diff options
Diffstat (limited to 'wireshark')
| -rw-r--r-- | wireshark/pictochat.lua | 61 |
1 files changed, 31 insertions, 30 deletions
diff --git a/wireshark/pictochat.lua b/wireshark/pictochat.lua index b64832a..ff6c21f 100644 --- a/wireshark/pictochat.lua +++ b/wireshark/pictochat.lua @@ -18,15 +18,16 @@ local MSG_TYPE = { local MSG_TYPE_MAP = { [MSG_TYPE.INIT] = "Init", -- sent once (init?) - [MSG_TYPE.MSG_START] = "Message start", -- sent before a message packet - [MSG_TYPE.MSG_END] = "Message end", -- sent after multi-frame message body packets - [MSG_TYPE.USER_JOIN] = "User join", -- these packets contain a username - [MSG_TYPE.STATUS] = "Status", -- constantly spammed (status?) + [MSG_TYPE.MSG_START] = "Message start", -- sent before message body and user join + [MSG_TYPE.MSG_END] = "Message end", -- (sometimes) sent after multi-frame message body packets + [MSG_TYPE.USER_JOIN] = "User join", -- contain nickname / message + [MSG_TYPE.STATUS] = "Status", -- constantly spammed, contains room users' addresses [MSG_TYPE.MSG_BODY] = "Message body", -- contains tile data for drawing } p.fields.unknown = ProtoField.uint16("pictochat.unknown", "Unknown") +p.fields.payload_len = ProtoField.uint16("pictochat.payload_len", "Payload length") local function dissect_payload(buffer, pinfo, tree) tree:add_le(p.fields.payload_len, buffer(0x00, 2)) local payload_length = buffer(0x00, 2):le_uint() @@ -45,7 +46,7 @@ dissect_msg_type[MSG_TYPE.MSG_START] = function (buffer, pinfo, tree) payload:add_le(p.fields.msg_start_len, buffer(0x04, 2)) local start_len = buffer(0x04, 2):le_uint() - state.data_remaining = start_len + state.body_remaining = start_len state.buf = ByteArray.new() state.want_next = 0 end @@ -72,64 +73,60 @@ dissect_msg_type[MSG_TYPE.USER_JOIN] = function (buffer, pinfo, tree) bday:add(p.fields.user_bday_day, buffer(0x5b, 1)) end -p.fields.payload_len = ProtoField.uint16("pictochat.payload_len", "Payload length") -p.fields.data_len = ProtoField.uint8("pictochat.data_len", "Data length") -p.fields.data_end = ProtoField.bool("pictochat.data_end", "Data end") -p.fields.data_offset = ProtoField.uint16("pictochat.data_offset", "Data offset") -p.fields.data_sequence = ProtoField.uint16("pictochat.data_sequence", "Data sequence") -p.fields.data = ProtoField.bytes("pictochat.data", "Data") -p.fields.sequence = ProtoField.uint16("pictochat.sequence", "Packet sequence") +p.fields.body_len = ProtoField.uint8("pictochat.body.len", "Length") +p.fields.body_end = ProtoField.bool("pictochat.body.end", "End") +p.fields.body_offset = ProtoField.uint16("pictochat.body.offset", "Offset") +p.fields.body_seq = ProtoField.uint16("pictochat.body.seq", "Sequence") +p.fields.body = ProtoField.bytes("pictochat.body", "Data") dissect_msg_type[MSG_TYPE.MSG_BODY] = function (buffer, pinfo, tree) local payload buffer, payload = dissect_payload(buffer, pinfo, tree) payload:add_le(p.fields.unknown, buffer(0x00, 2)) - payload:add_le(p.fields.data_len, buffer(0x02, 1)) - local data_length = buffer(0x02, 1):le_uint() + payload:add_le(p.fields.body_len, buffer(0x02, 1)) + local body_len = buffer(0x02, 1):le_uint() - payload:add_le(p.fields.data_end, buffer(0x03, 1)) + payload:add_le(p.fields.body_end, buffer(0x03, 1)) -- This appears to be some kind of offset for indicating where to store the -- current frame's data in a larger buffer. Messages sent in multiple parts -- increment this value by 160 for each new original (p.fields.original == -- True) message. - payload:add_le(p.fields.data_offset, buffer(0x04, 2)) - local data_offset = buffer(0x04, 2):le_uint() + payload:add_le(p.fields.body_offset, buffer(0x04, 2)) + local body_offset = buffer(0x04, 2):le_uint() payload:add_le(p.fields.unknown, buffer(0x06, 2)) -- usually 0 buffer = buffer(0x08) -- This appears to be the actual message data (the drawing) sent as an -- array of 8x8 tiles. - payload:add(p.fields.data, buffer(0, data_length)) - if state.want_next == data_offset then - state.want_next = data_offset + data_length - state.data_remaining = state.data_remaining - data_length - state.buf:append(buffer(0, data_length):bytes()) - pinfo.cols.info = "Message body" + payload:add(p.fields.body, buffer(0, body_len)) + if state.want_next == body_offset then + state.want_next = body_offset + body_len + state.body_remaining = state.body_remaining - body_len + state.buf:append(buffer(0, body_len:bytes())) ByteArray.tvb(state.buf, "Complete message") end - buffer = buffer(data_length) + buffer = buffer(body_len) - payload:add_le(p.fields.data_sequence, buffer(0x00, 2)) + payload:add_le(p.fields.body_seq, buffer(0x00, 2)) payload:add_le(p.fields.unknown, buffer(0x02, 2)) -- copy end p.fields.status_addr = ProtoField.bytes("pictochat.status.addr", "Address", base.COLON) +p.fields.status_seq = ProtoField.uint16("pictochat.status.seq", "Sequence") dissect_msg_type[MSG_TYPE.STATUS] = function (buffer, pinfo, tree) local payload buffer, payload = dissect_payload(buffer, pinfo, tree) - payload:add_le(p.fields.unknown, buffer(0x00, 2)) - payload:add_le(p.fields.unknown, buffer(0x02, 2)) + payload:add_le(p.fields.unknown, buffer(0x00, 4)) buffer = buffer(0x04) for _ = 0, 15 do - -- payload:add(p.fields.status_addr, buffer(0, 6)) add_addr_le(payload, p.fields.status_addr, buffer(0, 6)) buffer = buffer(6) end - payload:add_le(p.fields.unknown, buffer(0x00, 2)) + payload:add_le(p.fields.status_seq, buffer(0x00, 2)) payload:add_le(p.fields.unknown, buffer(0x02, 2)) end @@ -139,6 +136,8 @@ p.fields.msg_type = ProtoField.uint8("pictochat.msg_type", "Message type", base. function p.dissector(buffer, pinfo, tree) -- check magic if buffer(0x00, 2):uint() ~= GAMEID.PICTOCHAT then return 0 end + -- check length (avoid errors) + if buffer:len() < 6 then return 0 end local subtree = tree:add(p, buffer(), string.format("%s: %d bytes", p.description, buffer():len())) local buffer_len = buffer():len() @@ -156,7 +155,7 @@ function p.dissector(buffer, pinfo, tree) pinfo.cols.info = msg_type_str end - if msg_type == 0 then + if msg_type == MSG_TYPE.INIT then -- no more content return buffer_len end @@ -168,5 +167,7 @@ function p.dissector(buffer, pinfo, tree) if subdissector ~= nil then subdissector(buffer, pinfo, subtree) end + + return buffer_len end |