[Richard Sharpe <realrichardsharpe@xxxxxxxxx>]

On Sat, Jul 21, 2012 at 6:03 PM, Richard Sharpe
<realrichardsharpe@xxxxxxxxx> wrote:
> On Sat, Jul 21, 2012 at 11:00 AM, Richard Sharpe
> <realrichardsharpe@xxxxxxxxx> wrote:
>> I have started working on an NPL to Wireshark compiler/converter ...
>>
>> At this stage all I have is an initial Flex scanner file and a simple
>> Lemon grammar and some test files. The grammar is conflict free, but
>> not necessarily complete (lacking in examples and there does not seem
>> to be a spec from Microsoft :-(). I have been working from the
>> example/s in the Microsoft document I posted a link to a few days ago
>> called "Writing a Parser from Wire to Window."
>>
>> The next steps are to:
>>
>> 1. Get the grammar working more, and in particular, generate an AST,
>> 2. Add more to the grammar
>> 3. Generate dissectors in C.
>>
>> What I have is attached for those who are curious and for feedback.
>
> I have established a github repository for this. You can do:
>
>          git clone git@xxxxxxxxxx:RichardSharpe/npl-to-wshark.git

Well, having downloaded the NPL archive from the download link here:
http://nmparsers.codeplex.com/

it is clear that this is not going to be easy :-)

For example, there is a netmon.npl that has interesting things like this:

//
// Frame that contains the active network adapter used when the
capture file was created
//
Protocol NetworkInfo = FormatString("Network info for %s, Network
Adapter Count = %d",ComputerName,AdapterCount)
{
    UINT16 AdapterCount;
    [DataFieldByteOrder = LittleEndian]
    UnicodeString ComputerName;
    [MaxLoopCount=AdapterCount, Property.NetworkAdapterInfo = "NetworkInfo"]
    while[true] {
                NetMonNetworkAdapter NetworkAdapter;
    }
}

Seems like they have a fake frame that provides info about adapters
and the one that was used for capturing. In addition, there are
pragmas in there ([DataFieldByteOrder = LittelEndian] as well as
forward references from the FormatString to the fields in the
structure. Then there is that while[true] loop and references to a
structure further down:

Struct NetMonNetworkAdapter = FormatString("%s,
%s",Property.NetworkInfoFriendlyName,Property.NetworkInfoHardwareAddr)
    {
        [DataFieldByteOrder = LittleEndian]
        [Property.NetworkInfoFriendlyName]
        UnicodeString FriendlyName;
        [DataFieldByteOrder = LittleEndian]
        UnicodeString Description;
        switch(Property.NetworkAdapterInfo)
        {

which then has a Property.NetworkAdapterInfo (although it seems that
[Property.blah] before a field declares that field to be a property,
it seems.) which refers back to the NetworkInfo structure earlier.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)