Search code examples
luautf-16wireshark-dissector

Wireshark Lua dissector utf16 string

I am writing a custom Wireshark Lua dissector. One field in the dissector is a UTF16 string. I tried to specify this field with

msg_f = ProtoField.string("mydissector.msg", "msg", base.UNICODE)
local getMsg = buffer(13) -- starting on byte 13
subtree:add_le(m.msg_f, getMsg)

However, this only adds the first character rather than the whole string. It also raises an Expert Info warning undecoded trailing/stray characters.

What is the correct way to parse a UTF16 string?

Solution

  • The solution I came up with is simply:

    msg_f = ProtoField.string("mydissector.msg", "msg")
local getMsg = buffer(13) -- starting on byte 13
local msg = getMsg:le_ustring()
subtree:add(msg_f,  getMsg, msg)