2005-03-19 09:11:56 +00:00
/* DO NOT EDIT
2014-09-18 04:10:51 +00:00
This file was automatically generated by Pidl
2006-09-27 20:55:13 +00:00
from efs . idl and efs . cnf .
2014-03-07 15:32:18 +00:00
2013-11-24 02:51:36 +00:00
Pidl is a perl based IDL compiler for DCE / RPC idl files .
2006-09-27 20:55:13 +00:00
It is maintained by the Samba team , not the Wireshark team .
2013-11-24 02:51:36 +00:00
Instructions on how to download and install Pidl can be
2015-06-23 17:55:22 +00:00
found at https : //wiki.wireshark.org/Pidl
2006-09-27 20:55:13 +00:00
*/
2004-07-18 00:24:25 +00:00
# include "config.h"
# include <glib.h>
2005-03-19 09:11:56 +00:00
# include <string.h>
2004-07-18 00:24:25 +00:00
# include <epan/packet.h>
2006-09-27 20:55:13 +00:00
2004-07-18 00:24:25 +00:00
# include "packet-dcerpc.h"
# include "packet-dcerpc-nt.h"
2004-08-03 02:28:49 +00:00
# include "packet-windows-common.h"
2005-03-19 09:11:56 +00:00
# include "packet-dcerpc-efs.h"
2014-09-26 16:47:53 +00:00
void proto_register_dcerpc_efs ( void ) ;
void proto_reg_handoff_dcerpc_efs ( void ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* Ett declarations */
static gint ett_dcerpc_efs = - 1 ;
2005-03-19 09:11:56 +00:00
static gint ett_efs_EFS_HASH_BLOB = - 1 ;
static gint ett_efs_ENCRYPTION_CERTIFICATE_HASH = - 1 ;
static gint ett_efs_ENCRYPTION_CERTIFICATE_HASH_LIST = - 1 ;
static gint ett_efs_EFS_CERTIFICATE_BLOB = - 1 ;
static gint ett_efs_ENCRYPTION_CERTIFICATE = - 1 ;
2006-09-27 20:55:13 +00:00
/* Header field declarations */
2014-11-03 23:03:01 +00:00
static gint hf_efs_EFS_CERTIFICATE_BLOB_cbData = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_EFS_CERTIFICATE_BLOB_dwCertEncodingType = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_EFS_CERTIFICATE_BLOB_pbData = - 1 ;
static gint hf_efs_EFS_HASH_BLOB_cbData = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_EFS_HASH_BLOB_pbData = - 1 ;
static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers = - 1 ;
static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength = - 1 ;
static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash = - 1 ;
static gint hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_ENCRYPTION_CERTIFICATE_TotalLength = - 1 ;
static gint hf_efs_ENCRYPTION_CERTIFICATE_pCertBlob = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_ENCRYPTION_CERTIFICATE_pUserSid = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_EfsRpcAddUsersToFile_FileName = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_EfsRpcCloseRaw_pvContext = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_EfsRpcDecryptFileSrv_FileName = - 1 ;
static gint hf_efs_EfsRpcDecryptFileSrv_Reserved = - 1 ;
static gint hf_efs_EfsRpcEncryptFileSrv_Filename = - 1 ;
static gint hf_efs_EfsRpcOpenFileRaw_FileName = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_EfsRpcOpenFileRaw_Flags = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_EfsRpcOpenFileRaw_pvContext = - 1 ;
static gint hf_efs_EfsRpcQueryRecoveryAgents_FileName = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_EfsRpcQueryUsersOnFile_FileName = - 1 ;
static gint hf_efs_EfsRpcQueryUsersOnFile_pUsers = - 1 ;
static gint hf_efs_EfsRpcReadFileRaw_pvContext = - 1 ;
2014-09-27 01:27:30 +00:00
static gint hf_efs_EfsRpcRemoveUsersFromFile_FileName = - 1 ;
2014-11-03 23:03:01 +00:00
static gint hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate = - 1 ;
static gint hf_efs_EfsRpcWriteFileRaw_pvContext = - 1 ;
static gint hf_efs_opnum = - 1 ;
static gint hf_efs_werror = - 1 ;
2006-09-27 20:55:13 +00:00
static gint proto_dcerpc_efs = - 1 ;
/* Version information */
2005-03-19 09:11:56 +00:00
2015-03-03 10:47:53 +00:00
static e_guid_t uuid_dcerpc_efs = {
2006-09-27 20:55:13 +00:00
0xc681d488 , 0xd850 , 0x11d0 ,
{ 0x8c , 0x52 , 0x00 , 0xc0 , 0x4f , 0xd9 , 0x0f , 0x7e }
2005-03-19 09:11:56 +00:00
} ;
2006-09-27 20:55:13 +00:00
static guint16 ver_dcerpc_efs = 1 ;
2004-07-18 00:24:25 +00:00
2016-05-02 19:02:21 +00:00
static int efs_dissect_element_EFS_HASH_BLOB_cbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_HASH_BLOB_pbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_HASH_BLOB_pbData_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_HASH_BLOB_pbData__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pUserSid ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pUserSid_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pHash ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pHash_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_CERTIFICATE_BLOB_dwCertEncodingType ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_CERTIFICATE_BLOB_cbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_TotalLength ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_pUserSid ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_pUserSid_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_pCertBlob ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_ENCRYPTION_CERTIFICATE_pCertBlob_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcOpenFileRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcOpenFileRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcOpenFileRaw_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcOpenFileRaw_Flags ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcReadFileRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcReadFileRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcWriteFileRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcWriteFileRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcCloseRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcCloseRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcEncryptFileSrv_Filename ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcDecryptFileSrv_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcDecryptFileSrv_Reserved ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryUsersOnFile_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryRecoveryAgents_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcRemoveUsersFromFile_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcAddUsersToFile_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcSetFileEncryptionKey_pEncryptionCertificate ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
static int efs_dissect_element_EfsRpcSetFileEncryptionKey_pEncryptionCertificate_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ ) ;
2013-11-06 14:31:29 +00:00
static int
2013-11-24 02:51:36 +00:00
efs_dissect_struct_dom_sid ( tvbuff_t * tvb , int offset , packet_info * pinfo _U_ , proto_tree * tree , dcerpc_info * di , guint8 * drep _U_ , int hf_index _U_ , guint32 param _U_ )
2013-11-06 14:31:29 +00:00
{
2006-09-27 20:55:13 +00:00
if ( di - > conformant_run ) {
/* just a run to handle conformant arrays, no scalars to dissect */
return offset ;
}
offset = dissect_nt_sid ( tvb , offset , tree , " SID " , NULL , - 1 ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2007-02-24 21:34:29 +00:00
/* IDL: struct { */
2006-09-27 20:55:13 +00:00
/* IDL: uint32 cbData; */
2014-11-03 23:03:01 +00:00
/* IDL: [size_is(cbData)] [unique(1)] uint8 *pbData; */
2007-02-24 21:34:29 +00:00
/* IDL: } */
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_HASH_BLOB_cbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_EFS_HASH_BLOB_cbData , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_HASH_BLOB_pbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EFS_HASH_BLOB_pbData_ , NDR_POINTER_UNIQUE , " Pointer to PbData (uint8) " , hf_efs_EFS_HASH_BLOB_pbData ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_HASH_BLOB_pbData_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_ucarray ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EFS_HASH_BLOB_pbData__ ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_HASH_BLOB_pbData__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint8 ( tvb , offset , pinfo , tree , di , drep , hf_efs_EFS_HASH_BLOB_pbData , 0 ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
int
2016-05-02 19:02:21 +00:00
efs_dissect_struct_EFS_HASH_BLOB ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * parent_tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ , int hf_index _U_ , guint32 param _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
proto_item * item = NULL ;
proto_tree * tree = NULL ;
int old_offset ;
2004-07-18 00:24:25 +00:00
2013-10-21 19:41:54 +00:00
ALIGN_TO_5_BYTES ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
old_offset = offset ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
if ( parent_tree ) {
2013-10-21 19:41:54 +00:00
item = proto_tree_add_item ( parent_tree , hf_index , tvb , offset , - 1 , ENC_NA ) ;
2006-09-27 20:55:13 +00:00
tree = proto_item_add_subtree ( item , ett_efs_EFS_HASH_BLOB ) ;
}
2016-02-11 18:44:47 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EFS_HASH_BLOB_cbData ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EFS_HASH_BLOB_pbData ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
proto_item_set_len ( item , offset - old_offset ) ;
2005-03-19 09:11:56 +00:00
2013-10-21 19:41:54 +00:00
if ( di - > call_data - > flags & DCERPC_IS_NDR64 ) {
ALIGN_TO_5_BYTES ;
}
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2007-02-24 21:34:29 +00:00
/* IDL: struct { */
2006-09-27 20:55:13 +00:00
/* IDL: uint32 cbTotalLength; */
/* IDL: [unique(1)] dom_sid *pUserSid; */
/* IDL: [unique(1)] EFS_HASH_BLOB *pHash; */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [unique(1)] uint16 *lpDisplayInformation; */
2007-02-24 21:34:29 +00:00
/* IDL: } */
2006-09-27 20:55:13 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pUserSid ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pUserSid_ , NDR_POINTER_UNIQUE , " Pointer to PUserSid (dom_sid) " , hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pUserSid_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_dom_sid ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pHash ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pHash_ , NDR_POINTER_UNIQUE , " Pointer to PHash (EFS_HASH_BLOB) " , hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pHash_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_EFS_HASH_BLOB ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation_ , NDR_POINTER_UNIQUE , " Pointer to LpDisplayInformation (uint16) " , hf_efs_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
int
2016-05-02 19:02:21 +00:00
efs_dissect_struct_ENCRYPTION_CERTIFICATE_HASH ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * parent_tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ , int hf_index _U_ , guint32 param _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
proto_item * item = NULL ;
proto_tree * tree = NULL ;
int old_offset ;
2004-07-18 00:24:25 +00:00
2013-10-21 19:41:54 +00:00
ALIGN_TO_5_BYTES ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
old_offset = offset ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
if ( parent_tree ) {
2013-10-21 19:41:54 +00:00
item = proto_tree_add_item ( parent_tree , hf_index , tvb , offset , - 1 , ENC_NA ) ;
2006-09-27 20:55:13 +00:00
tree = proto_item_add_subtree ( item , ett_efs_ENCRYPTION_CERTIFICATE_HASH ) ;
}
2016-02-11 18:44:47 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength ( tvb , offset , pinfo , tree , di , drep ) ;
2005-03-19 09:11:56 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pUserSid ( tvb , offset , pinfo , tree , di , drep ) ;
2005-03-19 09:11:56 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_pHash ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
proto_item_set_len ( item , offset - old_offset ) ;
2013-10-21 19:41:54 +00:00
if ( di - > call_data - > flags & DCERPC_IS_NDR64 ) {
ALIGN_TO_5_BYTES ;
}
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2007-02-24 21:34:29 +00:00
/* IDL: struct { */
2006-09-27 20:55:13 +00:00
/* IDL: uint32 nCert_Hash; */
2014-11-03 23:03:01 +00:00
/* IDL: [size_is(nCert_Hash)] [unique(1)] ENCRYPTION_CERTIFICATE_HASH *pUsers[*]; */
2007-02-24 21:34:29 +00:00
/* IDL: } */
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_ucarray ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers_ ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers__ , NDR_POINTER_UNIQUE , " Pointer to PUsers (ENCRYPTION_CERTIFICATE_HASH) " , hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_ENCRYPTION_CERTIFICATE_HASH ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
int
2016-05-02 19:02:21 +00:00
efs_dissect_struct_ENCRYPTION_CERTIFICATE_HASH_LIST ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * parent_tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ , int hf_index _U_ , guint32 param _U_ )
2004-07-18 00:24:25 +00:00
{
2006-09-27 20:55:13 +00:00
proto_item * item = NULL ;
proto_tree * tree = NULL ;
int old_offset ;
2004-07-18 00:24:25 +00:00
2013-10-21 19:41:54 +00:00
ALIGN_TO_5_BYTES ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
old_offset = offset ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
if ( parent_tree ) {
2013-10-21 19:41:54 +00:00
item = proto_tree_add_item ( parent_tree , hf_index , tvb , offset , - 1 , ENC_NA ) ;
2006-09-27 20:55:13 +00:00
tree = proto_item_add_subtree ( item , ett_efs_ENCRYPTION_CERTIFICATE_HASH_LIST ) ;
}
2016-02-11 18:44:47 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
proto_item_set_len ( item , offset - old_offset ) ;
2013-10-21 19:41:54 +00:00
if ( di - > call_data - > flags & DCERPC_IS_NDR64 ) {
ALIGN_TO_5_BYTES ;
}
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2007-02-24 21:34:29 +00:00
/* IDL: struct { */
2006-09-27 20:55:13 +00:00
/* IDL: uint32 dwCertEncodingType; */
/* IDL: uint32 cbData; */
2014-11-03 23:03:01 +00:00
/* IDL: [size_is(cbData)] [unique(1)] uint8 *pbData; */
2007-02-24 21:34:29 +00:00
/* IDL: } */
2006-09-27 20:55:13 +00:00
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_CERTIFICATE_BLOB_dwCertEncodingType ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_EFS_CERTIFICATE_BLOB_dwCertEncodingType , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_CERTIFICATE_BLOB_cbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_EFS_CERTIFICATE_BLOB_cbData , 0 ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData_ , NDR_POINTER_UNIQUE , " Pointer to PbData (uint8) " , hf_efs_EFS_CERTIFICATE_BLOB_pbData ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_ucarray ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData__ ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint8 ( tvb , offset , pinfo , tree , di , drep , hf_efs_EFS_CERTIFICATE_BLOB_pbData , 0 ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
int
2016-05-02 19:02:21 +00:00
efs_dissect_struct_EFS_CERTIFICATE_BLOB ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * parent_tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ , int hf_index _U_ , guint32 param _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
proto_item * item = NULL ;
proto_tree * tree = NULL ;
int old_offset ;
2004-07-18 00:24:25 +00:00
2013-10-21 19:41:54 +00:00
ALIGN_TO_5_BYTES ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
old_offset = offset ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
if ( parent_tree ) {
2013-10-21 19:41:54 +00:00
item = proto_tree_add_item ( parent_tree , hf_index , tvb , offset , - 1 , ENC_NA ) ;
2006-09-27 20:55:13 +00:00
tree = proto_item_add_subtree ( item , ett_efs_EFS_CERTIFICATE_BLOB ) ;
}
2016-02-11 18:44:47 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EFS_CERTIFICATE_BLOB_dwCertEncodingType ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EFS_CERTIFICATE_BLOB_cbData ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EFS_CERTIFICATE_BLOB_pbData ( tvb , offset , pinfo , tree , di , drep ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
proto_item_set_len ( item , offset - old_offset ) ;
2013-10-21 19:41:54 +00:00
if ( di - > call_data - > flags & DCERPC_IS_NDR64 ) {
ALIGN_TO_5_BYTES ;
}
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2007-02-24 21:34:29 +00:00
/* IDL: struct { */
2006-09-27 20:55:13 +00:00
/* IDL: uint32 TotalLength; */
/* IDL: [unique(1)] dom_sid *pUserSid; */
/* IDL: [unique(1)] EFS_CERTIFICATE_BLOB *pCertBlob; */
2007-02-24 21:34:29 +00:00
/* IDL: } */
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_TotalLength ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_TotalLength , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_pUserSid ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_ENCRYPTION_CERTIFICATE_pUserSid_ , NDR_POINTER_UNIQUE , " Pointer to PUserSid (dom_sid) " , hf_efs_ENCRYPTION_CERTIFICATE_pUserSid ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_pUserSid_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_dom_sid ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_pUserSid , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_pCertBlob ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_ENCRYPTION_CERTIFICATE_pCertBlob_ , NDR_POINTER_UNIQUE , " Pointer to PCertBlob (EFS_CERTIFICATE_BLOB) " , hf_efs_ENCRYPTION_CERTIFICATE_pCertBlob ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_ENCRYPTION_CERTIFICATE_pCertBlob_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_EFS_CERTIFICATE_BLOB ( tvb , offset , pinfo , tree , di , drep , hf_efs_ENCRYPTION_CERTIFICATE_pCertBlob , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
int
2016-05-02 19:02:21 +00:00
efs_dissect_struct_ENCRYPTION_CERTIFICATE ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * parent_tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ , int hf_index _U_ , guint32 param _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
proto_item * item = NULL ;
proto_tree * tree = NULL ;
int old_offset ;
2005-03-19 09:11:56 +00:00
2013-10-21 19:41:54 +00:00
ALIGN_TO_5_BYTES ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
old_offset = offset ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
if ( parent_tree ) {
2013-10-21 19:41:54 +00:00
item = proto_tree_add_item ( parent_tree , hf_index , tvb , offset , - 1 , ENC_NA ) ;
2006-09-27 20:55:13 +00:00
tree = proto_item_add_subtree ( item , ett_efs_ENCRYPTION_CERTIFICATE ) ;
}
2016-02-11 18:44:47 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_TotalLength ( tvb , offset , pinfo , tree , di , drep ) ;
2005-03-19 09:11:56 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_pUserSid ( tvb , offset , pinfo , tree , di , drep ) ;
2005-03-19 09:11:56 +00:00
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_ENCRYPTION_CERTIFICATE_pCertBlob ( tvb , offset , pinfo , tree , di , drep ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
proto_item_set_len ( item , offset - old_offset ) ;
2004-07-18 00:24:25 +00:00
2013-10-21 19:41:54 +00:00
if ( di - > call_data - > flags & DCERPC_IS_NDR64 ) {
ALIGN_TO_5_BYTES ;
}
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcOpenFileRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_toplevel_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcOpenFileRaw_pvContext_ , NDR_POINTER_REF , " Pointer to PvContext (policy_handle) " , hf_efs_EfsRpcOpenFileRaw_pvContext ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcOpenFileRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_policy_hnd ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcOpenFileRaw_pvContext , PIDL_POLHND_OPEN ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcOpenFileRaw_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_EfsRpcOpenFileRaw_FileName , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
return offset ;
2004-07-18 00:24:25 +00:00
}
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcOpenFileRaw_Flags ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcOpenFileRaw_Flags , 0 ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcOpenFileRaw( */
2014-09-27 01:27:30 +00:00
/* IDL: [out] [ref] policy_handle *pvContext, */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [in] uint16 FileName[*], */
2006-09-27 20:55:13 +00:00
/* IDL: [in] uint32 Flags */
/* IDL: ); */
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcOpenFileRaw_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2004-07-18 00:24:25 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcOpenFileRaw " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcOpenFileRaw_pvContext ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcOpenFileRaw_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcOpenFileRaw " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcOpenFileRaw_FileName ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
offset = efs_dissect_element_EfsRpcOpenFileRaw_Flags ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcReadFileRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_toplevel_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcReadFileRaw_pvContext_ , NDR_POINTER_REF , " Pointer to PvContext (policy_handle) " , hf_efs_EfsRpcReadFileRaw_pvContext ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcReadFileRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_policy_hnd ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcReadFileRaw_pvContext , 0 ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcReadFileRaw( */
2014-09-27 01:27:30 +00:00
/* IDL: [in] [ref] policy_handle *pvContext */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcReadFileRaw_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2004-07-18 00:24:25 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcReadFileRaw " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcReadFileRaw_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcReadFileRaw " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcReadFileRaw_pvContext ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcWriteFileRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2006-09-27 20:55:13 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_toplevel_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcWriteFileRaw_pvContext_ , NDR_POINTER_REF , " Pointer to PvContext (policy_handle) " , hf_efs_EfsRpcWriteFileRaw_pvContext ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcWriteFileRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_policy_hnd ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcWriteFileRaw_pvContext , 0 ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcWriteFileRaw( */
/* IDL: [in] [ref] policy_handle *pvContext */
/* IDL: ); */
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcWriteFileRaw_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcWriteFileRaw " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2006-09-27 20:55:13 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcWriteFileRaw_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcWriteFileRaw " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcWriteFileRaw_pvContext ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcCloseRaw_pvContext ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_toplevel_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcCloseRaw_pvContext_ , NDR_POINTER_REF , " Pointer to PvContext (policy_handle) " , hf_efs_EfsRpcCloseRaw_pvContext ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcCloseRaw_pvContext_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_policy_hnd ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcCloseRaw_pvContext , PIDL_POLHND_CLOSE ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: void EfsRpcCloseRaw( */
2014-11-03 23:03:01 +00:00
/* IDL: [in] [out] [ref] policy_handle *pvContext */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcCloseRaw_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcCloseRaw " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcCloseRaw_pvContext ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcCloseRaw_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcCloseRaw " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcCloseRaw_pvContext ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcEncryptFileSrv_Filename ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_EfsRpcEncryptFileSrv_Filename , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcEncryptFileSrv( */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [in] uint16 Filename[*] */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcEncryptFileSrv_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcEncryptFileSrv " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcEncryptFileSrv_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcEncryptFileSrv " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcEncryptFileSrv_Filename ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcDecryptFileSrv_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_EfsRpcDecryptFileSrv_FileName , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcDecryptFileSrv_Reserved ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = PIDL_dissect_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcDecryptFileSrv_Reserved , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcDecryptFileSrv( */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [in] uint16 FileName[*], */
2006-09-27 20:55:13 +00:00
/* IDL: [in] uint32 Reserved */
/* IDL: ); */
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcDecryptFileSrv_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcDecryptFileSrv " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2006-09-27 20:55:13 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcDecryptFileSrv_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcDecryptFileSrv " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcDecryptFileSrv_FileName ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
offset = efs_dissect_element_EfsRpcDecryptFileSrv_Reserved ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryUsersOnFile_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_EfsRpcQueryUsersOnFile_FileName , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_toplevel_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers_ , NDR_POINTER_REF , " Pointer to PUsers (ENCRYPTION_CERTIFICATE_HASH_LIST) " , hf_efs_EfsRpcQueryUsersOnFile_pUsers ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers__ , NDR_POINTER_UNIQUE , " Pointer to PUsers (ENCRYPTION_CERTIFICATE_HASH_LIST) " , hf_efs_EfsRpcQueryUsersOnFile_pUsers ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_ENCRYPTION_CERTIFICATE_HASH_LIST ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcQueryUsersOnFile_pUsers , 0 ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcQueryUsersOnFile( */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [in] uint16 FileName[*], */
/* IDL: [out] [ref] [unique(1)] ENCRYPTION_CERTIFICATE_HASH_LIST **pUsers */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcQueryUsersOnFile_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2006-09-27 20:55:13 +00:00
{
guint32 status ;
2005-03-19 09:11:56 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcQueryUsersOnFile " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcQueryUsersOnFile_pUsers ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2005-03-19 09:11:56 +00:00
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcQueryUsersOnFile_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcQueryUsersOnFile " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcQueryUsersOnFile_FileName ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryRecoveryAgents_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_EfsRpcQueryRecoveryAgents_FileName , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_toplevel_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents_ , NDR_POINTER_REF , " Pointer to PRecoveryAgents (ENCRYPTION_CERTIFICATE_HASH_LIST) " , hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_embedded_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents__ , NDR_POINTER_UNIQUE , " Pointer to PRecoveryAgents (ENCRYPTION_CERTIFICATE_HASH_LIST) " , hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents__ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_ENCRYPTION_CERTIFICATE_HASH_LIST ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents , 0 ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcQueryRecoveryAgents( */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [in] uint16 FileName[*], */
/* IDL: [out] [ref] [unique(1)] ENCRYPTION_CERTIFICATE_HASH_LIST **pRecoveryAgents */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcQueryRecoveryAgents_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2004-07-18 00:24:25 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcQueryRecoveryAgents " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcQueryRecoveryAgents_pRecoveryAgents ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2004-07-18 00:24:25 +00:00
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2006-09-27 20:55:13 +00:00
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcQueryRecoveryAgents_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcQueryRecoveryAgents " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcQueryRecoveryAgents_FileName ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcRemoveUsersFromFile_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_EfsRpcRemoveUsersFromFile_FileName , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcRemoveUsersFromFile( */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [in] uint16 FileName[*] */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcRemoveUsersFromFile_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcRemoveUsersFromFile " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2005-03-19 09:11:56 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcRemoveUsersFromFile_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2006-09-27 20:55:13 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcRemoveUsersFromFile " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcRemoveUsersFromFile_FileName ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
}
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcAddUsersToFile_FileName ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
char * data ;
2005-03-19 09:11:56 +00:00
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_cvstring ( tvb , offset , pinfo , tree , di , drep , sizeof ( guint16 ) , hf_efs_EfsRpcAddUsersToFile_FileName , FALSE , & data ) ;
2006-09-27 20:55:13 +00:00
proto_item_append_text ( tree , " : %s " , data ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcAddUsersToFile( */
2014-11-03 23:03:01 +00:00
/* IDL: [charset(UTF16)] [in] uint16 FileName[*] */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcAddUsersToFile_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcAddUsersToFile " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcAddUsersToFile_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcAddUsersToFile " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcAddUsersToFile_FileName ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcSetFileEncryptionKey_pEncryptionCertificate ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2006-09-27 20:55:13 +00:00
{
2016-05-11 13:41:02 +00:00
offset = dissect_ndr_toplevel_pointer ( tvb , offset , pinfo , tree , di , drep , efs_dissect_element_EfsRpcSetFileEncryptionKey_pEncryptionCertificate_ , NDR_POINTER_UNIQUE , " Pointer to PEncryptionCertificate (ENCRYPTION_CERTIFICATE) " , hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_element_EfsRpcSetFileEncryptionKey_pEncryptionCertificate_ ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-06 14:31:29 +00:00
offset = efs_dissect_struct_ENCRYPTION_CERTIFICATE ( tvb , offset , pinfo , tree , di , drep , hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate , 0 ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcSetFileEncryptionKey( */
2014-11-03 23:03:01 +00:00
/* IDL: [in] [unique(1)] ENCRYPTION_CERTIFICATE *pEncryptionCertificate */
2006-09-27 20:55:13 +00:00
/* IDL: ); */
2004-07-18 00:24:25 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcSetFileEncryptionKey_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2004-07-18 00:24:25 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcSetFileEncryptionKey " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
return offset ;
2005-03-19 09:11:56 +00:00
}
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcSetFileEncryptionKey_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcSetFileEncryptionKey " ;
2013-11-06 14:31:29 +00:00
offset = efs_dissect_element_EfsRpcSetFileEncryptionKey_pEncryptionCertificate ( tvb , offset , pinfo , tree , di , drep ) ;
offset = dissect_deferred_pointers ( pinfo , tvb , offset , di , drep ) ;
2006-09-27 20:55:13 +00:00
return offset ;
2005-03-19 09:11:56 +00:00
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcNotSupported( */
/* IDL: */
/* IDL: ); */
2005-03-19 09:11:56 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcNotSupported_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2006-09-27 20:55:13 +00:00
guint32 status ;
2004-07-18 00:24:25 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcNotSupported " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcNotSupported_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2005-03-19 09:11:56 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcNotSupported " ;
2006-09-27 20:55:13 +00:00
return offset ;
}
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcFileKeyInfo( */
/* IDL: */
/* IDL: ); */
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcFileKeyInfo_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2006-09-27 20:55:13 +00:00
{
guint32 status ;
2005-03-19 09:11:56 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcFileKeyInfo " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2005-03-19 09:11:56 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcFileKeyInfo_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2006-09-27 20:55:13 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcFileKeyInfo " ;
2006-09-27 20:55:13 +00:00
return offset ;
}
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
/* IDL: WERROR EfsRpcDuplicateEncryptionInfoFile( */
/* IDL: */
/* IDL: ); */
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcDuplicateEncryptionInfoFile_response ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2006-09-27 20:55:13 +00:00
{
guint32 status ;
2004-07-18 00:24:25 +00:00
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcDuplicateEncryptionInfoFile " ;
2013-11-06 14:31:29 +00:00
offset = dissect_ndr_uint32 ( tvb , offset , pinfo , tree , di , drep , hf_efs_werror , & status ) ;
2004-07-18 00:24:25 +00:00
2013-10-01 14:45:03 +00:00
if ( status ! = 0 )
2006-09-27 20:55:13 +00:00
col_append_fstr ( pinfo - > cinfo , COL_INFO , " , Error: %s " , val_to_str ( status , WERR_errors , " Unknown DOS error 0x%08x " ) ) ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
return offset ;
}
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
static int
2016-05-02 19:02:21 +00:00
efs_dissect_EfsRpcDuplicateEncryptionInfoFile_request ( tvbuff_t * tvb _U_ , int offset _U_ , packet_info * pinfo _U_ , proto_tree * tree _U_ , dcerpc_info * di _U_ , guint8 * drep _U_ )
2004-07-18 00:24:25 +00:00
{
2013-11-24 20:55:55 +00:00
di - > dcerpc_procedure_name = " EfsRpcDuplicateEncryptionInfoFile " ;
2006-09-27 20:55:13 +00:00
return offset ;
}
static dcerpc_sub_dissector efs_dissectors [ ] = {
{ 0 , " EfsRpcOpenFileRaw " ,
efs_dissect_EfsRpcOpenFileRaw_request , efs_dissect_EfsRpcOpenFileRaw_response } ,
{ 1 , " EfsRpcReadFileRaw " ,
efs_dissect_EfsRpcReadFileRaw_request , efs_dissect_EfsRpcReadFileRaw_response } ,
{ 2 , " EfsRpcWriteFileRaw " ,
efs_dissect_EfsRpcWriteFileRaw_request , efs_dissect_EfsRpcWriteFileRaw_response } ,
{ 3 , " EfsRpcCloseRaw " ,
efs_dissect_EfsRpcCloseRaw_request , efs_dissect_EfsRpcCloseRaw_response } ,
{ 4 , " EfsRpcEncryptFileSrv " ,
efs_dissect_EfsRpcEncryptFileSrv_request , efs_dissect_EfsRpcEncryptFileSrv_response } ,
{ 5 , " EfsRpcDecryptFileSrv " ,
efs_dissect_EfsRpcDecryptFileSrv_request , efs_dissect_EfsRpcDecryptFileSrv_response } ,
{ 6 , " EfsRpcQueryUsersOnFile " ,
efs_dissect_EfsRpcQueryUsersOnFile_request , efs_dissect_EfsRpcQueryUsersOnFile_response } ,
{ 7 , " EfsRpcQueryRecoveryAgents " ,
efs_dissect_EfsRpcQueryRecoveryAgents_request , efs_dissect_EfsRpcQueryRecoveryAgents_response } ,
{ 8 , " EfsRpcRemoveUsersFromFile " ,
efs_dissect_EfsRpcRemoveUsersFromFile_request , efs_dissect_EfsRpcRemoveUsersFromFile_response } ,
{ 9 , " EfsRpcAddUsersToFile " ,
efs_dissect_EfsRpcAddUsersToFile_request , efs_dissect_EfsRpcAddUsersToFile_response } ,
{ 10 , " EfsRpcSetFileEncryptionKey " ,
efs_dissect_EfsRpcSetFileEncryptionKey_request , efs_dissect_EfsRpcSetFileEncryptionKey_response } ,
{ 11 , " EfsRpcNotSupported " ,
efs_dissect_EfsRpcNotSupported_request , efs_dissect_EfsRpcNotSupported_response } ,
{ 12 , " EfsRpcFileKeyInfo " ,
efs_dissect_EfsRpcFileKeyInfo_request , efs_dissect_EfsRpcFileKeyInfo_response } ,
{ 13 , " EfsRpcDuplicateEncryptionInfoFile " ,
efs_dissect_EfsRpcDuplicateEncryptionInfoFile_request , efs_dissect_EfsRpcDuplicateEncryptionInfoFile_response } ,
{ 0 , NULL , NULL , NULL }
} ;
2004-07-18 00:24:25 +00:00
2006-09-27 20:55:13 +00:00
void proto_register_dcerpc_efs ( void )
{
static hf_register_info hf [ ] = {
2014-11-03 23:03:01 +00:00
{ & hf_efs_EFS_CERTIFICATE_BLOB_cbData ,
2016-05-11 13:41:02 +00:00
{ " CbData " , " efs.EFS_CERTIFICATE_BLOB.cbData " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_EFS_CERTIFICATE_BLOB_dwCertEncodingType ,
2016-05-11 13:41:02 +00:00
{ " DwCertEncodingType " , " efs.EFS_CERTIFICATE_BLOB.dwCertEncodingType " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EFS_CERTIFICATE_BLOB_pbData ,
2016-05-11 13:41:02 +00:00
{ " PbData " , " efs.EFS_CERTIFICATE_BLOB.pbData " , FT_UINT8 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EFS_HASH_BLOB_cbData ,
2016-05-11 13:41:02 +00:00
{ " CbData " , " efs.EFS_HASH_BLOB.cbData " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_EFS_HASH_BLOB_pbData ,
2016-05-11 13:41:02 +00:00
{ " PbData " , " efs.EFS_HASH_BLOB.pbData " , FT_UINT8 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_nCert_Hash ,
2016-05-11 13:41:02 +00:00
{ " NCert Hash " , " efs.ENCRYPTION_CERTIFICATE_HASH_LIST.nCert_Hash " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_HASH_LIST_pUsers ,
2016-05-11 13:41:02 +00:00
{ " PUsers " , " efs.ENCRYPTION_CERTIFICATE_HASH_LIST.pUsers " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_HASH_cbTotalLength ,
2016-05-11 13:41:02 +00:00
{ " CbTotalLength " , " efs.ENCRYPTION_CERTIFICATE_HASH.cbTotalLength " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_HASH_lpDisplayInformation ,
2016-05-11 13:41:02 +00:00
{ " LpDisplayInformation " , " efs.ENCRYPTION_CERTIFICATE_HASH.lpDisplayInformation " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_HASH_pHash ,
2016-05-11 13:41:02 +00:00
{ " PHash " , " efs.ENCRYPTION_CERTIFICATE_HASH.pHash " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_HASH_pUserSid ,
2016-05-11 13:41:02 +00:00
{ " PUserSid " , " efs.ENCRYPTION_CERTIFICATE_HASH.pUserSid " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_TotalLength ,
2016-05-11 13:41:02 +00:00
{ " TotalLength " , " efs.ENCRYPTION_CERTIFICATE.TotalLength " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_pCertBlob ,
2016-05-11 13:41:02 +00:00
{ " PCertBlob " , " efs.ENCRYPTION_CERTIFICATE.pCertBlob " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_ENCRYPTION_CERTIFICATE_pUserSid ,
2016-05-11 13:41:02 +00:00
{ " PUserSid " , " efs.ENCRYPTION_CERTIFICATE.pUserSid " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcAddUsersToFile_FileName ,
2016-05-11 13:41:02 +00:00
{ " FileName " , " efs.EfsRpcAddUsersToFile.FileName " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_EfsRpcCloseRaw_pvContext ,
2016-05-11 13:41:02 +00:00
{ " PvContext " , " efs.EfsRpcCloseRaw.pvContext " , FT_BYTES , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcDecryptFileSrv_FileName ,
2016-05-11 13:41:02 +00:00
{ " FileName " , " efs.EfsRpcDecryptFileSrv.FileName " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcDecryptFileSrv_Reserved ,
2016-05-11 13:41:02 +00:00
{ " Reserved " , " efs.EfsRpcDecryptFileSrv.Reserved " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcEncryptFileSrv_Filename ,
2016-05-11 13:41:02 +00:00
{ " Filename " , " efs.EfsRpcEncryptFileSrv.Filename " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcOpenFileRaw_FileName ,
2016-05-11 13:41:02 +00:00
{ " FileName " , " efs.EfsRpcOpenFileRaw.FileName " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_EfsRpcOpenFileRaw_Flags ,
2016-05-11 13:41:02 +00:00
{ " Flags " , " efs.EfsRpcOpenFileRaw.Flags " , FT_UINT32 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcOpenFileRaw_pvContext ,
2016-05-11 13:41:02 +00:00
{ " PvContext " , " efs.EfsRpcOpenFileRaw.pvContext " , FT_BYTES , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcQueryRecoveryAgents_FileName ,
2016-05-11 13:41:02 +00:00
{ " FileName " , " efs.EfsRpcQueryRecoveryAgents.FileName " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_EfsRpcQueryRecoveryAgents_pRecoveryAgents ,
2016-05-11 13:41:02 +00:00
{ " PRecoveryAgents " , " efs.EfsRpcQueryRecoveryAgents.pRecoveryAgents " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcQueryUsersOnFile_FileName ,
2016-05-11 13:41:02 +00:00
{ " FileName " , " efs.EfsRpcQueryUsersOnFile.FileName " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcQueryUsersOnFile_pUsers ,
2016-05-11 13:41:02 +00:00
{ " PUsers " , " efs.EfsRpcQueryUsersOnFile.pUsers " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcReadFileRaw_pvContext ,
2016-05-11 13:41:02 +00:00
{ " PvContext " , " efs.EfsRpcReadFileRaw.pvContext " , FT_BYTES , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-09-27 01:27:30 +00:00
{ & hf_efs_EfsRpcRemoveUsersFromFile_FileName ,
2016-05-11 13:41:02 +00:00
{ " FileName " , " efs.EfsRpcRemoveUsersFromFile.FileName " , FT_STRING , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcSetFileEncryptionKey_pEncryptionCertificate ,
2016-05-11 13:41:02 +00:00
{ " PEncryptionCertificate " , " efs.EfsRpcSetFileEncryptionKey.pEncryptionCertificate " , FT_NONE , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_EfsRpcWriteFileRaw_pvContext ,
2016-05-11 13:41:02 +00:00
{ " PvContext " , " efs.EfsRpcWriteFileRaw.pvContext " , FT_BYTES , BASE_NONE , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_opnum ,
2016-05-11 13:41:02 +00:00
{ " Operation " , " efs.opnum " , FT_UINT16 , BASE_DEC , NULL , 0 , NULL , HFILL } } ,
2014-11-03 23:03:01 +00:00
{ & hf_efs_werror ,
2016-05-11 13:41:02 +00:00
{ " Windows Error " , " efs.werror " , FT_UINT32 , BASE_HEX , VALS ( WERR_errors ) , 0 , NULL , HFILL } } ,
2006-09-27 20:55:13 +00:00
} ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
static gint * ett [ ] = {
& ett_dcerpc_efs ,
& ett_efs_EFS_HASH_BLOB ,
& ett_efs_ENCRYPTION_CERTIFICATE_HASH ,
& ett_efs_ENCRYPTION_CERTIFICATE_HASH_LIST ,
& ett_efs_EFS_CERTIFICATE_BLOB ,
& ett_efs_ENCRYPTION_CERTIFICATE ,
} ;
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
proto_dcerpc_efs = proto_register_protocol ( " EFS (pidl) " , " EFS " , " efs " ) ;
proto_register_field_array ( proto_dcerpc_efs , hf , array_length ( hf ) ) ;
proto_register_subtree_array ( ett , array_length ( ett ) ) ;
2004-07-18 00:24:25 +00:00
}
2005-03-19 09:11:56 +00:00
2006-09-27 20:55:13 +00:00
void proto_reg_handoff_dcerpc_efs ( void )
{
dcerpc_init_uuid ( proto_dcerpc_efs , ett_dcerpc_efs ,
& uuid_dcerpc_efs , ver_dcerpc_efs ,
efs_dissectors , hf_efs_opnum ) ;
}