[Question] How to enable heuristic dissectors?

[Matheus-Garbelini]

Hi, I have a capture which only works with heurisitc dissectors - the payload is inserted inside UDP and a magic string is used to identify the protocol.

In root folder, we should have /wireshark/heuristic_protos
which contains lines

mac_lte_udp,1
mac_nr_udp,1

However, even if I try to insert this file by manually writing to the virtual file system, wiregasm does not seem to enable the dissectors. Is there any way to enable such in wiregasm?

The PCAP I'm using is attached as shown below.

Normally, to enable it you just have to go to the list of enable protocols in wireshark (Ctrl+SHIFT+E) and then search for mac_nr_udp.

nr.tar.gz

[dehydr8]

@Matheus-Garbelini the way we've patched Wireshark currently, the heuristic_protos was being read from a different directory and not /wireshark (the data directory). I've (Claude Opus mostly 😅) created a PR to add first-class support for managing protocols and heuristic dissectors at runtime.

Let me know if that works for you, I've used your sample as a test case.

[Matheus-Garbelini]

I see thanks a lot! Do you happen to know what the other directory it was being read from? Currently I can write to any directory in the FS, I just need to know the path.

[dehydr8]

@Matheus-Garbelini it's /home/web_user/.config/wireshark, try something like:

wg.init(loadWiregasm, overrides, async (lib) => {
  lib.FS.mkdirTree("/home/web_user/.config/wireshark");
  lib.FS.writeFile("/home/web_user/.config/wireshark/heuristic_protos", "mac_nr_udp,1\n");
});

And then load your capture file. Let me know if it works.

[Matheus-Garbelini]

Unfortunatelly it didn't work. But just saw you have a PR, will try that and let you know, thanks again.
By the way, what is the framework you use to automate this PRs via claude?

[dehydr8]

I validated setting the path on a local good-tools/good.tools build and it does work, see attached image.

The diff:

diff --git a/src/workers/wiregasm.worker.js b/src/workers/wiregasm.worker.js
index f5876a7..a92291e 100644
--- a/src/workers/wiregasm.worker.js
+++ b/src/workers/wiregasm.worker.js
@@ -46,6 +46,9 @@ fetchPackages()
       },
       handleStatus: (type, status) => postMessage({ type: 'status', code: type, status: status }),
       handleError: (error) => postMessage({ type: 'error', error: error }),
+    }, async (lib) => {
+      lib.FS.mkdirTree("/home/web_user/.config/wireshark");
+      lib.FS.writeFile("/home/web_user/.config/wireshark/heuristic_protos", "mac_nr_udp,1\n");
     })
       .then(() => {
         postMessage({ type: 'init' })

The important bit is that the configuration file needs to exist before the underlying init is called.

[Matheus-Garbelini]

@dehydr8 Thanks a lot. This works well. This project works really well to showcase specialized dissection without wireshark intalled on a server. Just curious what is the IDE or ai framework you use to automate the PR? Found very efficient haha

[dehydr8]

@Matheus-Garbelini #26 is the first AI one, but with manual oversight. It wasn't fully automated, I used VSCode with Cline (and AWS Bedrock for the models) for this one.

[Matheus-Garbelini]

Thanks @dehydr8