Question

我正在开发wireshark中的插件以获取专有协议。我有以下3种结构来定义协议的特征。

static const value_string packettypenames[] = { /* MAIN COMMAND */  
    {0x01,"FALO_PWRL_CMD"},                 /* 0x01  */  
    {0x02,"FALO_CALLABLE_CMD"},             /* 0x02  */  
    {0x03,"FALO_CORTEX_DATA_CMD"},      /* 0x03 */  
    {0x04,"FALO_LOCAL_CMD"}             /* 0x04 */  
    } 

static const calue_string packettypesubnames_falo_pwrl_cmd[]={/* SUBCOMMAND BASED */     
    {0x01, "FALO_PWRL_PREF_PLMN"},                      /*ON SELECTED MAIN COMMAND */  
    {0x02 ,"FALO_PWRL_PLMN_SEL"}  
}  

static const calue_string packettypesubnames_falo_callable_cmd[]={  /* SUBCOMMAND */  
    {0x01, "FALO_PWRL_PREF_PLMN"},            /*based ON SELECTED MAIN COMMAND */  
    {0x02 ,"FALO_PWRL_PLMN_SEL"}  
}

存储在hf_register数组中的结构和格式信息如下：

void proto_register_talo(void)  
{  
    static hf_register_info hf[] = {  
        { &hf_talo_main_command,  
            { "Talo Main Command", "talo.command",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypenames) , 0x0,  
            NULL, HFILL }  
        },  
        { &hf_ipc_sub_command,  
            { "Talo Sub Command", "talo.subcommand",  
            FT_UINT8, BASE_HEX,  
            VALS(packetsubtypenames), 0x0,   /* STUCK AT THIS POINT */  
            NULL, HFILL }  
        }  
};

此处，子命令的格式信息基于main命令的值。有没有办法获得这样的东西，所以第二个字段子命令的值可以根据主命令中的值来决定？

感谢您的帮助， Mrunal

Answer 1

您可以执行以下操作：

void proto_register_talo(void)  
{  
    static hf_register_info hf[] = {  
        { &hf_talo_main_command,  
            { "Talo Main Command", "talo.command",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypenames) , 0x0,  
            NULL, HFILL }  
        },  
        { &hf_ipc_sub_command_pwrl,  
            { "Talo Sub Command", "talo.subcommand",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypesubnames_falo_pwrl_cmd), 0x0,     
            NULL, HFILL }  
        }  
        { &hf_ipc_sub_command_callable,  
            { "Talo Sub Command", "talo.subcommand",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypesubnames_falo_callable_cmd), 0x0,
            NULL, HFILL }  
        }  

};

然后在你的剖析函数中：

switch(header_type) {
    case 1:
      hf_sub_command = hf_ipc_sub_command_pwrl;
      break;
    case 2:
      hf_sub_command = hf_ipc_sub_command_callable;
      break;
    }
proto_tree_add_item(tree, hf_sub_command, tvb, offset, 1, FALSE);

Wireshark解剖器：显示依赖于解剖树中前一个字段值的字段

1 个答案: