number bigger than 64 bits

Question

Hi,

Just wondering if anyone has to write a dissector in Lua that contains values bigger than 64 bit. How do you do it.

Thanks.

Answer 1

To do what with? Just to show it in the display tree? Have it be filterable by value? Or to actually perform some arithmetic on it?

If it's just to display in the tree, I suppose you can treat it as a byte string. You can even show it's numerical value by processing each byte in Lua and building/concatenating a string representing the numeric value, that you add to the tree item using Lua. (it would take some careful Lua coding to make such a bignum string, but it's possible)

But to have it be filterable by numeric value (i.e., have a display filter like 'myproto.bugnum = 42446744073709551615') isn't possible as far as I know, since there's no filter type for numbers bigger than 64-bit.

There's no way of performing Lua arithmetic (ie, add, subtract, divide) on numbers that big directly as a Lua number, because Lua itself only handles numbers as doubles; and though a double can certainly represent massive numbers, it loses precision above 53-bits (or 52 bits... I always forget which). As of Wireshark 1.11.3 we now have Lua arithmetic for 64-bit numbers, as Int64/UInt64 userdata objects, but nothing bigger. So if you need to handle something bigger, you'll have to write the Lua code to do it based on smaller number chunks of the bigger number.

Answer 2

Yes, Struct is in the latest nightly builds, and has Int64/UInt64 support by using 'e'/'E' in the pattern. Note that it's "Struct" not "struct", however - I didn't want to collide with someone's use of the real struct library if they were already using it. Also, our auto-generated docs for it are here, but it's not very helpful. I've been hoping to update the doc generator for the API, because we're very limited in the type of documentation that can be generated for the API. (it's auto-generated by a Perl script from source code)

So here are some rough notes from the source file:

** Some changes are based on a patch to struct.h from
** Flemming Madsen, from here:
** http://lua-users.org/lists/lua-l/2009-10/msg00572.html
** In particular, these changes from him:
** -Can handle 'long long' integers (i8 / I8); though they're converted to doubles
** -Can insert/specify padding anywhere in a struct. ('X' eg. when a string is following a union)
** -Can report current offset in both pack and unpack ('=')
** -Can mask out return values when you only want to calculate sizes or unmarshal pascal-style strings. '(' & ')'
**
** Changes I made:
** -Added support for Int64/UIn64 being packed/unpacked, using 'e'/'E'
** -Made it follow Wireshark's conventions so we could get API docs
** =======================================================
*/
/*
** Valid formats:
** > - big endian
** < - little endian
** ![num] - alignment
** x[num]   - pad num bytes, default 1
** X[num]   - pad to num align, default MAXALIGN
**
** Following are system-dependent sizes:
** b/B - signed/unsigned byte
** h/H - signed/unsigned short
** i/I - signed/unsigned int
** l/L - signed/unsigned long
** f - float
** d - double
** T   - size_t
**
** Following are system-independent sizes:
** in/In - signed/unsigned integer of size `n' bytes
          Note: unpack of i/I is done to a Lua_number, typically a double,
          so unpacking a 64-bit field (i8/I8) will lose precision.
          Use e/E to unpack into a Wireshark Int64/UInt64 object/userdata instead.
** e/E - signed/unsigned eight-byte Integer (64bits, long long), to/from Int64/UInt64 object
** cn - sequence of `n' chars (from/to a string); when packing, n==0 means
        the whole string; when unpacking, n==0 means use the previous
        read number as the string length
** s - zero-terminated string
** ' ' - ignored
** '(' ')'  - stop assigning items. ')' start assigning (padding when packing)
** '='      - return current position / offset
*/