Hi, I've developed a Lua dissector that runs in the Mac and Windows version of Wireshark (binaries from recent nightly builds). Since there is no binary for Linux in the nightly builds, I built it from source for my ubuntu 12.04. However, the behavior for the following lines of code has changed:
Basically my payload has many differently structured packages. My script has many package specific functions. My code tell Wireshark to dynamically call the right function to dissect a particular package based on package ID. The script works fine in Mac and Windows where it would call the right functions. But for some reason in Linux, instead of dissecting the packages, I get “ Here is my Wireshark flavor:
asked 07 Apr ‘14, 16:39 YXI edited 07 Apr ‘14, 19:03 Hadriel |
One Answer:
It should behave the same in Linux, Mac, and Windows - there's been a recent change. What version were you running on Windows/Mac?
When your script has this: "
You mean the Python code is writing something like this:
And it writes the above into the same Lua script file that has the code you posted in the question? If so, then there's at least one problem: that doesn't actually create a global function named " So change your Python code and the Lua code in your question to do this:
BTW, there’s no need to do the
answered 07 Apr ‘14, 20:37 Hadriel edited 07 Apr ‘14, 20:38 You are right. Wireshark on my Mac and Windows are from the nightly builds about a month ago. When I downloaded the newest Mac version from last night, it behaves just like the Linux version. Thanks for helping me figure out how to cope with this. Now this is one drawback of using nightly builds instead of a stable release. If I simply told other people to use the nightly build, my code would have been broken. Are you guys going to release what’s in the nightly builds (1.11.3) soon? (08 Apr ‘14, 09:43) YXI I’ve heard a rumor that the next stable release (1.12) is coming out in June - that will be whatever the 1.11.3 code is at that point in time; and then lucky release number 1.13 becomes the next development (unstable) release and 1.11.3 ends. (08 Apr ‘14, 10:43) Hadriel Apparently 1.11.3 is getting released on April 15th, and a 1.11.4 will be created for continued development; so whenever 1.12 gets released it will be based on 1.11.4 not 1.11.3 I think. (08 Apr ‘14, 18:05) Hadriel Would both GTK+ and QT versions be released together? I thought I read somewhere that GTK+ version is more stable. (10 Apr ‘14, 09:11) YXI You mean for 1.12, or 1.11.3? For 1.11.3: linux and windows get both GTK and Qt, but Mac only gets Qt… or at least that’s all it’s gotten in the automated nightly builds, so I assume that’s all it will get in the released version of 1.11.3. Note that you can compile the Mac version on your own for both GTK and Qt. It remains to be seen what happens with 1.12. The problem isn’t that Qt is less stable… the problem is it’s still missing a bunch of features that the GTK version has. For the features it has, Qt is superior in my opinion, but not having all the features is tough. Many of the missing features are really esoteric stuff that I bet only a very small, niche population uses… but some missing features aren’t so esoteric. (10 Apr ‘14, 09:49) Hadriel |
Can you show the code that sets the global
_G[funcName]
to be the function(s)?BTW, not that it matters, but is there some reason you’re putting them in the global table instead of just a local table in the script? Are they set from other Lua scripts?
The functions are generated by python. I have python code writing to the Lua file lines like “function pkgExtract%s(buffer, offset)” %pkgID, which is the start of the function. Is this what you mean?
As far as global vs. local tables, I guess my Lua experience is so limited, I have not given it any thought. When you say local tables, do you mean declare all the functions as “local”?