easylinux/cam-reverse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cleanup dissector

Browse Source
This commit is contained in:
DavidVentura
2024-02-01 16:25:30 +01:00
parent 94070b6e33
commit cfbdeaa0d0
1 changed files with 50 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dissector.lua
+17 -16
View File
@@ -4,7 +4,7 @@ ilnk_proto = Proto("iLnkP2P", "iLnk")
-- Define the fields you want to display in Wireshark -- Define the fields you want to display in Wireshark
ilnk_proto.fields = {} ilnk_proto.fields = {}
ilnk_proto.fields.type = ProtoField.string("iLnkP2P.type", "Type") ilnk_proto.fields.type = ProtoField.string("iLnkP2P.type", "Type")
ilnk_proto.fields.payload = ProtoField.bytes("iLnkP2P.payload", "Payload") -- ilnk_proto.fields.payload = ProtoField.bytes("iLnkP2P.payload", "Payload")
ilnk_proto.fields.len = ProtoField.uint16("iLnkP2P.len", "Packet length", base.HEX) ilnk_proto.fields.len = ProtoField.uint16("iLnkP2P.len", "Packet length", base.HEX)
ilnk_proto.fields.m_type = ProtoField.uint8("iLnkP2P.m_type", "Stream type", base.HEX) ilnk_proto.fields.m_type = ProtoField.uint8("iLnkP2P.m_type", "Stream type", base.HEX)
@@ -19,8 +19,7 @@ ilnk_proto.fields.cmd_dest = ProtoField.uint16("iLnkP2P.cmd_dest", "Dest", bas
ilnk_proto.fields.auth_token = ProtoField.bytes("iLnkP2P.auth_token", "CMD auth token", base.DASH) ilnk_proto.fields.auth_token = ProtoField.bytes("iLnkP2P.auth_token", "CMD auth token", base.DASH)
ilnk_proto.fields.cmd_payload = ProtoField.bytes("iLnkP2P.payload", "CMD Payload", base.DASH) ilnk_proto.fields.cmd_payload = ProtoField.bytes("iLnkP2P.payload", "CMD Payload", base.DASH)
-- jpeg | audio | continuation type? -- jpeg | audio | continuation type?
-- ilnk_proto.fields.cmd_payload = ProtoField.bytes("iLnkP2P.payload", "Payload", base.DASH) ilnk_proto.fields.data_payload = ProtoField.bytes("iLnkP2P.data_payload", "Data Payload", base.DASH)
-- ilnk_proto.fields.cmd_payload = ProtoField.bytes("iLnkP2P.payload", "Payload", base.DASH)
ilnk_proto.fields.encrypted = ProtoField.bool("iLnkP2P.encrypted", "Encrypted") ilnk_proto.fields.encrypted = ProtoField.bool("iLnkP2P.encrypted", "Encrypted")
ilnk_proto.fields.cmd_type = ProtoField.string("iLnkP2P.cmd_type", "Cmd Pkt Type") ilnk_proto.fields.cmd_type = ProtoField.string("iLnkP2P.cmd_type", "Cmd Pkt Type")
@@ -75,28 +74,30 @@ function ilnk_proto.dissector(buffer, pinfo, tree)
if packetname == "Drw" then if packetname == "Drw" then
local b_pkt_len = buffer(2, 2) local b_pkt_len = buffer(2, 2)
local pkt_len = b_pkt_len:uint() local pkt_len = b_pkt_len:uint()
local is_data_packet = buffer(5, 1):uint() == 1
subtree:add(ilnk_proto.fields.len, b_pkt_len) subtree:add(ilnk_proto.fields.len, b_pkt_len)
subtree:add(ilnk_proto.fields.m_type, buffer(4, 1)) subtree:add(ilnk_proto.fields.m_type, buffer(4, 1))
subtree:add(ilnk_proto.fields.m_stream_id, buffer(5, 1)) subtree:add(ilnk_proto.fields.m_stream_id, buffer(5, 1))
subtree:add(ilnk_proto.fields.pkt_seq, buffer(6, 2)) subtree:add(ilnk_proto.fields.pkt_seq, buffer(6, 2))
subtree:add_le(ilnk_proto.fields.start, buffer(8, 2))
subtree:add_le(ilnk_proto.fields.cmd, buffer(0xa, 2))
local b_payload_len = buffer(0xc, 2) local b_payload_len = buffer(0xc, 2)
local payload_len = buffer(0xc, 2):le_uint() local payload_len = buffer(0xc, 2):le_uint()
if not is_data_packet then
subtree:add_le(ilnk_proto.fields.start, buffer(8, 2))
subtree:add_le(ilnk_proto.fields.cmd, buffer(0xa, 2))
subtree:add_le(ilnk_proto.fields.cmd_payload_len, b_payload_len)
subtree:add_le(ilnk_proto.fields.cmd_dest, buffer(0xe, 2))
-- inline value for short-payload bytes
subtree:add(ilnk_proto.fields.auth_token, buffer(0x10, 4))
if buffer(0xb, 1):uint() % 2 == 1 then if buffer(0xb, 1):uint() % 2 == 1 then
cmdtype = "ack" cmdtype = "ack"
else else
cmdtype = "cmd" cmdtype = "cmd"
end end
subtree:add_le(ilnk_proto.fields.cmd_payload_len, b_payload_len)
subtree:add_le(ilnk_proto.fields.cmd_dest, buffer(0xe, 2))
-- inline value for short-payload bytes
subtree:add(ilnk_proto.fields.auth_token, buffer(0x10, 4))
subtree:add(ilnk_proto.fields.cmd_type, cmdtype):set_generated() subtree:add(ilnk_proto.fields.cmd_type, cmdtype):set_generated()
subtree:add(ilnk_proto.fields.encrypted, payload_len >= 5):set_generated() subtree:add(ilnk_proto.fields.encrypted, payload_len >= 5):set_generated()
if payload_len >= 5 then if payload_len >= 5 then
local payload = buffer(0x14, payload_len - 4) local payload = buffer(0x14, payload_len - 4)
local dec_payload = ByteArray.new() local dec_payload = ByteArray.new()
@@ -125,10 +126,10 @@ function ilnk_proto.dissector(buffer, pinfo, tree)
local payload_tvb = ByteArray.tvb(buffer(0x14, payload_len -4):bytes(), "CMD Payload") local payload_tvb = ByteArray.tvb(buffer(0x14, payload_len -4):bytes(), "CMD Payload")
subtree:add(ilnk_proto.fields.cmd_payload, payload_tvb:range(0, payload_len -4)) subtree:add(ilnk_proto.fields.cmd_payload, payload_tvb:range(0, payload_len -4))
end end
else
-- local payload_tvb = ByteArray.tvb(buffer(8, packet_length-8):bytes(), "Data Payload")
-- subtree:add(ilnk_proto.fields.cmd, buffer(0xc, 2)) subtree:add(ilnk_proto.fields.data_payload, payload_tvb:range(0, packet_length-8))
end
end end
-- AvcLIB = src/IpcSession.cpp, line 1113, CmdSndProc:BATC609531EXLVS[0:0:10] now CmdSend[start=a11,cmd=1032,len=4,dest=0]=12 -- AvcLIB = src/IpcSession.cpp, line 1113, CmdSndProc:BATC609531EXLVS[0:0:10] now CmdSend[start=a11,cmd=1032,len=4,dest=0]=12
-- UDP PKT SEND Drw (0xf1d0) -- UDP PKT SEND Drw (0xf1d0)
@@ -136,7 +137,7 @@ function ilnk_proto.dissector(buffer, pinfo, tree)
-- 00000000 f1 d0 00 10 d1 00 00 04 11 0a 32 10 04 00 00 00 ..........2..... -- 00000000 f1 d0 00 10 d1 00 00 04 11 0a 32 10 04 00 00 00 ..........2.....
-- 00000010 50 70 77 35 Ppw5 -- 00000010 50 70 77 35 Ppw5
subtree:add(ilnk_proto.fields.payload, buffer(2, packet_length-2)) -- subtree:add(ilnk_proto.fields.payload, buffer(2, packet_length-2))
end end
udp_table = DissectorTable.get("udp.port"):add(49512, ilnk_proto) udp_table = DissectorTable.get("udp.port"):add(49512, ilnk_proto)