mirror of
https://github.com/emanuele-f/PCAPdroid.git
synced 2026-05-08 21:12:26 +00:00
emanuele-f
65 lines
1.9 KiB
Lua
65 lines
1.9 KiB
Lua
--
|
|
-- This file is part of PCAPdroid.
|
|
--
|
|
-- PCAPdroid is free software: you can redistribute it and/or modify
|
|
-- it under the terms of the GNU General Public License as published by
|
|
-- the Free Software Foundation, either version 3 of the License, or
|
|
-- (at your option) any later version.
|
|
--
|
|
-- PCAPdroid is distributed in the hope that it will be useful,
|
|
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
-- GNU General Public License for more details.
|
|
--
|
|
-- You should have received a copy of the GNU General Public License
|
|
-- along with PCAPdroid. If not, see <http://www.gnu.org/licenses/>.
|
|
--
|
|
-- Copyright 2021 - Emanuele Faranda
|
|
--
|
|
|
|
pcapdroid = Proto("PCAPdroid", "PCAPdroid data")
|
|
|
|
-- #############################################
|
|
|
|
local PCAPDROID_MAGIC = 0x01072021
|
|
local PCAPDROID_TRAILER_SIZE = 32
|
|
|
|
-- #############################################
|
|
|
|
local fields = {}
|
|
|
|
fields.magic = ProtoField.uint32("pcapdroid.magic", "Magic", base.HEX)
|
|
fields.uid = ProtoField.int32("pcapdroid.uid", "UID", base.DEC)
|
|
fields.appname = ProtoField.string("pcapdroid.appname", "App name", base.ASCII)
|
|
|
|
pcapdroid.fields = fields
|
|
|
|
-- #############################################
|
|
|
|
function pcapdroid.dissector(buffer, pinfo, tree)
|
|
local length = buffer:len()
|
|
|
|
if(length < PCAPDROID_TRAILER_SIZE) then
|
|
return
|
|
end
|
|
|
|
-- -4: skip the FCS
|
|
local trailer = buffer(length - PCAPDROID_TRAILER_SIZE, PCAPDROID_TRAILER_SIZE - 4)
|
|
local magic = trailer(0, 4):uint()
|
|
|
|
if(magic ~= PCAPDROID_MAGIC) then
|
|
return
|
|
end
|
|
|
|
local appname = trailer(8, 20):string()
|
|
local subtree = tree:add(pcapdroid, buffer(), string.format("PCAPdroid, App: %s", appname))
|
|
|
|
subtree:add(fields.magic, trailer(0, 4))
|
|
subtree:add(fields.uid, trailer(4, 4))
|
|
subtree:add(fields.appname, trailer(8, 20))
|
|
end
|
|
|
|
-- #############################################
|
|
|
|
register_postdissector(pcapdroid)
|