local pc = Proto("pictochat", "Nintendo DS PictoChat") pc.fields.msg_type = ProtoField.uint16("pictochat.msg_type", "Frame type", base.DEC, { [0] = "Message", [1] = "???", }) pc.fields.resend = ProtoField.uint16("pictochat.resend", "Resend", base.DEC, { [0] = "Resend", [2] = "Original", }) -- TODO: 6 bytes unknown pc.fields.length = ProtoField.uint16("pictochat.length", "Message length") -- TODO: 4 bytes unknown pc.fields.mp_sender = ProtoField.ether("pictochat.mp_sender", "Multiplayer sender MAC") pc.fields.sender = ProtoField.ether("pictochat.sender", "Sender MAC") pc.fields.unknown_counter = ProtoField.uint16("pictochat.unknown_counter", "Unknown counter") -- TODO: 14 bytes unknown pc.fields.content_offset = ProtoField.uint16("pictochat.content_offset", "Content offset") pc.fields.content = ProtoField.bytes("pictochat.content", "Content") pc.fields.sequence = ProtoField.uint16("pictochat.sequence", "Packet sequence") pc.fields.unknown_constant = ProtoField.bytes("pictochat.unknown_constant", "unknown_constant") local nifi_length_field = Field.new("nifi.length") local pc_msg_type_field = Field.new("pictochat.msg_type") local pc_resend_field = Field.new("pictochat.resend") local pc_sender_field = Field.new("pictochat.sender") function pc.dissector(buffer, pinfo, tree) local header_length = nifi_length_field()() if header_length == 0 then return end buffer = buffer(0x18) -- skip the Ni-Fi header local pc_tree = tree:add(pc, buffer(), "PictoChat: " .. header_length .. " bytes") pc_tree:add_le(pc.fields.msg_type, buffer(0x00, 2)) pc_tree:add_le(pc.fields.resend, buffer(0x02, 2)) pc_tree:add_le(pc.fields.length, buffer(0x0a, 2)) pc_tree:add_le(pc.fields.mp_sender, buffer(0x10, 6)) pc_tree:add_le(pc.fields.sender, buffer(0x16, 6)) pc_tree:add_le(pc.fields.sender, buffer(0x1c, 6)) -- copy pc_tree:add_le(pc.fields.unknown_counter, buffer(0x22, 2)) pc_tree:add_le(pc.fields.content_offset, buffer(0x32, 2)) pc_tree:add(pc.fields.content, buffer(0x36, 0xa0)) pc_tree:add_le(pc.fields.sequence, buffer(0xd6, 2)) pc_tree:add_le(pc.fields.resend, buffer(0xd8, 2)) -- copy pc_tree:add(pc.fields.unknown_constant, buffer(0xda, 4)) pinfo.cols.protocol = pc.name pinfo.cols.src = tostring(pc_sender_field()) pinfo.cols.info = pc_msg_type_field().display .. ", " .. pc_resend_field().display end register_postdissector(pc)