From 4565b793d666f93cf34de445fb5ff5a6e66e5f7a Mon Sep 17 00:00:00 2001 From: Loek Le Blansch Date: Wed, 28 Aug 2024 17:37:58 +0200 Subject: more WIP --- wireshark/ieee.lua | 45 +++++++++++++++++++++++++++++---------------- 1 file changed, 29 insertions(+), 16 deletions(-) (limited to 'wireshark/ieee.lua') diff --git a/wireshark/ieee.lua b/wireshark/ieee.lua index bbdc397..97000db 100644 --- a/wireshark/ieee.lua +++ b/wireshark/ieee.lua @@ -2,6 +2,7 @@ require "util" local bit = require "bit" local p = Proto("ieee", "IEEE802.11 frame header") +local dslmp = DissectorTable.new("dslmp") -- DS Local Multi-Player -- based off @@ -28,17 +29,19 @@ p.fields.ctl_data = ProtoField.bool("ieee.ctl.data", "More data", base.DEC, nil, p.fields.ctl_wep = ProtoField.bool("ieee.ctl.wep", "WEP encrypt", base.DEC, nil, bits(14)) p.fields.ctl_order = ProtoField.bool("ieee.ctl.order", "Order", base.DEC, nil, bits(15)) -p.fields.duration = ProtoField.uint16("ieee.duration", "Duration / ID") +p.fields.duration = ProtoField.uint16("ieee.duration", "Duration / ID", base.HEX, nil, 0xffff) p.fields.addr1 = ProtoField.ether("ieee.addr1", "Address 1") p.fields.addr2 = ProtoField.ether("ieee.addr2", "Address 2") p.fields.addr3 = ProtoField.ether("ieee.addr3", "Address 3") p.fields.seq = ProtoField.uint16("ieee.seq", "Sequence control") p.fields.seq_frag = ProtoField.uint16("ieee.seq.frag", "Fragment", base.DEC, nil, bits(0, 4)) p.fields.seq_num = ProtoField.uint16("ieee.seq.num", "Sequence number", base.DEC, nil, bits(4, 12)) - p.fields.body = ProtoField.bytes("ieee.body", "Body") - -local pc_dissector = Dissector.get("pictochat") +p.fields.gameid = ProtoField.uint16("ieee.gameid", "Game ID", base.HEX, { + [GAMEID.PICTOCHAT] = "PictoChat", + [GAMEID.MARIOKART] = "Mario Kart DS", +}) +p.fields.fcs = ProtoField.bytes("ieee.fcs", "FCS (hardware only)") function p.dissector(buffer, pinfo, tree) local buffer_len = buffer:len() @@ -48,17 +51,16 @@ function p.dissector(buffer, pinfo, tree) -- pretty wireshark shit pinfo.cols.protocol = p.name - -- MAC header is (usually) 0x18 bytes, but also sometimes contains values in - -- the trailer. The 0x18 here is so wireshark only highlights the MAC header - -- when clicking this item in the dissection tree. + -- The 0x18 here is so wireshark only highlights the header when clicking + -- this item in the dissection tree. local subtree = tree:add(p, buffer(0x00, 0x18), p.description) - local trailer_size = 0 local ctl_tree = subtree:add_le(p.fields.ctl, buffer(0x00, 2)) ctl_tree:add_le(p.fields.ctl_ver, buffer(0x00, 2)) ctl_tree:add_le(p.fields.ctl_type, buffer(0x00, 2)) local ctl_type = bit.rshift(bit.band(buffer(0x00, 2):le_uint(), bits(2, 2)), 2) ctl_tree:add_le(p.fields.ctl_subtype, buffer(0x00, 2)) + local ctl_subtype = bit.rshift(bit.band(buffer(0x00, 2):le_uint(), bits(4, 4)), 4) ctl_tree:add_le(p.fields.ctl_to_ds, buffer(0x00, 2)) ctl_tree:add_le(p.fields.ctl_from_ds, buffer(0x00, 2)) ctl_tree:add_le(p.fields.ctl_fragment, buffer(0x00, 2)) @@ -76,21 +78,32 @@ function p.dissector(buffer, pinfo, tree) seq_tree:add_le(p.fields.seq_frag, buffer(0x16, 2)) seq_tree:add_le(p.fields.seq_num, buffer(0x16, 2)) - if ctl_type ~= 0 then - trailer_size = 4 -- Frame Check Sequence (FCS) (hardware-generated CRC32) + buffer = buffer(0x18) -- seek forward + + local fcs = true -- Frame Check Sequence (FCS) (hardware-generated CRC32) + if ctl_type == 0 then + fcs = false end - buffer = buffer(0x18) -- seek forward + local body_size = buffer:len() + if fcs == true then + body_size = body_size - 4 + end - local body_size = buffer:len() - trailer_size subtree:add(p.fields.body, buffer(0, body_size)) - pc_dissector:call(buffer(0, body_size):tvb(), pinfo, tree) - if trailer_size == 0 then - return buffer_len + -- Type = 2 (Data frame) and Subtype = 2 (Data + CF-Poll) + if ctl_type == 2 and ctl_subtype == 2 then + subtree:add(p.fields.gameid, buffer(0, 2)) + local gameid = buffer(0, 2):uint() + dslmp:try(gameid, buffer(0, body_size):tvb(), pinfo, tree) end - buffer = buffer(body_size) + if fcs == true then + buffer = buffer(body_size) + subtree:add(p.fields.fcs, buffer(0, 4)) + end return buffer_len end + -- cgit v1.2.3