Re: Extract bytes from a tvbuff_t

[Jakub Zawadzki <darkjames-ws () darkjames pl>]

Hi,

On Sun, May 26, 2013 at 09:29:54AM -0600, rion () rubion com wrote:
> I found that this gives me the exact number of bytes I'm looking for:
>
> fwrite(tvb, tvb_length(tvb), 1, fp);
>
> Unfortunately, when I check the resulting file in a hex editor the 
> bytes don't match up with what I see in the WireShark UI.
>
> In the UI I see (Partial):
>
> 16 03 01 00 39 02 00 00 35 03 01 51 a2 28 a1 19 75 ae ac 53 4f 36 a8 81 
> 62 48
>
> In the File I see (Partial):
>
> f0 a5 05 05 d0 6b fa 04 01 00 00 00 01 00 00 00 00 00 00 00 70 6e fa 04 
> d0 6b
>
> I checked the end of the file to see if the bytes were 'backwards' and 
> they are not. I'm not quite sure what to do now- am I missing something 
> obvious?

Try:
  int tvb_len = tvb_length(tvb);

  fwrite(tvb_get_ptr(tvb, 0, tvb_len), tvb_len, 1, fp);

hth.

Kuba.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe