Wireshark-dev: Re: [Wireshark-dev] Possibility to modify buffer?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 16 Sep 2009 18:33:56 -0700

On Sep 16, 2009, at 2:00 AM, Christian Gurk wrote:


That works so far. Now, if the checksum is ok (no frameerror) I would
like to decrypt the data and pass it to the next dissector to evaluate
the content of the frame further.
You would need to allocate a new tvbuff, and a blob big enough to hold all the decrypted data, and decrypt the data into the blob and attach that blob to the tvbuff, and hand *that* tvbuff to the next dissector. You cannot modify the data in a tvbuff handed to you. 

I don't know the details of how to do that in a Lua dissector.