Ask Your Question
0

Masked ProtoField.uint64 differences between 4.2 and 3.6

asked 2024-07-11 18:45:45 +0000

zvonler gravatar image

Hello, I developed a dissector that works under Wireshark 4.2 but now need it to run under 3.6, and am stuck on one of the differences between the versions.

I have some uint64 ProtoFields that represent 44-bit values so they use masks (i.e. they provide a non-nil 5th parameter to ProtoField.uint64) to get their values from an 8-byte range. In 4.2, the masks work when they are defined like UInt64.new(xxx, yyy), but in 3.6 that causes an error "bad argument #5 to 'uint64' (number expected, got userdata)". I tried using string masks instead with 3.6 (e.g. "0xyyyxxx") but the behavior then is that the ProtoFields appear to lose the upper bits of their values, so e.g. the field's value ends up 0x000000000a050000 instead of the correct 0x0000157c4a050000.

An example mask (that works in 4.2) is UInt64.new(0xFFFFFFB0, 0x0003FFFF). Is there a way to express that mask in a way that Wireshark 3.6 will do the right thing with a uint64 ProtoField? Is there some other way I could populate the 44-bit ProtoFields by doing the masking manually?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
1

answered 2024-07-11 22:36:32 +0000

zvonler gravatar image

In case it helps anyone else, I got something that works in both 3.6 and 4.2 by doing a manual mask and shift of the TVB range bytes, and by using TreeItem:add() instead of TreeItem:add_packet_field().

Given a ProtoField pf, a tvb range, a UInt64 mask and a number shift, the following gets the right values for the fields in both Wireshark and tshark:

local item = tree:add(pf, range:uint64():band(mask):rshift(shift))

The byte highlighting in Wireshark doesn't work with this approach since the protofield is added with a value directly.

edit flag offensive delete link more

Comments

Chuckc gravatar imageChuckc ( 2024-07-11 23:55:06 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-07-11 18:45:45 +0000

Seen: 130 times

Last updated: Jul 11