Wireshark-users: Re: [Wireshark-users] Reading a zero-terminated string in Lua dissector
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 04 Jun 2012 14:26:22 -0400
Carsten Fuchs wrote:

Hi Jeff,

thanks for your reply.

Am 2012-06-01 23:47, schrieb Jeff Morriss:

To use 'string' fields you'll need to determine the string length first.
'stringz' fields are strings that you're sure are NULL-terminated and so you should be able to use a length of -1 (which means "continue to the NULL terminator") but I'm not sure how that can be done in the Lua API (maybe you can just past -1 to the length in 
buffer()?).
Well, as I need the string length in order to progress my read offset into the buffer, I now just loop until I find the terminating NULL character, counting loop iterations.
It's not particularly elegant (at least it feels so, remember that I'm still new to writing Wireshark dissectors), but I've now used it for a while and it works very well.
Hmm, yeah, that does seem a bit silly; there should be a better way. Maybe the Lua API needs an equivalent of tvb_strsize(). I don't know a lot about Lua so I wouldn't hazard such an enhancement so you might want to open a bug report (https://bugs.wireshark.org) so someone who does know it might code it up.