There is a wip dissector for the windows search protocol from gregor beck, I have used it, it's nice but it is missing some things I need. I have no idea about wireshark dissectors, I would like to hack on this and make it more useful to me,
To learn about wireshark to improve the dissector for the wsp protocol that I am trying to learn about in some spare cycles.
- First explored trying to use samba's existing support from the pidl compiler to produce a dissector. The already existing idl that I previously created for the WSP protocol didn't play well with the pidl dissector generation code. Looking at the code generated for simpler idl constructs made my think even if I managed to make it work that the results wouldn't be satisfying. Mainly it seems to me that the pidl generated code doesn't offer any separation between the presentation and unmarshalling of the protocol data, display of such 'raw' data in the dissector imho wouldn't be very useful. (but perhaps this might itself make in interesting hackweek project)
- Secondly wrote some hacky tooling to extract a further 181 property sets from the msdn documentation thus increasing the property description coverage of the existing dissector by a further 290 or so descriptions.
- Thirdly my main goal, this was to actually be dissect the main results response message which currently is not dissected at all
CPMGetRows message response before hackweek
CPMGetRows message response after hackweek
4. Fourthly found and fixed bug where the existing dissector fails to process SMB2 Read Response and Write Requests which can carry WSP messages
request containing ignored WSP messages before hackweek
request containing WSP messages now handled after hackweek
Great to have the opportunity to hack on something for fun, learn about the innards or something you use, and beat it into being more useful for your own (and hopefully others) purposes.
Patches are available from my repo
This project is one of its kind!