ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] ethereal dump core when trying to decode mapi encrypted data

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 11 Aug 2004 01:41:02 -0700
On Tue, Aug 10, 2004 at 09:35:23PM -0700, TJ Li wrote:
> Codes are from latest ethereal branch.

I.e., the current Subversion main line?

> I made it by myself.  I attached back trace here. 
> 
> To reproduce it, select Preference-> Protocol -> Mapi Decrypt MAPI PDUs,
> ethereal crashes sometimes, not always, seems crash once the other
> time.
> 
> I also attachmented a mapi traffic here too.

I can't make it crash with that capture on my FreeBSD 4.6 machine
(current Subversion code).  There could be some OS difference that keeps
it from crashing.

> What should I do when I make ethereal so that it would show real function
> names instead of ?? when I backtrace core in gdb?

Try running

	./libtool gdb ethereal core.3920

When you build a binary that requires libtool (as Ethereal does), you
need to use "libtool gdb" rather than just "gdb" to debug the version of
the binary built in that tree (but not to debug the installed version) -
the "ethereal" file isn't the executable image for Ethereal, it's a
shell script wrapper, generated by libtool, to run that executable image
with the appropriate environment variable settings so that it'll find
shared libraries (such as libethereal.so).

Note the

	"/usr/home/nfs/tli/work/riverbed/ethereal-latest/ethereal/ethereal": not in executable format: File format not recognized

error, and the

	Core was generated by `lt-ethereal'.

"lt-ethereal" is the actual Ethereal binary; it's in a subdirectory
(".libs", I think) - but you can't necessarily do

	gdb .libs/lt-ethereal core.3920

You should, instead, do "./libtool gdb ethereal core.3920".

> Also, the latest ethereal windows version seems have problem with
> "follow tcp stream" .

What kind of problem?