Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Unable to see the plugin compiled in the custom wireshark run?

I am following the foo example given in the wireshark documentation. I am able to build the foo code plugin. I am using wireshark 3.0.1 version. In the workroot folder, I have updated the target - PLUGIN_SRC_DIRS - plugins/epan/foo just before gryphon.

I can see that my code builds because I got some compilation error which I was able to fix it.

My foo code lives inside the plugins/epan folder. I am running custom wireshark - sudo ./run/wireshark There is a surprise here that I can't see even gryphon protocol field in the running wireshark. So in order to test this, I am typing foo or gryphon in that display filter and it turns red and it say foo is neither a protocol nor a protocol field. I am using Ubuntu 16.04 LTS to build it. The build goes fine.

Here is packet-foo.c

#include "config.h"
#include <epan/packet.h>
#include "packet-foo.h"


static int proto_foo = -1;

static int dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree _U_, void *data _U_);


void
proto_register_foo(void)
{
    proto_foo = proto_register_protocol (
        "FOO Protocol", /* name       */
        "FOO",      /* short name */
        "foo"       /* abbrev     */
        );
}

void
proto_reg_handoff_foo(void)
{
    static dissector_handle_t foo_handle;

    foo_handle = create_dissector_handle(dissect_foo, proto_foo);
    dissector_add_uint("udp.port", FOO_PORT, foo_handle);
}

static int
dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree _U_, void *data _U_)
{
    col_set_str(pinfo->cinfo, COL_PROTOCOL, "FOO");
    /* Clear out stuff in the info column */
    col_clear(pinfo->cinfo,COL_INFO);

    return tvb_captured_length(tvb);
}

Here is the packet-foo.h

#define FOO_PORT 1234

The CMakeLists.txt is here, this is actually a copy of gryphon. So, I am wondering if gryphon wasn't recognised that means foo won't be recognised too. So, this file might be a source of problem.

include(WiresharkPlugin)

# Plugin name and version info (major minor micro extra)
set_module_info(foo 0 0 4 0)

set(DISSECTOR_SRC
    packet-foo.c
)

set(PLUGIN_FILES
    plugin.c
    ${DISSECTOR_SRC}
)

set_source_files_properties(
    ${PLUGIN_FILES}
    PROPERTIES
    COMPILE_FLAGS "${WERROR_COMMON_FLAGS}"
)

include_directories(${CMAKE_CURRENT_SOURCE_DIR})

register_plugin_files(plugin.c
    plugin
    ${DISSECTOR_SRC}
)

add_plugin_library(foo epan)

target_link_libraries(foo epan)

install_plugin(foo epan)

file(GLOB DISSECTOR_HEADERS RELATIVE "${CMAKE_CURRENT_SOURCE_DIR}" "*.h")
CHECKAPI(
    NAME
      foo
    SWITCHES
      -g abort -g termoutput -build
    SOURCES
      ${DISSECTOR_SRC}
      ${DISSECTOR_HEADERS}
)

Plugin Folder

like image 491
Prawn Hongs Avatar asked May 07 '19 23:05

Prawn Hongs


People also ask

Where do Wireshark plugins go?

If you are using Windows 32-bit OS, copy the plugin in to the following Wireshark directory on your computer: C:\Program Files (x86)\Wireshark\ . If you are using Windows 64-bit OS, copy the plugin in to the following Wireshark directory on your computer: C:\Program Files\Wireshark\plugins\ .


1 Answers

Merely changing the plugin isn't sufficient. You need to modify the top make file so that foo is actually installed.

vim CMakeListsCustom.txt.example

Firstly, uncomment - line number 16

 plugins/epan/foo

Since your foo lives inside plugins/epan/foo

Now, rename this example to

mv CMakeListsCustom.txt.example CMakeListsCustom.txt

vim CMakeLists.txt

Insert a line number around 1408- plugins/epan/foo

After that, do make and then sudo make install

Here is the working copy -

https://github.com/joshis1/WiresharkDissectorFoo

like image 137
dexterous Avatar answered Oct 12 '22 01:10

dexterous