andydavies / bplist-dissector Goto Github PK

The protocol uses a four byte packet to the length of the next packet i.e. packet containing bplist

Sometimes this sequence breaks down and the four bytes are added to the start of the bplist packet - this is fairly easy to resolve as the bplist marker will be just four byte further on in the packet.

Sometime the four bytes are are tagged onto the end on the previous bplist packet this creates a problem as the lookup table for entries in the bplist are at a 32 byte offset from the end of the packet.

Tried using wireshark's packet re-assembly to fix this but couldn't make it work.

It seems that the responsed from iOS are the problematic ones.

https://github.com/andydavies/bplist-dissector/blob/master/bplist.lua#L279

I believe the length has to be multiplied by objectRefSize.