ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Possibility to modify buffer?

From: Reinhard Speyerer <rspmn@xxxxxxxx>
Date: Thu, 17 Sep 2009 22:06:19 +0200
Guy Harris wrote:

> You would need to allocate a new tvbuff, and a blob big enough to hold  
> all the decrypted data, and decrypt the data into the blob and attach  
> that blob to the tvbuff, and hand *that* tvbuff to the next  
> dissector.  You cannot modify the data in a tvbuff handed to you.
> 
> I don't know the details of how to do that in a Lua dissector.

I use the following Lua code for this (SyncML example):

        local xmltvb = ByteArray.new(hexxml):tvb("application/vnd.syncml+wbxml")
        local subtree = tree:add(rls_syncml_wbxml_proto, xmltvb())
        syncml_xml_dissector:call(xmltvb, pinfo, subtree)

where hexxml contains the XML in hex ("3C...") and syncml_xml_dissector is

  local syncml_xml_dissector = Dissector.get("xml")

Regards,
Reinhard