[Bro] Accessing index of an uint8 array inside record

TQ nothinrandom at gmail.com
Sat Nov 17 10:50:23 PST 2018


What is the correct way of accessing the index of an array of uint8 inside
a record?

In protocol.pac, I have:

type Record_A = record {
    record_b : Record_B;
} &byteorder=littleendian;

type Record_B = record {
    data: uint8[4];
} &byteorder=littleendian;


In analyzer.pac, I tried using ${Record_A.record_b.data[0]}, but the log
becomes empty.  However, if I change data from uint8[4] to uint32 and used
${Record_A.record_b.data}, then the log gets generated correctly.  I also
tried: test->Assign(i, new Val((*Record_A.record_b.data)[0], TYPE_COUNT));
but no luck.  I'm probably missing something silly here, but can't seem to
figure it out.  Welcome all pointers!

Thanks,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20181117/8caf0080/attachment.html 


More information about the Bro mailing list