ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] How to modify hf_register_info hf[] ?

From: "Jan Kokott" <Blind007@xxxxxx>
Date: Thu, 25 Jan 2007 15:50:45 +0100
Hi,

I tried to alter the hf[] field which is 0 / 2 / 8 Byte by using a switch/case after initializing hf_register_info hf[] = {...} in the proto_register_zigbee.

hf[14].hfinfo.type = FT_UINT16;

But that doesn�t effect the array at all.
At the Moment the dissector could detect if the field is present with 8 Byte in length or not, but i can�t switch to a 2 Byte field.

Regards
Jan

-------- Original-Nachricht --------
Datum: Tue, 23 Jan 2007 10:27:06 +0100
Von: "Jan Kokott" <Blind007@xxxxxx>
An: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Betreff: Re: [Wireshark-dev] How to modify hf_register_info hf[] ?

> Hi,
> 
> That doesn�t seem to work.
> In the dissect_zigbee I read the 4 Bit and calculate them to an offset
> value.
> This value I use in:
> 
> proto_tree_add_item(adr_tree, hf_zigbee_adr_dest,tvb,5, dest_offset,
> FALSE);
> 
> So the added Item should have the correct length.(dest_offset = 0 / 2 / 8)
> 
> 
> In the hf_register_info I use:
> 
> { &hf_zigbee_adr_dest,
> 			{ "Destination Address",           "zigbee.adr.dest",
> 			FT_UINT64, BASE_HEX, NULL, 0x0,
> 			"", HFILL }
> 
> So at the Moment the field is either 8 Byte length (UINT64) or not
> existing, if the switch/Case in the dissect_zigbee detects 00 as Adressing
> Mode.(At least the hiding of the field when not used works)
> 
> I tried to use FT_BYTES instead of the FT_UINT64 but the length is still
> the same.
> 
> Regards
> Jan
> 
> 
> -------- Original-Nachricht --------
> Datum: Mon, 22 Jan 2007 16:22:12 +0100 (CET)
> Von: Jaap Keuter <jaap.keuter@xxxxxxxxx>
> An: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
> Betreff: Re: [Wireshark-dev] How to modify hf_register_info hf[] ?
> 
> > Hi,
> > 
> > There's no way to change a registered array. Therefore I suggested to
> use
> > FT_BYTES, which has a variable length given in the proto_tree_add_*
> > function.
> > 
> > Thanx,
> > Jaap
> > 
> > On Mon, 22 Jan 2007, Jan Kokott wrote:
> > 
> > > Hi,
> > >
> > > I have a little problem with the hf [] array.
> > > In the subtree "frame" are two fields defining the length of my
> subtree
> > "Adressing Field".
> > >
> > > The Field could varry between 4 and 20 byte. The total length is a
> > problem I have already solved. My problem is, that 2 of the 4 fields in
> those
> > 4-20 byte have a variable length(0,2 or 8 Byte).
> > >
> > > The dissector (if (tree)) was solved with an switch/case, for every
> > possibility.
> > > But how do I change the hf [], so that it could have 2 or 4 fields
> with
> > 0-8 Byte ?
> > > I could use a switch/case again but therefore I would need to write 6
> > different hf_register with 14-16 entrys.
> > >
> > > Any ideas on how I could do that a bit smoother ?
> > >
> > > Regards
> > > Jan Kokott
> > >
> > 
> > _______________________________________________
> > Wireshark-dev mailing list
> > Wireshark-dev@xxxxxxxxxxxxx
> > http://www.wireshark.org/mailman/listinfo/wireshark-dev
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev