Home page logo
/

wireshark logo Wireshark mailing list archives

Re: Writing python dissectors for Wireshark
From: Eshed Shaham <ashdnazg () gmail com>
Date: Thu, 24 Jan 2013 19:44:33 +0200

Hey,
I added the various files and fixes needed and the plugin currently builds
and runs alright on my ubuntu.
'make' and 'make install' work as they should.
It's now on the default branch in the google code repository (
http://code.google.com/p/pyreshark/) so the code can be cloned from there.

If anyone succeeds/has difficulties in building/using it, please let me
know :)

Cheers,
Eshed

On Fri, Jan 18, 2013 at 9:57 PM, Evan Huus <eapache () gmail com> wrote:

The linked patch adds a preliminary automake file, adds some linux
build results to hgignore and fixes one last gcc-specific warning.
With this applied it at least builds on my Ubuntu box. I'm more or
less out of time for this at the moment unfortunately, hope it helps.

Cheers,
Evan

http://dl.dropbox.com/u/171647/pyreshark.patch

On Fri, Jan 18, 2013 at 12:15 PM, Eshed Shaham <ashdnazg () gmail com> wrote:
Thanks for the reply,
I fixed the issues you mentioned in the source and also replaced some
slashes with os.path alternatives. It's now pushed to googlecode
repository.
I think that python/cal/c_abstraction_layer.py should have the c'tor
fixed
(that's where the CDLL calls are) but unfortunately I don't have a linux
machine at my disposal to test it.
If you make any progress with the porting, send me with a patch I'd be
more
than happy to add it to the repository.

Cheers,
Eshed

On Fri, Jan 18, 2013 at 2:35 AM, Evan Huus <eapache () gmail com> wrote:

Looks interesting. I haven't been able to get it to build on my Linux
box yet, but I've hit a few minor issues that are pretty trivial to
take care of:
- You have unnecessary trailing slashes in your Makefile.common -
specifically lines 31 and 36 can't have trailing slashes or autofoo
gets confused.
- You seem to be shipping a Makefile.in instead of a Makefile.am - the
former is typically generated by the latter, not the other way around.
- Functions taking no arguments must have their argument list
specified as void, not left blank, ie function(void) instead of
function(). This causes problems with init_pyreshark and
handoff_pyreshark. Note that this applies to the definition in the .c
file as well as the declaration in the .h file.

I also ran into http://bugs.python.org/issue896330 but that's not your
fault :)

With a little bit of hacking I managed to get it to run through GCC at
least. That spit out the following list of warnings-treated-as-errors:

pyreshark.c: In function 'init_pyreshark':
pyreshark.c:60:5: error: passing argument 2 of 'PyFile_FromString'
discards 'const' qualifier from pointer target type [-Werror]
In file included from /usr/include/python2.7/Python.h:108:0,
                 from pyreshark.c:32:
/usr/include/python2.7/fileobject.h:40:24: note: expected 'char *' but
argument is of type 'const char *'
pyreshark.c: In function 'add_tree_item':
pyreshark.c:128:58: error: unused parameter 'pinfo'
[-Werror=unused-parameter]
pyreshark.c: In function 'add_text_item':
pyreshark.c:136:5: error: format not a string literal and no format
arguments [-Werror=format-security]
pyreshark.c:134:58: error: unused parameter 'pinfo'
[-Werror=unused-parameter]
pyreshark.c: In function 'push_tree':
pyreshark.c:140:54: error: unused parameter 'pinfo'
[-Werror=unused-parameter]
pyreshark.c: In function 'pop_tree':
pyreshark.c:151:53: error: unused parameter 'pinfo'
[-Werror=unused-parameter]
pyreshark.c: In function 'advance_offset':
pyreshark.c:161:59: error: unused parameter 'pinfo'
[-Werror=unused-parameter]
pyreshark.c: In function 'set_column_text':
pyreshark.c:172:33: error: unused parameter 'tvb_and_tree'
[-Werror=unused-parameter]
pyreshark.c:172:72: error: unused parameter 'p_offset'
[-Werror=unused-parameter]
pyreshark.c: At top level:
pyreshark.c:43:13: error: 'proto_dummy_pyreshark' defined but not used
[-Werror=unused-variable]

Hope this helps,
Evan

On Thu, Jan 17, 2013 at 12:29 PM, Eshed Shaham <ashdnazg () gmail com>
wrote:
Hey guys,

I recently coded a plugin for wireshark which is actually a framework
for
allowing new dissectors to be written in python.
Unlike the unused python bindings in Wireshark's source, my plugin
hides
Wireshark's interface and provides a more "pythonic" one to the
developer.
I'm already using it for some time, and adding new features every now
and
then. Generally it can be quite useful if you don't like lua (or maybe
even
if you do...).

Feel free to grab the code or precompiled Windows binaries from google
code:
http://code.google.com/p/pyreshark/
There are also some helpful wiki pages there.

Do note that I haven't tried compiling it on anything that isn't
Windows, I
believe the code might need some porting before it can be built for
other
OS's.

Feedback of any kind is welcome,
Eshed





___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

mailto:wireshark-dev-request () wireshark org?subject=unsubscribe




___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org
?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org
?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]