c.o_register_tap_listener_pinfo_stat_tree_uat_plen_re cords_packet_range_set_cb_uat_plen_records_packet_range_tostr_cb_ipv4_ hosts_stats_tree_packet_ipv4_hosts_stats_tree_init_ipv4_srcdst_stats_t ree_packet_ipv4_srcdst_stats_tree_init_ipv4_ptype_stats_tree_packet_ip v4_ptype_stats_tree_init_ipv4_dsts_stats_tree_packet_ipv4_dsts_stats_t ree_init_ipv6_hosts_stats_tree_packet_ipv6_hosts_stats_tree_init_ipv6_ srcdst_stats_tree_packet_ipv6_srcdst_stats_tree_init_ipv6_ptype_stats_ tree_packet_ipv6_ptype_stats_tree_init_ipv6_dsts_stats_tree_packet_ipv 6_dsts_stats_tree_init_plen_stats_tree_packet_plen_stats_tree_init_uat _plen_record_copy_cb_uat_plen_record_update_cb_uat_plen_record_free_cb _uat_plen_record_post_update_cb_register_tap_listener_pinfo_stat_tree. plen_uat_flds_st_node_ipv4_st_node_ipv4_src_st_node_ipv4_dst_st_node_i pv4_ptype_st_node_ipv4_dsts_st_node_ipv6_st_node_ipv6_src_st_node_ipv6 _dst_st_node_ipv6_ptype_st_node_ipv6_dsts_default_range_uat_plen_recor ds_num_plen_uat_plen_uat_dsts_stats_tree_packet.str ̇fi ¿'‡,»‡ ̇fi ‰$fi y@ org.wireshark.stats_tree7Z6EMTD2C6∏oHfiâ(Óf(¡fiæ‰|∆I&ö ̋IoÜeßôrâc∂O ◊€SõDñ2’) ̈'TM›Æ ̊‚4%£ ̄ëÒ°T÷‡»¡%wBPflnéK ̨•Vd934m⁄-‚μ≠ ̈≤Xo∆Èf¿◊——kOXˇ|¥| zÖ⁄ΩãHâ,ßv\é ̧©?Á‰”Ø_G¥∞»JÏPvL§>∆±iä ̧ë@[v‹Û¬ƒÂ~ñ'x’+NÄGy≤ØÍ€...

Page 7. 0y1-0+U $Developer ID Certification Authority1&0$U Apple Certification Authority10U Apple Inc.1 0 UUS0 181004211216Z 231005211216Z0ÅØ10 í&âìÚ,d 7Z6EMTD2C61J0HU ADeveloper ID Application: Wireshark Foundation, Inc. (7Z6EMTD2C6)10U 7Z6EMTD2C61#0!U Wireshark Foundation, Inc.1 0 UUS0Ç"0 ... (more)

edit retag flag offensive close merge delete

Comments

Please post the contents of the dialog produced from the menu option Help -> About Wireshark -> Wireshark using the handy "Copy to Clipboard" button.

It would also be handy to know the plugins loaded in your copy of Wireshark, they can be viewed in the Plugins tab of the dialog referred to above, or if you want a list, using the command tshark -G plugins from a command prompt.

grahamb ( 2023-06-26 14:08:04 +0000 )edit

Hello grahamb,
I appoligize for the duplicate post and the lack of details. The question that is now closed by another admin shows some of the plug-ins I'm asking about. Unfortunately I can't access any files or utilities on the Mac . What I uploaded was from a email pdf copy . It's 11 pages long.

Mininno ( 2023-06-26 14:20:43 +0000 )edit

I've no idea what you've attempted to post there. Is there a problem with the instructions from my previous comment?

grahamb ( 2023-06-26 15:12:08 +0000 )edit

What do you mean by "developer plugins"? Wireshark does support plugins in several places.

Guy Harris ( 2023-06-26 23:21:24 +0000 )edit

What I uploaded was from a email pdf copy .

What is it a PDF copy of? (And how did you copy it?)

Guy Harris ( 2023-06-26 23:22:48 +0000 )edit

see more comments

answered 2023-06-27 21:57:07 +0000

Guy Harris
19890 ●3 ●659 ●207

I downloaded Wireshark on 6-2-23

...

The hack has total control of my MacBook, my iPhone and the iPhones and computers of my 2 kids. This has been goin on now for multiple years

OK, so the hack has nothing to do with Wireshark, unless you installed Wireshark several years ago; Wireshark is only involved in an attempt to see if any network traffic to and from your machine might have something to do with the hack.

The best thing to do about the hack is to take your machines (Mac and iPhones) to the Genius Bar at an Apple Store, or to a third-party Apple support service, and show the people there exactly what's happening. For example, since you "can't even open a file without the admin login which they changed my passwords for", show them exactly what happens when you try to open a file, and show them that the admin password that you had no longer works. Similarly, show them what the problems are with the iPhones.

Directly showing somebody the problem, rather than describing it over the phone to some tech support person, makes it a lot more immediately obvious what the problem is, so that they can give a better answer than just "reset everything".

So I looked at the plug-in file within the Wireshark package and found the plug in that I posted a few pdf pages from.

Yes, we do ship some plugins as part of Wireshark, so the answer to the question "does Wireshark use plugins" is "yes", not "no".

None of the plugins are PDFs; we do not ship any PDFs with Wireshark. I don't know what "download the plugin as a PDF" means; for one thing, the plugin in question isn't a separate download, it's part of Wireshark, and, for another thing, the plugin isn't a PDF, so at most you could give it a name that ends with ".pdf", but that doesn't make it into a PDF. (If I make a copy of that plugin, and give it a name that ends with ".pdf", neither Preview on Ventura, nor Acrobat Reader, will read it; they report it as being damaged, which really means "isn't even a PDF file" in this case.)

The stuff you posted looks like binary code files, which is what the Wireshark application, its libraries, and its compiled plugins are.

Some of the text that showed up in the file comes from text strings in the code for the plugin. In particular, "Range of packet sizes to count" is in the "Packet Lengths" plugin (Statistics > Packet Lengths), so that's the plugin you looked at - /Applications/Wireshark.app/Contents/PlugIns/wireshark/4-0/epan/stats_tree.so, in the standard Wireshark 4.0 installation.

Other text corresponds to names of routines in various Wireshark libraries that are called by the plugin, so that the code in macOS that programs and library routines uses to load plugins can make the calls ... (more)

edit flag offensive delete link

add a comment

Does WireShark use developer plugins?

Comments

2 Answers

Your Answer

Question Tools

Stats

Related questions

Does WireShark use developer plugins? edit

Comments

2 Answers

Your Answer

Question Tools

Stats

Related questions

Does WireShark use developer plugins?