How To Make Lua C Scripts Online
How To Make Lua C Scripts Free
How To Make Lua Scripts For Roblox
How To Make Lua Scripts

This post will explain how you can easily create protocol dissectorsin Wireshark, using the Lua programming language. This is can be useful when you’re working witha custom protocol that Wireshark doesn’t already have a dissector for. If Wireshark looks likethis for example

it’s hard to tell what the various bytes in the data part represents.

Wireshark is written in C, and dissectors for Wireshark are generally also written in C. However,Wireshark has a Lua implementation that makes it easy for people who are unfamiliar with C to writedissectors. For those who are unfamiliar with Lua, it’s a very light-weight programming languagethat is designed to be implemented as a scripting language in applications to extend theirfunctionality.

The downside of using Lua is that the dissector will be slower than a dissector written in C.

A loop statement allows us to execute a statement or group of statements multiple times. Following is the general form of a loop statement in most of the programming languages −. Lua provides the following types of loops to handle looping requirements. Intro to ECS and basic principles Part 2. Implementing the basics Part 3. Controlling entities in Lua by calling C functions. There are many reasons to use Lua with C. One of them is that you can put some of the logic from C code into scripts, so you can easily change them without the need. The goal of scripting is simple, your attempting to make the game itself work, not much else if you put it into a broad spectrum. Note, the following tutorial is for Roblox Lua, your experiences with other programs such as JavaScript, Python, C+, PHP, and all others will be significantly different. First, you push a key name to the stack. Then you call luagettable to get value of the key (it could be another table or just a simple variable). Now that you have the needed value on the stack, you can convert it to int or const char. by calling luatonumber or luatostring respectively.

Before we start writing the dissector, let’s go through a crash course on Lua. It’s not importantto know the language in detail, but we must know the basics.

Lua crash course

Lua is multi-paradigm, and supports procedural style, functional programming to some degree, andit also has some object-oriented programming features. It doesn’t have classes, prototypes orinheritance out of the box, but they can be made by the programmer.
It’s dynamically typed.
Scope is either local or global. It’s global if you don’t declare it.
Semicolons are not needed. Whitespace is not important like in Python.
Lines that start with -- are comments.
Don’t use ++ or +=. Use i = i + 1 instead.
Not equal in conditionals is ~= rather than !=.
Its types are: string, number, boolean, nil, function, userdata, thread and table. Numberrepresents all numbers, both floating points and integers. Booleans are either true or false.Strings are either single-quote or double-quote. You can forget about thread and userdata.
nil is a non-value. A variable will have the value nil before it’s assigned a proper value.
In conditionals: nil and false are falsy, the rest are thruthy.
Lua has a type called table, which is also the only data structure it has. Tables implementsassociative arrays. Associative arrays can be indexed by both numbers and other types, such asstrings. They have no fixed size and elements can be added dynamically. Tables are often calledobjects. They are created like this:

Values are assigned like this:

They can have functions and are generally very similar to objects in JavaScript.

Conditional branching looks like this:

Loops look like this:

That is i = first, last, delta. break can be used, but continue cannot.

Functions are declared like this:

and are called like this:

If you see functions called like this:

then the functions func1 and func2 belongs to the table (object) a. Using colon is syntacticsugar for passing the object itself as an argument to the function. That means a:func1() issimilar to a.func1(a).

That’s the important stuff. You can read the Lua 5.3 Reference Manualif you care about the details.

Setup

If you go to Help –> About Wireshark –> Folders, you’ll find all the folders Wireshark reads Luascripts from. Choose either the Personal Lua Plugins, Global Lua Plugins or Personal configurationfolder. E.g. C:Program FilesWiresharkplugins2.4.2 on Windows. The script will be active whenWireshark is started. You have to restart Wireshark after you do changes to the script, or reloadall the Lua scripts with Ctrl+Shift+L.

I’m using the latest version at the current date. What I’m doing here might not work on earlierversions.

How To Make Lua C Scripts Online

The protocol

The most interesting protocol to investigate in this post would probably be a custom one thatWireshark doesn’t know of already, but all the custom protocols I’ve worked with have been workrelated and I can’t post information about them here. So instead we’ll look at theMongoDB wire protocol.

(There is already a Mongo dissector in Wireshark, but I will not use that one.)

According to the specification linked to above, the MongoDB wire protocol is a TCP/IP protocolusing port number 27017. The byte ordering is little endian, meaning the least significant bytecomes first. Most protocols are big endian. The only difference is the ordering of the bytes. Ifwe had an int32 for example, with these bytes: 00 4F 23 11 in big endian, then the little endianversion would be 11 23 4F 00. This is something must to take into account when writing thedissector.

In this post, I’ll only take a look at the header of the protocol. It looks like this

We can see that it has four int32s, each containing 4 bytes, because 4*8 = 32.

Setting up the boilerplate code

Let’s start by setting up some of the boilerplate code that’s needed in all dissectors:

We start my creating a Proto (protocol) object and call it mongodb_protocol. Thetable constructor takes two arguments: name and description. The protocol requires a fieldstable and a dissector function. We haven’t added any fields yet, so the fields table is empty. Thedissector function is called once for every packet of our type.

The dissector function has three parameters: buffer, pinfo and tree. buffer contains thepacket’s buffer and is a Tvb object. It contains the data we want to dissect. pinfocontains the columns of the packet list and is a Pinfo object. Finally, tree isthe tree root and is a TreeItem object.

Inside the dissector function, we start by checking the length of the buffer and then returning ifit’s empty.

As mentioned before, the pinfo object contains the columns in the packet list. We can use it toset the protocol name when we receive a packet of MongoDB type. On the script’s first line we setthe name of the protocol to be “MongoDB” (by passing the name to the constructor). We set theprotocol column name here

and the protocol column name changes from TCP to MONGODB:

We must then create a sub tree in the tree structure found in the Packet Details pane. It done byadding an additional tree item to the tree object that was passed as an argument to the dissectorfunction.

The string is the name of the sub tree. Without having added any fields it will look like this:

Finally, we must assign the protocol to a port. In my case, I’ll use port 59274, because that’s theport I use to connect to the Mongo database.

'udp.port' can also be used, if the protocol uses UDP rather than TCP.

Adding fields

The script already runs at this stage, but it isn’t doing anything useful. For the script to dosomething useful we have to add the