wireshark lua插件解码私有协议

╰半橙微兮° 2022-05-16 00:18 244阅读 0赞

## code ##

-- @brief RtmpProxy over UDP Protocol dissector plugin
    -- @author 
    -- @date 2018.08.12
    -- @man https://wiki.wireshark.org/LuaAPI
    
    
    local VALS_FOO  = {[0x333333] = "New York", [0x303030] = "Los Angeles",[0x313233] = "Chicago"}
    local VALS_BAR  = {[0x06] = "Whiskey", [0x12] = "Rum", [0x13] ="Vodka", [0x14] = "Gin"}
    local VALS_BOOL = {[0] = "False", [1] = "True"}
    
    
    
    -- calling tostring() on random FieldInfo's can cause an error, so this func handles it
    local function getstring(finfo)
      local ok, val = pcall(tostring, finfo)
      if not ok then val = "(unknown)" end
      return val
    end
    
    
    -- 1. 创建解析器对象
    local NAME = "RPU"  --自定义的协议名
    local rpouProto = Proto(NAME, " RtmpProxy over UDP Protocol")
    
    -- rpouProto 定义协议的解析字段
    local fields = rpouProto.fields
    fields.sessionID = ProtoField.uint32 (NAME .. ".sessionID", "sessionID") --session id 头
    fields.Seq = ProtoField.uint32 (NAME .. ".Seq", "Seq") -- seq头
    fields.Length = ProtoField.uint32(NAME .. ".Length", "[Length]",base.DEC)  --代理包总长度
    fields.DataLength = ProtoField.uint32(NAME .. ".DataLength", "[DataLength]",base.DEC)  --有效数据长度
    
    
    fields.bf   = ProtoField.uint64(NAME .. ".bf"   , "Bitfield"        , base.HEX)
    fields.bfhi = ProtoField.uint32("toy.bfhi"  , "Upper 32 bits"   , base.HEX)
    fields.bflo = ProtoField.uint32("toy.bflo"  , "Lower 32 bits"   , base.HEX)
    fields.bf_foo   = ProtoField.uint32("RPU.bf.foo", "Bitfield-0"      , base.DEC,VALS_FOO , 0x00FFFFFF)
    fields.bf_bar   = ProtoField.uint32("RPU.bf.bar", "Bitfield-1"      , base.DEC,VALS_BAR , 0x0000000F)
    
    fields.bf_st    = ProtoField.uint32("toy.bf.st" , "Sticky"      , base.DEC,VALS_BOOL, 0x00000001)
    fields.bf_rd    = ProtoField.uint32("toy.bf.rd" , "Read"        , base.DEC,VALS_BOOL, 0x00000002)
    fields.bf_wr    = ProtoField.uint32("toy.bf.wr" , "Write"       , base.DEC,VALS_BOOL, 0x00000004)
    fields.bf_ex    = ProtoField.uint32("toy.bf.ex" , "Execute" , base.DEC,VALS_BOOL, 0x00000008)
    
    
    
    
    local data_dis = Dissector.get("data")
    
    -- 2. 解析器函数 dissect packet 
    --[[
        下面定义 foo 解析器的主函数，这个函数由 wireshark调用
        第一个参数是 Tvb 类型，表示的是需要此解析器解析的数据
        第二个参数是 Pinfo 类型，是协议解析树上的信息，包括 UI 上的显示
        第三个参数是 TreeItem 类型，表示上一级解析树
    --]]
    
    function rpouProto.dissector (tvb, pinfo, tree)
      local subtree = tree:add(rpouProto, tvb())
    
      -- 分组详情中协议行显示的协议名
      pinfo.cols.protocol = rpouProto.name 
    
      -- dissect field one by one, and add to protocol tree
      local sessionID = tvb(0, 4)  --表示从0开始4个字节
      subtree:add(fields.sessionID, sessionID)
    
      subtree:append_text(", sessionID: " .. sessionID:uint())
    
      local seq = tvb(4, 4)
      subtree:add(fields.Seq, tvb(4, 4))
    
      --分组列表中的info信息
      pinfo.cols.info:set(string.format("sessionID:%.11d seq= %.11d",sessionID:uint(),seq:uint())) 
    
      pinfo.cols.info:append(" " ..pinfo.src_port .. "->" .. pinfo.dst_port)
    
      subtree:add(fields.Length, tvb:len())
      subtree:add(fields.DataLength, tvb:len()-8)
    
    
      -- 位域的例子
    
      local t_bf = subtree:add( fields.bf, tvb(0,8) )       -- bitfield
    
    
      local t_hi = t_bf:add( fields.bfhi, tvb(1,4) )    -- Upper 32 bits
      t_hi:add( fields.bf_foo   , tvb(0,4) )        -- Foo
      t_hi:add( fields.bf_bar   , tvb(0,4) )        -- Bar
    
      local t_lo = t_bf:add( fields.bflo, tvb(4,4) )    -- Lower 32 bits
      t_lo:add( fields.bf_st    , tvb(4,4) )        -- Sticky
        t_lo:add( fields.bf_rd  , tvb(4,4) )        -- Read
        t_lo:add( fields.bf_wr  , tvb(4,4) )        -- Write
        t_lo:add( fields.bf_ex  , tvb(4,4) )        -- Execute
    
    
      pinfo.cols.info:append(" ☼RTMP代理协议☢") 
    
      data_dis:call(tvb(8):tvb(), pinfo, tree) --解析有效数据
    
      subtree:add_expert_info(PI_SECURITY, PI_ERROR , "添加专家信息!")
    -- subtree:set_len(20)
    
    end
    
    -- 3 将解析器注册到wireshark解析表 register this dissector
    local udp_port_table = DissectorTable.get("udp.port")
    
    --添加解析的UDP端口，根据端口号识别协议
    for i,port in ipairs{
       10000,20000} do
      udp_port_table:add(port,rpouProto)
    end
    
    
    
    
    --Post-dissector 后处理解析器 -----
    
    local myproto = Proto("hello","Dummy proto to edit info column")
    
    -- the dissector function callback
    function myproto.dissector(tvb,pinfo,tree)
    
      local websocket_flag = false
      local fields = { all_field_infos() }
      for i, finfo in ipairs(fields) do
    
    -- pinfo.cols.info:append("@" .. pinfo.port_type .. "$")
    
      end
    
    
    end
    
    -- register our new dummy protocol for post-dissection
    register_postdissector(myproto)

看下解析的效果

![这里写图片描述][70]

> [https://blog.csdn.net/x356982611/article/details/81628777][https_blog.csdn.net_x356982611_article_details_81628777]  
> [https://www.zybuluo.com/natsumi/note/77991][https_www.zybuluo.com_natsumi_note_77991]  
> [https://wiki.wireshark.org/Lua/Examples][https_wiki.wireshark.org_Lua_Examples]  
> [https://www.wireshark.org/docs/wsdg\_html\_chunked/wslua\_dissector\_example.html][https_www.wireshark.org_docs_wsdg_html_chunked_wslua_dissector_example.html]  
> [https://www.wireshark.org/docs/wsdg\_html\_chunked/wslua\_tap\_example.html][https_www.wireshark.org_docs_wsdg_html_chunked_wslua_tap_example.html]  
> [https://wiki.wireshark.org/LuaAPI][https_wiki.wireshark.org_LuaAPI]

[70]: /images/20220516/c3cb5d630e2343de841d0a6f20313f41.png
[https_blog.csdn.net_x356982611_article_details_81628777]: https://blog.csdn.net/x356982611/article/details/81628777
[https_www.zybuluo.com_natsumi_note_77991]: https://www.zybuluo.com/natsumi/note/77991
[https_wiki.wireshark.org_Lua_Examples]: https://wiki.wireshark.org/Lua/Examples
[https_www.wireshark.org_docs_wsdg_html_chunked_wslua_dissector_example.html]: https://www.wireshark.org/docs/wsdg_html_chunked/wslua_dissector_example.html
[https_www.wireshark.org_docs_wsdg_html_chunked_wslua_tap_example.html]: https://www.wireshark.org/docs/wsdg_html_chunked/wslua_tap_example.html
[https_wiki.wireshark.org_LuaAPI]: https://wiki.wireshark.org/LuaAPI