Question

I am trying to build a dissector for Wireshark on Windows platform. But, I am getting an error.

  1. I followed this link to install Wireshark from the source on windows, and I was able to build and run the software successfully.
  2. Then using the README.plugins, I added a plugin, and did all the changes, mentioned in the file.
  3. With the plugin, it built successfully, but whenever I tried running it, a dialog box appears stating The plugin 'ABC.dll' has neither a register routine, a register_tap_listener or a register_wtap_module or a register_codec_module routine.. Though wireshark is running fine, but my plugin is not included in it.
  4. Linux Environment: I tried compiling and running on linux platform, and it worked fine, with the plugin included.
    Can anybody tell me, where I might be going wrong on the windows platform. Thanks.
Was it helpful?

Solution

There's a bit of magic which happens when building plugins on Windows so that certain symbols in the DLL are declared as exported so they can be found in the DLL at run-time. (I haven't recently dug into all the details, but the mechanism is different on *nix and so the results on each platform might be different).

What version of Wireshark are you building ? (How are you getting the Wireshark sources ?).

The specific error message you re getting suggests you might be building a version of WWireshark 1.10. (The message has changed in the Wireshark development version (1.11)).

In any case, something is not quite right (obviously) as to how the DLL is being built on Windows.

My suggestion as a starting point:

You might be able get an idea as to what's wrong by comparing the plugin.c file (which is generated at build time) in your plugin directory on Windows with a plugin.c from one of the other Wireshark Windows plugin directories.

The magic occurs in that file.

Things like:

WS_DLL_PUBLIC_NOEXTERN void
plugin_reg_handoff(void)
{
  {extern void proto_reg_handoff_unistim (void); proto_reg_handoff_unistim ();}
}
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top