pyshark
pyshark copied to clipboard
Nothing shows in `Layer XXX_RAW` when calling `pretty_print` with `include_raw=True`
Describe the bug
No matter use_ek=True, include_raw=True or use_json=True, include_raw=True, nothing shows in Layer XXX_RAW when calling pretty_print.
To Reproduce
import pyshark
def tshark_callback(packet):
packet.pretty_print()
# print(packet.__str__())
cap = pyshark.LiveCapture(use_ek=True, include_raw=True, interface='wlan')
cap.set_debug()
cap.apply_on_packets(tshark_callback)

Replace use_ek with use_json, and as the same nothing shows in xxx_raw layer.

Expected behavior
Show the raw hex data in the specific xxx_raw fields.
Versions (please complete the following information):
- OS: Windows 10
- pyshark version: v0.5.3
- tshark version: TShark (Wireshark) 3.6.6 (v3.6.6-0-g7d96674e2a30)
The bug also occurs on Linux (Ubuntu 20.04) with pyshark v0.5.3 and TShark (Wireshark) 3.2.3 (Git v3.2.3 packaged as 3.2.3-1).
sudo tshark -l -n -T ek -x -P -V -i eth0 -c 1
Using ek mode, tshark return a JSON object which the type of xxx_raw layers (just like frame_raw) is str rather than dict.

However, in the source code the author parses it as dict. https://github.com/KimiNewt/pyshark/blob/60f08211ae79e9ca185b5cefd5039029b2b85d84/src/pyshark/packet/layers/ek_layer.py#L42-L44
The function pretty_print gets all keys in the dict, and in detail it gets field_names...
https://github.com/KimiNewt/pyshark/blob/60f08211ae79e9ca185b5cefd5039029b2b85d84/src/pyshark/packet/layers/ek_layer.py#L109-L126
https://github.com/KimiNewt/pyshark/blob/60f08211ae79e9ca185b5cefd5039029b2b85d84/src/pyshark/packet/layers/ek_layer.py#L63-L76
The raw layers belong to str type, which have no keys. So maybe you have to judge the type first before processing it...
It seems that another issue #586 is also caused by this problem.
This is still a problem today. This function that's in packet doesn't work either. The assert checks that FRAME_RAW is in the packet, which it is, but self.frame_raw.value isn't valid.
def get_raw_packet(self) -> bytes:
assert "FRAME_RAW" in self, "Packet contains no raw data. In order to contains it, " \
"make sure that use_json and include_raw are set to True " \
"in the Capture object"
raw_packet = b''
byte_values = [''.join(x) for x in zip(self.frame_raw.value[0::2], self.frame_raw.value[1::2])]
for value in byte_values:
raw_packet += binascii.unhexlify(value)
return raw_packet
I've tried updating the code to put frame_raw into the frame dictionary so that the EkLayer can access it that way, but that didn't work either. There must be some lookup table indicating what the valid fields are.