The PROPERTYINFO data structure is used to describe the properties that the protocol parser needs to describe the frames.
typedef struct _PROPERTYINFO
{
HPROPERTY hProperty;
DWORD Version;
LPSTR Label;
LPSTR Comment;
BYTE DataType;
BYTE DataQualifier;
union
{
LPVOID lpExtendedInfo;
LPRANGE lpRange;
LPSET lpSet;
DWORD Bitmask;
DWORD Value;
};
WORD FormatStringSize;
LPVOID InstanceData;
} PROPERTYINFO;
typedef PROPERTYINFO *LPPROPERTYINFO;
For example, the PROPERTYINFO table for the SMB parser starts like this:
PROPERTYINFO property_table[] =
{
// PROP_SMB_SUMMARY
{ 0,0,
"Summary",
"Server Message Block (SMB)",
PROP_TYPE_SUMMARY,
PROP_QUAL_NONE,
NULL,
128,
fm_smb_summary },
...
At Register time, the SMB parser then tell the system about the properties like this:
for (i = 0; i < PROP_LAST_PROPERTY; i++)
{
AddProperty(hSMBProtocol, &property_table[i]);
}