Wireshark · Wireshark-dev: [Wireshark-dev] Extract bytes from a tvbuff_t

[Rion Carter <rion@xxxxxxxxxx>]

Hi,

I'm trying to extract raw bytes from a tvbuff_t and am not having much luck. As a simple test I have code which tries to extract the bytes and write it to a file. When I compile and run I get an output file with only 4 bytes in it when I know there is more (extracting certificates).

Here is what I've got. Any help is appreciated:

guint8* extracted = (guint8*)ep_tvb_memdup(tvb, 0, -1);

fwrite(extracted, size of extracted), 1, file);

It's been awhile since I used c file io, and I'm pretty new to Wireshark dev. I may be missing obvious or going about this in the wrong fashion.

Rion