1423 lines
53 KiB
C
1423 lines
53 KiB
C
/* packet-dcom-sysact.c
|
|
* Routines for the ISystemActivator interface
|
|
* Copyright 2004, Jelmer Vernooij <jelmer@samba.org>
|
|
* Copyright 2012, Litao Gao <ltgao@juniper.net>
|
|
*
|
|
* Wireshark - Network traffic analyzer
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
* Copyright 1998 Gerald Combs
|
|
*
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include <epan/packet.h>
|
|
#include "packet-dcerpc.h"
|
|
#include "packet-dcom.h"
|
|
|
|
void proto_register_ISystemActivator(void);
|
|
void proto_reg_handoff_ISystemActivator(void);
|
|
|
|
static int proto_ISystemActivator = -1;
|
|
|
|
static gint ett_isystemactivator = -1;
|
|
static int hf_opnum = -1;
|
|
static int hf_sysact_actproperties = -1;
|
|
/* static int hf_sysact_unknown = -1; */
|
|
|
|
static gint ett_actproperties = -1;
|
|
static int hf_sysact_totalsize = -1;
|
|
static int hf_sysact_res = -1;
|
|
|
|
static gint ett_commonheader = -1;
|
|
static gint ett_propguids = -1;
|
|
static gint ett_properties = -1;
|
|
static int hf_sysact_customhdrsize = -1;
|
|
static int hf_sysact_dstctx = -1;
|
|
static int hf_sysact_actpropnumber = -1;
|
|
static int hf_sysact_actpropclsinfoid = -1;
|
|
/* static int hf_sysact_actpropclsids = -1; */
|
|
static int hf_sysact_actpropclsid = -1;
|
|
/* static int hf_sysact_actpropsizes = -1; */
|
|
static int hf_sysact_actpropsize = -1;
|
|
|
|
|
|
static gint ett_dcom_spclsysprop = -1;
|
|
static gint ett_dcom_reserved = -1;
|
|
static int hf_sysact_spsysprop_sid = -1;
|
|
static int hf_sysact_spsysprop_remotethissid = -1;
|
|
static int hf_sysact_spsysprop_cltimpersonating = -1;
|
|
static int hf_sysact_spsysprop_partitionid = -1;
|
|
static int hf_sysact_spsysprop_defauthlvl = -1;
|
|
static int hf_sysact_spsysprop_partition = -1;
|
|
static int hf_sysact_spsysprop_procrqstflgs = -1;
|
|
static int hf_sysact_spsysprop_origclsctx = -1;
|
|
static int hf_sysact_spsysprop_flags = -1;
|
|
/* static int hf_sysact_spsysprop_procid = -1; */
|
|
/* static int hf_sysact_spsysprop_hwnd = -1; */
|
|
|
|
static gint ett_dcom_instantianinfo = -1;
|
|
static int hf_sysact_instninfo_clsid = -1;
|
|
static int hf_sysact_instninfo_clsctx = -1;
|
|
static int hf_sysact_instninfo_actflags = -1;
|
|
static int hf_sysact_instninfo_issurrogate = -1;
|
|
static int hf_sysact_instninfo_iidcount = -1;
|
|
static int hf_sysact_instninfo_instflags = -1;
|
|
static int hf_sysact_instninfo_entiresize = -1;
|
|
static int hf_sysact_instninfo_iid = -1;
|
|
|
|
static gint ett_dcom_actctxinfo = -1;
|
|
static int hf_sysact_actctxinfo_cltok = -1;
|
|
static int hf_sysact_context = -1;
|
|
|
|
static gint ett_dcom_context = -1;
|
|
static int hf_sysact_ctx_id = -1;
|
|
static int hf_sysact_ctx_flags = -1;
|
|
static int hf_sysact_ctx_res = -1;
|
|
static int hf_sysact_ctx_numextents = -1;
|
|
static int hf_sysact_ctx_extentscnt = -1;
|
|
static int hf_sysact_ctx_mashflags = -1;
|
|
static int hf_sysact_ctx_count = -1;
|
|
static int hf_sysact_ctx_frozen = -1;
|
|
|
|
static gint ett_dcom_securityinfo = -1;
|
|
static int hf_sysact_si_authflalgs = -1;
|
|
static int hf_sysact_si_ci_res = -1;
|
|
static int hf_sysact_si_ci_string = -1;
|
|
static int hf_sysact_si_serverinfo = -1;
|
|
|
|
static gint ett_dcom_locationinfo = -1;
|
|
static int hf_sysact_li_string = -1;
|
|
static int hf_sysact_li_procid = -1;
|
|
static int hf_sysact_li_apartid = -1;
|
|
static int hf_sysact_li_ctxid = -1;
|
|
|
|
static gint ett_dcom_scmrqstinfo = -1;
|
|
static gint ett_dcom_rmtrqst = -1;
|
|
|
|
static int hf_sysact_sri_cltimplvl = -1;
|
|
static int hf_sysact_sri_protseqnum = -1;
|
|
static int hf_sysact_sri_protseq = -1;
|
|
|
|
static gint ett_dcom_propsoutput = -1;
|
|
static int hf_sysact_pi_ifnum = -1;
|
|
static int hf_sysact_pi_retval = -1;
|
|
static int hf_sysact_pi_interf = -1;
|
|
static int hf_sysact_pi_iid = -1;
|
|
|
|
static gint ett_dcom_scmrespinfo = -1;
|
|
static gint ett_dcom_rmtresp = -1;
|
|
static gint ett_dcom_oxidbinding = -1;
|
|
static int hf_sysact_scmri_rmtunknid = -1;
|
|
static int hf_sysact_scmri_authhint = -1;
|
|
static int hf_sysact_scmri_binding = -1;
|
|
static int hf_sysact_scmri_oxid = -1;
|
|
static int hf_sysact_unused_buffer = -1;
|
|
|
|
static gint ett_typeszcommhdr = -1;
|
|
static gint ett_typeszprivhdr = -1;
|
|
static int hf_typeszch = -1;
|
|
static int hf_typeszph = -1;
|
|
static int hf_typesz_ver = -1;
|
|
static int hf_typesz_endianness = -1;
|
|
static int hf_typesz_commhdrlen = -1;
|
|
static int hf_typesz_filler = -1;
|
|
static int hf_typesz_buflen = -1;
|
|
|
|
static e_guid_t uuid_ISystemActivator = { 0x000001a0, 0x0000, 0x0000, { 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 } };
|
|
static guint16 ver_ISystemActivator = 0;
|
|
|
|
/*static e_guid_t clsid_ActivationPropertiesIn = { 0x00000338, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
|
|
/*static e_guid_t clsid_ActivationPropertiesOut = { 0x00000339, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
|
|
static e_guid_t iid_ActivationPropertiesIn = { 0x000001a2, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t iid_ActivationPropertiesOut = { 0x000001a3, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
|
|
static e_guid_t clsid_SpecialSystemProperties = { 0x000001b9, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_InstantiationInfo = { 0x000001ab, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_ActivationContextInfo = { 0x000001a5, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_ContextMarshaler = { 0x0000033b, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_SecurityInfo = { 0x000001a6, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_ServerLocationInfo = { 0x000001a4, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_ScmRequestInfo = { 0x000001aa, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_PropsOutInfo = { 0x00000339, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
static e_guid_t clsid_ScmReplyInfo = { 0x000001b6, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
|
|
/*static e_guid_t clsid_InstanceInfo = { 0x000001ad, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
|
|
|
|
|
|
static const value_string instninfo_actflags[] = {
|
|
{ 0x00000002, "ACTVFLAGS_DISABLE_AAA" },
|
|
{ 0x00000004, "ACTVFLAGS_ACTIVATE_32_BIT_SERVER" },
|
|
{ 0x00000008, "ACTVFLAGS_ACTIVATE_64_BIT_SERVER" },
|
|
{ 0x00000020, "ACTVFLAGS_NO_FAILURE_LOG" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
static const value_string boolean_flag_vals[] = {
|
|
{ 0x00000001, "TRUE" },
|
|
{ 0x00000000, "FALSE" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
static const value_string dcom_context_flag_vals[] = {
|
|
{ 0x00000002, "MarshalByValue" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
static const value_string ts_endian_vals[] = {
|
|
{ 0x10, "Little-endian" },
|
|
{ 0x00, "Big-endian" },
|
|
{ 0, NULL }
|
|
};
|
|
|
|
/* MS-DCOM 2.2.28.1 */
|
|
#define MIN_ACTPROP_LIMIT 1
|
|
#define MAX_ACTPROP_LIMIT 10
|
|
|
|
typedef struct property_guids {
|
|
e_guid_t guid[MAX_ACTPROP_LIMIT];
|
|
guint32 size[MAX_ACTPROP_LIMIT];
|
|
guint32 id_idx;
|
|
guint32 size_idx;
|
|
} property_guids_t;
|
|
|
|
/* Type Serialization Version 1 */
|
|
static int
|
|
dissect_TypeSzCommPrivHdr(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
guint8 drep_tmp;
|
|
guint8 endian = 0x10;
|
|
gint old_offset;
|
|
|
|
/* Common Header use little endian */
|
|
sub_item = proto_tree_add_item(tree, hf_typeszch, tvb, offset, 0, ENC_NA);
|
|
sub_tree = proto_item_add_subtree(sub_item, ett_typeszcommhdr);
|
|
|
|
old_offset = offset;
|
|
offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_typesz_ver, NULL);
|
|
|
|
offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_typesz_endianness, &endian);
|
|
if (endian == 0x10)
|
|
*drep = DREP_LITTLE_ENDIAN;
|
|
else
|
|
*drep &= ~DREP_LITTLE_ENDIAN;
|
|
|
|
drep_tmp = DREP_LITTLE_ENDIAN;
|
|
offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, &drep_tmp,
|
|
hf_typesz_commhdrlen, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, &drep_tmp,
|
|
hf_typesz_filler, NULL);
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
/* Private Header */
|
|
old_offset = offset;
|
|
sub_item = proto_tree_add_item(tree, hf_typeszph, tvb, offset, 0, ENC_NA);
|
|
sub_tree = proto_item_add_subtree(sub_item, ett_typeszprivhdr);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_typesz_buflen, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_typesz_filler, NULL);
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
return offset;
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
dissect_dcom_Property_Guid(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
property_guids_t *pg;
|
|
|
|
pg = (property_guids_t*)di->private_data;
|
|
|
|
if (pg->id_idx < MAX_ACTPROP_LIMIT) {
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_actpropclsid, &pg->guid[pg->id_idx++]);
|
|
}
|
|
else {
|
|
/* TODO: expert info */
|
|
tvb_ensure_bytes_exist(tvb, offset, 16);
|
|
offset += 16;
|
|
}
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ActivationPropertiesCustomerHdr_PropertyGuids(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, dissect_dcom_Property_Guid);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_Property_Size(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
property_guids_t *pg;
|
|
|
|
pg = (property_guids_t*)di->private_data;
|
|
|
|
if (pg->size_idx < MAX_ACTPROP_LIMIT) {
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_actpropsize, &pg->size[pg->size_idx++]);
|
|
}
|
|
else {
|
|
/* TODO: expert info */
|
|
tvb_ensure_bytes_exist(tvb, offset, 4);
|
|
offset += 4;
|
|
}
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ActivationPropertiesCustomerHdr_PropertySizes(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, dissect_dcom_Property_Size);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ActivationPropertiesCustomerHdr(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
guint32 u32TotalSize;
|
|
guint32 u32CustomHdrSize;
|
|
guint32 u32ActPropNumber;
|
|
gint old_offset;
|
|
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_commonheader, &sub_item, "CustomHeader");
|
|
|
|
old_offset = offset;
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_totalsize, &u32TotalSize);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_customhdrsize, &u32CustomHdrSize);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_res, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_dstctx, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_actpropnumber, &u32ActPropNumber);
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_actpropclsinfoid, NULL);
|
|
|
|
/* ClsIdPtr, SizesPtr */
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_ActivationPropertiesCustomerHdr_PropertyGuids, NDR_POINTER_UNIQUE,
|
|
"ClsIdPtr",hf_sysact_actpropclsid);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_ActivationPropertiesCustomerHdr_PropertySizes, NDR_POINTER_UNIQUE,
|
|
"ClsSizesPtr",hf_sysact_actpropclsid);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NDR_POINTER_UNIQUE, "OpaqueDataPtr: Pointer To NULL", 0);
|
|
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
return offset;
|
|
}
|
|
|
|
|
|
static int
|
|
dissect_dcom_ActivationProperty(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, e_guid_t *clsid, gint size)
|
|
{
|
|
dcom_dissect_fn_t routine = NULL;
|
|
|
|
/* the following data depends on the clsid, get the routine by clsid */
|
|
routine = dcom_get_routine_by_uuid(clsid);
|
|
if (routine){
|
|
offset = routine(tvb, offset, pinfo, tree, di, drep, size);
|
|
}
|
|
|
|
return offset;
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
dissect_dcom_ActivationPropertiesBody(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
gint old_offset;
|
|
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
property_guids_t *pg;
|
|
guint32 i;
|
|
guint32 min_idx;
|
|
|
|
pg = (property_guids_t*)di->private_data;
|
|
|
|
if (pg->id_idx == pg->size_idx) {
|
|
min_idx = pg->id_idx;
|
|
}
|
|
else {
|
|
/* TODO: expert info */
|
|
min_idx = MIN(pg->id_idx, pg->size_idx);
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_properties, &sub_item, "Properties");
|
|
|
|
old_offset = offset;
|
|
for (i = 0; i < min_idx; i++) {
|
|
offset = dissect_dcom_ActivationProperty(tvb, offset, pinfo, sub_tree, di, drep,
|
|
&pg->guid[i], pg->size[i]);
|
|
}
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ActivationProperties(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size _U_)
|
|
{
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
property_guids_t *old_pg = NULL;
|
|
|
|
guint32 u32TotalSize;
|
|
guint32 u32Res;
|
|
|
|
sub_item = proto_tree_add_item(tree, hf_sysact_actproperties, tvb, offset, 0, ENC_NA);
|
|
sub_tree = proto_item_add_subtree(sub_item, ett_actproperties);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_totalsize, &u32TotalSize);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_res, &u32Res);
|
|
|
|
old_pg = (property_guids_t*)di->private_data;
|
|
di->private_data = wmem_new0(wmem_packet_scope(), property_guids_t);
|
|
|
|
offset = dissect_dcom_ActivationPropertiesCustomerHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
offset = dissect_dcom_ActivationPropertiesBody(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
di->private_data = old_pg;
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ContextMarshaler(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size _U_)
|
|
{
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
gint old_offset;
|
|
|
|
guint32 u32Count;
|
|
|
|
old_offset = offset;
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_context, &sub_item, "Context");
|
|
|
|
offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NULL);
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_id, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_flags, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_res, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_numextents, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_extentscnt, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_mashflags, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_count, &u32Count);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_ctx_frozen, NULL);
|
|
|
|
if (u32Count) {
|
|
/*PropMarshalHeader array*/
|
|
/*TBD*/
|
|
}
|
|
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_SpecialSystemProperties(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree, *tr;
|
|
gint old_offset, len, i;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_spclsysprop, NULL, "SpecialSystemProperties");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_sid, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_remotethissid, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_cltimpersonating, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_partitionid, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_defauthlvl, NULL);
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_partition, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_procrqstflgs, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_origclsctx, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_spsysprop_flags, NULL);
|
|
/*
|
|
*
|
|
* offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
* hf_sysact_spsysprop_procid, NULL);
|
|
* offset = dissect_dcom_I8(tvb, offset, pinfo, sub_tree, drep,
|
|
* hf_sysact_spsysprop_hwnd, NULL);
|
|
*
|
|
*/
|
|
tr = proto_tree_add_subtree(sub_tree, tvb, offset, sizeof(guint32)*8,
|
|
ett_dcom_reserved, NULL, "Reserved: 8 DWORDs");
|
|
for (i = 0; i < 8; i++) {
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, tr, di, drep,
|
|
hf_sysact_res, NULL);
|
|
}
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_InterfaceId(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_instninfo_iid, NULL);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_InstantiationInfoIids(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
|
|
dissect_dcom_InterfaceId);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_InstantiationInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree;
|
|
gint old_offset, len;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_instantianinfo, NULL, "InstantiationInfo");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_instninfo_clsid, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_instninfo_clsctx, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_instninfo_actflags, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_instninfo_issurrogate, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_instninfo_iidcount, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_instninfo_instflags, NULL);
|
|
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_InstantiationInfoIids, NDR_POINTER_UNIQUE,
|
|
"InterfaceIdsPtr", -1);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_instninfo_entiresize, NULL);
|
|
offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NULL);
|
|
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_ActCtxInfo_PropCtx(tvbuff_t *tvb _U_, gint offset,
|
|
packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info *di _U_, guint8 *drep _U_)
|
|
{
|
|
/*TBD*/
|
|
return offset;
|
|
}
|
|
|
|
|
|
static int
|
|
dissect_ActCtxInfo_CltCtx(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
if (di->conformant_run) {
|
|
return offset;
|
|
}
|
|
|
|
offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_context, NULL);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ActivationContextInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree;
|
|
gint old_offset, len;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_actctxinfo, NULL, "ActivationContextInfo");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_actctxinfo_cltok, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_res, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_res, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_res, NULL);
|
|
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_ActCtxInfo_CltCtx, NDR_POINTER_UNIQUE,
|
|
"ClientPtr", -1);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_ActCtxInfo_PropCtx, NDR_POINTER_UNIQUE,
|
|
"PrototypePtr", -1);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
return offset;
|
|
}
|
|
|
|
|
|
static int
|
|
dissect_dcom_COSERVERINFO(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex)
|
|
{
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
gint old_offset;
|
|
|
|
if (di->conformant_run) {
|
|
return offset;
|
|
}
|
|
|
|
sub_item = proto_tree_add_item(tree, hfindex, tvb, offset, 0, ENC_NA);
|
|
sub_tree = proto_item_add_subtree(sub_item, ett_dcom_securityinfo);
|
|
|
|
old_offset = offset;
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_si_ci_res, NULL);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Name(wstring)",
|
|
hf_sysact_si_ci_string);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NDR_POINTER_UNIQUE, "AuthInfoPtr", -1);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_si_ci_res, NULL);
|
|
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_SI_ServerInfo(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_dcom_COSERVERINFO(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_si_serverinfo);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_SecurtiyInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree;
|
|
gint old_offset, len;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_securityinfo, NULL, "SecurityInfo");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di ,drep);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_si_authflalgs, NULL);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_SI_ServerInfo, NDR_POINTER_UNIQUE, "ServerInfoPtr", -1);
|
|
/*This SHOULD be NULL and MUST be ignored on receipt*/
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NDR_POINTER_UNIQUE, "ReservedPtr", -1);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_LocationInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree;
|
|
gint old_offset, len;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_locationinfo, NULL, "LocationInfo");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "MachineNamePtr",
|
|
hf_sysact_li_string);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_li_procid, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_li_apartid, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_li_ctxid, NULL);
|
|
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ProtoSeq(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_sri_protseq, NULL);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ProtoSeqArray(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
|
|
dissect_dcom_ProtoSeq);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_customREMOTE_REQUEST_SCM_INFO(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
gint old_offset;
|
|
|
|
if (di->conformant_run) {
|
|
return offset;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_rmtrqst, &sub_item, "RemoteRequest");
|
|
|
|
old_offset = offset;
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_sri_cltimplvl, NULL);
|
|
offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_sri_protseqnum, NULL);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_ProtoSeqArray, NDR_POINTER_UNIQUE, "ProtocolSeqsArrayPtr", -1);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ScmRqstInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree;
|
|
gint old_offset, len;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_scmrqstinfo, NULL, "ScmRequestInfo");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
/*This MUST be set to NULL and MUST be ignored on receipt*/
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NDR_POINTER_UNIQUE, "Ptr", -1);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_customREMOTE_REQUEST_SCM_INFO, NDR_POINTER_UNIQUE,
|
|
"RemoteRequestPtr", -1);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_IfId(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_pi_iid, NULL);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_IfIds(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
|
|
dissect_dcom_IfId);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ReturnVal(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_pi_retval, NULL);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_ReturnVals(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
|
|
dissect_dcom_ReturnVal);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_OneInterfData(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_pi_interf, NULL);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_OneInterfDataPtr(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep,
|
|
dissect_OneInterfData, NDR_POINTER_UNIQUE, "InterfacePtr", -1);
|
|
return offset;
|
|
}
|
|
|
|
/*
|
|
* This MUST be an array of MInterfacePointer pointers containing the OBJREFs for
|
|
* the interfaces returned by the server.
|
|
*/
|
|
static int
|
|
dissect_dcom_InterfData(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
|
|
dissect_dcom_OneInterfDataPtr);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_dcom_PropsOutInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree;
|
|
gint old_offset, len;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_propsoutput, NULL, "PropertiesOutput");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_pi_ifnum, NULL);
|
|
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_IfIds, NDR_POINTER_UNIQUE, "InterfaceIdsPtr", -1);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_ReturnVals, NDR_POINTER_UNIQUE, "ReturnValuesPtr", -1);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_InterfData, NDR_POINTER_UNIQUE, "InterfacePtrsPtr", -1);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
|
|
return offset;
|
|
}
|
|
|
|
|
|
/*
|
|
*typedef struct tagDUALSTRINGARRAY {
|
|
* unsigned short wNumEntries;
|
|
* unsigned short wSecurityOffset;
|
|
* [size_is(wNumEntries)] unsigned short aStringArray[];
|
|
*} DUALSTRINGARRAY;
|
|
*/
|
|
static int
|
|
dissect_dcom_OxidBindings(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
gint old_offset;
|
|
|
|
if (di->conformant_run) {
|
|
return offset;
|
|
}
|
|
|
|
old_offset = offset;
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_oxidbinding, &sub_item, "OxidBindings");
|
|
|
|
offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, sub_tree, di, drep, NULL);
|
|
offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_scmri_binding, NULL);
|
|
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
return offset;
|
|
}
|
|
|
|
|
|
static int
|
|
dissect_dcom_customREMOTE_REPLY_SCM_INFO(tvbuff_t *tvb, gint offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
proto_item *sub_item;
|
|
proto_tree *sub_tree;
|
|
gint old_offset;
|
|
|
|
if (di->conformant_run) {
|
|
return offset;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_rmtresp, &sub_item, "RemoteReply");
|
|
|
|
old_offset = offset;
|
|
offset = dissect_dcom_ID(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_scmri_oxid, NULL);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_OxidBindings, NDR_POINTER_UNIQUE, "OxidBindingsPtr", -1);
|
|
offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_scmri_rmtunknid, NULL);
|
|
offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
|
|
hf_sysact_scmri_authhint, NULL);
|
|
offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NULL);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
proto_item_set_len(sub_item, offset - old_offset);
|
|
|
|
return offset;
|
|
}
|
|
|
|
|
|
static int
|
|
dissect_dcom_ScmReplyInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
|
|
proto_tree *tree, dcerpc_info *di, guint8 *drep, gint size)
|
|
{
|
|
proto_tree *sub_tree;
|
|
gint old_offset, len;
|
|
|
|
old_offset = offset;
|
|
|
|
if (size <= 0) {
|
|
/* TODO: expert info */
|
|
size = -1;
|
|
}
|
|
|
|
sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_scmrespinfo, NULL, "ScmReplyInfo");
|
|
|
|
offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
|
|
|
|
/*This MUST be set to NULL and MUST be ignored on receipt*/
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
NULL, NDR_POINTER_UNIQUE, "Ptr", -1);
|
|
offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
|
|
dissect_dcom_customREMOTE_REPLY_SCM_INFO, NDR_POINTER_UNIQUE,
|
|
"RemoteRequestPtr", -1);
|
|
offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
|
|
|
|
len = offset - old_offset;
|
|
if (size < len) {
|
|
/* TODO expert info */
|
|
size = len;
|
|
}
|
|
else if (size > len) {
|
|
proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
|
|
}
|
|
|
|
offset = old_offset + size;
|
|
|
|
return offset;
|
|
}
|
|
|
|
static void
|
|
sysact_register_routines(void)
|
|
{
|
|
dcom_register_routine(dissect_dcom_ActivationProperties, &iid_ActivationPropertiesIn);
|
|
dcom_register_routine(dissect_dcom_ActivationProperties, &iid_ActivationPropertiesOut);
|
|
dcom_register_routine(dissect_dcom_SpecialSystemProperties, &clsid_SpecialSystemProperties);
|
|
dcom_register_routine(dissect_dcom_InstantiationInfo, &clsid_InstantiationInfo);
|
|
dcom_register_routine(dissect_dcom_ActivationContextInfo, &clsid_ActivationContextInfo);
|
|
dcom_register_routine(dissect_dcom_ContextMarshaler, &clsid_ContextMarshaler);
|
|
dcom_register_routine(dissect_dcom_SecurtiyInfo, &clsid_SecurityInfo);
|
|
dcom_register_routine(dissect_dcom_LocationInfo, &clsid_ServerLocationInfo);
|
|
dcom_register_routine(dissect_dcom_ScmRqstInfo, &clsid_ScmRequestInfo);
|
|
dcom_register_routine(dissect_dcom_PropsOutInfo, &clsid_PropsOutInfo);
|
|
dcom_register_routine(dissect_dcom_ScmReplyInfo, &clsid_ScmReplyInfo);
|
|
|
|
return;
|
|
}
|
|
|
|
static int
|
|
dissect_remsysact_remotecreateinstance_rqst(tvbuff_t *tvb, int offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
|
|
sysact_register_routines();
|
|
|
|
offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
|
|
|
|
/* XXX - what is this? */
|
|
offset = dissect_dcom_nospec_data(tvb, offset, pinfo, tree, drep, 4);
|
|
offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_actproperties, NULL /* XXX */);
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_remsysact_remotecreateinstance_resp(tvbuff_t *tvb, int offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
sysact_register_routines();
|
|
|
|
offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
|
|
|
|
offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_actproperties, NULL /* XXX */);
|
|
|
|
offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
|
|
NULL /* pu32HResult */);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_remsysact_remotegetclassobject_rqst(tvbuff_t *tvb, int offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
sysact_register_routines();
|
|
|
|
offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
|
|
offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_actproperties, NULL);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static int
|
|
dissect_remsysact_remotegetclassobject_resp(tvbuff_t *tvb, int offset,
|
|
packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
|
|
{
|
|
sysact_register_routines();
|
|
|
|
offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
|
|
|
|
offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
|
|
hf_sysact_actproperties, NULL);
|
|
|
|
offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
|
|
NULL /* pu32HResult */);
|
|
|
|
return offset;
|
|
}
|
|
|
|
static dcerpc_sub_dissector ISystemActivator_dissectors[] = {
|
|
{ 0, "QueryInterfaceIRemoteSCMActivator", NULL, NULL },
|
|
{ 1, "AddRefIRemoteISCMActivator", NULL, NULL },
|
|
{ 2, "ReleaseIRemoteISCMActivator", NULL, NULL },
|
|
{ 3, "RemoteGetClassObject", dissect_remsysact_remotegetclassobject_rqst, dissect_remsysact_remotegetclassobject_resp },
|
|
{ 4, "RemoteCreateInstance", dissect_remsysact_remotecreateinstance_rqst, dissect_remsysact_remotecreateinstance_resp },
|
|
{ 0, NULL, NULL, NULL },
|
|
};
|
|
|
|
void
|
|
proto_register_ISystemActivator (void)
|
|
{
|
|
/* fields */
|
|
static hf_register_info hf[] = {
|
|
{ &hf_opnum,
|
|
{ "Operation", "isystemactivator.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_actproperties,
|
|
{ "IActProperties", "isystemactivator.actproperties", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
#if 0
|
|
{ &hf_sysact_unknown,
|
|
{ "IUnknown", "isystemactivator.unknown", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
#endif
|
|
};
|
|
|
|
static hf_register_info hf_actproperties[] = {
|
|
{ &hf_sysact_totalsize,
|
|
{ "Totalsize", "isystemactivator.actproperties.size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_res,
|
|
{ "Reserved", "isystemactivator.actproperties.resv", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
|
|
{ &hf_sysact_customhdrsize,
|
|
{ "CustomHeaderSize", "isystemactivator.customhdr.size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_dstctx,
|
|
{ "DestinationContext", "isystemactivator.customhdr.dc", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_actpropnumber,
|
|
{ "NumActivationPropertyStructs", "isystemactivator.customhdr.actpropnumber", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_actpropclsinfoid,
|
|
{ "ClassInfoClsid", "isystemactivator.customhdr.clsinfoid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
#if 0
|
|
{ &hf_sysact_actpropclsids,
|
|
{ "PropertyGuids", "isystemactivator.customhdr.clsids", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
#endif
|
|
{ &hf_sysact_actpropclsid,
|
|
{ "PropertyStructGuid", "isystemactivator.customhdr.clsid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
#if 0
|
|
{ &hf_sysact_actpropsizes,
|
|
{ "PropertyDataSizes", "isystemactivator.customhdr.datasizes", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
#endif
|
|
{ &hf_sysact_actpropsize,
|
|
{ "PropertyDataSize", "isystemactivator.customhdr.datasize", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
|
|
/*SpecialSystemProperties*/
|
|
{ &hf_sysact_spsysprop_sid,
|
|
{ "SessionID", "isystemactivator.properties.spcl.sid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, "A value that uniquely identifies a logon session on the server", HFILL }},
|
|
{ &hf_sysact_spsysprop_remotethissid,
|
|
{ "RemoteThisSessionID", "isystemactivator.properties.spcl.remotesid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_spsysprop_cltimpersonating,
|
|
{ "ClientImpersonating", "isystemactivator.properties.spcl.cltimp", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_spsysprop_partitionid,
|
|
{ "PartitionIDPresent", "isystemactivator.properties.spcl.cltimp", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_spsysprop_defauthlvl,
|
|
{ "DefaultAuthnLevel", "isystemactivator.properties.spcl.defauthlvl", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_spsysprop_partition,
|
|
{ "PartitionGuid", "isystemactivator.properties.spcl.partition", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_spsysprop_procrqstflgs,
|
|
{ "ProcessRequestFlags", "isystemactivator.properties.spcl.procreqstflgs", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_spsysprop_origclsctx,
|
|
{ "OriginalClassContext", "isystemactivator.properties.spcl.origclsctx", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_spsysprop_flags,
|
|
{ "Flags", "isystemactivator.properties.spcl.flags", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
#if 0
|
|
{ &hf_sysact_spsysprop_procid,
|
|
{ "ProcessID", "isystemactivator.properties.spcl.procid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
#endif
|
|
#if 0
|
|
{ &hf_sysact_spsysprop_hwnd,
|
|
{ "hWnd", "isystemactivator.properties.spcl.hwnd", FT_UINT64, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
#endif
|
|
|
|
/*InstantiationInfo*/
|
|
{ &hf_sysact_instninfo_clsid,
|
|
{ "InstantiatedObjectClsId", "isystemactivator.properties.instninfo.clsid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_instninfo_clsctx,
|
|
{ "ClassContext", "isystemactivator.properties.instninfo.clsctx", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_instninfo_actflags,
|
|
{ "ActivationFlags", "isystemactivator.properties.instninfo.actflags", FT_UINT32, BASE_DEC_HEX, VALS(instninfo_actflags), 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_instninfo_issurrogate,
|
|
{ "FlagsSurrogate", "isystemactivator.properties.instninfo.actflags", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_instninfo_iidcount,
|
|
{ "InterfaceIdCount", "isystemactivator.properties.instninfo.iidcount", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_instninfo_instflags,
|
|
{ "InstantiationFlag", "isystemactivator.properties.instninfo.instflags", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_instninfo_entiresize,
|
|
{ "EntirePropertySize", "isystemactivator.properties.instninfo.entiresize", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_instninfo_iid,
|
|
{ "InterfaceIds", "isystemactivator.properties.instninfo.iid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
|
|
/*ActivationContextInfo*/
|
|
{ &hf_sysact_actctxinfo_cltok,
|
|
{ "ClientOk", "isystemactivator.properties.actctxinfo.cltok", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_context,
|
|
{ "ClientContext", "isystemactivator.properties.context", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
|
|
/*dcom Context*/
|
|
{ &hf_sysact_ctx_id,
|
|
{ "ContextID", "isystemactivator.properties.context.id", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_ctx_flags,
|
|
{ "Flags", "isystemactivator.properties.context.flags", FT_UINT32, BASE_HEX, VALS(dcom_context_flag_vals), 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_ctx_res,
|
|
{ "Reserved", "isystemactivator.properties.context.res", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_ctx_numextents,
|
|
{ "NumExtents", "isystemactivator.properties.context.numext", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_ctx_extentscnt,
|
|
{ "ExtentCount", "isystemactivator.properties.context.extcnt", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_ctx_mashflags,
|
|
{ "MarshalFlags", "isystemactivator.properties.context.mashflags", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_ctx_count,
|
|
{ "ContextPropertyCount", "isystemactivator.properties.context.cnt", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_ctx_frozen,
|
|
{ "Frozen", "isystemactivator.properties.context.frz", FT_UINT32, BASE_HEX, VALS(boolean_flag_vals), 0x0, NULL, HFILL }},
|
|
|
|
/*Security Info*/
|
|
{ &hf_sysact_si_authflalgs,
|
|
{ "AuthenticationFlags", "isystemactivator.properties.si.authflags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_si_serverinfo,
|
|
{ "ServerInfo", "isystemactivator.properties.si.ci", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
|
|
{ &hf_sysact_si_ci_res,
|
|
{ "Reserved", "isystemactivator.properties.si.ci.res", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_si_ci_string,
|
|
{ "String", "isystemactivator.properties.si.ci.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
|
|
|
|
/*Location info*/
|
|
{ &hf_sysact_li_string,
|
|
{ "String", "isystemactivator.properties.li.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
|
|
{ &hf_sysact_li_procid,
|
|
{ "ProcessId", "isystemactivator.properties.li.procid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_li_apartid,
|
|
{ "ApartmentId", "isystemactivator.properties.li.apartid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_li_ctxid,
|
|
{ "ContextId", "isystemactivator.properties.li.ctxid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
|
|
|
|
/*ScmRequst info*/
|
|
{ &hf_sysact_sri_cltimplvl,
|
|
{ "ClientImpersonationLevel", "isystemactivator.properties.sri.cltimplvl", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_sri_protseqnum,
|
|
{ "NumProtocolSequences", "isystemactivator.properties.sri.protseqnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_sri_protseq,
|
|
{ "ProtocolSeq", "isystemactivator.properties.sri.protseq", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
|
|
/*PropsOutInfo*/
|
|
{ &hf_sysact_pi_ifnum,
|
|
{ "NumInterfaces", "isystemactivator.properties.pi.ifnum", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_pi_retval,
|
|
{ "ReturnValue", "isystemactivator.properties.retval", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_pi_interf,
|
|
{ "Interface", "isystemactivator.properties.interf", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_pi_iid,
|
|
{ "IID", "isystemactivator.properties.iid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
|
|
/*ScmReply info*/
|
|
{ &hf_sysact_scmri_rmtunknid,
|
|
{ "IRemUnknownInterfacePointerId", "isystemactivator.properties.scmresp.rmtunknid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_scmri_authhint,
|
|
{ "AuthenticationHint", "isystemactivator.properties.scmresp.authhint", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_scmri_binding,
|
|
{ "Bindings", "isystemactivator.properties.scmresp.binding", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_scmri_oxid,
|
|
{ "OXID", "isystemactivator.properties.scmresp.oxid", FT_UINT64, BASE_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_sysact_unused_buffer,
|
|
{ "Unused buffer", "isystemactivator.unused_buffer", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
};
|
|
|
|
static hf_register_info hf_tshdr[] = {
|
|
{ &hf_typeszch,
|
|
{ "CommonHeader", "isystemactivator.actproperties.ts.hdr", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_typeszph,
|
|
{ "PrivateHeader", "isystemactivator.actproperties.ts.hdr", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_typesz_ver,
|
|
{ "Version", "isystemactivator.actproperties.ts.ver", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_typesz_endianness,
|
|
{ "Endianness", "isystemactivator.actproperties.ts.end", FT_UINT8, BASE_HEX, VALS(ts_endian_vals), 0x0, NULL, HFILL }},
|
|
{ &hf_typesz_commhdrlen,
|
|
{ "CommonHeaderLength", "isystemactivator.actproperties.ts.chl", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_typesz_filler,
|
|
{ "Filler", "isystemactivator.actproperties.ts.fil", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
|
|
{ &hf_typesz_buflen,
|
|
{ "ObjectBufferLength", "isystemactivator.actproperties.ts.buflen", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
|
|
};
|
|
|
|
|
|
/* Tree */
|
|
static gint *ett[] = {
|
|
&ett_isystemactivator,
|
|
&ett_actproperties,
|
|
&ett_properties,
|
|
&ett_commonheader,
|
|
&ett_propguids,
|
|
&ett_typeszcommhdr,
|
|
&ett_typeszprivhdr,
|
|
&ett_dcom_spclsysprop,
|
|
&ett_dcom_reserved,
|
|
&ett_dcom_instantianinfo,
|
|
&ett_dcom_actctxinfo,
|
|
&ett_dcom_context,
|
|
&ett_dcom_securityinfo,
|
|
&ett_dcom_locationinfo,
|
|
&ett_dcom_scmrqstinfo,
|
|
&ett_dcom_rmtrqst,
|
|
|
|
&ett_dcom_propsoutput,
|
|
&ett_dcom_scmrespinfo,
|
|
&ett_dcom_rmtresp,
|
|
&ett_dcom_oxidbinding,
|
|
|
|
};
|
|
|
|
proto_ISystemActivator = proto_register_protocol ("ISystemActivator ISystemActivator Resolver", "ISystemActivator", "isystemactivator");
|
|
proto_register_field_array (proto_ISystemActivator, hf, array_length (hf));
|
|
proto_register_field_array (proto_ISystemActivator, hf_actproperties, array_length (hf_actproperties));
|
|
proto_register_field_array(proto_ISystemActivator, hf_tshdr, array_length(hf_tshdr));
|
|
proto_register_subtree_array (ett, array_length (ett));
|
|
}
|
|
|
|
void
|
|
proto_reg_handoff_ISystemActivator (void)
|
|
{
|
|
/* Register the protocol as dcerpc */
|
|
dcerpc_init_uuid (proto_ISystemActivator, ett_isystemactivator, &uuid_ISystemActivator,
|
|
ver_ISystemActivator, ISystemActivator_dissectors, hf_opnum);
|
|
}
|
|
|
|
/*
|
|
* Editor modelines - https://www.wireshark.org/tools/modelines.html
|
|
*
|
|
* Local variables:
|
|
* c-basic-offset: 4
|
|
* tab-width: 8
|
|
* indent-tabs-mode: nil
|
|
* End:
|
|
*
|
|
* vi: set shiftwidth=4 tabstop=8 expandtab:
|
|
* :indentSize=4:tabSize=8:noTabs=true:
|
|
*/
|