diff options
| -rw-r--r-- | epan/dissectors/packet-dcerpc-eventlog.c | 532 | ||||
| -rw-r--r-- | epan/dissectors/packet-dcerpc-eventlog.h | 9 | ||||
| -rw-r--r-- | epan/dissectors/pidl/README | 5 | ||||
| -rw-r--r-- | epan/dissectors/pidl/eventlog.cnf | 22 | ||||
| -rw-r--r-- | epan/dissectors/pidl/eventlog.idl | 10 |
5 files changed, 281 insertions, 297 deletions
diff --git a/epan/dissectors/packet-dcerpc-eventlog.c b/epan/dissectors/packet-dcerpc-eventlog.c index 3676f68c07..0891d9aa8c 100644 --- a/epan/dissectors/packet-dcerpc-eventlog.c +++ b/epan/dissectors/packet-dcerpc-eventlog.c @@ -1,10 +1,10 @@ /* DO NOT EDIT - This filter was automatically generated + This file was automatically generated by Pidl from eventlog.idl and eventlog.cnf. - Pidl is a perl based IDL compiler for DCE/RPC idl files. + Pidl is a perl based IDL compiler for DCE/RPC idl files. It is maintained by the Samba team, not the Wireshark team. - Instructions on how to download and install Pidl can be + Instructions on how to download and install Pidl can be found at http://wiki.wireshark.org/Pidl */ @@ -36,98 +36,98 @@ static gint ett_eventlog_eventlog_ChangeUnknown0 = -1; /* Header field declarations */ -static gint hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel = -1; -static gint hf_eventlog_Record_computer_name = -1; -static gint hf_eventlog_eventlog_OpenEventLogW_unknown0 = -1; -static gint hf_eventlog_eventlog_Record_computer_name = -1; static gint hf_eventlog_eventlog_RegisterEventSourceW_handle = -1; +static gint hf_eventlog_eventlog_OpenEventLogW_MinorVersion = -1; +static gint hf_eventlog_Record = -1; +static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown0 = -1; +static gint hf_eventlog_eventlog_GetLogIntormation_handle = -1; +static gint hf_eventlog_Record_source_name = -1; +static gint hf_eventlog_eventlog_ChangeNotify_unknown3 = -1; +static gint hf_eventlog_eventlog_ReportEventW_num_of_strings = -1; +static gint hf_eventlog_eventlog_ReportEventW_data_length = -1; +static gint hf_eventlog_eventlog_Record_reserved = -1; +static gint hf_eventlog_eventlog_GetLogIntormation_cbBufSize = -1; static gint hf_eventlog_eventlog_GetNumRecords_handle = -1; -static gint hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE = -1; +static gint hf_eventlog_Record_computer_name = -1; +static gint hf_eventlog_opnum = -1; +static gint hf_eventlog_eventlog_OpenEventLogW_Module = -1; +static gint hf_eventlog_eventlog_Record_strings = -1; +static gint hf_eventlog_eventlog_RegisterEventSourceW_servername = -1; +static gint hf_eventlog_eventlog_Record_time_written = -1; +static gint hf_eventlog_eventlog_Record_reserved_flags = -1; +static gint hf_eventlog_eventlog_BackupEventLogW_backupfilename = -1; +static gint hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE = -1; +static gint hf_eventlog_eventlog_ReportEventW_event_id = -1; +static gint hf_eventlog_eventlogEventTypes_EVENTLOG_SUCCESS = -1; static gint hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE = -1; -static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown2 = -1; -static gint hf_eventlog_eventlog_Record_sid_offset = -1; -static gint hf_eventlog_Record_string = -1; -static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE = -1; -static gint hf_eventlog_eventlog_ChangeNotify_unknown2 = -1; +static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown3 = -1; +static gint hf_eventlog_eventlog_ReadEventLogW_handle = -1; +static gint hf_eventlog_eventlog_ReportEventW_computer_name = -1; static gint hf_eventlog_eventlog_ReportEventW_event_category = -1; +static gint hf_eventlog_eventlog_OpenBackupEventLogW_handle = -1; static gint hf_eventlog_eventlog_ChangeUnknown0_unknown0 = -1; -static gint hf_eventlog_eventlog_Record_data_offset = -1; -static gint hf_eventlog_eventlog_OpenUnknown0_unknown0 = -1; -static gint hf_eventlog_eventlog_BackupEventLogW_backupfilename = -1; -static gint hf_eventlog_eventlog_ClearEventLogW_handle = -1; -static gint hf_eventlog_eventlog_Record_closing_record_number = -1; -static gint hf_eventlog_eventlog_Record_size = -1; -static gint hf_eventlog_eventlog_ReportEventW_computer_name = -1; -static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown0 = -1; +static gint hf_eventlog_eventlog_ReadEventLogW_number_of_bytes = -1; +static gint hf_eventlog_eventlog_GetOldestRecord_handle = -1; static gint hf_eventlog_eventlog_Record_event_id = -1; -static gint hf_eventlog_eventlog_ReadEventLogW_handle = -1; -static gint hf_eventlog_eventlog_BackupEventLogW_handle = -1; -static gint hf_eventlog_eventlog_Record_raw_data = -1; -static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown0 = -1; -static gint hf_eventlog_eventlog_CloseEventLog_handle = -1; -static gint hf_eventlog_eventlog_ChangeUnknown0_unknown1 = -1; -static gint hf_eventlog_eventlog_OpenBackupEventLogW_handle = -1; -static gint hf_eventlog_eventlog_Record_reserved_flags = -1; -static gint hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded = -1; static gint hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ = -1; -static gint hf_eventlog_eventlog_OpenEventLogW_MinorVersion = -1; -static gint hf_eventlog_eventlog_Record_source_name = -1; -static gint hf_eventlog_eventlog_GetLogIntormation_handle = -1; -static gint hf_eventlog_Record_length = -1; -static gint hf_eventlog_eventlog_Record_sid_length = -1; -static gint hf_eventlog_eventlog_GetOldestRecord_oldest = -1; -static gint hf_eventlog_eventlog_Record_strings = -1; -static gint hf_eventlog_eventlog_Record_record_number = -1; -static gint hf_eventlog_eventlog_OpenEventLogW_handle = -1; -static gint hf_eventlog_eventlog_GetLogIntormation_lpBuffer = -1; -static gint hf_eventlog_eventlog_RegisterEventSourceW_logname = -1; -static gint hf_eventlog_eventlog_ReadEventLogW_real_size = -1; -static gint hf_eventlog_eventlog_Record_time_written = -1; -static gint hf_eventlog_eventlog_Record_stringoffset = -1; -static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown3 = -1; -static gint hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ = -1; -static gint hf_eventlog_eventlog_Record_reserved = -1; +static gint hf_eventlog_eventlog_FlushEventLog_handle = -1; static gint hf_eventlog_eventlog_Record_data_length = -1; -static gint hf_eventlog_eventlog_RegisterEventSourceW_servername = -1; -static gint hf_eventlog_eventlog_ReportEventW_event_id = -1; -static gint hf_eventlog_eventlog_ReportEventW_handle = -1; -static gint hf_eventlog_eventlog_ReadEventLogW_sent_size = -1; +static gint hf_eventlog_eventlog_ReadEventLogW_offset = -1; +static gint hf_eventlog_eventlog_DeregisterEventSource_handle = -1; +static gint hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ = -1; static gint hf_eventlog_eventlog_ChangeNotify_handle = -1; -static gint hf_eventlog_eventlog_OpenBackupEventLogW_logname = -1; -static gint hf_eventlog_Record_source_name = -1; -static gint hf_eventlog_eventlog_Record_event_type = -1; +static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE = -1; +static gint hf_eventlog_eventlog_ChangeNotify_unknown2 = -1; +static gint hf_eventlog_eventlog_Record_sid_offset = -1; static gint hf_eventlog_eventlog_Record_num_of_strings = -1; -static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown2 = -1; -static gint hf_eventlog_eventlog_ReadEventLogW_offset = -1; -static gint hf_eventlog_eventlog_Record_event_category = -1; -static gint hf_eventlog_eventlog_GetOldestRecord_handle = -1; +static gint hf_eventlog_eventlog_GetLogIntormation_lpBuffer = -1; static gint hf_eventlog_eventlog_OpenUnknown0_unknown1 = -1; -static gint hf_eventlog_eventlog_GetNumRecords_number = -1; -static gint hf_eventlog_eventlog_Record_time_generated = -1; -static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS = -1; -static gint hf_eventlog_eventlog_OpenEventLogW_RegModuleName = -1; -static gint hf_eventlog_eventlog_ReportEventW_data_length = -1; -static gint hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ = -1; -static gint hf_eventlog_Record = -1; -static gint hf_eventlog_eventlog_ReadEventLogW_data = -1; -static gint hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE = -1; -static gint hf_eventlog_eventlog_DeregisterEventSource_handle = -1; -static gint hf_eventlog_opnum = -1; -static gint hf_eventlog_eventlog_ChangeNotify_unknown3 = -1; -static gint hf_eventlog_eventlog_ReportEventW_num_of_strings = -1; -static gint hf_eventlog_eventlog_ReportEventW_time = -1; +static gint hf_eventlog_eventlog_Record_computer_name = -1; +static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown0 = -1; +static gint hf_eventlog_eventlog_ClearEventLogW_backupfilename = -1; +static gint hf_eventlog_eventlog_ReportEventW_handle = -1; static gint hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ = -1; +static gint hf_eventlog_eventlog_OpenEventLogW_unknown0 = -1; +static gint hf_eventlog_eventlog_Record_size = -1; static gint hf_eventlog_status = -1; -static gint hf_eventlog_eventlog_ReadEventLogW_number_of_bytes = -1; -static gint hf_eventlog_eventlog_ClearEventLogW_backupfilename = -1; -static gint hf_eventlog_eventlog_OpenEventLogW_Module = -1; -static gint hf_eventlog_eventlog_FlushEventLog_handle = -1; +static gint hf_eventlog_eventlog_Record_data_offset = -1; +static gint hf_eventlog_eventlog_OpenEventLogW_handle = -1; +static gint hf_eventlog_eventlog_OpenEventLogW_RegModuleName = -1; static gint hf_eventlog_eventlog_ReportEventW_Type = -1; -static gint hf_eventlog_eventlog_OpenEventLogW_MajorVersion = -1; -static gint hf_eventlog_eventlog_GetLogIntormation_cbBufSize = -1; +static gint hf_eventlog_eventlog_ReadEventLogW_real_size = -1; static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown3 = -1; +static gint hf_eventlog_eventlog_OpenUnknown0_unknown0 = -1; +static gint hf_eventlog_eventlog_Record_source_name = -1; +static gint hf_eventlog_eventlog_Record_record_number = -1; +static gint hf_eventlog_eventlog_Record_event_category = -1; +static gint hf_eventlog_eventlog_Record_raw_data = -1; +static gint hf_eventlog_eventlog_OpenBackupEventLogW_logname = -1; +static gint hf_eventlog_eventlog_Record_sid_length = -1; +static gint hf_eventlog_eventlog_Record_time_generated = -1; +static gint hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ = -1; +static gint hf_eventlog_eventlog_ClearEventLogW_handle = -1; +static gint hf_eventlog_eventlog_BackupEventLogW_handle = -1; +static gint hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE = -1; +static gint hf_eventlog_eventlog_ReportEventW_time = -1; +static gint hf_eventlog_Record_length = -1; +static gint hf_eventlog_eventlog_Record_closing_record_number = -1; +static gint hf_eventlog_eventlog_OpenBackupEventLogW_unknown2 = -1; +static gint hf_eventlog_eventlog_Record_event_type = -1; +static gint hf_eventlog_eventlog_RegisterEventSourceW_unknown2 = -1; static gint hf_eventlog_eventlog_ReadEventLogW_flags = -1; -static gint hf_eventlog_eventlogEventTypes_EVENTLOG_SUCCESS = -1; +static gint hf_eventlog_eventlog_RegisterEventSourceW_logname = -1; +static gint hf_eventlog_eventlog_OpenEventLogW_MajorVersion = -1; +static gint hf_eventlog_eventlog_GetNumRecords_number = -1; +static gint hf_eventlog_eventlog_ChangeUnknown0_unknown1 = -1; +static gint hf_eventlog_Record_string = -1; +static gint hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS = -1; +static gint hf_eventlog_eventlog_ReadEventLogW_sent_size = -1; +static gint hf_eventlog_eventlog_Record_stringoffset = -1; +static gint hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded = -1; +static gint hf_eventlog_eventlog_GetOldestRecord_oldest = -1; +static gint hf_eventlog_eventlog_CloseEventLog_handle = -1; +static gint hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel = -1; +static gint hf_eventlog_eventlog_ReadEventLogW_data = -1; static gint proto_dcerpc_eventlog = -1; /* Version information */ @@ -285,7 +285,7 @@ static int eventlog_dissect_element_FlushEventLog_handle(tvbuff_t *tvb _U_, int static int eventlog_dissect_element_FlushEventLog_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); /* Add this one manually until we can compile LSA */ static int -eventlog_dissect_struct_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, int hf_index,int notused _U_) +eventlog_dissect_struct_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,int notused _U_) { if(di->conformant_run){ /*just a run to handle conformant arrays, nothing to dissect */ @@ -333,7 +333,7 @@ eventlog_dissect_element_Record_sid_offset(tvbuff_t *tvb, int offset, packet_inf offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_sid_offset,&sid_offset); if(sid_offset && sid_length){ tvbuff_t *sid_tvb; - /* this blob contains an NT SID. + /* this blob contains an NT SID. * tvb starts at the beginning of the record. */ sid_tvb=tvb_new_subset(tvb, sid_offset, MIN((gint)sid_length, tvb_length_remaining(tvb, offset)), sid_length); @@ -345,10 +345,8 @@ static int eventlog_dissect_element_Record_source_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, guint8 *drep _U_) { guint len; - len=tvb_unicode_strsize(tvb, offset); proto_tree_add_item(tree, hf_eventlog_Record_source_name, tvb, offset, len, ENC_UTF_16|ENC_LITTLE_ENDIAN); - offset+=len; return offset; } @@ -356,10 +354,8 @@ static int eventlog_dissect_element_Record_computer_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, guint8 *drep _U_) { guint len; - len=tvb_unicode_strsize(tvb, offset); proto_tree_add_item(tree, hf_eventlog_Record_computer_name, tvb, offset, len, ENC_UTF_16|ENC_LITTLE_ENDIAN); - offset+=len; return offset; } @@ -384,15 +380,11 @@ eventlog_dissect_element_Record_strings(tvbuff_t *tvb, int offset, packet_info * { while(string_offset && num_of_strings){ guint len; - len=tvb_unicode_strsize(tvb, string_offset); proto_tree_add_item(tree, hf_eventlog_Record_string, tvb, string_offset, len, ENC_UTF_16|ENC_LITTLE_ENDIAN); string_offset+=len; - num_of_strings--; } - - return offset; } @@ -891,7 +883,7 @@ eventlog_dissect_element_ClearEventLogW_backupfilename_(tvbuff_t *tvb _U_, int o /* IDL: NTSTATUS eventlog_ClearEventLogW( */ /* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [unique(1)] [in] lsa_String *backupfilename */ +/* IDL: [in] [unique(1)] lsa_String *backupfilename */ /* IDL: ); */ static int @@ -952,7 +944,7 @@ eventlog_dissect_element_BackupEventLogW_backupfilename_(tvbuff_t *tvb _U_, int } /* IDL: NTSTATUS eventlog_BackupEventLogW( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [unique(1)] [in] lsa_String *backupfilename */ /* IDL: ); */ @@ -998,7 +990,7 @@ eventlog_dissect_element_CloseEventLog_handle_(tvbuff_t *tvb _U_, int offset _U_ } /* IDL: NTSTATUS eventlog_CloseEventLog( */ -/* IDL: [out] [ref] [in] policy_handle *handle */ +/* IDL: [ref] [out] [in] policy_handle *handle */ /* IDL: ); */ static int @@ -1044,7 +1036,7 @@ eventlog_dissect_element_DeregisterEventSource_handle_(tvbuff_t *tvb _U_, int of } /* IDL: NTSTATUS eventlog_DeregisterEventSource( */ -/* IDL: [out] [ref] [in] policy_handle *handle */ +/* IDL: [in] [out] [ref] policy_handle *handle */ /* IDL: ); */ static int @@ -1106,7 +1098,7 @@ eventlog_dissect_element_GetNumRecords_number_(tvbuff_t *tvb _U_, int offset _U_ } /* IDL: NTSTATUS eventlog_GetNumRecords( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [out] [ref] uint32 *number */ /* IDL: ); */ @@ -1170,7 +1162,7 @@ eventlog_dissect_element_GetOldestRecord_oldest_(tvbuff_t *tvb _U_, int offset _ /* IDL: NTSTATUS eventlog_GetOldestRecord( */ /* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [out] [ref] uint32 *oldest */ +/* IDL: [ref] [out] uint32 *oldest */ /* IDL: ); */ static int @@ -1240,8 +1232,8 @@ eventlog_dissect_element_ChangeNotify_unknown3(tvbuff_t *tvb _U_, int offset _U_ } /* IDL: NTSTATUS eventlog_ChangeNotify( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [in] [ref] eventlog_ChangeUnknown0 *unknown2, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [ref] [in] eventlog_ChangeUnknown0 *unknown2, */ /* IDL: [in] uint32 unknown3 */ /* IDL: ); */ @@ -1444,12 +1436,12 @@ eventlog_dissect_element_RegisterEventSourceW_handle_(tvbuff_t *tvb _U_, int off } /* IDL: NTSTATUS eventlog_RegisterEventSourceW( */ -/* IDL: [unique(1)] [in] eventlog_OpenUnknown0 *unknown0, */ +/* IDL: [in] [unique(1)] eventlog_OpenUnknown0 *unknown0, */ /* IDL: [in] lsa_String logname, */ /* IDL: [in] lsa_String servername, */ /* IDL: [in] uint32 unknown2, */ /* IDL: [in] uint32 unknown3, */ -/* IDL: [out] [ref] policy_handle *handle */ +/* IDL: [ref] [out] policy_handle *handle */ /* IDL: ); */ static int @@ -1547,7 +1539,7 @@ eventlog_dissect_element_OpenBackupEventLogW_handle_(tvbuff_t *tvb _U_, int offs /* IDL: [in] lsa_String logname, */ /* IDL: [in] uint32 unknown2, */ /* IDL: [in] uint32 unknown3, */ -/* IDL: [out] [ref] policy_handle *handle */ +/* IDL: [ref] [out] policy_handle *handle */ /* IDL: ); */ static int @@ -1675,7 +1667,7 @@ eventlog_dissect_element_ReadEventLogW_real_size_(tvbuff_t *tvb _U_, int offset /* IDL: [in] eventlogReadFlags flags, */ /* IDL: [in] uint32 offset, */ /* IDL: [in] uint32 number_of_bytes, */ -/* IDL: [out] [ref] [size_is(number_of_bytes)] uint8 *data, */ +/* IDL: [out] [size_is(number_of_bytes)] [ref] uint8 *data, */ /* IDL: [out] [ref] uint32 *sent_size, */ /* IDL: [out] [ref] uint32 *real_size */ /* IDL: ); */ @@ -2210,7 +2202,7 @@ eventlog_dissect_element_FlushEventLog_handle_(tvbuff_t *tvb _U_, int offset _U_ } /* IDL: NTSTATUS eventlog_FlushEventLog( */ -/* IDL: [ref] [in] policy_handle *handle */ +/* IDL: [in] [ref] policy_handle *handle */ /* IDL: ); */ static int @@ -2292,190 +2284,190 @@ static dcerpc_sub_dissector eventlog_dissectors[] = { void proto_register_dcerpc_eventlog(void) { static hf_register_info hf[] = { - { &hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel, - { "Dwinfolevel", "eventlog.eventlog_GetLogIntormation.dwInfoLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_Record_computer_name, - { "Computer Name", "eventlog.Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenEventLogW_unknown0, - { "Unknown0", "eventlog.eventlog_OpenEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_computer_name, - { "Computer Name", "eventlog.eventlog_Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_RegisterEventSourceW_handle, + { &hf_eventlog_eventlog_RegisterEventSourceW_handle, { "Handle", "eventlog.eventlog_RegisterEventSourceW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetNumRecords_handle, + { &hf_eventlog_eventlog_OpenEventLogW_MinorVersion, + { "Minorversion", "eventlog.eventlog_OpenEventLogW.MinorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_Record, + { "Record", "eventlog.Record", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenBackupEventLogW_unknown0, + { "Unknown0", "eventlog.eventlog_OpenBackupEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetLogIntormation_handle, + { "Handle", "eventlog.eventlog_GetLogIntormation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_Record_source_name, + { "Source Name", "eventlog.Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ChangeNotify_unknown3, + { "Unknown3", "eventlog.eventlog_ChangeNotify.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_num_of_strings, + { "Num Of Strings", "eventlog.eventlog_ReportEventW.num_of_strings", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_data_length, + { "Data Length", "eventlog.eventlog_ReportEventW.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_reserved, + { "Reserved", "eventlog.eventlog_Record.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetLogIntormation_cbBufSize, + { "Cbbufsize", "eventlog.eventlog_GetLogIntormation.cbBufSize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetNumRecords_handle, { "Handle", "eventlog.eventlog_GetNumRecords.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE, - { "Eventlog Warning Type", "eventlog.eventlogEventTypes.EVENTLOG_WARNING_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_WARNING_TYPE_tfs), ( 0x0002 ), NULL, HFILL }}, - { &hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE, + { &hf_eventlog_Record_computer_name, + { "Computer Name", "eventlog.Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_opnum, + { "Operation", "eventlog.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenEventLogW_Module, + { "Module", "eventlog.eventlog_OpenEventLogW.Module", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_strings, + { "Strings", "eventlog.eventlog_Record.strings", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_RegisterEventSourceW_servername, + { "Servername", "eventlog.eventlog_RegisterEventSourceW.servername", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_time_written, + { "Time Written", "eventlog.eventlog_Record.time_written", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_reserved_flags, + { "Reserved Flags", "eventlog.eventlog_Record.reserved_flags", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_BackupEventLogW_backupfilename, + { "Backupfilename", "eventlog.eventlog_BackupEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE, + { "Eventlog Information Type", "eventlog.eventlogEventTypes.EVENTLOG_INFORMATION_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_INFORMATION_TYPE_tfs), ( 0x0004 ), NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_event_id, + { "Event Id", "eventlog.eventlog_ReportEventW.event_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlogEventTypes_EVENTLOG_SUCCESS, + { "Eventlog Success", "eventlog.eventlogEventTypes.EVENTLOG_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_SUCCESS_tfs), ( 0x0000 ), NULL, HFILL }}, + { &hf_eventlog_eventlogEventTypes_EVENTLOG_ERROR_TYPE, { "Eventlog Error Type", "eventlog.eventlogEventTypes.EVENTLOG_ERROR_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_ERROR_TYPE_tfs), ( 0x0001 ), NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenBackupEventLogW_unknown2, - { "Unknown2", "eventlog.eventlog_OpenBackupEventLogW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_sid_offset, - { "Sid Offset", "eventlog.eventlog_Record.sid_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_Record_string, - { "string", "eventlog.Record.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE, - { "Eventlog Audit Failure", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_FAILURE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_FAILURE_tfs), ( 0x0010 ), NULL, HFILL }}, - { &hf_eventlog_eventlog_ChangeNotify_unknown2, - { "Unknown2", "eventlog.eventlog_ChangeNotify.unknown2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_event_category, + { &hf_eventlog_eventlog_RegisterEventSourceW_unknown3, + { "Unknown3", "eventlog.eventlog_RegisterEventSourceW.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReadEventLogW_handle, + { "Handle", "eventlog.eventlog_ReadEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_computer_name, + { "Computer Name", "eventlog.eventlog_ReportEventW.computer_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_event_category, { "Event Category", "eventlog.eventlog_ReportEventW.event_category", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ChangeUnknown0_unknown0, + { &hf_eventlog_eventlog_OpenBackupEventLogW_handle, + { "Handle", "eventlog.eventlog_OpenBackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ChangeUnknown0_unknown0, { "Unknown0", "eventlog.eventlog_ChangeUnknown0.unknown0", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_data_offset, - { "Data Offset", "eventlog.eventlog_Record.data_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenUnknown0_unknown0, - { "Unknown0", "eventlog.eventlog_OpenUnknown0.unknown0", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_BackupEventLogW_backupfilename, - { "Backupfilename", "eventlog.eventlog_BackupEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ClearEventLogW_handle, - { "Handle", "eventlog.eventlog_ClearEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_closing_record_number, - { "Closing Record Number", "eventlog.eventlog_Record.closing_record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_size, - { "Size", "eventlog.eventlog_Record.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_computer_name, - { "Computer Name", "eventlog.eventlog_ReportEventW.computer_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenBackupEventLogW_unknown0, - { "Unknown0", "eventlog.eventlog_OpenBackupEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_event_id, + { &hf_eventlog_eventlog_ReadEventLogW_number_of_bytes, + { "Number Of Bytes", "eventlog.eventlog_ReadEventLogW.number_of_bytes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetOldestRecord_handle, + { "Handle", "eventlog.eventlog_GetOldestRecord.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_event_id, { "Event Id", "eventlog.eventlog_Record.event_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReadEventLogW_handle, - { "Handle", "eventlog.eventlog_ReadEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_BackupEventLogW_handle, - { "Handle", "eventlog.eventlog_BackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_raw_data, - { "Raw Data", "eventlog.eventlog_Record.raw_data", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_RegisterEventSourceW_unknown0, - { "Unknown0", "eventlog.eventlog_RegisterEventSourceW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_CloseEventLog_handle, - { "Handle", "eventlog.eventlog_CloseEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ChangeUnknown0_unknown1, - { "Unknown1", "eventlog.eventlog_ChangeUnknown0.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenBackupEventLogW_handle, - { "Handle", "eventlog.eventlog_OpenBackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_reserved_flags, - { "Reserved Flags", "eventlog.eventlog_Record.reserved_flags", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded, - { "Cbbytesneeded", "eventlog.eventlog_GetLogIntormation.cbBytesNeeded", FT_INT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ, + { &hf_eventlog_eventlogReadFlags_EVENTLOG_SEEK_READ, { "Eventlog Seek Read", "eventlog.eventlogReadFlags.EVENTLOG_SEEK_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_SEEK_READ_tfs), ( 0x0002 ), NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenEventLogW_MinorVersion, - { "Minorversion", "eventlog.eventlog_OpenEventLogW.MinorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_source_name, - { "Source Name", "eventlog.eventlog_Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetLogIntormation_handle, - { "Handle", "eventlog.eventlog_GetLogIntormation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_Record_length, - { "Record Length", "eventlog.Record.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_sid_length, - { "Sid Length", "eventlog.eventlog_Record.sid_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetOldestRecord_oldest, - { "Oldest", "eventlog.eventlog_GetOldestRecord.oldest", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_strings, - { "Strings", "eventlog.eventlog_Record.strings", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_record_number, - { "Record Number", "eventlog.eventlog_Record.record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenEventLogW_handle, - { "Handle", "eventlog.eventlog_OpenEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetLogIntormation_lpBuffer, - { "Lpbuffer", "eventlog.eventlog_GetLogIntormation.lpBuffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_RegisterEventSourceW_logname, - { "Logname", "eventlog.eventlog_RegisterEventSourceW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReadEventLogW_real_size, - { "Real Size", "eventlog.eventlog_ReadEventLogW.real_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_time_written, - { "Time Written", "eventlog.eventlog_Record.time_written", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_stringoffset, - { "Stringoffset", "eventlog.eventlog_Record.stringoffset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_RegisterEventSourceW_unknown3, - { "Unknown3", "eventlog.eventlog_RegisterEventSourceW.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ, - { "Eventlog Sequential Read", "eventlog.eventlogReadFlags.EVENTLOG_SEQUENTIAL_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ_tfs), ( 0x0001 ), NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_reserved, - { "Reserved", "eventlog.eventlog_Record.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_data_length, + { &hf_eventlog_eventlog_FlushEventLog_handle, + { "Handle", "eventlog.eventlog_FlushEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_data_length, { "Data Length", "eventlog.eventlog_Record.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_RegisterEventSourceW_servername, - { "Servername", "eventlog.eventlog_RegisterEventSourceW.servername", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_event_id, - { "Event Id", "eventlog.eventlog_ReportEventW.event_id", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_handle, - { "Handle", "eventlog.eventlog_ReportEventW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReadEventLogW_sent_size, - { "Sent Size", "eventlog.eventlog_ReadEventLogW.sent_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ChangeNotify_handle, + { &hf_eventlog_eventlog_ReadEventLogW_offset, + { "Offset", "eventlog.eventlog_ReadEventLogW.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_DeregisterEventSource_handle, + { "Handle", "eventlog.eventlog_DeregisterEventSource.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ, + { "Eventlog Sequential Read", "eventlog.eventlogReadFlags.EVENTLOG_SEQUENTIAL_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_SEQUENTIAL_READ_tfs), ( 0x0001 ), NULL, HFILL }}, + { &hf_eventlog_eventlog_ChangeNotify_handle, { "Handle", "eventlog.eventlog_ChangeNotify.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenBackupEventLogW_logname, - { "Logname", "eventlog.eventlog_OpenBackupEventLogW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_Record_source_name, - { "Source Name", "eventlog.Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_event_type, - { "Event Type", "eventlog.eventlog_Record.event_type", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_num_of_strings, + { &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_FAILURE, + { "Eventlog Audit Failure", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_FAILURE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_FAILURE_tfs), ( 0x0010 ), NULL, HFILL }}, + { &hf_eventlog_eventlog_ChangeNotify_unknown2, + { "Unknown2", "eventlog.eventlog_ChangeNotify.unknown2", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_sid_offset, + { "Sid Offset", "eventlog.eventlog_Record.sid_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_num_of_strings, { "Num Of Strings", "eventlog.eventlog_Record.num_of_strings", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_RegisterEventSourceW_unknown2, - { "Unknown2", "eventlog.eventlog_RegisterEventSourceW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReadEventLogW_offset, - { "Offset", "eventlog.eventlog_ReadEventLogW.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_event_category, - { "Event Category", "eventlog.eventlog_Record.event_category", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetOldestRecord_handle, - { "Handle", "eventlog.eventlog_GetOldestRecord.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenUnknown0_unknown1, + { &hf_eventlog_eventlog_GetLogIntormation_lpBuffer, + { "Lpbuffer", "eventlog.eventlog_GetLogIntormation.lpBuffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenUnknown0_unknown1, { "Unknown1", "eventlog.eventlog_OpenUnknown0.unknown1", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetNumRecords_number, - { "Number", "eventlog.eventlog_GetNumRecords.number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_Record_time_generated, - { "Time Generated", "eventlog.eventlog_Record.time_generated", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS, - { "Eventlog Audit Success", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS_tfs), ( 0x0008 ), NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenEventLogW_RegModuleName, - { "Regmodulename", "eventlog.eventlog_OpenEventLogW.RegModuleName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_data_length, - { "Data Length", "eventlog.eventlog_ReportEventW.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ, - { "Eventlog Backwards Read", "eventlog.eventlogReadFlags.EVENTLOG_BACKWARDS_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_BACKWARDS_READ_tfs), ( 0x0008 ), NULL, HFILL }}, - { &hf_eventlog_Record, - { "Record", "eventlog.Record", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReadEventLogW_data, - { "Data", "eventlog.eventlog_ReadEventLogW.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogEventTypes_EVENTLOG_INFORMATION_TYPE, - { "Eventlog Information Type", "eventlog.eventlogEventTypes.EVENTLOG_INFORMATION_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_INFORMATION_TYPE_tfs), ( 0x0004 ), NULL, HFILL }}, - { &hf_eventlog_eventlog_DeregisterEventSource_handle, - { "Handle", "eventlog.eventlog_DeregisterEventSource.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_opnum, - { "Operation", "eventlog.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ChangeNotify_unknown3, - { "Unknown3", "eventlog.eventlog_ChangeNotify.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_num_of_strings, - { "Num Of Strings", "eventlog.eventlog_ReportEventW.num_of_strings", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_time, - { "Time", "eventlog.eventlog_ReportEventW.time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ, + { &hf_eventlog_eventlog_Record_computer_name, + { "Computer Name", "eventlog.eventlog_Record.computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_RegisterEventSourceW_unknown0, + { "Unknown0", "eventlog.eventlog_RegisterEventSourceW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ClearEventLogW_backupfilename, + { "Backupfilename", "eventlog.eventlog_ClearEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_handle, + { "Handle", "eventlog.eventlog_ReportEventW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlogReadFlags_EVENTLOG_FORWARDS_READ, { "Eventlog Forwards Read", "eventlog.eventlogReadFlags.EVENTLOG_FORWARDS_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_FORWARDS_READ_tfs), ( 0x0004 ), NULL, HFILL }}, - { &hf_eventlog_status, + { &hf_eventlog_eventlog_OpenEventLogW_unknown0, + { "Unknown0", "eventlog.eventlog_OpenEventLogW.unknown0", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_size, + { "Size", "eventlog.eventlog_Record.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_status, { "NT Error", "eventlog.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReadEventLogW_number_of_bytes, - { "Number Of Bytes", "eventlog.eventlog_ReadEventLogW.number_of_bytes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ClearEventLogW_backupfilename, - { "Backupfilename", "eventlog.eventlog_ClearEventLogW.backupfilename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenEventLogW_Module, - { "Module", "eventlog.eventlog_OpenEventLogW.Module", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_FlushEventLog_handle, - { "Handle", "eventlog.eventlog_FlushEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReportEventW_Type, + { &hf_eventlog_eventlog_Record_data_offset, + { "Data Offset", "eventlog.eventlog_Record.data_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenEventLogW_handle, + { "Handle", "eventlog.eventlog_OpenEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenEventLogW_RegModuleName, + { "Regmodulename", "eventlog.eventlog_OpenEventLogW.RegModuleName", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_Type, { "Type", "eventlog.eventlog_ReportEventW.Type", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenEventLogW_MajorVersion, - { "Majorversion", "eventlog.eventlog_OpenEventLogW.MajorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_GetLogIntormation_cbBufSize, - { "Cbbufsize", "eventlog.eventlog_GetLogIntormation.cbBufSize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_OpenBackupEventLogW_unknown3, + { &hf_eventlog_eventlog_ReadEventLogW_real_size, + { "Real Size", "eventlog.eventlog_ReadEventLogW.real_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenBackupEventLogW_unknown3, { "Unknown3", "eventlog.eventlog_OpenBackupEventLogW.unknown3", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlog_ReadEventLogW_flags, + { &hf_eventlog_eventlog_OpenUnknown0_unknown0, + { "Unknown0", "eventlog.eventlog_OpenUnknown0.unknown0", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_source_name, + { "Source Name", "eventlog.eventlog_Record.source_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_record_number, + { "Record Number", "eventlog.eventlog_Record.record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_event_category, + { "Event Category", "eventlog.eventlog_Record.event_category", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_raw_data, + { "Raw Data", "eventlog.eventlog_Record.raw_data", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenBackupEventLogW_logname, + { "Logname", "eventlog.eventlog_OpenBackupEventLogW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_sid_length, + { "Sid Length", "eventlog.eventlog_Record.sid_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_time_generated, + { "Time Generated", "eventlog.eventlog_Record.time_generated", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlogReadFlags_EVENTLOG_BACKWARDS_READ, + { "Eventlog Backwards Read", "eventlog.eventlogReadFlags.EVENTLOG_BACKWARDS_READ", FT_BOOLEAN, 32, TFS(&eventlogReadFlags_EVENTLOG_BACKWARDS_READ_tfs), ( 0x0008 ), NULL, HFILL }}, + { &hf_eventlog_eventlog_ClearEventLogW_handle, + { "Handle", "eventlog.eventlog_ClearEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_BackupEventLogW_handle, + { "Handle", "eventlog.eventlog_BackupEventLogW.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlogEventTypes_EVENTLOG_WARNING_TYPE, + { "Eventlog Warning Type", "eventlog.eventlogEventTypes.EVENTLOG_WARNING_TYPE", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_WARNING_TYPE_tfs), ( 0x0002 ), NULL, HFILL }}, + { &hf_eventlog_eventlog_ReportEventW_time, + { "Time", "eventlog.eventlog_ReportEventW.time", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_Record_length, + { "Record Length", "eventlog.Record.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_closing_record_number, + { "Closing Record Number", "eventlog.eventlog_Record.closing_record_number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenBackupEventLogW_unknown2, + { "Unknown2", "eventlog.eventlog_OpenBackupEventLogW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_event_type, + { "Event Type", "eventlog.eventlog_Record.event_type", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_RegisterEventSourceW_unknown2, + { "Unknown2", "eventlog.eventlog_RegisterEventSourceW.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReadEventLogW_flags, { "Flags", "eventlog.eventlog_ReadEventLogW.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_eventlog_eventlogEventTypes_EVENTLOG_SUCCESS, - { "Eventlog Success", "eventlog.eventlogEventTypes.EVENTLOG_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_SUCCESS_tfs), ( 0x0000 ), NULL, HFILL }}, + { &hf_eventlog_eventlog_RegisterEventSourceW_logname, + { "Logname", "eventlog.eventlog_RegisterEventSourceW.logname", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_OpenEventLogW_MajorVersion, + { "Majorversion", "eventlog.eventlog_OpenEventLogW.MajorVersion", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetNumRecords_number, + { "Number", "eventlog.eventlog_GetNumRecords.number", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ChangeUnknown0_unknown1, + { "Unknown1", "eventlog.eventlog_ChangeUnknown0.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_Record_string, + { "string", "eventlog.Record.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS, + { "Eventlog Audit Success", "eventlog.eventlogEventTypes.EVENTLOG_AUDIT_SUCCESS", FT_BOOLEAN, 32, TFS(&eventlogEventTypes_EVENTLOG_AUDIT_SUCCESS_tfs), ( 0x0008 ), NULL, HFILL }}, + { &hf_eventlog_eventlog_ReadEventLogW_sent_size, + { "Sent Size", "eventlog.eventlog_ReadEventLogW.sent_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_Record_stringoffset, + { "Stringoffset", "eventlog.eventlog_Record.stringoffset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetLogIntormation_cbBytesNeeded, + { "Cbbytesneeded", "eventlog.eventlog_GetLogIntormation.cbBytesNeeded", FT_INT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetOldestRecord_oldest, + { "Oldest", "eventlog.eventlog_GetOldestRecord.oldest", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_CloseEventLog_handle, + { "Handle", "eventlog.eventlog_CloseEventLog.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_GetLogIntormation_dwInfoLevel, + { "Dwinfolevel", "eventlog.eventlog_GetLogIntormation.dwInfoLevel", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_eventlog_eventlog_ReadEventLogW_data, + { "Data", "eventlog.eventlog_ReadEventLogW.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, }; diff --git a/epan/dissectors/packet-dcerpc-eventlog.h b/epan/dissectors/packet-dcerpc-eventlog.h index d872844b90..953aac95b3 100644 --- a/epan/dissectors/packet-dcerpc-eventlog.h +++ b/epan/dissectors/packet-dcerpc-eventlog.h @@ -1,16 +1,13 @@ -/* autogenerated by pidl */ - /* DO NOT EDIT - This filter was automatically generated + This file was automatically generated by Pidl from eventlog.idl and eventlog.cnf. - Pidl is a perl based IDL compiler for DCE/RPC idl files. + Pidl is a perl based IDL compiler for DCE/RPC idl files. It is maintained by the Samba team, not the Wireshark team. - Instructions on how to download and install Pidl can be + Instructions on how to download and install Pidl can be found at http://wiki.wireshark.org/Pidl */ - #ifndef __PACKET_DCERPC_EVENTLOG_H #define __PACKET_DCERPC_EVENTLOG_H diff --git a/epan/dissectors/pidl/README b/epan/dissectors/pidl/README index 5f802b4720..c7d82a63a0 100644 --- a/epan/dissectors/pidl/README +++ b/epan/dissectors/pidl/README @@ -99,11 +99,6 @@ Not compiling idl As of November 23, 2013, the following idl have issues when generating and compiling: -pidl generates declarations of functions that take a dcerpc_info * -argument and definitions of those functions that don't: - - eventlog.idl - pidl generates declarations and definitions of functions that take a dcerpc_info * argument, but calls to those functions that don't: diff --git a/epan/dissectors/pidl/eventlog.cnf b/epan/dissectors/pidl/eventlog.cnf index cc8491795f..fde79f8a6d 100644 --- a/epan/dissectors/pidl/eventlog.cnf +++ b/epan/dissectors/pidl/eventlog.cnf @@ -34,7 +34,7 @@ PARAM_VALUE eventlog_dissect_element_CloseEventLog_handle_ PIDL_POLHND_CLO CODE START /* Add this one manually until we can compile LSA */ static int -eventlog_dissect_struct_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep, int hf_index,int notused _U_) +eventlog_dissect_struct_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,int notused _U_) { if(di->conformant_run){ /*just a run to handle conformant arrays, nothing to dissect */ @@ -48,7 +48,7 @@ eventlog_dissect_struct_lsa_String(tvbuff_t *tvb, int offset, packet_info *pinfo static int -eventlog_dissect_element_ReadEventLogW_data_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +eventlog_dissect_element_ReadEventLogW_data_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) { guint32 len; tvbuff_t *record_tvb; @@ -78,7 +78,7 @@ eventlog_dissect_element_ReadEventLogW_data_(tvbuff_t *tvb, int offset, packet_i and we want to dissect the sid from the data blob */ static guint32 sid_length; static int -eventlog_dissect_element_Record_sid_length(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +eventlog_dissect_element_Record_sid_length(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) { sid_length=0; offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_sid_length,&sid_length); @@ -86,7 +86,7 @@ eventlog_dissect_element_Record_sid_length(tvbuff_t *tvb, int offset, packet_inf return offset; } static int -eventlog_dissect_element_Record_sid_offset(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +eventlog_dissect_element_Record_sid_offset(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) { guint32 sid_offset=0; offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_sid_offset,&sid_offset); @@ -94,7 +94,7 @@ eventlog_dissect_element_Record_sid_offset(tvbuff_t *tvb, int offset, packet_inf if(sid_offset && sid_length){ tvbuff_t *sid_tvb; - /* this blob contains an NT SID. + /* this blob contains an NT SID. * tvb starts at the beginning of the record. */ sid_tvb=tvb_new_subset(tvb, sid_offset, MIN((gint)sid_length, tvb_length_remaining(tvb, offset)), sid_length); @@ -105,7 +105,7 @@ eventlog_dissect_element_Record_sid_offset(tvbuff_t *tvb, int offset, packet_inf } static int -eventlog_dissect_element_Record_source_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, guint8 *drep _U_) +eventlog_dissect_element_Record_source_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, guint8 *drep _U_) { guint len; @@ -117,7 +117,7 @@ eventlog_dissect_element_Record_source_name(tvbuff_t *tvb, int offset, packet_in } static int -eventlog_dissect_element_Record_computer_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, guint8 *drep _U_) +eventlog_dissect_element_Record_computer_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, guint8 *drep _U_) { guint len; @@ -131,7 +131,7 @@ eventlog_dissect_element_Record_computer_name(tvbuff_t *tvb, int offset, packet_ static guint16 num_of_strings; static int -eventlog_dissect_element_Record_num_of_strings(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +eventlog_dissect_element_Record_num_of_strings(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) { num_of_strings=0; offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_num_of_strings,&num_of_strings); @@ -142,7 +142,7 @@ eventlog_dissect_element_Record_num_of_strings(tvbuff_t *tvb, int offset, packet static guint32 string_offset; static int -eventlog_dissect_element_Record_stringoffset(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +eventlog_dissect_element_Record_stringoffset(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) { string_offset=0; offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_eventlog_eventlog_Record_stringoffset,&string_offset); @@ -151,7 +151,7 @@ eventlog_dissect_element_Record_stringoffset(tvbuff_t *tvb, int offset, packet_i } static int -eventlog_dissect_element_Record_strings(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, guint8 *drep _U_) +eventlog_dissect_element_Record_strings(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info *di _U_, guint8 *drep _U_) { while(string_offset && num_of_strings){ guint len; @@ -159,7 +159,7 @@ eventlog_dissect_element_Record_strings(tvbuff_t *tvb, int offset, packet_info * len=tvb_unicode_strsize(tvb, string_offset); proto_tree_add_item(tree, hf_eventlog_Record_string, tvb, string_offset, len, ENC_UTF_16|ENC_LITTLE_ENDIAN); string_offset+=len; - + num_of_strings--; } diff --git a/epan/dissectors/pidl/eventlog.idl b/epan/dissectors/pidl/eventlog.idl index 61679e84c5..cef3c3885e 100644 --- a/epan/dissectors/pidl/eventlog.idl +++ b/epan/dissectors/pidl/eventlog.idl @@ -31,8 +31,8 @@ uint16 unknown0; uint16 unknown1; } eventlog_OpenUnknown0; - - typedef [public] struct { + + typedef [public] struct { uint32 size; uint32 reserved; uint32 record_number; @@ -68,7 +68,7 @@ [in] policy_handle *handle, [in,unique] lsa_String *backupfilename ); - + /******************/ /* Function: 0x02 */ NTSTATUS eventlog_CloseEventLog( @@ -169,7 +169,7 @@ /*****************/ /* Function 0x0c */ NTSTATUS eventlog_ClearEventLogA(); - + /******************/ /* Function: 0x0d */ NTSTATUS eventlog_BackupEventLogA(); @@ -220,5 +220,5 @@ /* Function 0x17 */ NTSTATUS eventlog_FlushEventLog( [in] policy_handle *handle - ); + ); } |