1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
-- declare some Fields to be read
usb_hl_f = Field.new("usb.usbpcap_header_len")
usb_tt_f = Field.new("usb.transfer_type")
usb_dl_f = Field.new("usb.data_len")
-- declare our (pseudo) protocol
dispenser_proto = Proto("dispenser","NCR S1 Dispenser")
u1_vals = {
[ 1 ] = "Command (?)",
[ 2 ] = "Upload (?)",
}
-- create the fields for our "protocol"
u00_00_F = ProtoField.uint8("dispenser.u01", "Unknown 00", base.HEX, u1_vals)
u01_05_F = ProtoField.bytes("dispenser.u02", "Unknown 01-05")
seq_F = ProtoField.uint16("dispenser.seq", "Sequence Nr (?)", base.HEX)
magic_F = ProtoField.uint16("dispenser.magic", "Magic Cookie", base.HEX)
u0a_0f_F = ProtoField.bytes("dispenser.u0a", "Unknown 0a-0f", base.HEX)
u10_17_F = ProtoField.bytes("dispenser.u10", "Unknown 10-17", base.HEX)
u18_1f_F = ProtoField.bytes("dispenser.u18", "Unknown 18-1f", base.HEX)
-- add the field to the protocol
dispenser_proto.fields = {
u00_00_F,
u01_05_F,
seq_F,
magic_F,
u0a_0f_F,
u10_17_F,
u18_1f_F,
}
-- create a function to "postdissect" each frame
function dispenser_proto.dissector(buffer,pinfo,tree)
-- obtain the current values the protocol fields
local usb_hl = usb_hl_f()
local usb_tt = usb_tt_f()
local usb_dl = usb_dl_f()
if usb_tt.value == 0x01 and usb_dl.value >= 63 then
local off = 64 -- linux (usbmon)
if usb_hl then
off = usb_hl.value -- windows (https://desowin.org/usbpcap/)
end
local magic = buffer(off + 8,2)
if magic:le_uint() == 0xbeef then
local subtree = tree:add(dispenser_proto, "NCR S1 Dispenser")
subtree:add(u00_00_F, buffer(off + 0x00,1))
subtree:add(u01_05_F, buffer(off + 0x01,5))
subtree:add_le(seq_F, buffer(off + 0x06,2))
subtree:add_le(magic_F, magic)
subtree:add(u0a_0f_F, buffer(off + 0x0a,6))
subtree:add(u10_17_F, buffer(off + 0x10,8))
subtree:add(u18_1f_F, buffer(off + 0x18,8))
end
end
end
-- register our protocol as a postdissector
register_postdissector(dispenser_proto)
|
