diff options
Diffstat (limited to 'wireshark/pictochat.lua')
| -rw-r--r-- | wireshark/pictochat.lua | 49 |
1 files changed, 45 insertions, 4 deletions
diff --git a/wireshark/pictochat.lua b/wireshark/pictochat.lua index 5eb8089..4927a9b 100644 --- a/wireshark/pictochat.lua +++ b/wireshark/pictochat.lua @@ -1,14 +1,55 @@ local pc = Proto("pictochat", "Nintendo DS PictoChat") +pc.fields.msg_type = ProtoField.uint16("pictochat.msg_type", "Frame type", base.DEC, { + [0] = "Message", + [1] = "???", +}) +pc.fields.resend = ProtoField.uint16("pictochat.resend", "Resend", base.DEC, { + [0] = "Resend", + [2] = "Original", +}) +-- TODO: 6 bytes unknown +pc.fields.length = ProtoField.uint16("pictochat.length", "Message length") +-- TODO: 4 bytes unknown +pc.fields.mp_sender = ProtoField.ether("pictochat.mp_sender", "Multiplayer sender MAC") +pc.fields.sender = ProtoField.ether("pictochat.sender", "Sender MAC") +pc.fields.unknown_counter = ProtoField.uint16("pictochat.unknown_counter", "Unknown counter") +-- TODO: 14 bytes unknown +pc.fields.content_offset = ProtoField.uint16("pictochat.content_offset", "Content offset") +pc.fields.content = ProtoField.bytes("pictochat.content", "Content") +pc.fields.sequence = ProtoField.uint16("pictochat.sequence", "Packet sequence") +pc.fields.unknown_constant = ProtoField.bytes("pictochat.unknown_constant", "unknown_constant") + +local nifi_length_field = Field.new("nifi.length") +local pc_msg_type_field = Field.new("pictochat.msg_type") +local pc_resend_field = Field.new("pictochat.resend") +local pc_sender_field = Field.new("pictochat.sender") function pc.dissector(buffer, pinfo, tree) + local header_length = nifi_length_field()() + if header_length == 0 then return end + + buffer = buffer(0x18) -- skip the Ni-Fi header + + local pc_tree = tree:add(pc, buffer(), "PictoChat: " .. header_length .. " bytes") - local pc_tree = tree:add(pc, buffer(), "PictoChat Message") + pc_tree:add_le(pc.fields.msg_type, buffer(0x00, 2)) + pc_tree:add_le(pc.fields.resend, buffer(0x02, 2)) + pc_tree:add_le(pc.fields.length, buffer(0x0a, 2)) + pc_tree:add_le(pc.fields.mp_sender, buffer(0x10, 6)) + pc_tree:add_le(pc.fields.sender, buffer(0x16, 6)) + pc_tree:add_le(pc.fields.sender, buffer(0x1c, 6)) -- copy + pc_tree:add_le(pc.fields.unknown_counter, buffer(0x22, 2)) + pc_tree:add_le(pc.fields.content_offset, buffer(0x32, 2)) + pc_tree:add(pc.fields.content, buffer(0x36, 0xa0)) + pc_tree:add_le(pc.fields.sequence, buffer(0xd6, 2)) + pc_tree:add_le(pc.fields.resend, buffer(0xd8, 2)) -- copy + pc_tree:add(pc.fields.unknown_constant, buffer(0xda, 4)) pinfo.cols.protocol = pc.name + pinfo.cols.src = tostring(pc_sender_field()) + pinfo.cols.info = pc_msg_type_field().display .. ", " .. pc_resend_field().display end --- no worky -local nifi = DissectorTable.get("nifi.length") -nifi:add('>0', pc) +register_postdissector(pc) |