3

I'm coding Wireshark Dissector lua script now.

How to convert userdata to hex string?
I want to get output like this 0102030405060708000a0b0c0d0e0f10

I can convert hex string using tostring.
But it omits long data. Output Image

How to convert userdata to hex string without omit long data?

proto = Proto("Test", "My Test Protocol")

function proto.dissector(buffer, pinfo, tree)
  print(tostring(buffer()))
  -- "userdata"
  -- print(type(buffer()))
end

tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1234, proto)

Environment

  • Wireshark 3.2.1

1 Answer 1

3

I'm not very familiar with Wireshark, but from a quick look into the manual I get that buffer is a Tvb

and buffer() is equivalent to buffer:range() which returns a TvbRange

There is a Tvb:__tostring function which claims to

Convert the bytes of a Tvb into a string. This is primarily useful for debugging purposes since the string will be truncated if it is too long.

Printing a TvbRange is truncated to 24 bytes.

I'd try to get a ByteArray from your Tvb and obtain the hex string of that ByteArray using

11.8.1.14. bytearray:tohex([lowercase], [separator]) Obtain a Lua string of the bytes in a ByteArray as hex-ascii, with given separator

So your code might look something like

proto = Proto("Test", "My Test Protocol")
function proto.dissector(buffer, pinfo, tree)
  print(buffer:bytes():tohex())
  -- or print(buffer():bytes():tohex())
  -- but I guess if you don't give a range in buffer()
  -- it will be pretty much the same as buffer.
end
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.