4 ms·
Automatic generation of wireshark dissectors would be amazing. I wrote a few in Lua, but it still felt second class citizen to built-in C dissectors, loading t
by ysleepy 5y ago
Automatic generation of wireshark dissectors would be amazing.
I wrote a few in Lua, but it still felt second class citizen to built-in C dissectors, loading them was annoying and the UI to use them was too.
A good dissector will annotate fields with semantic meaning and group and nest them, giving wireshark the precise bit offset+length where a value came from.
Those are some different requirements than other parsers and reuse is therefore a bit difficult.
- woodrowbarlow 5y agopreach! by the way: wireshark can load ASN.1 source files directly. https://www.wireshark.org/docs/wsdg_html_chunked/CreatingAsn1Dissectors.html https://www.wireshark.org/docs/wsdg_html_chunked/CreatingAsn...
- hombre_fatal 5y agoWould something like this help? https://github.com/joushx/kaitai-to-wireshark https://github.com/joushx/kaitai-to-wireshark Happened to just see this article when reading Kaitai docs: https://www.incibe-cert.es/en/blog/understanding-industrial-network-traffic-dissectors-and-lua-and-kaitai https://www.incibe-cert.es/en/blog/understanding-industrial-... I was checking out Kaitai the other day (generate binary parsers from declarative structures) and noticed its tutorials section has great content on reverse-engineering binary formats with it: https://doc.kaitai.io https://doc.kaitai.io. Might be interesting to anyone interested in OP's question. I like the first blog link that reverses the binary format of one of those interactive anime novels from an .exe: https://hackernoon.com/reverse-engineering-visual-novels-101-d0bc3bf7ab8 https://hackernoon.com/reverse-engineering-visual-novels-101... Really cool walkthrough of how to do such a thing regardless of whether you use Kaitai to do it.