more WIP

1 files changed, 29 insertions, 16 deletions

diff --git a/wireshark/ieee.lua b/wireshark/ieee.lua
index bbdc397..97000db 100644
--- a/wireshark/ieee.lua
+++ b/wireshark/ieee.lua
@@ -2,6 +2,7 @@ require "util"
 local bit = require "bit"
 
 local p = Proto("ieee", "IEEE802.11 frame header")
+local dslmp = DissectorTable.new("dslmp") -- DS Local Multi-Player
 
 -- based off <https://www.problemkaputt.de/gbatek.htm#dswifiieee80211frames>
 
@@ -28,17 +29,19 @@ p.fields.ctl_data = ProtoField.bool("ieee.ctl.data", "More data", base.DEC, nil,
 p.fields.ctl_wep = ProtoField.bool("ieee.ctl.wep", "WEP encrypt", base.DEC, nil, bits(14))
 p.fields.ctl_order = ProtoField.bool("ieee.ctl.order", "Order", base.DEC, nil, bits(15))
 
-p.fields.duration = ProtoField.uint16("ieee.duration", "Duration / ID")
+p.fields.duration = ProtoField.uint16("ieee.duration", "Duration / ID", base.HEX, nil, 0xffff)
 p.fields.addr1 = ProtoField.ether("ieee.addr1", "Address 1")
 p.fields.addr2 = ProtoField.ether("ieee.addr2", "Address 2")
 p.fields.addr3 = ProtoField.ether("ieee.addr3", "Address 3")
 p.fields.seq = ProtoField.uint16("ieee.seq", "Sequence control")
 p.fields.seq_frag = ProtoField.uint16("ieee.seq.frag", "Fragment", base.DEC, nil, bits(0, 4))
 p.fields.seq_num = ProtoField.uint16("ieee.seq.num", "Sequence number", base.DEC, nil, bits(4, 12))
-
 p.fields.body = ProtoField.bytes("ieee.body", "Body")
-
-local pc_dissector = Dissector.get("pictochat")
+p.fields.gameid = ProtoField.uint16("ieee.gameid", "Game ID", base.HEX, {
+	[GAMEID.PICTOCHAT] = "PictoChat",
+	[GAMEID.MARIOKART] = "Mario Kart DS",
+})
+p.fields.fcs = ProtoField.bytes("ieee.fcs", "FCS (hardware only)")
 
 function p.dissector(buffer, pinfo, tree)
 	local buffer_len = buffer:len()
@@ -48,17 +51,16 @@ function p.dissector(buffer, pinfo, tree)
 	-- pretty wireshark shit
 	pinfo.cols.protocol = p.name
 
-	-- MAC header is (usually) 0x18 bytes, but also sometimes contains values in
-	-- the trailer. The 0x18 here is so wireshark only highlights the MAC header
-	-- when clicking this item in the dissection tree.
+	-- The 0x18 here is so wireshark only highlights the header when clicking
+	-- this item in the dissection tree.
 	local subtree = tree:add(p, buffer(0x00, 0x18), p.description)
-	local trailer_size = 0
 
 	local ctl_tree = subtree:add_le(p.fields.ctl, buffer(0x00, 2))
 		ctl_tree:add_le(p.fields.ctl_ver, buffer(0x00, 2))
 		ctl_tree:add_le(p.fields.ctl_type, buffer(0x00, 2))
 		local ctl_type = bit.rshift(bit.band(buffer(0x00, 2):le_uint(), bits(2, 2)), 2)
 		ctl_tree:add_le(p.fields.ctl_subtype, buffer(0x00, 2))
+		local ctl_subtype = bit.rshift(bit.band(buffer(0x00, 2):le_uint(), bits(4, 4)), 4)
 		ctl_tree:add_le(p.fields.ctl_to_ds, buffer(0x00, 2))
 		ctl_tree:add_le(p.fields.ctl_from_ds, buffer(0x00, 2))
 		ctl_tree:add_le(p.fields.ctl_fragment, buffer(0x00, 2))
@@ -76,21 +78,32 @@ function p.dissector(buffer, pinfo, tree)
 		seq_tree:add_le(p.fields.seq_frag, buffer(0x16, 2))
 		seq_tree:add_le(p.fields.seq_num, buffer(0x16, 2))
 
-	if ctl_type ~= 0 then
-		trailer_size = 4 -- Frame Check Sequence (FCS) (hardware-generated CRC32)
+	buffer = buffer(0x18) -- seek forward
+
+	local fcs = true -- Frame Check Sequence (FCS) (hardware-generated CRC32)
+	if ctl_type == 0 then
+		fcs = false
 	end
 
-	buffer = buffer(0x18) -- seek forward
+	local body_size = buffer:len()
+	if fcs == true then
+		body_size = body_size - 4
+	end
 
-	local body_size = buffer:len() - trailer_size
 	subtree:add(p.fields.body, buffer(0, body_size))
-	pc_dissector:call(buffer(0, body_size):tvb(), pinfo, tree)
 
-	if trailer_size == 0 then
-		return buffer_len
+	-- Type = 2 (Data frame) and Subtype = 2 (Data + CF-Poll)
+	if ctl_type == 2 and ctl_subtype == 2 then
+		subtree:add(p.fields.gameid, buffer(0, 2))
+		local gameid = buffer(0, 2):uint()
+		dslmp:try(gameid, buffer(0, body_size):tvb(), pinfo, tree)
 	end
 
-	buffer = buffer(body_size)
+	if fcs == true then
+		buffer = buffer(body_size)
+		subtree:add(p.fields.fcs, buffer(0, 4))
+	end
 
 	return buffer_len
 end
+