4

I am trying to write custom dissector for Wireshark, which will change byte/hex output to ASCII string.

I was able to write the body of this dissector and it works. My only problem is conversion of this data to ASCII string.

Wireshark declares this data to be sequence of bytes. To Lua the data type is userdata (tested using type(data)). If I simply convert it to string using tostring(data) my dissector returns 24:50:48, which is the exact hex representation of bytes in an array.

Is there any way to directly convert this byte sequence to ascii, or can you help me convert this colon separated string to ascii string? I am totally new to Lua. I've tried something like split(tostring(data),":") but this returns Lua Error: attempt to call global 'split' (a nil value)


Using Jakuje's answer I was able to create something like this:

function isempty(s)
  return s == nil or s == ''
end
data = "24:50:48:49:4A"
s = ""
for i in string.gmatch(data, "[^:]*") do
    if not isempty( i ) then
        print(string.char(tonumber(i,16)))
        s = s .. string.char(tonumber(i,16))
    end
end
print( s )

I am not sure if this is effective, but at least it works ;)

2 Answers 2

2

There is no such function as split in Lua (consulting reference manual is a good start). You should use probably string.gmatch function as described on wiki:

data = "24:50:48"
for i in string.gmatch(data, "[^:]*") do
  print(i)
end

(live example)

Further you are searching for string.char function to convert bytes to ascii char.

Sign up to request clarification or add additional context in comments.

3 Comments

I saw someone using split in the same way, so I've tried as well. Later I've found out as well, that there is no split in Lua :( I'll try to go your way. First I must skip empty entries of string.gmatch.
are you asking me? I don't see a downvote mark next to this answer. But now I am not sure if i haven't downvoted you by mistake, when I was trying to accept this answer. ofc it was lifted off right away. I am sure it happened to me recently, just not sure if this was this thread/question/answer.
@SoulReaver If you don't see the downvote mark, then it was not you. Its just a general question, if it would happened the down-voter would show up again.
2

You need to mark range of bytes in the buffer that you're interested in and convert it to the type you want:

data:range(offset, length):string()
-- or just call it, which works the same thanks to __call metamethod
data(offset, length):string()

See TvbRange description in https://wiki.wireshark.org/LuaAPI/Tvb for full list of available methods of converting buffer range data to different types.

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.