summaryrefslogtreecommitdiff
path: root/lua
AgeCommit message (Collapse)AuthorFilesLines
2021-07-21tls-alerts.lua: Add listener to identify domains with unusual TLS alertsPeter Wu1-0/+136
2020-04-01file-zip: parse mtime into a human-readable formPeter Wu1-4/+28
2020-02-13lua/doh-get.lua: fix base64url decodingPeter Wu1-0/+15
Avoids malformed packet exception with certain unpadded values. See also https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16386
2020-02-07lua: add DoH GET dissectorPeter Wu1-0/+39
Quick hack that allows me to debug DoH GET requests. See also https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14433
2019-01-13file-tar: basic POSIX tar archive dissectorPeter Wu1-0/+217
Support the POSIX tar format only and not other dialects.
2018-12-18file-ar: fix processing of regular .a archivesPeter Wu1-20/+22
Do not try to dissect its data as COFF, it could be something else.
2018-12-18file-ar: extend with PE support (.exe/.dll)Peter Wu1-12/+183
2018-12-17file-ar: fix dissection of llvm-dlltool archivesPeter Wu1-16/+54
Add Storage Classes dissection and fix for llvm-dlltool output which has a large "//" archive member (longnames) that are newline-terminated instead of null-terminated. Tested against the output .lib file from LLVM 7.0.0-1: llvm-dlltool -m i386:x86-64 -d libgnutls-30.def -l libgnutls-30.lib -D libgnutls-30.dll
2018-12-17file-ar: ar and COFF dissector for WiresharkPeter Wu1-0/+523
Created in order to compare libgcrypt-20.dll.a as created by MinGW versus libgcrypt-20.lib as created by MSVC. Based on file-zip.lua.
2017-11-07lua/trivial: add some more commentsPeter Wu1-7/+23
And remove the unnecessary nothing() function, it was there to test a crash issue.
2017-11-07lua/trivial: trivial protocol examplePeter Wu1-0/+23
Added in 2015-09-27, contains a minimal dissector that does not use fields.
2016-12-22file-zip: remove "._" from field namesPeter Wu1-1/+1
These were not supposed to be exposed in the actual filters, but are used internally because a table value could not act as both a ProtoField and a table of other ProtoFields.
2016-12-22file-zip: further speed up DD searchPeter Wu1-14/+13
The previous implementation took 8.9 seconds with this command: tshark -Xlua_script:file-zip.lua -r TechnicLauncher.jar -Vx -ozip_archive.decompress:FALSE If the signature was not optional, we could optimize and avoid a linear search, using string.find with steps of four bytes on negative match. This would take 5.6 seconds (but does not handle a missing signature). The combined approach that first scans with string.find (assuming a signature) and then falling back to a linear search (assuming no signature) would take 14.4 seconds (terrible in the worst case). So try another approach, doing a byte for byte search (as before), but then delaying the signature check until the length is valid. This improves the running time to 7.5 seconds.
2016-12-22file-zip: speed up data descriptor scanningPeter Wu1-7/+7
Reduce time to process TechnicLauncher.jar from 20 to 9 seconds (ASAN build with tshark -Vx) by reducing TvbRange allocations.
2016-12-22file-zip: allow decompression to be disabledPeter Wu1-2/+4
Allow decompression to be disabled for performance reasons.
2016-12-22file-zip: decode External File AttributesPeter Wu1-2/+14
Found also hints via http://unix.stackexchange.com/q/14705/8250 Anslysis of unix/unix.c was done on Info-ZIP 6.0.
2016-12-21file-zip: decode version field, update referencesPeter Wu1-15/+57
System mappings are taken from the APPNOTE.
2016-12-21file-zip: Deflate decompression supportPeter Wu1-0/+9
2016-12-21file-zip.lua: fix data length readoutPeter Wu1-1/+1
Finally parses dex2jar-2.0.zip now :-)
2016-12-21file-zip: compr method and extra attrsPeter Wu1-2/+14
2016-12-21file-zip: recognize Extra data and Jar magicPeter Wu1-4/+22
Jar magic found via https://github.com/openjdk/jdk7-jdk/blob/f977378235c3f9a73b6f90980cbbcb3c78263c30/src/share/classes/java/util/jar/JarOutputStream.java#L103
2016-12-21zip-file: decode more flagsPeter Wu1-12/+37
Based on spec from https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
2016-12-21file-zip: implement heuristics to find DDPeter Wu1-15/+51
To be able to scan linearly, apply heuristics.
2016-12-21file-zip: WIP for data descriptorPeter Wu1-12/+60
Well, this does not work because the actual data size is unknown... And it turns out that you really have to parse the EoCD first, otherwise .jar files cannot be parsed...
2016-12-21file-zip: implement End of Central Directory RecordPeter Wu1-3/+31
And also added missing fields for CD. Both were mostly scripted based on the tables from Wikipedia.
2016-12-21file-zip: implement Central Directory recordPeter Wu1-6/+60
2016-12-21file-zip: decode local file headerPeter Wu1-1/+104
2016-12-21file-zip: start of a Zip Archive file dissector for WiresharkPeter Wu1-0/+95
Implemented a template for opening a file and making it available to dissectors. For this, a FileHandler has been implemented which then links with the MIME encapsulation type. The "seek_read" issue mentioned in the comments should be fixed with https://code.wireshark.org/review/19366
2016-07-27lua/r8152.lua: add basic USB dissector for Realtek Ethernet adapterPeter Wu1-0/+73
Last modified at 2015-12-08
2016-07-06lua/gelf: add very basic GELF dissectorPeter Wu1-0/+27
GELF is a simple UDP protocol, every datagram is a gzipped JSON message. This dissector demonstrates how one could decompress it and parse it as JSON. Does not support chunked format.
generated by cgit v1.2.1 (git 2.18.0) at 2024-04-27 15:29:37 +0000