Lua + LuaSocket problem (Win64)

Wireshark
1

Hi there,

I am running Wireshark 1.8.5 (with Lua 5.1) on Windows 7 Home Premium (x64). I also have Lua For Windows 5.1.4.

I’ve set up a simple tap with Lua, which works fine, but I’d like to be able to report certain statistics to a URL through LuaSocket.

LUA_PATH & LUA_CPATH are correctly set to expose /lua/socket.lua and /clibs/socket/core.dll to require(), but when I call require(“socket.http”), I get:

[quote]tshark: Lua: Error during loading:
error loading module ‘socket.core’ from file ‘C:\Program Files (x86)\Lua\5.1\cl
ibs\socket\core.dll’:
%1 is not a valid Win32 application.[/quote]

Note that the same require call works fine if I run it through lua.exe (not Wireshark’s interpreter).

Has anyone found a way to do this?

Thanks!

3

The error message you get when calling require("socket.http") inside Wireshark’s Lua interpreter:

error loading module ‘socket.core’ from file ‘C:\Program Files (x86)\Lua\5.1\cl
ibs\socket\core.dll’:
%1 is not a valid Win32 application.

indicates a bitness mismatch or incompatibility between the Lua interpreter embedded in Wireshark and the LuaSocket DLL (core.dll) you are trying to load

Explanation and Cause

  • Wireshark 1.8.5 ships with Lua 5.1 embedded, but the LuaSocket DLL you have is likely compiled for a different Lua version or architecture (e.g., 64-bit vs 32-bit).
  • The error %1 is not a valid Win32 application usually means the DLL is either 64-bit while the host process is 32-bit, or vice versa.
  • Also, LuaSocket modules are compiled against a specific Lua DLL (e.g., lua5.1.dll vs lua51.dll), and if those don’t match exactly, loading fails.
  • The fact that require("socket.http") works fine when run in standalone lua.exe but not in Wireshark confirms the embedded Lua environment is different.

Solutions

  1. Match the bitness and Lua version
    You must use a LuaSocket DLL compiled exactly for the same Lua version and architecture as Wireshark’s embedded Lua interpreter.
  • If Wireshark is 32-bit, use 32-bit LuaSocket DLLs compiled for Lua 5.1.
  • If Wireshark is 64-bit, use 64-bit LuaSocket DLLs compiled for Lua 5.1.
    Mixing 32-bit and 64-bit binaries causes this error.
  1. Copy required Lua DLLs to Wireshark folder
    LuaSocket DLLs depend on Lua DLLs (e.g., lua5.1.dll). If Wireshark uses lua5.1.dll but your LuaSocket DLL was built against lua51.dll, this mismatch causes failure.
  • Copy the Lua DLLs (lua5.1.dll and/or lua51.dll) into the Wireshark executable directory to ensure the correct Lua runtime is found.
  1. Rebuild LuaSocket for Wireshark Lua environment
    If precompiled binaries are not available, compile LuaSocket yourself against the Lua version and architecture used by Wireshark.
    This ensures compatibility and resolves the %1 is not a valid Win32 application error.
  2. Avoid mixing Lua installations
    Ensure your LUA_PATH and LUA_CPATH environment variables point to the LuaSocket files built for Wireshark’s Lua, not to your standalone Lua for Windows installation.
    Mixing paths can cause Lua to try loading incompatible DLLs.
  3. Alternative: Use Lua’s TCP socket directly
    If LuaSocket integration is too complex, consider implementing HTTP requests using raw TCP sockets if Wireshark’s Lua supports it, or use external tools to report statistics.