Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Reading a zero-terminated string in Lua dissector

From: Carsten Fuchs <carsten.fuchs@xxxxxxx>
Date: Mon, 04 Jun 2012 09:05:27 +0200
Hi Jeff,

thanks for your reply.

Am 2012-06-01 23:47, schrieb Jeff Morriss:
To use 'string' fields you'll need to determine the string length first.

'stringz' fields are strings that you're sure are NULL-terminated and so you should be
able to use a length of -1 (which means "continue to the NULL terminator") but I'm not
sure how that can be done in the Lua API (maybe you can just past -1 to the length in
buffer()?).

Well, as I need the string length in order to progress my read offset into the buffer, I now just loop until I find the terminating NULL character, counting loop iterations.

It's not particularly elegant (at least it feels so, remember that I'm still new to writing Wireshark dissectors), but I've now used it for a while and it works very well.

If anyone is interested, my current dissector code is at:
http://trac.cafu.de/browser/cafu/trunk/Ca3DE/wireshark-cafu.lua

Best regards,
Carsten



--
   Cafu - the open-source Game and Graphics Engine
for multiplayer, cross-platform, real-time 3D Action
          Learn more at http://www.cafu.de