Initial commit

tplink-smarthome.lua

@@ -0,0 +1,88 @@
+-- TP-Link Smart Home Protocol (Port 9999) Wireshark Dissector
+-- For decrypting local network traffic between TP-Link 
+-- Smart Home Devices and the Kasa Smart Home App
+--
+-- Install under:
+-- (Windows)      %APPDATA%\Wireshark\plugins\
+-- (Linux, Mac)   $HOME/.wireshark/plugins
+--
+-- by Lubomir Stroetmann
+-- Copyright 2016 softScheck GmbH 
+-- 
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+-- 
+--    http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+--
+
+-- Create TP-Link Smart Home protocol and its fields
+p_tplink = Proto ("TPLink-SmartHome","TP-Link Smart Home Protocol")
+
+-- Dissector function
+function p_tplink.dissector (buf, pkt, root)
+  -- Validate packet length
+  if buf:len() == 0 then return end
+  pkt.cols.protocol = p_tplink.name
+ 
+  -- Decode data
+        local ascii = ""
+		local hex = ""
+		
+		-- Skip first 4 bytes (header)
+        start = 4
+        endPosition = buf:len() - 1
+		
+		-- Decryption key is -85 (256-85=171)
+		local key = 171
+
+		-- Decrypt Autokey XOR
+		-- Save results as ascii and hex
+        for index = start, endPosition do
+          local c = buf(index,1):uint()
+		  -- XOR first byte with key
+		  d = bit32.bxor(c,key)
+		  -- Use byte as next key
+		  key = c
+		 
+		  hex = hex .. string.format("%x", d)
+          -- Convert to printable characters
+          if d >= 0x20 and d <= 0x7E then
+            ascii = ascii .. string.format("%c", d)
+          else
+            -- Use dot for non-printable bytes
+            ascii = ascii .. "."
+          end
+        end
+
+  
+  -- Create subtree
+  subtree = root:add(p_tplink, buf(0))
+  
+  -- Add data to subtree
+  subtree:add(ascii)
+  -- Description of payload
+  subtree:append_text(" (decrypted)")
+  
+  -- Call JSON Dissector with decrypted data
+  local b = ByteArray.new(hex)
+  local tvb = ByteArray.tvb(b, "JSON TVB")
+  Dissector.get("json"):call(tvb, pkt, root)
+ 
+end
+ 
+-- Initialization routine
+function p_tplink.init()
+end
+ 
+-- Register a chained dissector for port 9999
+local tcp_dissector_table = DissectorTable.get("tcp.port")
+dissector = tcp_dissector_table:get_dissector(9999)
+tcp_dissector_table:add(9999, p_tplink)