Wireshark · Wireshark-dev: Re: [Wireshark-dev] displaying more than 32 bits

[Andreas <AndreasSander1@xxxxxxx>]

Am 06.03.2011 15:50, schrieb Yosi Saggi:
> Hi everybody
>
> I have a payload  that its size is 42 bits. I am getting it from the TVB
> in little Endian.
>
> I have no problem displaying the whole payload as big endian with a
> guint 64bit variable:
>
> guint32  f2_val1, f2_val2;
> guint64 f2_val;
>
> f2_val1 = tvb_get_letohl(tvb, *plen)
> f2_val2 = tvb_get_letohl(tvb, (*plen+4));
> f2_val = f2_val1;
> f2_val= (f2_val<<32);
> f2_val = f2_val|f2_val2;

> Are threr any suggestions what can I use to display it correctly. As I
> have seen that "proto_tree_add_bits_ret_val", although having a "big
> endian/little endian" operand, that "little endian" is not implemented
> yet.


If you have a big endian number, than the high part should be *plen, the 
lower part (*plen)+4 not (*plen+4). The latter is plen[4].

suggestions:

- Check the (*plen+4) term.
- Check that your 32 bit variables have the expected values.
- Check your variable names ;-) I got confused while trying to reproduce 
it since with the names f2_val and f2_val2. If the code above is not 
literally from your dissector but "simplified" you probably also have 
done this failure.

--
Andy