more fiddling (found plain text!)

3 files changed, 42 insertions, 34 deletions

diff --git a/wireshark/nifi-dissect.lua b/wireshark/nifi-dissect.lua
deleted file mode 100644
index 98520e5..0000000
--- a/wireshark/nifi-dissect.lua
+++ /dev/null
@@ -1,32 +0,0 @@
-proto = Proto("NIFI", "Nintendo DS ni-fi")
-
-MAGIC = ProtoField.uint32("nifi.magic", "Magic", base.HEX)
-SENDERID = ProtoField.int32("nifi.senderid", "SenderID", base.DEC)
-TYPE = ProtoField.uint32("nifi.type", "Type", base.DEC)
-LENGTH = ProtoField.uint32("nifi.length", "Length", base.DEC)
-TIMESTAMP = ProtoField.uint64("nifi.timestamp", "Timestamp", base.DEC)
-
-proto.fields = {
-	MAGIC,
-	SENDERID,
-	TYPE,
-	LENGTH,
-	TIMESTAMP,
-}
-
-function proto.dissector(buffer, pinfo, tree)
-	-- check magic ("NIFI")
-	if buffer(0, 4):uint() ~= 0x4e494649 then return end
-
-	pinfo.cols.protocol = proto.name
-
-	local subtree = tree:add(proto, buffer(), "Ni-Fi data")
-
-	subtree:add(MAGIC, buffer(0, 4))
-	subtree:add_le(SENDERID, buffer(4, 4))
-	pinfo.cols.src = tostring(buffer(4, 4):le_int())
-	subtree:add_le(TYPE, buffer(8, 4))
-	subtree:add_le(LENGTH, buffer(12, 4))
-	subtree:add_le(TIMESTAMP, buffer(16, 8))
-end
-
diff --git a/wireshark/nifi.lua b/wireshark/nifi.lua
new file mode 100644
index 0000000..d81ff31
--- /dev/null
+++ b/wireshark/nifi.lua
@@ -0,0 +1,40 @@
+-- NOTE: my system is little-endian, so the .pcap files and this decoder expect
+-- little endian
+
+local nifi = Proto("nifi", "Nintendo DS ni-fi")
+nifi.fields.magic = ProtoField.uint32("nifi.magic", "Magic", base.HEX)
+nifi.fields.senderid = ProtoField.int32("nifi.senderid", "SenderID", base.DEC)
+nifi.fields.type = ProtoField.new("Type", "nifi.type", ftypes.UINT32)
+nifi.fields.type_enum = ProtoField.uint16("nifi.type.enum", "Numeric message type enum", base.DEC, {
+	[0] = "Regular",
+	[1] = "CMD",
+	[2] = "Reply",
+	[3] = "ACK",
+})
+nifi.fields.type_aid = ProtoField.uint16("nifi.type.aid", "Message type \"aid\" value")
+nifi.fields.length = ProtoField.uint32("nifi.length", "Length", base.DEC)
+nifi.fields.timestamp = ProtoField.uint64("nifi.timestamp", "Timestamp", base.DEC)
+
+local nifi_senderid_field = Field.new("nifi.senderid")
+local nifi_type_enum_field = Field.new("nifi.type.enum")
+
+function nifi.dissector(buffer, pinfo, tree)
+	-- check magic ("NIFI")
+	if buffer(0, 4):uint() ~= 0x4e494649 then return end
+	local nifi_tree = tree:add(nifi, buffer(), "Ni-Fi data")
+	nifi_tree:add(nifi.fields.magic, buffer(0, 4))
+
+	nifi_tree:add_le(nifi.fields.senderid, buffer(4, 4))
+
+	local nifi_type_tree = nifi_tree:add_le(nifi.fields.type, buffer(8, 4))
+		nifi_type_tree:add_le(nifi.fields.type_enum, buffer(8, 2))
+		nifi_type_tree:add_le(nifi.fields.type_aid, buffer(10, 2))
+
+	nifi_tree:add_le(nifi.fields.length, buffer(12, 4))
+	nifi_tree:add_le(nifi.fields.timestamp, buffer(16, 8))
+
+	pinfo.cols.protocol = nifi.name
+	pinfo.cols.src = nifi_senderid_field().display
+	pinfo.cols.info = "type:" .. nifi_type_enum_field().display
+end
+
diff --git a/wireshark/wireshark b/wireshark/wireshark
index b871ea3..42c37a5 100755
--- a/wireshark/wireshark
+++ b/wireshark/wireshark
@@ -1,5 +1,5 @@
 #!/bin/sh
-# simple wrapper to load nifi-dissect script as DLT_USER0 dissecter
+# simple wrapper to load nifi.lua script as DLT_USER0 dissecter
 here="$(dirname "$0")"
-exec wireshark -X "lua_script:$here/nifi-dissect.lua" -o 'uat:user_dlts:"User 0 (DLT=147)","nifi","","","",""' "$@"
+exec wireshark -X "lua_script:$here/nifi.lua" -o 'uat:user_dlts:"User 0 (DLT=147)","nifi","","","",""' "$@"