Wireshark · Ethereal-users: Re: [Ethereal-users] Parsing WBXML

["Olivier Biot (Ethereal)" <ethereal@xxxxxxxxxxxxxxx>]

Hello Jimmy,

 

WAP is already 1 year ago for me, but let's inspect your trace.

 

You can always convert hex data into a dummy packet with the text2pcap utility that ships with Ethereal. In order to do so very easily, just separate the hex bytes with a single space, and prepend that single line with "0: " meaning "at offset zero, the following bytes are: ".

 

For your convenience I did this for the sample bytes you sent in your message (make sure they get on ONE single line):

0: 06 04 03 AE 81 EA 02 05 6A 00 45 C6 0B 03 63 75 73 74 6F 6D 65 72 2E 73 69 74 65 70 68 65 6E 74 65 20 64 69 6E 20 67 72 61 74 69 73 20 72 69 6E 67 65 74 6F 6E 65 20 6D 71

Write this data as plain text in a text file, say "push_in.txt".

 

Then run text2pcap as follows for connectionless WSP (destination port 9200, dummy source port 10000):

$ ./text2pcap.exe -u 10000,9200 push_in.txt push_in.pcap

 

Finally run Ethereal or tethereal with that file.

 

As I am rebuilding Ethereal, I did the WSP and WBXML dissection by hand:

 

00: WSP Transaction identifier

 

06: WSP Push (unconfirmed)

04: Headers length in bytes (uintvar-integer) = 4 bytes

03 ae 81 ea: Content-Type: application/vnd.wap.sic (0x2e encoded as well-known-content-type); charset=UTF-8

 

WBXML content follows:

 

02: WBXML/1.2

05: Public identifier: "-//WAPFORUM//DTD SI 1.0//EN (Service Indication 1.0)"

6A: Charset in the WBXML/1.2 document: uintvar-integer 0x6a = UTF-8

00: Length of the string table: uintvar-integer 0x00 = 0 bytes (meaning no string table)

[sTAG] 45: Opening tag with content, no attributes : <si>

[sTAG] C6: Opening tag with attributes and content: <indication

[ATTR] 0B: Attribute start: href="">

03: Inline string follows:

63 75 73 74 6F 6D 65 72 2E 73 69 74 65 70 68 65 6E 74 65 20 64 69 6E 20 67 72 61 74 69 73 20 72 69 6E 67 65 74 6F 6E 65 20 6D 71

    "customer.sitephente din gratis ringetone mq"

 

==> This is an invalid URL for the href attribute, but worse, the push message is incorrectly encoded from there on, I suspect.

 

Cheers!

 

Olivier

----- Original Message -----

From: Jimmy

To: ethereal-users@xxxxxxxxxxxx

Sent: Sunday, September 04, 2005 2:29 PM

Subject: [Ethereal-users] Parsing WBXML

Hi

 

I have found the page: http://wiki.ethereal.com/WAP_Binary_XML

 

but I am unable to locate any information as to how I can parse an encoded WBXML-document.

 

Here is the data part from two SMS:

00060403AE81EA02056A0045C60B03637573746F6D65722E7369746570

68656E74652064696E206772617469732072696E6765746F6E65206D71

 

When they are concatenated in the phone, they form a WAP PUSH link.

 

However, I cannot see anywhere in man tethereal or on the above mentioned webpage where I should insert the hex strings?

 

Thanks in advance,

Jimmy

---

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users