1.12.x plugin installation doesn’t work with 2.x Wireshark

Question

I build with success a plugin downloaded from the net, i use headers' wireshark 1.12.6, but i'm using wireshark 2.0.2. when i put the plug in in the appropriate directory and i start up wireshark i see this message:

Couldn't load module /Applications/Wireshark.app/Contents/PlugIns/wireshark/whatsapp.so: dlopen(/Applications/Wireshark.app/Contents/PlugIns/wireshark/whatsapp.so, 10): Library not loaded: /usr/local/lib/libwireshark.5.dylib
  Referenced from: /Applications/Wireshark.app/Contents/PlugIns/wireshark/whatsapp.so
  Reason: image not found

Maybe because i use a plugin for wireshark 1.12.6 but when i totally disintall wireshark 2.0.2 and then install wireshark 1.12.6 wireshark 1.12.6 crash at start up. Do u know why? If i reinstall wireshark 2.0.2 it crash at startup without any message!

Answer 1

1

Wireshark does not guarantee binary compatibility between versions, so a plugin has to be compiled for the version of Wireshark it is to be used with.

You'll need to recompile the plugin using a Wireshark 2.0 build environment.

Note this appears to be a duplicate of your earlier question, please don't post duplicates, instead try to edit your question to better describe the issue so someone may help you. I've deleted the earlier question.

answered 04 Apr '16, 07:03

grahamb ♦
19.8k●3●30●206
accept rate: 22%

i'm very sorry for the duplicate question. Thank you so much for the fast answer. now i try and then i can check this question as solved!

(04 Apr '16, 08:11) cicciovo

@grahamb, now i have another problem... while i'm building the plugin for wireshark 2.0.2 now, i see this message: 2 warnings generated.

[ 66%] Building C object CMakeFiles/whatsapp.dir/tinfl.c.o [ 83%] Linking CXX shared module whatsapp.so ld: library not found for -lwireshark then, i copy libwireshark.6.0.2.dylib libwireshark.6.dylib libwireshark.dylib in /usr/local/lib and after the make i see this message: [ 16%] Linking CXX shared module whatsapp.so Undefined symbols for architecture x86_64: "_tvb_length", referenced from: _get_whatsapp_message_len in packet-whatsapp.c.o _dissect_whatsapp_message in packet-whatsapp.c.o ld: symbol(s) not found for architecture x86_64

can anyone help me please?

(04 Apr '16, 10:12) cicciovo

API in Wireshark 2.0 was changed. Function tvb_length is no longer present. It was renamed to tvb_captured_length. It is also quite possible you're going to encounter more errors similar to this caused by API change.

(05 Apr '16, 04:04) Aliniel

@Aliniel , thank you so much! you're very kind. So i have only two possibilities: or build the plugin whit wireshark 1.12.6 and install Wireshark 1.12.6 or.... i can trash "my project" ? I don't won't to trash "my project" so i install wireshark 1.12.6 but whit this i have some problem, because when i install it wireshark crash at startup.... what do u think? In the checkAPIS.pl i find 'tvb_length_remaining', # replaced with tvb_captured_length_remaining ... now i try to change the tvb_length in tvb_captured_lentgth .. maybe is the more fast solution :D

(05 Apr '16, 09:59) cicciovo

I think you have a few options:

Debug the crashing issue in 1.12.6.
Rebuild the plugin using 1.12.10 (the last release of 1.12.x) as that may have fixed the issue causing the crash, and if it still crashes debug it.
Fix up the plugin so it compiles with 2.0.2.

(05 Apr '16, 10:10) grahamb ♦

I am not sure if list of all the changes can be found somewhere. Anyway, you don't have to "trash" your project. I updated two plugins myself. It's not impossible, just keep changing everything that's not recognized until it compiles right.

(05 Apr '16, 10:22) Aliniel

Thank you so much! i try to fix the plugin ;)

(05 Apr '16, 10:33) cicciovo

Wow. I fix up the plugin! thank you to you! I hope that i can help someone here! tank you to all! This is SOLVED!

(05 Apr '16, 15:23) cicciovo

@Aliniel When you updated those plugins to compile with Wireshark 2.0.2 and compiled with no errors or warnings...were you able to launch the app and use your filter first try?

The reason why I ask is because I too am updating my plugin, and after I was able to make some changes to compile...the executable crashes with a Runtime error when registering my plugin. Just looking for any help here. I can provide more info if needed.

FYI...I remove my dll, wireshark works just fine for what it's worth. And this plugin did work with wireshark v.1.6.

(12 Apr '17, 10:01) aawale15

I'm sorry, @aawale15, but I haven't worked with Wireshark for almost a year now. As far as I remember we only needed to apply those few API changes and then plugins worked as before.

(12 Apr '17, 10:10) Aliniel

No problem @Aliniel, thanks for the immediate response!

(12 Apr '17, 10:13) aawale15

showing 5 of 11 show 6 more comments