This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

My dissector which was compiled with 1.8, doesn’t work on official 1.8

1

Hey, I compiled (VS2010) my dissector with the 1.8 trunk release and even tried it the the 1.8.4 official source release but it still doesn't work with the official 1.8.4 release.

The dissector works only for the release that I build him for: If I build it with trunk 1.8, It only works for my own build.

The dissector is a plugin

The build works fine, afterwards I copy the .dll to the plugin\version dir of the official release and I execute the official release, then I get an error message about my dissector

The error message:

"Couldn't load module C:\Program Files\Wireshark\plugins\1.8.4\my_plugin.dll: `C:\Program Files\Wireshark\plugins\1.8.4\my_plugin.dll': %1 is not a valid Win32 application."

edit: I tried to see if the problem is in my dissector, or in they way I build... I took a working plugin "gryphon" and built it, copied it to the official wireshark\plugins\1.8.4\ and it gives me the same error. So I guess something is wrong with my build...

Does anyone have any suggestions?

Thanks ahead

asked 15 Dec '12, 07:18

hudac's gravatar image

hudac
61111317
accept rate: 50%

edited 17 Dec '12, 01:06

You'll need to provide more information before anyone can answer your question.

What doesn't work ? Build ? Error messages ? etc.

What kind of dissector: Plugin ? Built-in ?

For what release does the dissector work with ?

(15 Dec '12, 07:25) Bill Meier ♦♦

Thanks for the comment. The dissector works only for the release that I build him for: If I build it with trunk 1.8, It only works for my own build.

The dissector is a plugin

The build works fine, afterwards I copy the .dll to the plugin\version dir of the official release and I execute the official release, then I get an error message about my dissector (unfortunately I will be able to write the error message only on Monday...)

(15 Dec '12, 07:57) hudac

can you post your compiled version of the gryphon plugin somewhere?

(17 Dec '12, 01:55) Kurt Knochner ♦

Thanks, my mistake was that I thought I built for win64, while I built for win32... I tried to run it on win64 and it didn't work...

(17 Dec '12, 03:24) hudac

2 Answers:

3

Have you built your plugin for Win64 and are now running a 32 bit version of Wireshark? You'll need to match the bit size of Wireshark and the plugin.

answered 17 Dec '12, 01:25

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

I built it for win64, and I'm running 64bit version of wireshark...

(17 Dec '12, 01:29) hudac

Can you post the output of dumpbin /headers path\to\your\dll?

(17 Dec '12, 02:56) grahamb ♦

Thanks, my mistake was that I thought I built for win64, while I built for win32... I tried to run it on win64 and it didn't work...

(17 Dec '12, 03:24) hudac

If the answer solved your issue can you accept it for the benefit of other users by clicking the checkmark icon?

(17 Dec '12, 03:59) grahamb ♦

1

Once you post the error message, someone may be able to identify the specific problem.

That being said, a Google search for 'site:wireshark.org plugin "1.8"' gives a number of hits which may be worth investigating.

As noted elsewhere [plugin not loading]

"Wireshark does not guarantee that plugins built against a given major release (such as 1.4.x, for various values of x) will continue to work with later major releases (such as 1.6.x or 1.8.x, for various values of x)."

It' certainly possible that you will need coding changes in your dissector for use with Wireshark 1.8 (altho that may not be the actual problem since you say it works with your 1.8 build).

answered 15 Dec '12, 08:20

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%

edited 15 Dec '12, 08:22

Thanks for your comment, I added the error message.. It will be very helpful if you could look at it

(16 Dec '12, 22:25) hudac