Wireshark 解析器：根据解析树中前一个字段的值显示一个字段

Question

我正在致力于在wireshark中开发一个用于专有协议的插件。我有以下 3 个结构来定义协议的特征。

static const value_string packettypenames[] = { /* MAIN COMMAND */  
    {0x01,"FALO_PWRL_CMD"},                 /* 0x01  */  
    {0x02,"FALO_CALLABLE_CMD"},             /* 0x02  */  
    {0x03,"FALO_CORTEX_DATA_CMD"},      /* 0x03 */  
    {0x04,"FALO_LOCAL_CMD"}             /* 0x04 */  
    } 

static const calue_string packettypesubnames_falo_pwrl_cmd[]={/* SUBCOMMAND BASED */     
    {0x01, "FALO_PWRL_PREF_PLMN"},                      /*ON SELECTED MAIN COMMAND */  
    {0x02 ,"FALO_PWRL_PLMN_SEL"}  
}  

static const calue_string packettypesubnames_falo_callable_cmd[]={  /* SUBCOMMAND */  
    {0x01, "FALO_PWRL_PREF_PLMN"},            /*based ON SELECTED MAIN COMMAND */  
    {0x02 ,"FALO_PWRL_PLMN_SEL"}  
}  

hf_register 数组中存储的结构和格式信息如下：

void proto_register_talo(void)  
{  
    static hf_register_info hf[] = {  
        { &hf_talo_main_command,  
            { "Talo Main Command", "talo.command",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypenames) , 0x0,  
            NULL, HFILL }  
        },  
        { &hf_ipc_sub_command,  
            { "Talo Sub Command", "talo.subcommand",  
            FT_UINT8, BASE_HEX,  
            VALS(packetsubtypenames), 0x0,   /* STUCK AT THIS POINT */  
            NULL, HFILL }  
        }  
};

这里我的子命令的格式信息是基于主命令的值。有没有办法获得这样的东西，以便第二个字段子命令的值可以根据主命令中存在的值来决定？

谢谢你的帮助， 姆鲁纳尔

Answer 1

您可以执行以下操作：

void proto_register_talo(void)  
{  
    static hf_register_info hf[] = {  
        { &hf_talo_main_command,  
            { "Talo Main Command", "talo.command",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypenames) , 0x0,  
            NULL, HFILL }  
        },  
        { &hf_ipc_sub_command_pwrl,  
            { "Talo Sub Command", "talo.subcommand",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypesubnames_falo_pwrl_cmd), 0x0,     
            NULL, HFILL }  
        }  
        { &hf_ipc_sub_command_callable,  
            { "Talo Sub Command", "talo.subcommand",  
            FT_UINT8, BASE_HEX,  
            VALS(packettypesubnames_falo_callable_cmd), 0x0,
            NULL, HFILL }  
        }  

};

然后在您的解剖函数中执行类似以下操作：

switch(header_type) {
    case 1:
      hf_sub_command = hf_ipc_sub_command_pwrl;
      break;
    case 2:
      hf_sub_command = hf_ipc_sub_command_callable;
      break;
    }
proto_tree_add_item(tree, hf_sub_command, tvb, offset, 1, FALSE);