[Bro] Accessing index of an uint8 array inside record
TQ
nothinrandom at gmail.com
Sat Nov 17 10:50:23 PST 2018
What is the correct way of accessing the index of an array of uint8 inside
a record?
In protocol.pac, I have:
type Record_A = record {
record_b : Record_B;
} &byteorder=littleendian;
type Record_B = record {
data: uint8[4];
} &byteorder=littleendian;
In analyzer.pac, I tried using ${Record_A.record_b.data[0]}, but the log
becomes empty. However, if I change data from uint8[4] to uint32 and used
${Record_A.record_b.data}, then the log gets generated correctly. I also
tried: test->Assign(i, new Val((*Record_A.record_b.data)[0], TYPE_COUNT));
but no luck. I'm probably missing something silly here, but can't seem to
figure it out. Welcome all pointers!
Thanks,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20181117/8caf0080/attachment.html
More information about the Bro
mailing list