local pc = Proto("pictochat", "Nintendo DS PictoChat") pc.fields.unknown = ProtoField.uint16("pictochat.unknown", "Unknown") pc.fields.frame_type = ProtoField.uint16("pictochat.frame_type", "Frame type", base.DEC, { [0] = "Normal", -- Used for actual messages, ack packets [1] = "Announcement", -- TODO: send broadcast??? }) pc.fields.original = ProtoField.bool("pictochat.original", "Original") -- only 0 or 2 pc.fields.msg_type = ProtoField.uint8("pictochat.msg_type", "Message type", base.DEC, { [0] = "???", [1] = "???", [10] = "Message start", -- sent before a message packet [24] = "Message end", -- sent after multi-frame message body packets [48] = "User join", -- these packets contain a username [52] = "Keepalive", -- constantly spammed (keep alive?) [86] = "Message body", -- contains tile data for drawing [184] = "???", -- user leave?? }) pc.fields.length = ProtoField.uint16("pictochat.length", "Length") pc.fields.host = ProtoField.ether("pictochat.host", "Room host") pc.fields.src = ProtoField.ether("pictochat.src", "Source") pc.fields.dst = ProtoField.ether("pictochat.dst", "Destination") pc.fields.payload_len = ProtoField.uint16("pictochat.payload_len", "Payload length") pc.fields.data_len = ProtoField.uint8("pictochat.data_len", "Data length") pc.fields.data_end = ProtoField.bool("pictochat.data_end", "Data end") pc.fields.data_offset = ProtoField.uint16("pictochat.data_offset", "Data offset") pc.fields.data_sequence = ProtoField.uint16("pictochat.data_sequence", "Data sequence") pc.fields.data = ProtoField.bytes("pictochat.data", "Data") pc.fields.sequence = ProtoField.uint16("pictochat.sequence", "Packet sequence") pc.fields.magic_header = ProtoField.bytes("pictochat.magic_header", "Magic (header)") pc.fields.magic_trailer = ProtoField.bytes("pictochat.magic_trailer", "Magic (trailer)") pc.fields.user_mac = ProtoField.ether("pictochat.user.mac", "Address") pc.fields.user_name = ProtoField.string("pictochat.user.name", "Nickname") pc.fields.user_msg = ProtoField.string("pictochat.user.msg", "Message") pc.fields.user_color = ProtoField.uint16("pictochat.user.color", "Color", base.DEC, { [0] = "Gray", [1] = "Brown", [2] = "Red", [3] = "Pink", [4] = "Orange", [5] = "Yellow", [6] = "Lime", [7] = "Green", [8] = "Other green?", [9] = "Cyan", [10] = "Aqua", [11] = "Indigo", [12] = "Purple", [13] = "Violet", [14] = "Hot pink", [15] = "Hotter pink?", }) pc.fields.user_bday_month = ProtoField.uint8("pictochat.user.bday_month", "Month") pc.fields.user_bday_day = ProtoField.uint8("pictochat.user.bday_day", "Day") local nifi_length_field = Field.new("nifi.length") local pc_msg_type_field = Field.new("pictochat.msg_type") local pc_src_field = Field.new("pictochat.src") local pc_dst_field = Field.new("pictochat.dst") function pc.dissector(buffer, pinfo, tree) local header_length = nifi_length_field()() if header_length == 0 then return end buffer = buffer(0x18) -- skip the Ni-Fi header local pc_tree = tree:add(pc, buffer(), "PictoChat: " .. header_length .. " bytes") -- pictochat header local pc_header = pc_tree:add(buffer(0x00, 12), "Header: 12 bytes") pc_header:add_le(pc.fields.frame_type, buffer(0x00, 2)) pc_header:add_le(pc.fields.original, buffer(0x02, 2)) local original = buffer(0x02, 2):le_uint() > 0 pc_header:add_le(pc.fields.unknown, buffer(0x04, 2)) pc_header:add_le(pc.fields.unknown, buffer(0x06, 2)) pc_header:add_le(pc.fields.magic_header, buffer(0x08, 2)) -- const 0x1401 pc_header:add_le(pc.fields.length, buffer(0x0a, 2)) -- above length represents that of the remaining message so this info is -- grouped and the buffer is advanced 12 bytes buffer = buffer(0x0c) pc_tree:add_le(pc.fields.unknown, buffer(0x00, 2)) pc_tree:add_le(pc.fields.unknown, buffer(0x02, 2)) pc_tree:add_le(pc.fields.dst, buffer(0x04, 6)) pc_tree:add_le(pc.fields.src, buffer(0x0a, 6)) pc_tree:add_le(pc.fields.host, buffer(0x10, 6)) pc_tree:add_le(pc.fields.sequence, buffer(0x16, 2)) pc_tree:add_le(pc.fields.unknown, buffer(0x18, 2)) pc_tree:add_le(pc.fields.unknown, buffer(0x1a, 2)) pc_tree:add_le(pc.fields.msg_type, buffer(0x1c, 1)) local msg_type = buffer(0x1c, 1):le_uint() pc_tree:add_le(pc.fields.unknown, buffer(0x1d, 1)) pc_tree:add_le(pc.fields.unknown, buffer(0x1e, 2)) buffer = buffer(0x20) pc_tree:add_le(pc.fields.payload_len, buffer(0x00, 2)) local payload_length = buffer(0x00, 2):le_uint() buffer = buffer(0x02) local payload = pc_tree:add(buffer(0x00, payload_length), "Payload: " .. payload_length .. " bytes") local buffer_next = buffer(payload_length) if msg_type == 48 -- user join then payload:add_le(pc.fields.user_mac, buffer(0x0a, 6)) -- endianness is fucked payload:add(pc.fields.user_name, buffer(0x10, 20), buffer(0x10, 20):le_ustring()) payload:add(pc.fields.user_msg, buffer(0x24, 52), buffer(0x24, 52):le_ustring()) payload:add_le(pc.fields.user_color, buffer(0x58, 2)) payload:add(pc.fields.user_bday_month, buffer(0x5a, 1)) payload:add(pc.fields.user_bday_day, buffer(0x5b, 1)) elseif msg_type == 10 or -- msg start msg_type == 24 or -- msg end msg_type == 86 -- msg body then payload:add_le(pc.fields.unknown, buffer(0x00, 2)) payload:add_le(pc.fields.data_len, buffer(0x02, 1)) local data_length = buffer(0x02, 1):le_uint() payload:add_le(pc.fields.data_end, buffer(0x03, 1)) -- This appears to be some kind of offset for indicating where to store the -- current frame's data in a larger buffer. Messages sent in multiple parts -- increment this value by 160 for each new original (pc.fields.original == -- True) message. payload:add_le(pc.fields.data_offset, buffer(0x04, 2)) payload:add_le(pc.fields.unknown, buffer(0x06, 2)) -- usually 0 buffer = buffer(0x08) -- This appears to be the actual message data (the drawing) sent as an -- array of 8x8 tiles. -- payload:add(pc.fields.data, buffer(0, data_length)) -- buffer = buffer(data_length) payload:add_le(pc.fields.data_sequence, buffer(0x00, 2)) payload:add_le(pc.fields.unknown, buffer(0x02, 2)) -- copy buffer = buffer(0x04) end buffer = buffer_next -- after payload pc_tree:add_le(pc.fields.unknown, buffer(0x00, 2)) pc_tree:add_le(pc.fields.magic_trailer, buffer(0x02, 2)) -- const 0xb8b6 -- pretty wireshark shit pinfo.cols.protocol = pc.name pinfo.cols.src = tostring(pc_src_field()) pinfo.cols.dst = tostring(pc_dst_field()) pinfo.cols.info = pc_msg_type_field().display .. ", " .. (original and "Original" or "Resend") end register_postdissector(pc)