BLF: Support for BLF file format

This patch adds first support for the BLF file format.

8 files changed, 2604 insertions, 3 deletions

diff --git a/docbook/release-notes.adoc b/docbook/release-notes.adoc
index 469fd47ea6..cb5e3e5977 100644
--- a/docbook/release-notes.adoc
+++ b/docbook/release-notes.adoc
@@ -133,6 +133,7 @@ Too many protocols have been updated to list here.
 // Add one file type per line between the -- delimiters.
 [commaize]
 --
+BLF support
 --
 
 // === New and Updated Capture Interfaces support
diff --git a/epan/dissectors/CMakeLists.txt b/epan/dissectors/CMakeLists.txt
index 9640976237..534d64bef3 100644
--- a/epan/dissectors/CMakeLists.txt
+++ b/epan/dissectors/CMakeLists.txt
@@ -639,6 +639,7 @@ set(DISSECTOR_HEADER_FILES
 )
 
 set(DISSECTOR_SRC
+	${CMAKE_CURRENT_SOURCE_DIR}/file-blf.c
 	${CMAKE_CURRENT_SOURCE_DIR}/file-btsnoop.c
 	${CMAKE_CURRENT_SOURCE_DIR}/file-elf.c
 	${CMAKE_CURRENT_SOURCE_DIR}/file-file.c
diff --git a/epan/dissectors/file-blf.c b/epan/dissectors/file-blf.c
new file mode 100644
index 0000000000..9234bf7041
--- /dev/null
+++ b/epan/dissectors/file-blf.c
@@ -0,0 +1,553 @@
+/* file-blf.c
+ * BLF File Format.
+ * By Dr. Lars Voelker <lars.voelker@technica-engineering.de>
+ * Copyright 2020-2021 Dr. Lars Voelker
+  *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998 Gerald Combs
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This dissector allows to parse BLF files.
+ */
+
+ /*
+  * The following was used as a reference for the file format:
+  *     https://bitbucket.org/tobylorenz/vector_blf
+  * The repo above includes multiple examples files as well.
+  */
+
+#include "config.h"
+
+#include <epan/packet.h>
+#include <epan/prefs.h>
+#include <epan/expert.h>
+#include <epan/exceptions.h>
+#include <epan/show_exception.h>
+#include <epan/wmem/wmem.h>
+#include <wiretap/blf.h>
+
+static int proto_blf = -1;
+
+static int hf_blf_file_header = -1;
+static int hf_blf_file_header_magic = -1;
+static int hf_blf_file_header_length = -1;
+static int hf_blf_file_header_api = -1;
+static int hf_blf_file_header_app = -1;
+static int hf_blf_file_header_comp_level = -1;
+static int hf_blf_file_header_app_major = -1;
+static int hf_blf_file_header_app_minor = -1;
+static int hf_blf_file_header_len_comp = -1;
+static int hf_blf_file_header_len_uncomp = -1;
+static int hf_blf_file_header_obj_count = -1;
+static int hf_blf_file_header_app_build = -1;
+static int hf_blf_file_header_start_date = -1;
+static int hf_blf_file_header_end_date = -1;
+static int hf_blf_file_header_restore_point_offset = -1;
+
+static int hf_blf_lobj = -1;
+static int hf_blf_lobj_hdr = -1;
+static int hf_blf_lobj_magic = -1;
+static int hf_blf_lobj_hdr_len = -1;
+static int hf_blf_lobj_hdr_type = -1;
+static int hf_blf_lobj_obj_len = -1;
+static int hf_blf_lobj_obj_type = -1;
+static int hf_blf_lobj_hdr_remains = -1;
+static int hf_blf_lobj_payload = -1;
+
+static int hf_blf_cont_comp_method = -1;
+static int hf_blf_cont_res1 = -1;
+static int hf_blf_cont_res2 = -1;
+static int hf_blf_cont_uncomp_size = -1;
+static int hf_blf_cont_res4 = -1;
+static int hf_blf_cont_payload = -1;
+
+static gint ett_blf = -1;
+static gint ett_blf_header = -1;
+static gint ett_blf_obj = -1;
+static gint ett_blf_obj_header = -1;
+static gint ett_blf_logcontainer_payload = -1;
+
+static const value_string blf_object_names[] = {
+    { BLF_OBJTYPE_UNKNOWN,                          "Unknown" },
+    { BLF_OBJTYPE_CAN_MESSAGE,                      "CAN Message" },
+    { BLF_OBJTYPE_CAN_ERROR,                        "CAN Error" },
+    { BLF_OBJTYPE_CAN_OVERLOAD,                     "CAN Overload" },
+    { BLF_OBJTYPE_CAN_STATISTIC,                    "CAN Statistics" },
+    { BLF_OBJTYPE_APP_TRIGGER,                      "App Trigger" },
+    { BLF_OBJTYPE_ENV_INTEGER,                      "Env Integer" },
+    { BLF_OBJTYPE_ENV_DOUBLE,                       "Env Double" },
+    { BLF_OBJTYPE_ENV_STRING,                       "Env String" },
+    { BLF_OBJTYPE_ENV_DATA,                         "Env Data" },
+    { BLF_OBJTYPE_LOG_CONTAINER,                    "Log Container" },
+    { BLF_OBJTYPE_LIN_MESSAGE,                      "LIN Message" },
+    { BLF_OBJTYPE_LIN_CRC_ERROR,                    "LIN CRC Error" },
+    { BLF_OBJTYPE_LIN_DLC_INFO,                     "LIN DLC Info" },
+    { BLF_OBJTYPE_LIN_RCV_ERROR,                    "LIN Receive Error" },
+    { BLF_OBJTYPE_LIN_SND_ERROR,                    "LIN Send Error" },
+    { BLF_OBJTYPE_LIN_SLV_TIMEOUT,                  "LIN Slave Timeout" },
+    { BLF_OBJTYPE_LIN_SCHED_MODCH,                  "LIN Schedule Mode Change" },
+    { BLF_OBJTYPE_LIN_SYN_ERROR,                    "LIN Sync Error" },
+    { BLF_OBJTYPE_LIN_BAUDRATE,                     "LIN Baudrate" },
+    { BLF_OBJTYPE_LIN_SLEEP,                        "LIN Sleep" },
+    { BLF_OBJTYPE_LIN_WAKEUP,                       "LIN Wakeup" },
+    { BLF_OBJTYPE_MOST_SPY,                         "MOST Spy" },
+    { BLF_OBJTYPE_MOST_CTRL,                        "MOST Control" },
+    { BLF_OBJTYPE_MOST_LIGHTLOCK,                   "MOST Light Lock" },
+    { BLF_OBJTYPE_MOST_STATISTIC,                   "MOST Statistics" },
+    { BLF_OBJTYPE_FLEXRAY_DATA,                     "FlexRay Data" },
+    { BLF_OBJTYPE_FLEXRAY_SYNC,                     "FlexRay Sync" },
+    { BLF_OBJTYPE_CAN_DRIVER_ERROR,                 "CAN Driver Error" },
+    { BLF_OBJTYPE_MOST_PKT,                         "MOST Packet" },
+    { BLF_OBJTYPE_MOST_PKT2,                        "MOST Packet 2" },
+    { BLF_OBJTYPE_MOST_HWMODE,                      "MOST Hardware Mode" },
+    { BLF_OBJTYPE_MOST_REG,                         "MOST Register Data" },
+    { BLF_OBJTYPE_MOST_GENREG,                      "MOST Register Data" },
+    { BLF_OBJTYPE_MOST_NETSTATE,                    "MOST Net State" },
+    { BLF_OBJTYPE_MOST_DATALOST,                    "MOST Data Lost" },
+    { BLF_OBJTYPE_MOST_TRIGGER,                     "MOST Trigger" },
+    { BLF_OBJTYPE_FLEXRAY_CYCLE,                    "FlexRay Cycle" },
+    { BLF_OBJTYPE_FLEXRAY_MESSAGE,                  "FlexRay Message" },
+    { BLF_OBJTYPE_LIN_CHECKSUM_INFO,                "LIN Checksum Info" },
+    { BLF_OBJTYPE_LIN_SPIKE_EVENT,                  "LIN Spike Event" },
+    { BLF_OBJTYPE_CAN_DRIVER_SYNC,                  "CAN Driver Sync" },
+    { BLF_OBJTYPE_FLEXRAY_STATUS,                   "FlexRay Status" },
+    { BLF_OBJTYPE_GPS_EVENT,                        "GPS Event" },
+    { BLF_OBJTYPE_FLEXRAY_ERROR,                    "FlexRay Error" },
+    { BLF_OBJTYPE_FLEXRAY_STATUS,                   "FlexRay Status" },
+    { BLF_OBJTYPE_FLEXRAY_STARTCYCLE,               "FlexRay Start Cycle" },
+    { BLF_OBJTYPE_FLEXRAY_RCVMESSAGE,               "FlexRay Receive Message" },
+    { BLF_OBJTYPE_REALTIMECLOCK,                    "Realtime Clock" },
+    { BLF_OBJTYPE_LIN_STATISTIC,                    "LIN Statistics" },
+    { BLF_OBJTYPE_J1708_MESSAGE,                    "J1708 Message" },
+    { BLF_OBJTYPE_J1708_VIRTUAL_MSG,                "J1708 Virtual Message" },
+    { BLF_OBJTYPE_LIN_MESSAGE2,                     "LIN Message 2" },
+    { BLF_OBJTYPE_LIN_SND_ERROR2,                   "LIN Send Error 2" },
+    { BLF_OBJTYPE_LIN_SYN_ERROR2,                   "LIN Sync Error 2" },
+    { BLF_OBJTYPE_LIN_CRC_ERROR2,                   "LIN CRC Error 2" },
+    { BLF_OBJTYPE_LIN_RCV_ERROR2,                   "LIN Receive Error 2" },
+    { BLF_OBJTYPE_LIN_WAKEUP2,                      "LIN Wakeup 2" },
+    { BLF_OBJTYPE_LIN_SPIKE_EVENT2,                 "LIN Spike Event 2" },
+    { BLF_OBJTYPE_LIN_LONG_DOM_SIG,                 "LIN Long Dominant Signal" },
+    { BLF_OBJTYPE_APP_TEXT,                         "Text" },
+    { BLF_OBJTYPE_FLEXRAY_RCVMESSAGE_EX,            "FlexRay Receive Message Ext" },
+    { BLF_OBJTYPE_MOST_STATISTICEX,                 "MOST Statistics Ext" },
+    { BLF_OBJTYPE_MOST_TXLIGHT,                     "MOST TX Light" },
+    { BLF_OBJTYPE_MOST_ALLOCTAB,                    "MOST Allocation Table" },
+    { BLF_OBJTYPE_MOST_STRESS,                      "MOST Stress" },
+    { BLF_OBJTYPE_ETHERNET_FRAME,                   "Ethernet Frame" },
+    { BLF_OBJTYPE_SYS_VARIABLE,                     "System Variable" },
+    { BLF_OBJTYPE_CAN_ERROR_EXT,                    "CAN Error Ext" },
+    { BLF_OBJTYPE_CAN_DRIVER_ERROR_EXT,             "CAN Driver Error Ext" },
+    { BLF_OBJTYPE_LIN_LONG_DOM_SIG2,                "LIN Long Dominant Signal 2" },
+    { BLF_OBJTYPE_MOST_150_MESSAGE,                 "MOST150 Message" },
+    { BLF_OBJTYPE_MOST_150_PKT,                     "MOST150 Packet" },
+    { BLF_OBJTYPE_MOST_ETHERNET_PKT,                "MOST Ethernet Packet" },
+    { BLF_OBJTYPE_MOST_150_MESSAGE_FRAGMENT,        "MOST150 Message Fragment" },
+    { BLF_OBJTYPE_MOST_150_PKT_FRAGMENT,            "MOST150 Packet Fragment" },
+    { BLF_OBJTYPE_MOST_ETHERNET_PKT_FRAGMENT,       "MOST Ethernet Packet Fragment" },
+    { BLF_OBJTYPE_MOST_SYSTEM_EVENT,                "MOST System Event" },
+    { BLF_OBJTYPE_MOST_150_ALLOCTAB,                "MOST150 Allocation Table" },
+    { BLF_OBJTYPE_MOST_50_MESSAGE,                  "MOST50 Message" },
+    { BLF_OBJTYPE_MOST_50_PKT,                      "MOST50 Packet" },
+    { BLF_OBJTYPE_CAN_MESSAGE2,                     "CAN Message 2" },
+    { BLF_OBJTYPE_LIN_UNEXPECTED_WAKEUP,            "LIN Unexpected Wakeup" },
+    { BLF_OBJTYPE_LIN_SHORT_OR_SLOW_RESPONSE,       "LIN Short or Slow Response" },
+    { BLF_OBJTYPE_LIN_DISTURBANCE_EVENT,            "LIN Disturbance" },
+    { BLF_OBJTYPE_SERIAL_EVENT,                     "Serial" },
+    { BLF_OBJTYPE_OVERRUN_ERROR,                    "Overrun Error" },
+    { BLF_OBJTYPE_EVENT_COMMENT,                    "Comment" },
+    { BLF_OBJTYPE_WLAN_FRAME,                       "WLAN Frame" },
+    { BLF_OBJTYPE_WLAN_STATISTIC,                   "WLAN Statistics" },
+    { BLF_OBJTYPE_MOST_ECL,                         "MOST Electric Control Line" },
+    { BLF_OBJTYPE_GLOBAL_MARKER,                    "Global Marker" },
+    { BLF_OBJTYPE_AFDX_FRAME,                       "AFDX Frame" },
+    { BLF_OBJTYPE_AFDX_STATISTIC,                   "AFDX Statistics" },
+    { BLF_OBJTYPE_KLINE_STATUSEVENT,                "KLINE Status" },
+    { BLF_OBJTYPE_CAN_FD_MESSAGE,                   "CANFD Message" },
+    { BLF_OBJTYPE_CAN_FD_MESSAGE_64,                "CANFD Message 64" },
+    { BLF_OBJTYPE_ETHERNET_RX_ERROR,                "Ethernet RX Error" },
+    { BLF_OBJTYPE_ETHERNET_STATUS,                  "Ethernet Status" },
+    { BLF_OBJTYPE_CAN_FD_ERROR_64,                  "CANFD Error 64" },
+    { BLF_OBJTYPE_AFDX_STATUS,                      "AFDX Status" },
+    { BLF_OBJTYPE_AFDX_BUS_STATISTIC,               "AFDX Bus Statistics" },
+    { BLF_OBJTYPE_AFDX_ERROR_EVENT,                 "AFDX Error" },
+    { BLF_OBJTYPE_A429_ERROR,                       "A429 Error" },
+    { BLF_OBJTYPE_A429_STATUS,                      "A429 Status" },
+    { BLF_OBJTYPE_A429_BUS_STATISTIC,               "A429 Bus Statistics" },
+    { BLF_OBJTYPE_A429_MESSAGE,                     "A429 Message" },
+    { BLF_OBJTYPE_ETHERNET_STATISTIC,               "Ethernet Statistics" },
+    { BLF_OBJTYPE_TEST_STRUCTURE,                   "Test Structure" },
+    { BLF_OBJTYPE_DIAG_REQUEST_INTERPRETATION,      "Diagnostics Request Interpretation" },
+    { BLF_OBJTYPE_ETHERNET_FRAME_EX,                "Ethernet Frame Ext" },
+    { BLF_OBJTYPE_ETHERNET_FRAME_FORWARDED,         "Ethernet Frame Forwarded" },
+    { BLF_OBJTYPE_ETHERNET_ERROR_EX,                "Ethernet Error Ext" },
+    { BLF_OBJTYPE_ETHERNET_ERROR_FORWARDED,         "Ethernet Error Forwarded" },
+    { BLF_OBJTYPE_FUNCTION_BUS,                     "Function Bus" },
+    { BLF_OBJTYPE_DATA_LOST_BEGIN,                  "Data Lost Begin" },
+    { BLF_OBJTYPE_DATA_LOST_END,                    "Data Lost End" },
+    { BLF_OBJTYPE_WATER_MARK_EVENT,                 "Watermark" },
+    { BLF_OBJTYPE_TRIGGER_CONDITION,                "Trigger Condition" },
+    { BLF_OBJTYPE_CAN_SETTING_CHANGED,              "CAN Settings Changed" },
+    { BLF_OBJTYPE_DISTRIBUTED_OBJECT_MEMBER,        "Distributed Object Member" },
+    { BLF_OBJTYPE_ATTRIBUTE_EVENT,                  "Attribute Event" },
+    { 0, NULL }
+};
+
+static const value_string application_names[] = {
+    { 0,    "Unknown" },
+    { 1,    "Vector CANalyzer" },
+    { 2,    "Vector CANoe" },
+    { 3,    "Vector CANstress" },
+    { 4,    "Vector CANlog" },
+    { 5,    "Vector CANape" },
+    { 6,    "Vector CANcaseXL log" },
+    { 7,    "Vector Logger Configurator" },
+    { 200,  "Porsche Logger" },
+    { 201,  "CAETEC Logger" },
+    { 202,  "Vector Network Simulator" },
+    { 203,  "IPETRONIK logger" },
+    { 204,  "RT PK" },
+    { 205,  "PikeTec" },
+    { 206,  "Sparks" },
+    { 0, NULL }
+};
+
+
+#define BLF_COMPRESSION_NONE    0
+#define BLF_COMPRESSION_ZLIB    2
+
+static const value_string blf_compression_names[] = {
+    { BLF_COMPRESSION_NONE,     "No Compression" },
+    { BLF_COMPRESSION_ZLIB,     "Compression ZLIB" },
+    { 0, NULL }
+};
+
+void proto_register_file_blf(void);
+void proto_reg_handoff_file_blf(void);
+static int dissect_blf_next_object(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset);
+
+#define MAGIC_NUMBER_SIZE 4
+static const guint8 blf_file_magic[MAGIC_NUMBER_SIZE] = { 'L', 'O', 'G', 'G' };
+static const guint8 blf_lobj_magic[MAGIC_NUMBER_SIZE] = { 'L', 'O', 'B', 'J' };
+
+
+static proto_item *
+dissect_blf_header_date(proto_tree *tree, int hf, tvbuff_t *tvb, gint offset, gint length) {
+    static const value_string weekday_names[] = {
+    { 0,    "Sunday"},
+    { 1,    "Monday"},
+    { 2,    "Tuesday"},
+    { 3,    "Wednesday"},
+    { 4,    "Thursday"},
+    { 5,    "Friday"},
+    { 6,    "Saturday"},
+    { 0, NULL }
+    };
+
+    guint16 year        = tvb_get_guint16(tvb, offset +  0, ENC_LITTLE_ENDIAN);
+    guint16 month       = tvb_get_guint16(tvb, offset +  2, ENC_LITTLE_ENDIAN);
+    guint16 day_of_week = tvb_get_guint16(tvb, offset +  4, ENC_LITTLE_ENDIAN);
+    guint16 day         = tvb_get_guint16(tvb, offset +  6, ENC_LITTLE_ENDIAN);
+    guint16 hour        = tvb_get_guint16(tvb, offset +  8, ENC_LITTLE_ENDIAN);
+    guint16 minute      = tvb_get_guint16(tvb, offset + 10, ENC_LITTLE_ENDIAN);
+    guint16 sec         = tvb_get_guint16(tvb, offset + 12, ENC_LITTLE_ENDIAN);
+    guint16 ms          = tvb_get_guint16(tvb, offset + 14, ENC_LITTLE_ENDIAN);
+
+    header_field_info *hfinfo = proto_registrar_get_nth(hf);
+
+    return proto_tree_add_bytes_format(tree, hf, tvb, offset, length, NULL,
+                                       "%s: %s %d-%02d-%02d %02d:%02d:%02d.%03d",
+                                       hfinfo->name,
+                                       val_to_str(day_of_week, weekday_names, "%d"),
+                                       year, month, day, hour, minute, sec, ms);
+}
+
+static proto_item *
+dissect_blf_api_version(proto_tree *tree, int hf, tvbuff_t *tvb, gint offset, gint length) {
+    guint8 major = tvb_get_guint8(tvb, offset + 0);
+    guint8 minor = tvb_get_guint8(tvb, offset + 1);
+    guint8 build = tvb_get_guint8(tvb, offset + 2);
+    guint8 patch = tvb_get_guint8(tvb, offset + 3);
+
+    header_field_info *hfinfo = proto_registrar_get_nth(hf);
+
+    return proto_tree_add_bytes_format(tree, hf, tvb, offset, length, NULL, "%s: %d.%d.%d.%d",
+                                       hfinfo->name, major, minor, build, patch);
+}
+
+static int
+dissect_blf_lobj(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, gint offset_orig) {
+    proto_item    *ti_root = NULL;
+    proto_item    *ti = NULL;
+    proto_tree    *objtree = NULL;
+    proto_tree    *subtree = NULL;
+    volatile gint  offset = offset_orig;
+    tvbuff_t      *sub_tvb;
+
+    guint          hdr_length = tvb_get_guint16(tvb, offset_orig + 4, ENC_LITTLE_ENDIAN);
+    guint          obj_length;
+    guint          obj_type;
+    guint32        comp_method;
+
+    /* this should never happen since we should only be called with at least 16 Bytes present */
+    if (tvb_captured_length_remaining(tvb, offset_orig) < 16) {
+        return tvb_captured_length_remaining(tvb, offset_orig);
+    }
+
+    ti_root = proto_tree_add_item(tree, hf_blf_lobj, tvb, offset, -1, ENC_NA);
+    objtree = proto_item_add_subtree(ti_root, ett_blf_obj);
+
+    ti = proto_tree_add_item(objtree, hf_blf_lobj_hdr, tvb, offset, hdr_length, ENC_NA);
+    subtree = proto_item_add_subtree(ti, ett_blf_obj);
+
+    proto_tree_add_item(subtree, hf_blf_lobj_magic, tvb, offset, 4, ENC_NA);
+    offset += 4;
+    proto_tree_add_item(subtree, hf_blf_lobj_hdr_len, tvb, offset, 2, ENC_LITTLE_ENDIAN);
+    offset += 2;
+    proto_tree_add_item(subtree, hf_blf_lobj_hdr_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);
+    offset += 2;
+    proto_tree_add_item_ret_uint(subtree, hf_blf_lobj_obj_len, tvb, offset, 4, ENC_LITTLE_ENDIAN, &obj_length);
+    offset += 4;
+    proto_tree_add_item_ret_uint(subtree, hf_blf_lobj_obj_type, tvb, offset, 4, ENC_LITTLE_ENDIAN, &obj_type);
+    offset += 4;
+
+    /* check if the whole object is present or if it was truncated */
+    if (tvb_captured_length_remaining(tvb, offset_orig) < (gint)obj_length) {
+        proto_item_set_end(ti_root, tvb, offset_orig + tvb_captured_length_remaining(tvb, offset_orig));
+        proto_item_append_text(ti_root, " TRUNCATED");
+        return tvb_captured_length_remaining(tvb, offset_orig);
+    }
+
+    proto_item_set_end(ti_root, tvb, offset_orig + obj_length);
+    proto_item_append_text(ti_root, " (%s)", val_to_str(obj_type, blf_object_names, "%d"));
+
+    switch (obj_type) {
+        case BLF_OBJTYPE_LOG_CONTAINER:
+            proto_tree_add_item_ret_uint(objtree, hf_blf_cont_comp_method, tvb, offset, 2, ENC_LITTLE_ENDIAN, &comp_method);
+            offset += 2;
+            proto_tree_add_item(objtree, hf_blf_cont_res1, tvb, offset, 2, ENC_LITTLE_ENDIAN);
+            offset += 2;
+            proto_tree_add_item(objtree, hf_blf_cont_res2, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+            offset += 4;
+            proto_tree_add_item(objtree, hf_blf_cont_uncomp_size, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+            offset += 4;
+            proto_tree_add_item(objtree, hf_blf_cont_res4, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+            offset += 4;
+            if (comp_method == BLF_COMPRESSION_NONE) {
+                sub_tvb = tvb_new_subset_length_caplen(tvb, offset, offset_orig + obj_length - offset, offset_orig + obj_length - offset);
+            } else {
+                sub_tvb = tvb_child_uncompress(tvb, tvb, offset, offset_orig + obj_length - offset);
+                if (sub_tvb) {
+                    add_new_data_source(pinfo, sub_tvb, "Decompressed Data");
+                }
+            }
+
+            /* TODO: actually the objects might overlap containers, which we do not consider here... */
+            if (sub_tvb) {
+                guint offset_sub = 0;
+                ti = proto_tree_add_item(objtree, hf_blf_cont_payload, sub_tvb, 0, offset_orig + obj_length - offset, ENC_NA);
+                subtree = proto_item_add_subtree(ti, ett_blf_logcontainer_payload);
+
+                guint tmp = 42;
+                while ((offset_sub + 16 <= offset_orig + obj_length - offset) && (tmp > 0)) {
+                    tmp = dissect_blf_next_object(sub_tvb, pinfo, subtree, offset_sub);
+                    offset_sub += tmp;
+                }
+            }
+            break;
+        default:
+            if (offset - offset_orig < (gint)hdr_length) {
+                proto_tree_add_item(subtree, hf_blf_lobj_hdr_remains, tvb, offset, hdr_length - (offset - offset_orig), ENC_NA);
+                offset = offset_orig + hdr_length;
+            }
+
+            proto_tree_add_item(objtree, hf_blf_lobj_payload, tvb, offset, obj_length - hdr_length, ENC_NA);
+            offset = offset_orig + obj_length;
+            break;
+    }
+
+    return (gint)obj_length;
+}
+
+static int
+dissect_blf_next_object(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset) {
+    gint offset_orig = offset;
+
+    while (tvb_captured_length_remaining(tvb, offset) >= 16) {
+        if (!tvb_memeql(tvb, offset, blf_lobj_magic, MAGIC_NUMBER_SIZE) == 0) {
+            offset += 1;
+        } else {
+            int bytes_parsed = dissect_blf_lobj(tvb, pinfo, tree, offset);
+            if (bytes_parsed <= 0) {
+                return 0;
+            } else {
+                offset += bytes_parsed;
+            }
+        }
+    }
+
+    return offset - offset_orig;
+}
+
+
+static int
+dissect_blf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) {
+    volatile gint    offset = 0;
+    proto_tree      *blf_tree;
+    proto_tree      *subtree;
+    proto_item      *ti;
+    guint            length;
+
+    if (tvb_captured_length(tvb) < 8 || !tvb_memeql(tvb, 0, blf_file_magic, MAGIC_NUMBER_SIZE) == 0) {
+        /* does not start with LOGG, so this is not BLF it seems */
+        return 0;
+    }
+
+    ti = proto_tree_add_item(tree, proto_blf, tvb, offset, -1, ENC_NA);
+    blf_tree = proto_item_add_subtree(ti, ett_blf);
+    length = tvb_get_guint32(tvb, 4, ENC_LITTLE_ENDIAN);
+
+    ti = proto_tree_add_item(blf_tree, hf_blf_file_header, tvb, offset, length, ENC_NA);
+    subtree = proto_item_add_subtree(ti, ett_blf_header);
+
+    proto_tree_add_item(subtree, hf_blf_file_header_magic, tvb, offset, 4, ENC_NA);
+    offset += 4;
+    proto_tree_add_item(subtree, hf_blf_file_header_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+    offset += 4;
+    dissect_blf_api_version(subtree, hf_blf_file_header_api, tvb, offset, 4);
+    offset += 4;
+    proto_tree_add_item(subtree, hf_blf_file_header_app, tvb, offset, 1, ENC_NA);
+    offset += 1;
+    proto_tree_add_item(subtree, hf_blf_file_header_comp_level, tvb, offset, 1, ENC_NA);
+    offset += 1;
+    proto_tree_add_item(subtree, hf_blf_file_header_app_major, tvb, offset, 1, ENC_NA);
+    offset += 1;
+    proto_tree_add_item(subtree, hf_blf_file_header_app_minor, tvb, offset, 1, ENC_NA);
+    offset += 1;
+    proto_tree_add_item(subtree, hf_blf_file_header_len_comp, tvb, offset, 8, ENC_LITTLE_ENDIAN);
+    offset += 8;
+    proto_tree_add_item(subtree, hf_blf_file_header_len_uncomp, tvb, offset, 8, ENC_LITTLE_ENDIAN);
+    offset += 8;
+    proto_tree_add_item(subtree, hf_blf_file_header_obj_count, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+    offset += 4;
+    proto_tree_add_item(subtree, hf_blf_file_header_app_build, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+    offset += 4;
+    dissect_blf_header_date(subtree, hf_blf_file_header_start_date, tvb, offset, 16);
+    offset += 16;
+    dissect_blf_header_date(subtree, hf_blf_file_header_end_date, tvb, offset, 16);
+    offset += 16;
+    proto_tree_add_item(subtree, hf_blf_file_header_restore_point_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN);
+    offset += 8;
+
+    offset += dissect_blf_next_object(tvb, pinfo, blf_tree, offset);
+
+    return offset;
+}
+
+static gboolean
+dissect_blf_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) {
+    return dissect_blf(tvb, pinfo, tree, NULL) > 0;
+}
+
+void
+proto_register_file_blf(void) {
+    static hf_register_info hf[] = {
+        { &hf_blf_file_header,
+            { "File Header", "blf.file_header", FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_magic,
+            { "Magic", "blf.file_header.magic", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_length,
+            { "Header Length", "blf.file_header.length", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_api,
+            { "API Version", "blf.file_header.api", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_app,
+            { "Application", "blf.file_header.application", FT_UINT8, BASE_DEC, VALS(application_names), 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_comp_level,
+            { "Compression Level", "blf.file_header.compression_level", FT_UINT8, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_app_major,
+            { "Application Major Version", "blf.file_header.application_major", FT_UINT8, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_app_minor,
+            { "Application Minor Version", "blf.file_header.application_minor", FT_UINT8, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_len_comp,
+            { "Length (compressed)", "blf.file_header.length_compressed", FT_UINT64, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_len_uncomp,
+            { "Length (uncompressed)", "blf.file_header.length_uncompressed", FT_UINT64, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_obj_count,
+            { "Object Count", "blf.file_header.object_count", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_app_build,
+            { "Application Build", "blf.file_header.application_build", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_start_date,
+            { "Start Date", "blf.file_header.start_date", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_end_date,
+            { "End Date", "blf.file_header.end_date", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_file_header_restore_point_offset,
+            { "Restore Point Offset", "blf.file_header.restore_point_offset", FT_UINT64, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+
+        { &hf_blf_lobj,
+            { "Object", "blf.object", FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_hdr,
+            { "Object Header", "blf.object.header", FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_magic,
+            { "Magic", "blf.object.header.magic", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_hdr_len,
+            { "Header Length", "blf.object.header.header_length", FT_UINT16, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_hdr_type,
+            { "Header Type", "blf.object.header.header_type", FT_UINT16, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_obj_len,
+            { "Object Length", "blf.object.header.object_length", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_obj_type,
+            { "Object Type", "blf.object.header.object_type", FT_UINT32, BASE_DEC, VALS(blf_object_names), 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_hdr_remains,
+            { "Header unparsed", "blf.object.header.unparsed", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_lobj_payload,
+            { "Payload", "blf.object.payload", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+
+        { &hf_blf_cont_comp_method,
+            { "Compression Method", "blf.object.logcontainer.compression_method", FT_UINT16, BASE_HEX, VALS(blf_compression_names), 0x00, NULL, HFILL }},
+        { &hf_blf_cont_res1,
+            { "Reserved", "blf.object.logcontainer.res1", FT_UINT16, BASE_HEX, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_cont_res2,
+            { "Reserved", "blf.object.logcontainer.res2", FT_UINT32, BASE_HEX, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_cont_uncomp_size,
+            { "Uncompressed Length", "blf.object.logcontainer.uncompressed_length", FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_cont_res4,
+            { "Reserved", "blf.object.logcontainer.res4", FT_UINT32, BASE_HEX, NULL, 0x00, NULL, HFILL }},
+        { &hf_blf_cont_payload,
+            { "Payload", "blf.object.logcontainer.payload", FT_BYTES, BASE_NONE, NULL, 0x00, NULL, HFILL }},
+
+    };
+
+    static gint *ett[] = {
+        &ett_blf,
+        &ett_blf_header,
+        &ett_blf_obj,
+        &ett_blf_obj_header,
+        &ett_blf_logcontainer_payload,
+    };
+
+    proto_blf = proto_register_protocol("BLF File Format", "File-BLF", "file-blf");
+    proto_register_field_array(proto_blf, hf, array_length(hf));
+    proto_register_subtree_array(ett, array_length(ett));
+
+    register_dissector("file-blf", dissect_blf, proto_blf);
+}
+
+void
+proto_reg_handoff_file_blf(void) {
+    heur_dissector_add("wtap_file", dissect_blf_heur, "BLF File", "blf_wtap", proto_blf, HEURISTIC_ENABLE);
+}
+
+/*
+ * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+ *
+ * Local Variables:
+ * c-basic-offset: 4
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * ex: set shiftwidth=4 tabstop=8 expandtab:
+ * :indentSize=4:tabSize=8:noTabs=true:
+ */
diff --git a/wiretap/CMakeLists.txt b/wiretap/CMakeLists.txt
index 40e42e87ce..ded80e4558 100644
--- a/wiretap/CMakeLists.txt
+++ b/wiretap/CMakeLists.txt
@@ -34,6 +34,7 @@ set(WIRETAP_C_MODULE_FILES
 	${CMAKE_CURRENT_SOURCE_DIR}/ascendtext.c
 	${CMAKE_CURRENT_SOURCE_DIR}/atm.c
 	${CMAKE_CURRENT_SOURCE_DIR}/ber.c
+	${CMAKE_CURRENT_SOURCE_DIR}/blf.c
 	${CMAKE_CURRENT_SOURCE_DIR}/btsnoop.c
 	${CMAKE_CURRENT_SOURCE_DIR}/busmaster.c
 	${CMAKE_CURRENT_SOURCE_DIR}/camins.c
diff --git a/wiretap/blf.c b/wiretap/blf.c
new file mode 100644
index 0000000000..8f0d3a92cd
--- /dev/null
+++ b/wiretap/blf.c
@@ -0,0 +1,1567 @@
+/* blf.c
+ *
+ * Wiretap Library
+ * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
+ *
+ * File format support for blf file format
+ * Copyright (c) 2021 by Dr. Lars Voelker <lars.voelker@technica-engineering.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+ /*
+  * The following was used as a reference for the file format:
+  *     https://bitbucket.org/tobylorenz/vector_blf
+  * The repo above includes multiple examples files as well.
+  */
+
+#include <config.h>
+#include "blf.h"
+
+#include <epan/dissectors/packet-socketcan.h>
+#include <string.h>
+#include <wsutil/wslog.h>
+#include "file_wrappers.h"
+#include "wtap-int.h"
+
+#ifdef HAVE_ZLIB
+#define ZLIB_CONST
+#include <zlib.h>
+#endif /* HAVE_ZLIB */
+
+static const guint8 blf_magic[] = { 'L', 'O', 'G', 'G' };
+static const guint8 blf_obj_magic[] = { 'L', 'O', 'B', 'J' };
+
+static int blf_file_type_subtype = -1;
+
+void register_blf(void);
+
+static gboolean blf_read(wtap *wth, wtap_rec *rec, Buffer *buf, int *err, gchar **err_info, gint64 *data_offset);
+static gboolean blf_seek_read(wtap *wth, gint64 seek_off, wtap_rec* rec, Buffer *buf, int *err, gchar **err_info);
+static void blf_close(wtap *wth);
+
+/*
+ * The virtual buffer looks like this (skips all headers):
+ * uncompressed log container data
+ * uncompressed log container data
+ * ...
+ *
+ * The "real" positions, length, etc. reference this layout and not the file.
+ * When no compression is used the file is accessed directly.
+ */
+
+typedef struct blf_log_container {
+    gint64   infile_start_pos;        /* start position of log container in file */
+    guint64  infile_length;           /* length of log container in file */
+    guint64  infile_data_start;       /* start position of data in log container in file */
+
+    gint64   real_start_pos;          /* decompressed (virtual) start position including header */
+    guint64  real_length;             /* decompressed length */
+    gint64   real_first_object_pos;   /* where does the first obj start? */
+    guint64  real_leftover_bytes;     /* how many bytes are left over for the next container? */
+
+    guint16  compression_method;      /* 0: uncompressed, 2: zlib */
+
+    unsigned char  *real_data;        /* cache for decompressed data */
+} blf_log_container_t;
+
+typedef struct blf_data {
+    gint64  start_of_last_obj;
+    gint64  current_real_seek_pos;
+
+    guint   current_log_container;
+    GArray *log_containers;
+} blf_t;
+
+typedef struct blf_params {
+    wtap     *wth;
+    wtap_rec *rec;
+    Buffer   *buf;
+    FILE_T    fh;
+
+    blf_t    *blf_data;
+} blf_params_t;
+
+gboolean blf_read_block(blf_params_t *params, gint64 start_pos, int *err, gchar **err_info);
+
+void
+fix_endianness_blf_date(blf_date_t *date) {
+    date->year = GUINT16_FROM_LE(date->year);
+    date->month = GUINT16_FROM_LE(date->month);
+    date->dayofweek = GUINT16_FROM_LE(date->dayofweek);
+    date->day = GUINT16_FROM_LE(date->day);
+    date->hour = GUINT16_FROM_LE(date->hour);
+    date->mins = GUINT16_FROM_LE(date->mins);
+    date->sec = GUINT16_FROM_LE(date->sec);
+    date->ms = GUINT16_FROM_LE(date->ms);
+}
+
+void
+fix_endianness_blf_fileheader(blf_fileheader_t *header) {
+    header->header_length = GUINT32_FROM_LE(header->header_length);
+    header->len_compressed = GUINT64_FROM_LE(header->len_compressed);
+    header->len_uncompressed = GUINT64_FROM_LE(header->len_uncompressed);
+    header->obj_count = GUINT32_FROM_LE(header->obj_count);
+    header->obj_read = GUINT32_FROM_LE(header->obj_read);
+    fix_endianness_blf_date(&(header->start_date));
+    fix_endianness_blf_date(&(header->end_date));
+    header->length3 = GUINT32_FROM_LE(header->length3);
+}
+
+void
+fix_endianness_blf_blockheader(blf_blockheader_t *header) {
+    header->header_length = GUINT16_FROM_LE(header->header_length);
+    header->header_type = GUINT16_FROM_LE(header->header_type);
+    header->object_length = GUINT32_FROM_LE(header->object_length);
+    header->object_type = GUINT32_FROM_LE(header->object_type);
+}
+
+void
+fix_endianness_blf_logcontainerheader(blf_logcontainerheader_t *header) {
+    header->compression_method = GUINT16_FROM_LE(header->compression_method);
+    header->res1 = GUINT16_FROM_LE(header->res1);
+    header->res2 = GUINT32_FROM_LE(header->res2);
+    header->uncompressed_size = GUINT32_FROM_LE(header->uncompressed_size);
+    header->res4 = GUINT32_FROM_LE(header->res4);
+}
+
+void
+fix_endianness_blf_logobjectheader(blf_logobjectheader_t *header) {
+    header->flags = GUINT32_FROM_LE(header->flags);
+    header->client_index = GUINT16_FROM_LE(header->client_index);
+    header->object_version = GUINT16_FROM_LE(header->object_version);
+    header->object_timestamp = GUINT64_FROM_LE(header->object_timestamp);
+}
+
+void
+fix_endianness_blf_ethernetframeheader(blf_ethernetframeheader_t *header) {
+    header->channel = GUINT16_FROM_LE(header->channel);
+    header->direction = GUINT16_FROM_LE(header->direction);
+    header->ethtype = GUINT16_FROM_LE(header->ethtype);
+    header->tpid = GUINT16_FROM_LE(header->tpid);
+    header->tci = GUINT16_FROM_LE(header->tci);
+    header->payloadlength = GUINT16_FROM_LE(header->payloadlength);
+}
+
+void
+fix_endianness_blf_ethernetframeheader_ex(blf_ethernetframeheader_ex_t *header) {
+    header->struct_length = GUINT16_FROM_LE(header->struct_length);
+    header->flags = GUINT16_FROM_LE(header->flags);
+    header->channel = GUINT16_FROM_LE(header->channel);
+    header->hw_channel = GUINT16_FROM_LE(header->hw_channel);
+    header->frame_duration = GUINT64_FROM_LE(header->frame_duration);
+    header->frame_checksum = GUINT32_FROM_LE(header->frame_checksum);
+    header->direction = GUINT16_FROM_LE(header->direction);
+    header->frame_length = GUINT16_FROM_LE(header->frame_length);
+    header->frame_handle = GUINT32_FROM_LE(header->frame_handle);
+    header->error = GUINT32_FROM_LE(header->error);
+}
+
+void
+fix_endianness_blf_canmessage(blf_canmessage_t *header) {
+    header->channel = GUINT16_FROM_LE(header->channel);
+    header->id = GUINT32_FROM_LE(header->id);
+}
+
+void
+fix_endianness_blf_canmessage2_trailer(blf_canmessage2_trailer_t *header) {
+    header->frameLength_in_ns = GUINT32_FROM_LE(header->frameLength_in_ns);
+    header->reserved2 = GUINT16_FROM_LE(header->reserved1);
+}
+
+void
+fix_endianness_blf_canfdmessage(blf_canfdmessage_t *header) {
+    header->channel = GUINT16_FROM_LE(header->channel);
+    header->id = GUINT32_FROM_LE(header->id);
+    header->frameLength_in_ns = GUINT32_FROM_LE(header->frameLength_in_ns);
+    header->reservedCanFdMessage2 = GUINT32_FROM_LE(header->reservedCanFdMessage2);
+}
+
+void
+fix_endianness_blf_canfdmessage64(blf_canfdmessage64_t *header) {
+    header->id = GUINT32_FROM_LE(header->id);
+    header->frameLength_in_ns = GUINT32_FROM_LE(header->frameLength_in_ns);
+    header->flags = GUINT32_FROM_LE(header->flags);
+    header->btrCfgArb = GUINT32_FROM_LE(header->btrCfgArb);
+    header->btrCfgData = GUINT32_FROM_LE(header->btrCfgData);
+    header->timeOffsetBrsNs = GUINT32_FROM_LE(header->timeOffsetBrsNs);
+    header->timeOffsetCrcDelNs = GUINT32_FROM_LE(header->timeOffsetCrcDelNs);
+    header->bitCount = GUINT16_FROM_LE(header->bitCount);
+    header->crc = GUINT32_FROM_LE(header->crc);
+}
+
+void
+fix_endianness_blf_flexraydata(blf_flexraydata_t *header) {
+    header->channel = GUINT16_FROM_LE(header->channel);
+    header->messageId = GUINT16_FROM_LE(header->messageId);
+    header->crc = GUINT16_FROM_LE(header->crc);
+    header->reservedFlexRayData2 = GUINT16_FROM_LE(header->reservedFlexRayData2);
+}
+
+void
+fix_endianness_blf_flexraymessage(blf_flexraymessage_t *header) {
+    header->channel = GUINT16_FROM_LE(header->channel);
+    header->fpgaTick = GUINT32_FROM_LE(header->fpgaTick);
+    header->fpgaTickOverflow = GUINT32_FROM_LE(header->fpgaTickOverflow);
+    header->clientIndexFlexRayV6Message = GUINT32_FROM_LE(header->clientIndexFlexRayV6Message);
+    header->clusterTime = GUINT32_FROM_LE(header->clusterTime);
+    header->frameId = GUINT16_FROM_LE(header->frameId);
+    header->headerCrc = GUINT16_FROM_LE(header->headerCrc);
+    header->frameState = GUINT16_FROM_LE(header->frameState);
+    header->reservedFlexRayV6Message2 = GUINT16_FROM_LE(header->reservedFlexRayV6Message2);
+}
+
+void
+fix_endianness_blf_flexrayrcvmessage(blf_flexrayrcvmessage_t *header) {
+    header->channel = GUINT16_FROM_LE(header->channel);
+    header->version = GUINT16_FROM_LE(header->version);
+    header->channelMask = GUINT16_FROM_LE(header->channelMask);
+    header->dir = GUINT16_FROM_LE(header->dir);
+    header->clientIndex = GUINT32_FROM_LE(header->clientIndex);
+    header->clusterNo = GUINT32_FROM_LE(header->clusterNo);
+    header->frameId = GUINT16_FROM_LE(header->frameId);
+    header->headerCrc1 = GUINT16_FROM_LE(header->headerCrc1);
+    header->headerCrc2 = GUINT16_FROM_LE(header->headerCrc2);
+    header->payloadLength = GUINT16_FROM_LE(header->payloadLength);
+    header->payloadLengthValid = GUINT16_FROM_LE(header->payloadLengthValid);
+    header->cycle = GUINT16_FROM_LE(header->cycle);
+    header->tag = GUINT32_FROM_LE(header->tag);
+    header->data = GUINT32_FROM_LE(header->data);
+    header->frameFlags = GUINT32_FROM_LE(header->frameFlags);
+    header->appParameter = GUINT32_FROM_LE(header->appParameter);
+/*  this would be extra for ext format:
+    header->frameCRC = GUINT32_FROM_LE(header->frameCRC);
+    header->frameLengthInNs = GUINT32_FROM_LE(header->frameLengthInNs);
+    header->frameId1 = GUINT16_FROM_LE(header->frameId1);
+    header->pduOffset = GUINT16_FROM_LE(header->pduOffset);
+    header->blfLogMask = GUINT16_FROM_LE(header->blfLogMask);
+*/
+}
+
+guint64
+blf_timestamp_to_ns(blf_logobjectheader_t *header) {
+    switch (header->flags) {
+    case BLF_TIMESTAMP_RESOLUTION_10US:
+        return 10000 * header->object_timestamp;
+        break;
+
+    case BLF_TIMESTAMP_RESOLUTION_1NS:
+        return header->object_timestamp;
+        break;
+
+    default:
+        ws_debug("i dont understand the flags 0x%x", header->flags);
+        return 0;
+        break;
+    }
+}
+
+void
+blf_init_logcontainer(blf_log_container_t *tmp) {
+    tmp->infile_start_pos = 0;
+    tmp->infile_length = 0;
+    tmp->infile_data_start = 0;
+    tmp->real_start_pos = 0;
+    tmp->real_length = 0;
+    tmp->real_first_object_pos = -1;
+    tmp->real_leftover_bytes = G_MAXUINT64;
+    tmp->real_data = NULL;
+    tmp->compression_method = 0;
+}
+
+void
+blf_add_logcontainer(blf_t *blf_data, blf_log_container_t log_container) {
+    if (blf_data->log_containers == NULL) {
+        blf_data->log_containers = g_array_sized_new(FALSE, FALSE, sizeof(blf_log_container_t), 1);
+        blf_data->current_log_container = 0;
+    } else {
+        blf_data->current_log_container++;
+    }
+
+    g_array_append_val(blf_data->log_containers, log_container);
+}
+
+gboolean
+blf_get_logcontainer_by_index(blf_t *blf_data, guint index, blf_log_container_t **ret) {
+    if (blf_data == NULL || blf_data->log_containers == NULL || index >= blf_data->log_containers->len) {
+        return FALSE;
+    }
+
+    *ret = &g_array_index(blf_data->log_containers, blf_log_container_t, index);
+    return TRUE;
+}
+
+gboolean
+blf_get_current_logcontainer(blf_t *blf_data, blf_log_container_t **ret) {
+    return blf_get_logcontainer_by_index(blf_data, blf_data->current_log_container, ret);
+}
+
+gint
+blf_number_of_logcontainers(blf_t *blf_data) {
+    if (blf_data == NULL) {
+        return -1;
+    }
+    if (blf_data->log_containers == NULL) {
+        return 0;
+    }
+    return (gint)blf_data->log_containers->len;
+}
+
+guint64
+blf_get_num_prev_leftover_bytes(blf_t *blf_data) {
+    if (blf_data->current_log_container == 0) {
+        return 0;
+    } else {
+        blf_log_container_t tmp = g_array_index(blf_data->log_containers, blf_log_container_t, blf_data->current_log_container-1);
+        return tmp.real_leftover_bytes;
+    }
+}
+
+gboolean
+blf_find_logcontainer_for_address(blf_t *blf_data, gint64 pos, blf_log_container_t **container, gint *container_index) {
+    blf_log_container_t *tmp;
+
+    if (blf_data == NULL || blf_data->log_containers == NULL) {
+        return FALSE;
+    }
+
+    for (guint i = 0; i < blf_data->log_containers->len; i++) {
+        tmp = &g_array_index(blf_data->log_containers, blf_log_container_t, i);
+        if (tmp->real_start_pos <= pos && pos < tmp->real_start_pos + (gint64)tmp->real_length) {
+            *container = tmp;
+            *container_index = i;
+            return TRUE;
+        }
+    }
+
+    return FALSE;
+}
+
+gboolean
+blf_pull_logcontainer_into_memory(blf_params_t *params, guint index_log_container) {
+    blf_t *blf_data = params->blf_data;
+    blf_log_container_t tmp;
+
+    if (index_log_container >= blf_data->log_containers->len) {
+        ws_debug("blf_pull_logcontainer_into_memory: cannot pull an unknown log container into memory");
+        return FALSE;
+    }
+
+    tmp = g_array_index(blf_data->log_containers, blf_log_container_t, index_log_container);
+
+    if (tmp.real_data != NULL) {
+        return TRUE;
+    }
+
+    if (tmp.compression_method == BLF_COMPRESSION_ZLIB) {
+#ifdef HAVE_ZLIB
+        int err = 0;
+        gchar *err_info;
+
+        file_seek(params->fh, tmp.infile_data_start, SEEK_SET, &err);
+        if (err < 0) {
+            ws_debug("blf_pull_logcontainer_into_memory: cannot seek to start of log_container");
+            return FALSE;
+        }
+
+        /* pull compressed data into buffer */
+        unsigned char *compressed_data = g_try_malloc0(tmp.infile_length);
+        guint64 data_length = (unsigned int)tmp.infile_length - (tmp.infile_data_start - tmp.infile_start_pos);
+        if (!wtap_read_bytes_or_eof(params->fh, compressed_data, (unsigned int)data_length, &err, &err_info)) {
+            ws_debug("blf_pull_logcontainer_into_memory: cannot read compressed data");
+            return FALSE;
+        }
+
+        unsigned char *buf = g_try_malloc0(tmp.real_length);
+        z_stream infstream;
+        infstream.zalloc = Z_NULL;
+        infstream.zfree = Z_NULL;
+        infstream.opaque = Z_NULL;
+
+        infstream.avail_in  = (unsigned int)data_length;
+        infstream.next_in   = compressed_data;
+        infstream.avail_out = (unsigned int)tmp.real_length;
+        infstream.next_out  = buf;
+
+        // the actual DE-compression work.
+        inflateInit(&infstream);
+        inflate(&infstream, Z_NO_FLUSH);
+        inflateEnd(&infstream);
+
+        tmp.real_data = buf;
+        g_array_index(blf_data->log_containers, blf_log_container_t, index_log_container) = tmp;
+        return TRUE;
+#else
+        return FALSE;
+#endif
+    }
+
+    return FALSE;
+}
+
+/* returns position and -1, if compressed or split */
+gint64
+blf_translate_pos(blf_t *blf_data, gint64 pos) {
+    blf_log_container_t *tmp;
+    gint container_index;
+
+    if (blf_find_logcontainer_for_address(blf_data, pos, &tmp, &container_index)) {
+        if (tmp->compression_method == BLF_COMPRESSION_NONE) {
+            /* this should be the same as pos, as long as infile and real start pos stay the same. */
+            return tmp->infile_start_pos + pos - tmp->real_start_pos;
+        }
+    }
+    return -1;
+}
+
+gboolean
+blf_read_bytes_or_eof(blf_params_t *params, guint64 real_pos, void *target_buffer, unsigned int count, int *err, gchar **err_info) {
+    blf_log_container_t *start_container;
+    blf_log_container_t *end_container;
+    blf_log_container_t *current_container;
+
+    gint start_container_index = -1;
+    gint end_container_index   = -1;
+    gint current_container_index = -1;
+
+    unsigned int copied = 0;
+    unsigned int data_left;
+    unsigned int start_in_buf;
+
+    unsigned char *buf = (unsigned char *)target_buffer;
+
+    if (!blf_find_logcontainer_for_address(params->blf_data, real_pos, &start_container, &start_container_index)) {
+        ws_debug("blf_read_bytes_or_eof: cannot read data because start position cannot be mapped");
+        return FALSE;
+    }
+    if (!blf_find_logcontainer_for_address(params->blf_data, real_pos + count - 1, &end_container, &end_container_index)) {
+        ws_debug("blf_read_bytes_or_eof: cannot read data because end position cannot be mapped");
+        return FALSE;
+    }
+
+    current_container_index = start_container_index;
+    current_container = start_container;
+    start_in_buf = (unsigned int)real_pos - (unsigned int)start_container->real_start_pos;
+
+    switch (start_container->compression_method) {
+    case BLF_COMPRESSION_NONE:
+        while (current_container_index <= end_container_index) {
+            if (!blf_get_logcontainer_by_index(params->blf_data, current_container_index, &current_container)) {
+                ws_debug("blf_read_bytes_or_eof: cannot refresh container");
+                return FALSE;
+            }
+
+            data_left = (unsigned int)(current_container->real_length - start_in_buf);
+
+            if (file_seek(params->fh, current_container->infile_data_start + start_in_buf, SEEK_SET, err) < 0) {
+                ws_debug("blf_read_bytes_or_eof: cannot seek data");
+                return FALSE;
+            }
+
+            if (data_left < (count - copied)) {
+                if (!wtap_read_bytes_or_eof(params->fh, buf + copied, data_left, err, err_info)) {
+                    ws_debug("blf_read_bytes_or_eof: cannot read data");
+                    return FALSE;
+                }
+                copied += data_left;
+                current_container_index++;
+                start_in_buf = 0;
+            } else {
+                if (!wtap_read_bytes_or_eof(params->fh, buf + copied, count - copied, err, err_info)) {
+                    ws_debug("blf_read_bytes_or_eof: cannot read data");
+                    return FALSE;
+                }
+                return TRUE;
+            }
+        }
+        break;
+
+    case BLF_COMPRESSION_ZLIB:
+            while (current_container_index <= end_container_index) {
+            if (!blf_pull_logcontainer_into_memory(params, current_container_index)) {
+                ws_debug("blf_read_bytes_or_eof: cannot pull in container");
+                return FALSE;
+            }
+
+            if (!blf_get_logcontainer_by_index(params->blf_data, current_container_index, &current_container)) {
+                ws_debug("blf_read_bytes_or_eof: cannot refresh container");
+                return FALSE;
+            }
+
+            if (current_container->real_data == NULL) {
+                ws_debug("blf_read_bytes_or_eof: pulling in container failed hard");
+                return FALSE;
+            }
+
+            data_left = (unsigned int)(current_container->real_length - start_in_buf);
+
+            if (data_left < (count - copied)) {
+                memcpy(buf + copied, current_container->real_data + start_in_buf, (unsigned int)data_left);
+                copied += data_left;
+                current_container_index++;
+                start_in_buf = 0;
+            } else {
+                memcpy(buf + copied, current_container->real_data + start_in_buf, count - copied);
+                return TRUE;
+            }
+        }
+        break;
+
+    default:
+        ws_debug("blf_read_bytes_or_eof: unknown compression method");
+        return FALSE;
+    }
+
+    return FALSE;
+}
+
+/* this is only called once on open to figure out the layout of the file */
+gboolean
+blf_scan_file_for_logcontainers(blf_params_t *params) {
+    blf_blockheader_t        header;
+    blf_logcontainerheader_t logcontainer_header;
+    blf_log_container_t      tmp;
+
+    int    err;
+    gchar *err_info;
+
+    guint64  current_start_pos;
+    guint64  current_real_start  = 0;
+
+    while (1) {
+        current_start_pos = file_tell(params->fh);
+
+        /* Find Object */
+        while (1) {
+            if (!wtap_read_bytes_or_eof(params->fh, &header, sizeof header, &err, &err_info)) {
+                ws_debug("we found end of file");
+
+                /* lets ignore some bytes at the end since some implementations think it is ok to add a few zero bytes */
+                if (err == WTAP_ERR_SHORT_READ) {
+                    err = 0;
+                }
+
+                return TRUE;
+            }
+
+            fix_endianness_blf_blockheader(&header);
+
+            if (memcmp(header.magic, blf_obj_magic, sizeof(blf_obj_magic))) {
+                ws_debug("object magic is not LOBJ");
+            } else {
+                break;
+            }
+
+            /* we are moving back and try again but 1 byte later */
+            /* TODO: better understand how this paddings works... */
+            current_start_pos++;
+            if (file_seek(params->fh, current_start_pos, SEEK_SET, &err) < 0) {
+                return FALSE;
+            }
+        }
+
+        if (header.header_type != BLF_HEADER_TYPE_DEFAULT) {
+            ws_debug("unknown header type, I know only BLF_HEADER_TYPE_DEFAULT (1)");
+            return FALSE;
+        }
+
+        switch (header.object_type) {
+        case BLF_OBJTYPE_LOG_CONTAINER:
+            /* skip unknown header part if needed */
+            if (header.header_length - sizeof(blf_blockheader_t) > 0) {
+                /* seek over unknown header part */
+                if (file_seek(params->fh, current_start_pos + header.header_length, SEEK_SET, &err) < 0) {
+                    ws_debug("cannot seek file for skipping unknown header bytes in log container");
+                    return FALSE;
+                }
+            }
+
+            if (!wtap_read_bytes_or_eof(params->fh, &logcontainer_header, sizeof(blf_logcontainerheader_t), &err, &err_info)) {
+                ws_debug("not enough bytes for log container header");
+                return FALSE;
+            }
+
+            //tmp = g_malloc(sizeof(blf_log_container_t));
+            blf_init_logcontainer(&tmp);
+
+            tmp.infile_start_pos = current_start_pos;
+            tmp.infile_data_start = file_tell(params->fh);
+            tmp.infile_length = header.object_length;
+
+            tmp.real_start_pos = current_real_start;
+            tmp.real_length = logcontainer_header.uncompressed_size;
+            tmp.compression_method = logcontainer_header.compression_method;
+
+            /* set up next start position */
+            current_real_start += logcontainer_header.uncompressed_size;
+
+            if (file_seek(params->fh, current_start_pos + header.object_length, SEEK_SET, &err) < 0) {
+                ws_debug("cannot seek file for skipping log container bytes");
+                return FALSE;
+            }
+
+            blf_add_logcontainer(params->blf_data, tmp);
+
+            break;
+        default:
+            ws_debug("we found a non BLF log container on top level. this is unexpected.");
+
+            /* TODO: maybe create "fake Log Container" for this */
+            if (file_seek(params->fh, current_start_pos + header.object_length, SEEK_SET, &err) < 0) {
+                return FALSE;
+            }
+        }
+    }
+
+    params->blf_data->current_real_seek_pos = 0;
+
+    return TRUE;
+}
+
+void
+blf_init_rec(blf_params_t *params, guint64 object_timestamp, int pkt_encap, guint32 channel) {
+    params->rec->rec_type = REC_TYPE_PACKET;
+    params->rec->tsprec = WTAP_TSPREC_NSEC;       /* there is no 10us, maybe we should update this*/
+    params->rec->ts.secs = object_timestamp / (1000 * 1000 * 1000);
+    params->rec->ts.nsecs = object_timestamp % (1000 * 1000 * 1000);
+
+    params->rec->rec_header.packet_header.pkt_encap = pkt_encap;
+    params->rec->rec_header.packet_header.interface_id = channel;
+    params->rec->rec_header.packet_header.drop_count = 0;
+    params->rec->rec_header.packet_header.packet_id = 0;
+    params->rec->rec_header.packet_header.interface_queue = 0;
+
+    /* TODO: before we had to remove comments and verdict here to not leak memory but APIs have changed ... */
+}
+
+gboolean
+blf_read_ethernetframe(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length) {
+    blf_logobjectheader_t logheader;
+    blf_ethernetframeheader_t ethheader;
+    guint8 tmpbuf[18];
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_ethernetframe: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_ethernetframe: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if (object_length < (data_start - block_start) + sizeof(blf_ethernetframeheader_t)) {
+        ws_debug("blf_read_ethernetframe: not enough bytes for ethernet frame header in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &ethheader, sizeof(ethheader), err, err_info)) {
+        ws_debug("blf_read_ethernetframe: not enough bytes for ethernet frame header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_ethernetframeheader(&ethheader);
+
+    /*
+     * BLF breaks up and reorders the Ethernet header and VLAN tag fields.
+     * This is a really bad design and makes this format one of the worst.
+     * If you want a fast format that keeps your data intact, avoid this format!
+     * So, lets hope we can reconstruct the original packet successfully.
+     */
+
+    tmpbuf[0] = ethheader.dst_addr[0];
+    tmpbuf[1] = ethheader.dst_addr[1];
+    tmpbuf[2] = ethheader.dst_addr[2];
+    tmpbuf[3] = ethheader.dst_addr[3];
+    tmpbuf[4] = ethheader.dst_addr[4];
+    tmpbuf[5] = ethheader.dst_addr[5];
+    tmpbuf[6] = ethheader.src_addr[0];
+    tmpbuf[7] = ethheader.src_addr[1];
+    tmpbuf[8] = ethheader.src_addr[2];
+    tmpbuf[9] = ethheader.src_addr[3];
+    tmpbuf[10] = ethheader.src_addr[4];
+    tmpbuf[11] = ethheader.src_addr[5];
+
+    if (ethheader.tpid != 0 && ethheader.tci != 0) {
+        tmpbuf[12] = (ethheader.tpid & 0xff00) >> 8;
+        tmpbuf[13] = (ethheader.tpid & 0x00ff);
+        tmpbuf[14] = (ethheader.tci & 0xff00) >> 8;
+        tmpbuf[15] = (ethheader.tci & 0x00ff);
+        tmpbuf[16] = (ethheader.ethtype & 0xff00) >> 8;
+        tmpbuf[17] = (ethheader.ethtype & 0x00ff);
+        ws_buffer_assure_space(params->buf, (gsize)18 + ethheader.payloadlength);
+        ws_buffer_append(params->buf, tmpbuf, (gsize)18);
+        params->rec->rec_header.packet_header.caplen = ((guint32)18 + ethheader.payloadlength);
+        params->rec->rec_header.packet_header.len = ((guint32)18 + ethheader.payloadlength);
+    } else {
+        tmpbuf[12] = (ethheader.ethtype & 0xff00) >> 8;
+        tmpbuf[13] = (ethheader.ethtype & 0x00ff);
+        ws_buffer_assure_space(params->buf, (gsize)14 + ethheader.payloadlength);
+        ws_buffer_append(params->buf, tmpbuf, (gsize)14);
+        params->rec->rec_header.packet_header.caplen = ((guint32)14 + ethheader.payloadlength);
+        params->rec->rec_header.packet_header.len = ((guint32)14 + ethheader.payloadlength);
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start + sizeof(blf_ethernetframeheader_t), ws_buffer_end_ptr(params->buf), ethheader.payloadlength, err, err_info)) {
+        ws_debug("blf_read_ethernetframe: copying ethernet frame failed");
+        return FALSE;
+    }
+    params->buf->first_free += ethheader.payloadlength;
+
+    params->rec->presence_flags = WTAP_HAS_TS | WTAP_HAS_CAP_LEN | WTAP_HAS_INTERFACE_ID;
+    blf_init_rec(params, logheader.object_timestamp, WTAP_ENCAP_ETHERNET, ethheader.channel);
+
+    return TRUE;
+}
+
+gboolean
+blf_read_ethernetframe_ext(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length) {
+    blf_logobjectheader_t logheader;
+    blf_ethernetframeheader_ex_t ethheader;
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_ethernetframe_ex: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_ethernetframe_ex: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if (object_length < (data_start - block_start) + sizeof(blf_ethernetframeheader_ex_t)) {
+        ws_debug("blf_read_ethernetframe_ex: not enough bytes for ethernet frame header in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &ethheader, sizeof(blf_ethernetframeheader_ex_t), err, err_info)) {
+        ws_debug("blf_read_ethernetframe_ex: not enough bytes for ethernet frame header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_ethernetframeheader_ex(&ethheader);
+
+    ws_buffer_assure_space(params->buf, ethheader.frame_length);
+
+    if (object_length - (data_start - block_start) - sizeof(blf_ethernetframeheader_ex_t) < ethheader.frame_length) {
+        ws_debug("blf_read_ethernetframe_ext: frame too short");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start + sizeof(blf_ethernetframeheader_ex_t), ws_buffer_start_ptr(params->buf), ethheader.frame_length, err, err_info)) {
+        ws_debug("blf_read_ethernetframe_ex: copying ethernet frame failed");
+        return FALSE;
+    }
+
+    blf_init_rec(params, logheader.object_timestamp, WTAP_ENCAP_ETHERNET, ethheader.channel);
+    params->rec->presence_flags = WTAP_HAS_TS | WTAP_HAS_CAP_LEN | WTAP_HAS_INTERFACE_ID | WTAP_HAS_INT_QUEUE;
+    params->rec->rec_header.packet_header.interface_queue = ethheader.hw_channel;
+    params->rec->rec_header.packet_header.caplen = ethheader.frame_length;
+    params->rec->rec_header.packet_header.len = ethheader.frame_length;
+    return TRUE;
+}
+
+static guint8 can_dlc_to_length[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 8, 8, 8, 8, 8, 8, 8 };
+static guint8 canfd_dlc_to_length[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 12, 16, 20, 24, 32, 48, 64 };
+
+gboolean
+blf_can_fill_buf_and_rec(blf_params_t *params, int *err, gchar **err_info, guint32 canid, guint8 payload_length, guint8 payload_length_valid, guint64 start_position,
+                         guint64 object_timestamp, guint32 channel) {
+    guint8   tmpbuf[8];
+    tmpbuf[0] = (canid & 0xff000000) >> 24;
+    tmpbuf[1] = (canid & 0x00ff0000) >> 16;
+    tmpbuf[2] = (canid & 0x0000ff00) >> 8;
+    tmpbuf[3] = (canid & 0x000000ff);
+    tmpbuf[4] = payload_length;
+    tmpbuf[5] = 0;
+    tmpbuf[6] = 0;
+    tmpbuf[7] = 0;
+
+    ws_buffer_assure_space(params->buf, sizeof(tmpbuf) + payload_length_valid);
+    ws_buffer_append(params->buf, tmpbuf, sizeof(tmpbuf));
+    params->rec->rec_header.packet_header.caplen = sizeof(tmpbuf) + payload_length_valid;
+    params->rec->rec_header.packet_header.len = sizeof(tmpbuf) + payload_length;
+
+    if (payload_length_valid > 0 && !blf_read_bytes_or_eof(params, start_position, ws_buffer_end_ptr(params->buf), payload_length_valid, err, err_info)) {
+        ws_debug("blf_can_fill_buf: copying can payload failed");
+        return FALSE;
+    }
+    params->buf->first_free += payload_length_valid;
+
+    blf_init_rec(params, object_timestamp, WTAP_ENCAP_SOCKETCAN, channel);
+    params->rec->presence_flags = WTAP_HAS_TS | WTAP_HAS_CAP_LEN | WTAP_HAS_INTERFACE_ID;
+
+    return TRUE;
+}
+
+gboolean
+blf_read_canmessage(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length, gboolean can_message2) {
+    blf_logobjectheader_t logheader;
+    blf_canmessage_t canheader;
+    blf_canmessage2_trailer_t can2trailer;
+
+    guint32  canid;
+    guint8   payload_length;
+    guint8   payload_length_valid;
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_canmessage: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_canmessage: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if (object_length < (data_start - block_start) + sizeof(canheader)) {
+        ws_debug("blf_read_canmessage: not enough bytes for canfd header in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &canheader, sizeof(canheader), err, err_info)) {
+        ws_debug("blf_read_canmessage: not enough bytes for can header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_canmessage(&canheader);
+
+    if (canheader.dlc > 15) {
+        canheader.dlc = 15;
+    }
+
+    payload_length = canheader.dlc;
+    if (payload_length > 8) {
+        ws_debug("blf_read_canmessage: regular CAN tries more than 8 bytes? Cutting to 8!");
+        payload_length = 8;
+    }
+
+    payload_length_valid = payload_length;
+
+    if (payload_length_valid > object_length - (data_start - block_start)) {
+        ws_debug("blf_read_canmessage: shortening CAN payload because buffer is too short!");
+        payload_length_valid = (guint8)(object_length - (data_start - block_start));
+    }
+
+    canid = canheader.id;
+
+    if ((canheader.flags & BLF_CANMESSAGE_FLAG_RTR) == BLF_CANMESSAGE_FLAG_RTR) {
+        canid |= CAN_RTR_FLAG;
+        payload_length_valid = 0;
+    }
+
+    if (!blf_can_fill_buf_and_rec(params, err, err_info, canid, payload_length, payload_length_valid, data_start + sizeof(canheader), logheader.object_timestamp, canheader.channel)) {
+        return FALSE;
+    }
+
+    /* actually, we do not really need the data, right now.... */
+    if (can_message2) {
+        if (object_length < (data_start - block_start) + sizeof(canheader) + payload_length_valid + sizeof(can2trailer)) {
+            ws_debug("blf_read_canmessage2: not enough bytes for can message 2 trailer");
+            return FALSE;
+        }
+        if (!blf_read_bytes_or_eof(params, data_start + sizeof(canheader) + payload_length_valid, &can2trailer, sizeof(can2trailer), err, err_info)) {
+            ws_debug("blf_read_canmessage2: not enough bytes for can message 2 trailer in file");
+            return FALSE;
+        }
+        fix_endianness_blf_canmessage2_trailer(&can2trailer);
+    }
+
+    return TRUE;
+}
+
+gboolean
+blf_read_canfdmessage(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length) {
+    blf_logobjectheader_t logheader;
+    blf_canfdmessage_t canheader;
+
+    gboolean canfd;
+    guint32  canid;
+    guint8   payload_length;
+    guint8   payload_length_valid;
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if (object_length < (data_start - block_start) + sizeof(canheader)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for canfd header in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &canheader, sizeof(canheader), err, err_info)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for canfd header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_canfdmessage(&canheader);
+
+    if (canheader.dlc > 15) {
+        canheader.dlc = 15;
+    }
+
+    canfd = (canheader.canfdflags & BLF_CANFDMESSAGE_CANFDFLAG_EDL) == BLF_CANFDMESSAGE_CANFDFLAG_EDL;
+    if (canfd) {
+        payload_length = canfd_dlc_to_length[canheader.dlc];
+    } else {
+        if (canheader.dlc > 8) {
+            ws_debug("blf_read_canfdmessage64: regular CAN tries more than 8 bytes?");
+        }
+        payload_length = can_dlc_to_length[canheader.dlc];
+    }
+
+    payload_length_valid = payload_length;
+
+    if (payload_length_valid > canheader.validDataBytes) {
+        ws_debug("blf_read_canfdmessage: shortening canfd payload because valid data bytes shorter!");
+        payload_length_valid = canheader.validDataBytes;
+    }
+
+    if (payload_length_valid > object_length - (data_start - block_start) + sizeof(canheader)) {
+        ws_debug("blf_read_canfdmessage: shortening can payload because buffer is too short!");
+        payload_length_valid = (guint8)(object_length - (data_start - block_start));
+    }
+
+    canid = canheader.id;
+
+    if ((canheader.flags & BLF_CANMESSAGE_FLAG_RTR) == BLF_CANMESSAGE_FLAG_RTR) {
+        canid |= CAN_RTR_FLAG;
+        payload_length_valid = 0;
+    }
+
+    if (!blf_can_fill_buf_and_rec(params, err, err_info, canid, payload_length, payload_length_valid, data_start + sizeof(canheader), logheader.object_timestamp, canheader.channel)) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+gboolean
+blf_read_canfdmessage64(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length) {
+    blf_logobjectheader_t logheader;
+    blf_canfdmessage64_t canheader;
+
+    gboolean canfd;
+    guint32  canid;
+    guint8   payload_length;
+    guint8   payload_length_valid;
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if (object_length < (data_start - block_start) + sizeof(canheader)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for canfd header in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &canheader, sizeof(canheader), err, err_info)) {
+        ws_debug("blf_read_canfdmessage64: not enough bytes for canfd header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_canfdmessage64(&canheader);
+
+
+    if (canheader.dlc > 15) {
+        canheader.dlc = 15;
+    }
+
+    canfd = (canheader.flags & BLF_CANFDMESSAGE64_FLAG_EDL) == BLF_CANFDMESSAGE64_FLAG_EDL;
+    if (canfd) {
+        payload_length = canfd_dlc_to_length[canheader.dlc];
+    } else {
+        if (canheader.dlc > 8) {
+            ws_debug("blf_read_canfdmessage64: regular CAN tries more than 8 bytes?");
+        }
+        payload_length = can_dlc_to_length[canheader.dlc];
+    }
+
+    payload_length_valid = payload_length;
+
+    if (payload_length_valid > canheader.validDataBytes) {
+        ws_debug("blf_read_canfdmessage64: shortening canfd payload because valid data bytes shorter!");
+        payload_length_valid = canheader.validDataBytes;
+    }
+
+    if (payload_length_valid > object_length - (data_start - block_start)) {
+        ws_debug("blf_read_canfdmessage64: shortening can payload because buffer is too short!");
+        payload_length_valid = (guint8)(object_length - (data_start - block_start));
+    }
+
+    canid = canheader.id;
+
+    if ((canid & CAN_EFF_FLAG) == CAN_EFF_FLAG) {
+        if ((canheader.flags & BLF_CANFDMESSAGE64_FLAG_SRR) == BLF_CANFDMESSAGE64_FLAG_SRR) {
+            canid |= CAN_RTR_FLAG;
+            payload_length_valid = 0;
+        }
+    } else {
+        if ((canheader.flags & BLF_CANFDMESSAGE64_FLAG_REMOTE_FRAME) == BLF_CANFDMESSAGE64_FLAG_REMOTE_FRAME) {
+            canid |= CAN_RTR_FLAG;
+            payload_length_valid = 0;
+        }
+    }
+
+    if (!blf_can_fill_buf_and_rec(params, err, err_info, canid, payload_length, payload_length_valid, data_start + sizeof(canheader), logheader.object_timestamp, canheader.channel)) {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+gboolean
+blf_read_flexraydata(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length) {
+    blf_logobjectheader_t logheader;
+    blf_flexraydata_t frheader;
+
+    guint8 payload_length;
+    guint8 payload_length_valid;
+    guint8 tmpbuf[7];
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_flexraydata: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_flexraydata: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if (object_length < (data_start - block_start) + sizeof(frheader)) {
+        ws_debug("blf_read_flexraydata: not enough bytes for flexrayheader in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &frheader, sizeof(frheader), err, err_info)) {
+        ws_debug("blf_read_flexraydata: not enough bytes for flexrayheader header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_flexraydata(&frheader);
+
+    payload_length = frheader.len;
+    payload_length_valid = payload_length;
+
+    if ((frheader.len & 0x01) == 0x01) {
+        ws_debug("blf_read_flexraydata: reading odd length in FlexRay!?");
+    }
+
+    if (payload_length_valid > object_length - (data_start - block_start) - sizeof(frheader)) {
+        ws_debug("blf_read_flexraydata: shortening FlexRay payload because buffer is too short!");
+        payload_length_valid = (guint8)(object_length - (data_start - block_start) - sizeof(frheader));
+    }
+
+    if (frheader.channel != 0 && frheader.channel != 1) {
+        ws_debug("blf_read_flexraydata: FlexRay supports only two channels.");
+    }
+
+    /* Measurement Header */
+    if (frheader.channel == 0) {
+        tmpbuf[0] = BLF_FLEXRAYDATA_FRAME;
+    } else {
+        tmpbuf[0] = BLF_FLEXRAYDATA_FRAME | BLF_FLEXRAYDATA_CHANNEL_B;
+    }
+
+    /* Error Flags */
+    tmpbuf[1] = 0;
+
+    /* Frame Header */
+    tmpbuf[2] = 0x20 | ((0x0700 & frheader.messageId) >> 8);
+    tmpbuf[3] = 0x00ff & frheader.messageId;
+    tmpbuf[4] = (0xfe & frheader.len) | ((frheader.crc & 0x0400) >> 10);
+    tmpbuf[5] = (0x03fc & frheader.crc) >> 2;
+    tmpbuf[6] = ((0x0003 & frheader.crc) << 6) | (0x3f & frheader.mux);
+
+    ws_buffer_assure_space(params->buf, sizeof(tmpbuf) + payload_length_valid);
+    ws_buffer_append(params->buf, tmpbuf, sizeof(tmpbuf));
+    params->rec->rec_header.packet_header.caplen = sizeof(tmpbuf) + payload_length_valid;
+    params->rec->rec_header.packet_header.len = sizeof(tmpbuf) + payload_length;
+
+    if (payload_length_valid > 0 && !blf_read_bytes_or_eof(params, data_start + sizeof(frheader), ws_buffer_end_ptr(params->buf), payload_length_valid, err, err_info)) {
+        ws_debug("blf_read_flexraydata: copying can payload failed");
+        return FALSE;
+    }
+    params->buf->first_free += payload_length_valid;
+
+    blf_init_rec(params, logheader.object_timestamp, WTAP_ENCAP_FLEXRAY, frheader.channel);
+    params->rec->presence_flags = WTAP_HAS_TS | WTAP_HAS_CAP_LEN | WTAP_HAS_INTERFACE_ID;
+
+    return TRUE;
+}
+
+gboolean
+blf_read_flexraymessage(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length) {
+    blf_logobjectheader_t logheader;
+    blf_flexraymessage_t frheader;
+
+    guint8 payload_length;
+    guint8 payload_length_valid;
+    guint8 tmpbuf[7];
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if (object_length < (data_start - block_start) + sizeof(frheader)) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for flexrayheader in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &frheader, sizeof(frheader), err, err_info)) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for flexrayheader header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_flexraymessage(&frheader);
+
+    payload_length = frheader.length;
+    payload_length_valid = payload_length;
+
+    if ((frheader.length & 0x01) == 0x01) {
+        ws_debug("blf_read_flexraymessage: reading odd length in FlexRay!?");
+    }
+
+    if (payload_length_valid > object_length - (data_start - block_start) - sizeof(frheader)) {
+        ws_debug("blf_read_flexraymessage: shortening FlexRay payload because buffer is too short!");
+        payload_length_valid = (guint8)(object_length - (data_start - block_start) - sizeof(frheader));
+    }
+
+    if (frheader.channel != 0 && frheader.channel != 1) {
+        ws_debug("blf_read_flexraymessage: FlexRay supports only two channels.");
+    }
+
+    /* Measurement Header */
+    if (frheader.channel == 0) {
+        tmpbuf[0] = BLF_FLEXRAYDATA_FRAME;
+    } else {
+        tmpbuf[0] = BLF_FLEXRAYDATA_FRAME | BLF_FLEXRAYDATA_CHANNEL_B;
+    }
+
+    /* Error Flags */
+    tmpbuf[1] = 0;
+
+    /* Frame Header */
+    tmpbuf[2] = ((0x0700 & frheader.frameId) >> 8);
+    if ((frheader.frameState & BLF_FLEXRAYMESSAGE_STATE_PPI) == BLF_FLEXRAYMESSAGE_STATE_PPI) {
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_PPI;
+    }
+
+    if ((frheader.frameState & BLF_FLEXRAYMESSAGE_STATE_SFI) == BLF_FLEXRAYMESSAGE_STATE_SFI) {
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_SFI;
+    }
+
+    if ((frheader.frameState & BLF_FLEXRAYMESSAGE_STATE_NFI) != BLF_FLEXRAYMESSAGE_STATE_NFI) {
+        /* NFI needs to be inversed !? */
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_NFI;
+    }
+
+    if ((frheader.frameState & BLF_FLEXRAYMESSAGE_STATE_STFI) == BLF_FLEXRAYMESSAGE_STATE_STFI) {
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_STFI;
+    }
+
+    tmpbuf[3] = 0x00ff & frheader.frameId;
+    tmpbuf[4] = (0xfe & frheader.length) | ((frheader.headerCrc & 0x0400) >> 10);
+    tmpbuf[5] = (0x03fc & frheader.headerCrc) >> 2;
+    tmpbuf[6] = ((0x0003 & frheader.headerCrc) << 6) | (0x3f & frheader.cycle);
+
+    ws_buffer_assure_space(params->buf, sizeof(tmpbuf) + payload_length_valid);
+    ws_buffer_append(params->buf, tmpbuf, sizeof(tmpbuf));
+    params->rec->rec_header.packet_header.caplen = sizeof(tmpbuf) + payload_length_valid;
+    params->rec->rec_header.packet_header.len = sizeof(tmpbuf) + payload_length;
+
+    if (payload_length_valid > 0 && !blf_read_bytes_or_eof(params, data_start + sizeof(frheader), ws_buffer_end_ptr(params->buf), payload_length_valid, err, err_info)) {
+        ws_debug("blf_read_flexraymessage: copying can payload failed");
+        return FALSE;
+    }
+    params->buf->first_free += payload_length_valid;
+
+    blf_init_rec(params, logheader.object_timestamp, WTAP_ENCAP_FLEXRAY, frheader.channel);
+    params->rec->presence_flags = WTAP_HAS_TS | WTAP_HAS_CAP_LEN | WTAP_HAS_INTERFACE_ID;
+
+    return TRUE;
+}
+
+gboolean
+blf_read_flexrayrcvmessageex(blf_params_t *params, int *err, gchar **err_info, gint64 block_start, gint64 header2_start, gint64 data_start, guint64 object_length, gboolean ext) {
+    blf_logobjectheader_t logheader;
+    blf_flexrayrcvmessage_t frheader;
+
+    guint16 payload_length;
+    guint16 payload_length_valid;
+    guint8  tmpbuf[7];
+    gint    frheadersize = sizeof(frheader);
+
+    if (ext) {
+        frheadersize += 40;
+    }
+
+    if (data_start - header2_start < (gint64)sizeof(blf_logobjectheader_t)) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for timestamp header");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, header2_start, &logheader, sizeof(logheader), err, err_info)) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for logheader");
+        return FALSE;
+    }
+    fix_endianness_blf_logobjectheader(&logheader);
+
+    if ((gint64)object_length < (data_start - block_start) + frheadersize) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for flexrayheader in object");
+        return FALSE;
+    }
+
+    if (!blf_read_bytes_or_eof(params, data_start, &frheader, sizeof(frheader), err, err_info)) {
+        ws_debug("blf_read_flexraymessage: not enough bytes for flexrayheader header in file");
+        return FALSE;
+    }
+    fix_endianness_blf_flexrayrcvmessage(&frheader);
+
+    if (!ext) {
+        frheader.dir &= 0xff;
+        frheader.cycle &= 0xff;
+    }
+
+    payload_length = frheader.payloadLength;
+    payload_length_valid = frheader.payloadLengthValid;
+
+    if ((frheader.payloadLength & 0x01) == 0x01) {
+        ws_debug("blf_read_flexraymessage: reading odd length in FlexRay!?");
+    }
+
+    if (payload_length_valid > object_length - (data_start - block_start) - frheadersize) {
+        ws_debug("blf_read_flexraymessage: shortening FlexRay payload because buffer is too short!");
+        payload_length_valid = (guint8)(object_length - (data_start - block_start) - frheadersize);
+    }
+
+    /* Measurement Header */
+    /* TODO: It seems that this format support both channels at the same time!? */
+    if (frheader.channelMask == BLF_FLEXRAYRCVMSG_CHANNELMASK_A) {
+        tmpbuf[0] = BLF_FLEXRAYDATA_FRAME;
+    } else {
+        tmpbuf[0] = BLF_FLEXRAYDATA_FRAME | BLF_FLEXRAYDATA_CHANNEL_B;
+    }
+
+    /* Error Flags */
+    tmpbuf[1] = 0;
+
+    /* Frame Header */
+    tmpbuf[2] = ((0x0700 & frheader.frameId) >> 8);
+    if ((frheader.data & BLF_FLEXRAYRCVMSG_DATA_FLAG_PAYLOAD_PREAM) == BLF_FLEXRAYRCVMSG_DATA_FLAG_PAYLOAD_PREAM) {
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_PPI;
+    }
+
+    if ((frheader.data & BLF_FLEXRAYRCVMSG_DATA_FLAG_SYNC) == BLF_FLEXRAYRCVMSG_DATA_FLAG_SYNC) {
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_SFI;
+    }
+
+    if ((frheader.data & BLF_FLEXRAYRCVMSG_DATA_FLAG_NULL_FRAME) != BLF_FLEXRAYRCVMSG_DATA_FLAG_NULL_FRAME) {
+        /* NFI needs to be inversed !? */
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_NFI;
+    }
+
+    if ((frheader.data & BLF_FLEXRAYRCVMSG_DATA_FLAG_STARTUP) == BLF_FLEXRAYRCVMSG_DATA_FLAG_STARTUP) {
+        tmpbuf[2] |= BLF_DLT_FLEXRAY_STFI;
+    }
+
+    tmpbuf[3] = 0x00ff & frheader.frameId;
+    tmpbuf[4] = (0xfe & frheader.payloadLength) | ((frheader.headerCrc1 & 0x0400) >> 10);
+    tmpbuf[5] = (0x03fc & frheader.headerCrc1) >> 2;
+    tmpbuf[6] = ((0x0003 & frheader.headerCrc1) << 6) | (0x3f & frheader.cycle);
+
+    ws_buffer_assure_space(params->buf, sizeof(tmpbuf) + payload_length_valid);
+    ws_buffer_append(params->buf, tmpbuf, sizeof(tmpbuf));
+    params->rec->rec_header.packet_header.caplen = sizeof(tmpbuf) + payload_length_valid;
+    params->rec->rec_header.packet_header.len = sizeof(tmpbuf) + payload_length;
+
+    if (payload_length_valid > 0 && !blf_read_bytes_or_eof(params, data_start + frheadersize, ws_buffer_end_ptr(params->buf), payload_length_valid, err, err_info)) {
+        ws_debug("blf_read_flexraymessage: copying can payload failed");
+        return FALSE;
+    }
+    params->buf->first_free += payload_length_valid;
+
+    blf_init_rec(params, logheader.object_timestamp, WTAP_ENCAP_FLEXRAY, frheader.channelMask);
+    params->rec->presence_flags = WTAP_HAS_TS | WTAP_HAS_CAP_LEN | WTAP_HAS_INTERFACE_ID;
+
+    return TRUE;
+}
+
+
+gboolean
+blf_read_block(blf_params_t *params, gint64 start_pos, int *err, gchar **err_info) {
+    blf_blockheader_t header;
+    //gint64 infile_block_start = blf_translate_pos(params->blf_data, start_pos);
+
+    while (1) {
+        /* Find Object */
+
+        /* Resetting buffer */
+        params->buf->first_free = params->buf->start;
+
+        while (1) {
+            if (!blf_read_bytes_or_eof(params, start_pos, &header, sizeof header, err, err_info)) {
+                ws_debug("blf_read_block: not enough bytes for block header or unsupported file");
+                if (*err == WTAP_ERR_SHORT_READ) {
+                    /* we have found the end that is not a short read therefore. */
+                    *err = 0;
+                    g_free(*err_info);
+                }
+                return FALSE;
+            }
+
+            fix_endianness_blf_blockheader(&header);
+
+            if (memcmp(header.magic, blf_obj_magic, sizeof(blf_obj_magic))) {
+                ws_debug("object magic is not LOBJ");
+            } else {
+                break;
+            }
+
+            /* we are moving back and try again but 1 byte later */
+            /* TODO: better understand how this paddings works... */
+            start_pos++;
+        }
+        params->blf_data->start_of_last_obj = start_pos;
+
+        if (header.header_type != BLF_HEADER_TYPE_DEFAULT) {
+            ws_debug("unknown header type");
+            return FALSE;
+        }
+
+        /* already making sure that we start after this object next time. */
+        params->blf_data->current_real_seek_pos = start_pos + header.object_length;
+
+        switch (header.object_type) {
+        case BLF_OBJTYPE_LOG_CONTAINER:
+            ws_debug("blf_read_block: log container in log container not supported");
+            return FALSE;
+            break;
+
+        case BLF_OBJTYPE_ETHERNET_FRAME:
+            return blf_read_ethernetframe(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                          start_pos + header.header_length, header.object_length);
+            break;
+
+        case BLF_OBJTYPE_ETHERNET_FRAME_EX:
+            return blf_read_ethernetframe_ext(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                              start_pos + header.header_length, header.object_length);
+            break;
+
+        case BLF_OBJTYPE_CAN_MESSAGE:
+            return blf_read_canmessage(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                       start_pos + header.header_length, header.object_length, FALSE);
+            break;
+
+        case BLF_OBJTYPE_CAN_MESSAGE2:
+            return blf_read_canmessage(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                       start_pos + header.header_length, header.object_length, TRUE);
+            break;
+
+        case BLF_OBJTYPE_CAN_FD_MESSAGE:
+            return blf_read_canfdmessage(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                         start_pos + header.header_length, header.object_length);
+            break;
+
+        case BLF_OBJTYPE_CAN_FD_MESSAGE_64:
+            return blf_read_canfdmessage64(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                           start_pos + header.header_length, header.object_length);
+            break;
+
+        case BLF_OBJTYPE_FLEXRAY_DATA:
+            return blf_read_flexraydata(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                           start_pos + header.header_length, header.object_length);
+            break;
+
+        case BLF_OBJTYPE_FLEXRAY_MESSAGE:
+            return blf_read_flexraymessage(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                           start_pos + header.header_length, header.object_length);
+            break;
+
+        case BLF_OBJTYPE_FLEXRAY_RCVMESSAGE:
+            return blf_read_flexrayrcvmessageex(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                                start_pos + header.header_length, header.object_length, FALSE);
+            break;
+
+        case BLF_OBJTYPE_FLEXRAY_RCVMESSAGE_EX:
+            return blf_read_flexrayrcvmessageex(params, err, err_info, start_pos, start_pos + sizeof(blf_blockheader_t),
+                                                start_pos + header.header_length, header.object_length, TRUE);
+            break;
+
+        default:
+            ws_debug("blf_read_block: unknown object type");
+            start_pos += header.object_length;
+        }
+    }
+    return TRUE;
+}
+
+static gboolean blf_read(wtap *wth, wtap_rec *rec, Buffer *buf, int *err, gchar **err_info, gint64 *data_offset) {
+    blf_params_t blf_tmp;
+
+    blf_tmp.wth = wth;
+    blf_tmp.fh  = wth->fh;
+    blf_tmp.rec = rec;
+    blf_tmp.buf = buf;
+    blf_tmp.blf_data = (blf_t *)wth->priv;
+
+    if (!blf_read_block(&blf_tmp, blf_tmp.blf_data->current_real_seek_pos, err, err_info)) {
+        ws_debug("data_offset is %" G_GINT64_MODIFIER "d", *data_offset);
+        return FALSE;
+    }
+    *data_offset = blf_tmp.blf_data->start_of_last_obj;
+
+    return TRUE;
+}
+
+static gboolean blf_seek_read(wtap *wth, gint64 seek_off, wtap_rec *rec, Buffer *buf, int *err, gchar **err_info) {
+    blf_params_t blf_tmp;
+
+    blf_tmp.wth = wth;
+    blf_tmp.fh  = wth->random_fh;
+    blf_tmp.rec = rec;
+    blf_tmp.buf = buf;
+    blf_tmp.blf_data = (blf_t *)wth->priv;
+
+    if (!blf_read_block(&blf_tmp, seek_off, err, err_info)) {
+        ws_debug("couldn't read packet block (err=%d).", *err);
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+static void blf_close(wtap *wth) {
+    blf_t *blf = (blf_t *)wth->priv;
+
+    if (blf != NULL && blf->log_containers != NULL) {
+        for (guint i = 0; i < blf->log_containers->len; i++) {
+            blf_log_container_t *log_container = &g_array_index(blf->log_containers, blf_log_container_t, i);
+            if (log_container->real_data != NULL) {
+                g_free(log_container->real_data);
+            }
+        }
+        g_array_free(blf->log_containers, TRUE);
+        blf->log_containers = NULL;
+    }
+
+    return;
+}
+
+wtap_open_return_val
+blf_open(wtap *wth, int *err, gchar **err_info) {
+    blf_fileheader_t  header;
+    blf_t            *blf;
+    blf_params_t      params;
+
+    ws_debug("opening file");
+
+    if (!wtap_read_bytes_or_eof(wth->fh, &header, sizeof header, err, err_info)) {
+
+        ws_debug("wtap_read_bytes_or_eof() failed, err = %d.", *err);
+        if (*err == 0 || *err == WTAP_ERR_SHORT_READ) {
+            /*
+             * Short read or EOF.
+             *
+             * We're reading this as part of an open, so
+             * the file is too short to be a blf file.
+             */
+            *err = 0;
+            g_free(*err_info);
+            *err_info = NULL;
+            return WTAP_OPEN_NOT_MINE;
+        }
+        return WTAP_OPEN_ERROR;
+    }
+
+    fix_endianness_blf_fileheader(&header);
+
+    if (memcmp(header.magic, blf_magic, sizeof(blf_magic))) {
+        return WTAP_OPEN_NOT_MINE;
+    }
+
+    /* This seems to be an BLF! */
+    /* skip unknown part of header */
+    file_seek(wth->fh, header.header_length, SEEK_SET, err);
+
+    /* Prepare our private context. */
+    blf = g_new(blf_t, 1);
+    blf->log_containers = NULL;
+    blf->current_log_container = 0;
+    blf->current_real_seek_pos = 0;
+
+    /* embed in params */
+    params.blf_data = blf;
+    params.buf = NULL;
+    params.fh = wth->fh;
+    params.rec = NULL;
+    params.wth = wth;
+    params.blf_data->current_real_seek_pos = 0;
+
+    /* lets check out the layout of all log containers */
+    blf_scan_file_for_logcontainers(&params);
+
+    wth->priv = (void *)blf;
+    wth->file_encap = WTAP_ENCAP_UNKNOWN;
+    wth->snapshot_length = 0;
+    wth->file_tsprec = WTAP_TSPREC_UNKNOWN;
+    wth->subtype_read = blf_read;
+    wth->subtype_seek_read = blf_seek_read;
+    wth->subtype_close = blf_close;
+    wth->file_type_subtype = blf_file_type_subtype;
+
+    return WTAP_OPEN_MINE;
+}
+
+static const struct supported_block_type blf_blocks_supported[] = {
+    { WTAP_BLOCK_PACKET, ONE_BLOCK_SUPPORTED, NO_OPTIONS_SUPPORTED }
+};
+
+static const struct file_type_subtype_info blf_info = {
+        "BLF Logfile", "blf", "blf", NULL,
+        FALSE, BLOCKS_SUPPORTED(blf_blocks_supported),
+        NULL, NULL, NULL
+};
+
+void register_blf(void)
+{
+    blf_file_type_subtype = wtap_register_file_type_subtype(&blf_info);
+
+    /*
+     * Register name for backwards compatibility with the
+     * wtap_filetypes table in Lua.
+     */
+    wtap_register_backwards_compatibility_lua_name("BLF", blf_file_type_subtype);
+}
+
+/*
+ * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 4
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=4 tabstop=8 expandtab:
+ * :indentSize=4:tabSize=8:noTabs=true:
+ */
diff --git a/wiretap/blf.h b/wiretap/blf.h
new file mode 100644
index 0000000000..3871b31326
--- /dev/null
+++ b/wiretap/blf.h
@@ -0,0 +1,473 @@
+/* blf.h
+ *
+ * BLF file format decoder for the Wiretap library.
+ *
+ * Copyright (c) 2021 by Dr. Lars Voelker <lars.voelker@technica-engineering.de>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+ /*
+  * The following was used as a reference for the file format:
+  *     https://bitbucket.org/tobylorenz/vector_blf
+  * The repo above includes multiple examples files as well.
+  */
+
+#ifndef __W_BLF_H__
+#define __W_BLF_H__
+
+#include "wtap.h"
+#include <epan/value_string.h>
+
+wtap_open_return_val blf_open(wtap *wth, int *err, gchar **err_info);
+
+
+#define BLF_HEADER_TYPE_DEFAULT                   1
+
+#define BLF_COMPRESSION_NONE                      0
+#define BLF_COMPRESSION_ZLIB                      2
+
+#define BLF_TIMESTAMP_RESOLUTION_10US             1
+#define BLF_TIMESTAMP_RESOLUTION_1NS              2
+
+typedef struct blf_date {
+    guint16 year;
+    guint16 month;
+    guint16 dayofweek;
+    guint16 day;
+    guint16 hour;
+    guint16 mins;
+    guint16 sec;
+    guint16 ms;
+} blf_date_t;
+
+/* BLF Header */
+typedef struct blf_fileheader {
+    guint8 magic[4];
+    guint32 header_length;
+
+    guint8 applications[4];
+    guint8 api[4];
+
+    guint64 len_compressed;
+    guint64 len_uncompressed;
+
+    guint32 obj_count;
+    guint32 obj_read;
+
+    blf_date_t start_date;
+    blf_date_t end_date;
+
+    guint32 length3;
+} blf_fileheader_t;
+
+typedef struct blf_blockheader {
+    guint8  magic[4];
+    guint16 header_length;         /* length of header starting with magic */
+    guint16 header_type;           /* header format ? */
+    guint32 object_length;         /* complete length including header */
+    guint32 object_type;
+} blf_blockheader_t;
+
+typedef struct blf_logcontainerheader {
+    guint16 compression_method;    /* 0 uncompressed, 2 zlib */
+    guint16 res1;
+    guint32 res2;
+    guint32 uncompressed_size;
+    guint32 res4;
+} blf_logcontainerheader_t;
+
+typedef struct blf_logobjectheader {
+    guint32 flags;
+    guint16 client_index;
+    guint16 object_version;
+    guint64 object_timestamp;
+} blf_logobjectheader_t;
+
+typedef struct blf_ethernetframeheader {
+    guint8  src_addr[6];
+    guint16 channel;
+    guint8  dst_addr[6];
+    guint16 direction;
+    guint16 ethtype;
+    guint16 tpid;
+    guint16 tci;
+    guint16 payloadlength;
+    guint64 res;
+} blf_ethernetframeheader_t;
+
+typedef struct blf_ethernetframeheader_ex {
+    guint16 struct_length;
+    guint16 flags;
+    guint16 channel;
+    guint16 hw_channel;
+    guint64 frame_duration;
+    guint32 frame_checksum;
+    guint16 direction;
+    guint16 frame_length;
+    guint32 frame_handle;
+    guint32 error;
+} blf_ethernetframeheader_ex_t;
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/CanMessage.h */
+
+/* shared for CAN message and CAN message2 and CANFD message */
+#define BLF_CANMESSAGE_FLAG_TX                      0x01
+#define BLF_CANMESSAGE_FLAG_NERR                    0x20
+#define BLF_CANMESSAGE_FLAG_WU                      0x40
+#define BLF_CANMESSAGE_FLAG_RTR                     0x80
+
+/* shared for CAN message and CAN message2*/
+typedef struct blf_canmessage {
+    guint16 channel;
+    guint8  flags;
+    guint8  dlc;
+    guint32 id;
+} blf_canmessage_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/CanMessage2.h */
+
+typedef struct blf_canmessage2_trailer {
+    guint32 frameLength_in_ns;
+    guint8 bitCount;
+    guint8 reserved1;
+    guint16 reserved2;
+} blf_canmessage2_trailer_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/CanFdMessage.h */
+
+/* EDL 0: CAN, 1: CAN-FD*/
+#define BLF_CANFDMESSAGE_CANFDFLAG_EDL              0x01
+#define BLF_CANFDMESSAGE_CANFDFLAG_BRS              0x02
+#define BLF_CANFDMESSAGE_CANFDFLAG_ESI              0x04
+
+typedef struct blf_canfdmessage {
+    guint16 channel;
+    guint8  flags;
+    guint8  dlc;
+    guint32 id;
+    guint32 frameLength_in_ns;
+    guint8  canfdflags;
+    guint8  validDataBytes;
+    guint8  reservedCanFdMessage1;
+    guint32  reservedCanFdMessage2;
+    /* DATA */
+    /* guint32 reservedCanFdMessage3 */
+} blf_canfdmessage_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/CanFdMessage64.h */
+
+#define BLF_CANFDMESSAGE64_FLAG_NERR                0x000004
+#define BLF_CANFDMESSAGE64_FLAG_HIGH_VOLT_WAKE_UP   0x000008
+#define BLF_CANFDMESSAGE64_FLAG_REMOTE_FRAME        0x000010
+#define BLF_CANFDMESSAGE64_FLAG_TX_ACK              0x000040
+#define BLF_CANFDMESSAGE64_FLAG_TX_REQ              0x000080
+#define BLF_CANFDMESSAGE64_FLAG_SRR                 0x000200
+#define BLF_CANFDMESSAGE64_FLAG_R0                  0x000400
+#define BLF_CANFDMESSAGE64_FLAG_R1                  0x000800
+/* EDL 0: CAN, 1: CAN-FD*/
+#define BLF_CANFDMESSAGE64_FLAG_EDL                 0x001000
+#define BLF_CANFDMESSAGE64_FLAG_BRS                 0x002000
+#define BLF_CANFDMESSAGE64_FLAG_ESI                 0x004000
+#define BLF_CANFDMESSAGE64_FLAG_BURST               0x200000
+
+typedef struct blf_canfdmessage64 {
+    guint8  channel;
+    guint8  dlc;
+    guint8  validDataBytes;
+    guint8  txCount;
+    guint32 id;
+    guint32 frameLength_in_ns;
+    guint32 flags;
+    guint32 btrCfgArb;
+    guint32 btrCfgData;
+    guint32 timeOffsetBrsNs;
+    guint32 timeOffsetCrcDelNs;
+    guint16 bitCount;
+    guint8  dir;
+    guint8  extDataOffset;
+    guint32 crc;
+} blf_canfdmessage64_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/FlexRayData.h */
+
+#define BLF_FLEXRAYDATA_FRAME                       0x01
+#define BLF_FLEXRAYDATA_CHANNEL_B                   0x80
+
+typedef struct blf_flexraydata {
+    guint16 channel;
+    guint8  mux;
+    guint8  len;
+    guint16 messageId;
+    guint16 crc;
+    guint8  dir;
+    guint8  reservedFlexRayData1;
+    guint16 reservedFlexRayData2;
+} blf_flexraydata_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/FlexRayV6Message.h */
+
+#define BLF_FLEXRAYMESSAGE_DIR_RX                   0x01
+#define BLF_FLEXRAYMESSAGE_DIR_TX                   0x02
+#define BLF_FLEXRAYMESSAGE_DIR_TX_REQ               0x04
+
+#define BLF_FLEXRAYMESSAGE_STATE_PPI                0x01
+#define BLF_FLEXRAYMESSAGE_STATE_SFI                0x02
+#define BLF_FLEXRAYMESSAGE_STATE_RES_BIT2           0x04
+#define BLF_FLEXRAYMESSAGE_STATE_NFI                0x08
+#define BLF_FLEXRAYMESSAGE_STATE_STFI               0x10
+#define BLF_FLEXRAYMESSAGE_STATE_FORMAT             0xe0
+
+#define BLF_FLEXRAYMESSAGE_HEADER_BIT_NM            0x01
+#define BLF_FLEXRAYMESSAGE_HEADER_BIT_SYNC          0x02
+#define BLF_FLEXRAYMESSAGE_HEADER_BIT_RES           0x04
+
+#define BLF_DLT_FLEXRAY_STFI                        0x08
+#define BLF_DLT_FLEXRAY_SFI                         0x10
+#define BLF_DLT_FLEXRAY_NFI                         0x20
+#define BLF_DLT_FLEXRAY_PPI                         0x40
+
+typedef struct blf_flexraymessage {
+    guint16 channel;
+    guint8  dir;            /* Flags: 0 RX, 1 TX, 2 TX Req, 3 internal, 4 internal*/
+    guint8  lowTime;
+    guint32 fpgaTick;
+    guint32 fpgaTickOverflow;
+    guint32 clientIndexFlexRayV6Message;
+    guint32 clusterTime;
+    guint16 frameId;
+    guint16 headerCrc;
+    guint16 frameState;
+    guint8  length;
+    guint8  cycle;
+    guint8  headerBitMask;
+    guint8  reservedFlexRayV6Message1;
+    guint16 reservedFlexRayV6Message2;
+} blf_flexraymessage_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/FlexRayVFrReceiveMsg.h */
+
+#define BLF_FLEXRAYRCVMSG_DIR_RX                  0x01
+#define BLF_FLEXRAYRCVMSG_DIR_TX                  0x02
+#define BLF_FLEXRAYRCVMSG_DIR_TX_REQ              0x04
+
+#define BLF_FLEXRAYRCVMSG_CHANNELMASK_RES         0x00
+#define BLF_FLEXRAYRCVMSG_CHANNELMASK_A           0x01
+#define BLF_FLEXRAYRCVMSG_CHANNELMASK_B           0x02
+#define BLF_FLEXRAYRCVMSG_CHANNELMASK_AB          0x03
+
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_NULL_FRAME    0x00000001
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_VALID_DATA    0x00000002
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_SYNC          0x00000004
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_STARTUP       0x00000008
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_PAYLOAD_PREAM 0x00000010
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_RES_20        0x00000020
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_ERROR         0x00000040
+#define BLF_FLEXRAYRCVMSG_DATA_FLAG_RES_80        0x00000080
+
+typedef struct blf_flexrayrcvmessage {
+    guint16 channel;
+    guint16 version;
+    guint16 channelMask;    /* 0 res, 1 A, 2 B, 3 A+B */
+    guint16  dir;           /* 0 RX, 1 TX, 2 TX Req, 3 internal, 4 internal*/ /* high byte reserved! */
+    guint32 clientIndex;
+    guint32 clusterNo;
+    guint16 frameId;
+    guint16 headerCrc1;
+    guint16 headerCrc2;
+    guint16 payloadLength;
+    guint16 payloadLengthValid;
+    guint16 cycle;          /* high byte reserved! */
+    guint32 tag;
+    guint32 data;
+    guint32 frameFlags;
+    guint32 appParameter;
+    /* if ext, skip 40 bytes */
+    /* payload bytes */
+    /* guint16 res3 */
+    /* guint32 res4 */
+} blf_flexrayrcvmessage_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/FlexRayVFrReceiveMsgEx.h */
+
+/* defines see above BLF_FLEXRAYRCVMSG_* */
+
+typedef struct blf_flexrayrcvmessageex {
+    guint16 channel;
+    guint16 version;
+    guint16 channelMask;    /* 0 res, 1 A, 2 B, 3 A+B */
+    guint16 dir;            /* 0 RX, 1 TX, 2 TX Req, 3 internal, 4 internal*/
+    guint32 clientIndex;
+    guint32 clusterNo;
+    guint16 frameId;
+    guint16 headerCrc1;
+    guint16 headerCrc2;
+    guint16 payloadLength;
+    guint16 payloadLengthValid;
+    guint16 cycle;
+    guint32 tag;
+    guint32 data;
+    guint32 frameFlags;
+    guint32 appParameter;
+    guint32 frameCRC;
+    guint32 frameLengthInNs;
+    guint16 frameId1;
+    guint16 pduOffset;
+    guint16 blfLogMask;
+    guint16 res1;
+    guint32 res2;
+    guint32 res3;
+    guint32 res4;
+    guint32 res5;
+    guint32 res6;
+    guint32 res7;
+    /* payload bytes */
+} blf_flexrayrcvmessageex_t;
+
+
+/* see https://bitbucket.org/tobylorenz/vector_blf/src/master/src/Vector/BLF/ObjectHeaderBase.h */
+
+#define BLF_OBJTYPE_UNKNOWN                       0
+#define BLF_OBJTYPE_CAN_MESSAGE                   1
+#define BLF_OBJTYPE_CAN_ERROR                     2
+#define BLF_OBJTYPE_CAN_OVERLOAD                  3
+#define BLF_OBJTYPE_CAN_STATISTIC                 4
+#define BLF_OBJTYPE_APP_TRIGGER                   5
+#define BLF_OBJTYPE_ENV_INTEGER                   6
+#define BLF_OBJTYPE_ENV_DOUBLE                    7
+#define BLF_OBJTYPE_ENV_STRING                    8
+#define BLF_OBJTYPE_ENV_DATA                      9
+#define BLF_OBJTYPE_LOG_CONTAINER                10
+#define BLF_OBJTYPE_LIN_MESSAGE                  11
+#define BLF_OBJTYPE_LIN_CRC_ERROR                12
+#define BLF_OBJTYPE_LIN_DLC_INFO                 13
+#define BLF_OBJTYPE_LIN_RCV_ERROR                14
+#define BLF_OBJTYPE_LIN_SND_ERROR                15
+#define BLF_OBJTYPE_LIN_SLV_TIMEOUT              16
+#define BLF_OBJTYPE_LIN_SCHED_MODCH              17
+#define BLF_OBJTYPE_LIN_SYN_ERROR                18
+#define BLF_OBJTYPE_LIN_BAUDRATE                 19
+#define BLF_OBJTYPE_LIN_SLEEP                    20
+#define BLF_OBJTYPE_LIN_WAKEUP                   21
+#define BLF_OBJTYPE_MOST_SPY                     22
+#define BLF_OBJTYPE_MOST_CTRL                    23
+#define BLF_OBJTYPE_MOST_LIGHTLOCK               24
+#define BLF_OBJTYPE_MOST_STATISTIC               25
+#define BLF_OBJTYPE_FLEXRAY_DATA                 29
+#define BLF_OBJTYPE_FLEXRAY_SYNC                 30
+#define BLF_OBJTYPE_CAN_DRIVER_ERROR             31
+#define BLF_OBJTYPE_MOST_PKT                     32
+#define BLF_OBJTYPE_MOST_PKT2                    33
+#define BLF_OBJTYPE_MOST_HWMODE                  34
+#define BLF_OBJTYPE_MOST_REG                     35
+#define BLF_OBJTYPE_MOST_GENREG                  36
+#define BLF_OBJTYPE_MOST_NETSTATE                37
+#define BLF_OBJTYPE_MOST_DATALOST                38
+#define BLF_OBJTYPE_MOST_TRIGGER                 39
+#define BLF_OBJTYPE_FLEXRAY_CYCLE                40
+#define BLF_OBJTYPE_FLEXRAY_MESSAGE              41
+#define BLF_OBJTYPE_LIN_CHECKSUM_INFO            42
+#define BLF_OBJTYPE_LIN_SPIKE_EVENT              43
+#define BLF_OBJTYPE_CAN_DRIVER_SYNC              44
+#define BLF_OBJTYPE_FLEXRAY_STATUS               45
+#define BLF_OBJTYPE_GPS_EVENT                    46
+#define BLF_OBJTYPE_FLEXRAY_ERROR                47
+#define BLF_OBJTYPE_FLEXRAY_STATUS2              48
+#define BLF_OBJTYPE_FLEXRAY_STARTCYCLE           49
+#define BLF_OBJTYPE_FLEXRAY_RCVMESSAGE           50
+#define BLF_OBJTYPE_REALTIMECLOCK                51
+#define BLF_OBJTYPE_LIN_STATISTIC                54
+#define BLF_OBJTYPE_J1708_MESSAGE                55
+#define BLF_OBJTYPE_J1708_VIRTUAL_MSG            56
+#define BLF_OBJTYPE_LIN_MESSAGE2                 57
+#define BLF_OBJTYPE_LIN_SND_ERROR2               58
+#define BLF_OBJTYPE_LIN_SYN_ERROR2               59
+#define BLF_OBJTYPE_LIN_CRC_ERROR2               60
+#define BLF_OBJTYPE_LIN_RCV_ERROR2               61
+#define BLF_OBJTYPE_LIN_WAKEUP2                  62
+#define BLF_OBJTYPE_LIN_SPIKE_EVENT2             63
+#define BLF_OBJTYPE_LIN_LONG_DOM_SIG             64
+#define BLF_OBJTYPE_APP_TEXT                     65
+#define BLF_OBJTYPE_FLEXRAY_RCVMESSAGE_EX        66
+#define BLF_OBJTYPE_MOST_STATISTICEX             67
+#define BLF_OBJTYPE_MOST_TXLIGHT                 68
+#define BLF_OBJTYPE_MOST_ALLOCTAB                69
+#define BLF_OBJTYPE_MOST_STRESS                  70
+#define BLF_OBJTYPE_ETHERNET_FRAME               71
+#define BLF_OBJTYPE_SYS_VARIABLE                 72
+#define BLF_OBJTYPE_CAN_ERROR_EXT                73
+#define BLF_OBJTYPE_CAN_DRIVER_ERROR_EXT         74
+#define BLF_OBJTYPE_LIN_LONG_DOM_SIG2            75
+#define BLF_OBJTYPE_MOST_150_MESSAGE             76
+#define BLF_OBJTYPE_MOST_150_PKT                 77
+#define BLF_OBJTYPE_MOST_ETHERNET_PKT            78
+#define BLF_OBJTYPE_MOST_150_MESSAGE_FRAGMENT    79
+#define BLF_OBJTYPE_MOST_150_PKT_FRAGMENT        80
+#define BLF_OBJTYPE_MOST_ETHERNET_PKT_FRAGMENT   81
+#define BLF_OBJTYPE_MOST_SYSTEM_EVENT            82
+#define BLF_OBJTYPE_MOST_150_ALLOCTAB            83
+#define BLF_OBJTYPE_MOST_50_MESSAGE              84
+#define BLF_OBJTYPE_MOST_50_PKT                  85
+#define BLF_OBJTYPE_CAN_MESSAGE2                 86
+#define BLF_OBJTYPE_LIN_UNEXPECTED_WAKEUP        87
+#define BLF_OBJTYPE_LIN_SHORT_OR_SLOW_RESPONSE   88
+#define BLF_OBJTYPE_LIN_DISTURBANCE_EVENT        89
+#define BLF_OBJTYPE_SERIAL_EVENT                 90
+#define BLF_OBJTYPE_OVERRUN_ERROR                91
+#define BLF_OBJTYPE_EVENT_COMMENT                92
+#define BLF_OBJTYPE_WLAN_FRAME                   93
+#define BLF_OBJTYPE_WLAN_STATISTIC               94
+#define BLF_OBJTYPE_MOST_ECL                     95
+#define BLF_OBJTYPE_GLOBAL_MARKER                96
+#define BLF_OBJTYPE_AFDX_FRAME                   97
+#define BLF_OBJTYPE_AFDX_STATISTIC               98
+#define BLF_OBJTYPE_KLINE_STATUSEVENT            99
+#define BLF_OBJTYPE_CAN_FD_MESSAGE              100
+#define BLF_OBJTYPE_CAN_FD_MESSAGE_64           101
+#define BLF_OBJTYPE_ETHERNET_RX_ERROR           102
+#define BLF_OBJTYPE_ETHERNET_STATUS             103
+#define BLF_OBJTYPE_CAN_FD_ERROR_64             104
+#define BLF_OBJTYPE_AFDX_STATUS                 106
+#define BLF_OBJTYPE_AFDX_BUS_STATISTIC          107
+#define BLF_OBJTYPE_AFDX_ERROR_EVENT            109
+#define BLF_OBJTYPE_A429_ERROR                  110
+#define BLF_OBJTYPE_A429_STATUS                 111
+#define BLF_OBJTYPE_A429_BUS_STATISTIC          112
+#define BLF_OBJTYPE_A429_MESSAGE                113
+#define BLF_OBJTYPE_ETHERNET_STATISTIC          114
+#define BLF_OBJTYPE_TEST_STRUCTURE              118
+#define BLF_OBJTYPE_DIAG_REQUEST_INTERPRETATION 119
+#define BLF_OBJTYPE_ETHERNET_FRAME_EX           120
+#define BLF_OBJTYPE_ETHERNET_FRAME_FORWARDED    121
+#define BLF_OBJTYPE_ETHERNET_ERROR_EX           122
+#define BLF_OBJTYPE_ETHERNET_ERROR_FORWARDED    123
+#define BLF_OBJTYPE_FUNCTION_BUS                124
+#define BLF_OBJTYPE_DATA_LOST_BEGIN             125
+#define BLF_OBJTYPE_DATA_LOST_END               126
+#define BLF_OBJTYPE_WATER_MARK_EVENT            127
+#define BLF_OBJTYPE_TRIGGER_CONDITION           128
+#define BLF_OBJTYPE_CAN_SETTING_CHANGED         129
+#define BLF_OBJTYPE_DISTRIBUTED_OBJECT_MEMBER   130
+#define BLF_OBJTYPE_ATTRIBUTE_EVENT             131
+
+#endif
+
+/*
+ * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 4
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=4 tabstop=8 expandtab:
+ * :indentSize=4:tabSize=8:noTabs=true:
+ */
diff --git a/wiretap/file_access.c b/wiretap/file_access.c
index 3ceecfeb52..eacdbd73d9 100644
--- a/wiretap/file_access.c
+++ b/wiretap/file_access.c
@@ -88,6 +88,7 @@
 #include "log3gpp.h"
 #include "candump.h"
 #include "busmaster.h"
+#include "blf.h"
 
 
 /*
@@ -158,6 +159,7 @@ static const struct file_extension_info file_type_extensions_base[] = {
 	{ "MPEG2 transport stream", TRUE, "mp2t;ts;mpg" },
 	{ "Ixia IxVeriWave .vwr Raw 802.11 Capture", TRUE, "vwr" },
 	{ "CAM Inspector file", TRUE, "camins" },
+	{ "BLF file", TRUE, "blf" },
 	{ "MPEG files", FALSE, "mpg;mp3" },
 	{ "Transport-Neutral Encapsulation Format", FALSE, "tnef" },
 	{ "JPEG/JFIF files", FALSE, "jpg;jpeg;jfif" },
@@ -370,7 +372,7 @@ static const struct open_info open_info_base[] = {
 	{ "HP-UX nettl trace",                      OPEN_INFO_MAGIC,     nettl_open,               NULL,       NULL, NULL },
 	{ "Visual Networks traffic capture",        OPEN_INFO_MAGIC,     visual_open,              NULL,       NULL, NULL },
 	{ "InfoVista 5View capture",                OPEN_INFO_MAGIC,     _5views_open,             NULL,       NULL, NULL },
-	{ "Viavi Observer",                         OPEN_INFO_MAGIC,     observer_open, NULL,       NULL, NULL },
+	{ "Viavi Observer",                         OPEN_INFO_MAGIC,     observer_open,            NULL,       NULL, NULL },
 	{ "Savvius tagged",                         OPEN_INFO_MAGIC,     peektagged_open,          NULL,       NULL, NULL },
 	{ "Colasoft Capsa",                         OPEN_INFO_MAGIC,     capsa_open,               NULL,       NULL, NULL },
 	{ "DBS Etherwatch (VMS)",                   OPEN_INFO_MAGIC,     dbs_etherwatch_open,      NULL,       NULL, NULL },
@@ -384,10 +386,11 @@ static const struct open_info open_info_base[] = {
 	{ "3GPP TS 32.423 Trace format",            OPEN_INFO_MAGIC,     nettrace_3gpp_32_423_file_open, NULL, NULL, NULL },
 	/* Gammu DCT3 trace must come before MIME files as it's XML based*/
 	{ "Gammu DCT3 trace",                       OPEN_INFO_MAGIC,     dct3trace_open,           NULL,       NULL, NULL },
+	{ "BLF Logfile",                            OPEN_INFO_MAGIC,     blf_open,                 "blf",      NULL, NULL },
 	{ "MIME Files Format",                      OPEN_INFO_MAGIC,     mime_file_open,           NULL,       NULL, NULL },
 	{ "Micropross mplog",                       OPEN_INFO_MAGIC,     mplog_open,               "mplog",    NULL, NULL },
 	{ "Unigraf DPA-400 capture",                OPEN_INFO_MAGIC,     dpa400_open,              "bin",      NULL, NULL },
-	{ "RFC 7468 files",                         OPEN_INFO_MAGIC,     rfc7468_open,                 "pem;crt",  NULL, NULL },
+	{ "RFC 7468 files",                         OPEN_INFO_MAGIC,     rfc7468_open,             "pem;crt",  NULL, NULL },
 	{ "Novell LANalyzer",                       OPEN_INFO_HEURISTIC, lanalyzer_open,           "tr1",      NULL, NULL },
 	/*
 	 * PacketLogger must come before MPEG, because its files
diff --git a/wiretap/mime_file.c b/wiretap/mime_file.c
index 14e0e1c8c3..81c3af044e 100644
--- a/wiretap/mime_file.c
+++ b/wiretap/mime_file.c
@@ -70,6 +70,7 @@ static const guint8 pcap_swapped_magic[]   = { 0xD4, 0xC3, 0xB2, 0xA1 };
 static const guint8 pcap_nsec_magic[]           = { 0xA1, 0xB2, 0x3C, 0x4D };
 static const guint8 pcap_nsec_swapped_magic[]   = { 0x4D, 0x3C, 0xB2, 0xA1 };
 static const guint8 pcapng_premagic[]      = { 0x0A, 0x0D, 0x0D, 0x0A };
+static const guint8 blf_magic[]                 = { 'L', 'O', 'G', 'G' };
 
 /* File does not start with it */
 static const guint8 pcapng_xmagic[]         = { 0x1A, 0x2B, 0x3C, 0x4D };
@@ -89,7 +90,8 @@ static const mime_files_t magic_files[] = {
 	{ pcap_swapped_magic, sizeof(pcap_swapped_magic) },
 	{ pcap_nsec_magic, sizeof(pcap_nsec_magic) },
 	{ pcap_nsec_swapped_magic, sizeof(pcap_nsec_swapped_magic) },
-	{ pcapng_premagic, sizeof(pcapng_premagic) }
+	{ pcapng_premagic, sizeof(pcapng_premagic) },
+	{ blf_magic, sizeof(blf_magic) }
 };
 
 #define	N_MAGIC_TYPES	(sizeof(magic_files) / sizeof(magic_files[0]))