First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Filtering text before adding to tree

  • retag add tags

I'm trying to filter some ebcdic text before translating and adding to an item.

At the moment I'm simply doing

t_body:add_packet_field(f_message_body, buffer(offsetBody), ENC_EBCDIC)

but the text contains legitimate non-printable characters, such as x00 (which ends the printed string) and 0x15 (which prints as \u0015), amongst others, that I'd like to translate to a period before adding them.

I think I can build a translate table using something like:

printableEbcdic = {}
for i=0, 255 do
  printableEbcdic[i] = i
end
printableEbcdic[0] = 0x4b
printableEbcdic[0x15] = 0x4b

I seem to be able to get the raw bytes by doing:

local message_bytes = buffer(offsetBody):bytes()
print("mb: (".. message_bytes:len() .. ") " .. tostring(message_bytes) )

But then I'm at a loss how to proceed. A test loop fails as the byte is being translated to nil:

for i=1, message_bytes:len() do
    local byteBefore = message_bytes:raw(i-1,1)
    print("before: " .. byteBefore)

    local byteAfter = printableEbcdic[byteBefore]
    print("after: " .. byteAfter)
end

Lua Error: ...ads\WiresharkPortable64-development\Data\plugins\pao.lua:131: attempt to concatenate local 'byteAfter' (a nil value)

which suggests that lua is not using the index into the translation table in the way I'm expecting.

Another issue I'm concerned about is that add_packet_field() expects a tvbrange in order to highlight the bytes on the packet hex dump, but if I translate them to something else, how do I inform wireshark to identify the range correctly?

Any suggestions of how to get this working -- and preferably more efficiently than using a loop -- would be much appreciated.

IanW's avatar
3
IanW
asked 2022-10-07 13:12:37 +0000, updated 2022-10-07 13:49:49 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Try replacing this line:

local byteBefore = message_bytes:raw(i-1,1)

With this one:

local byteBefore = message_bytes:get_index(i - 1)
cmaynard's avatar
11.1k
cmaynard
answered 2022-10-13 23:36:06 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer