diff options
| author | Guy Harris <guy@alum.mit.edu> | 2014-11-03 15:03:01 -0800 |
|---|---|---|
| committer | Guy Harris <guy@alum.mit.edu> | 2014-11-03 23:03:45 +0000 |
| commit | 61676733b451bc8b3a83dee47df71c5ffe3f19dd (patch) | |
| tree | 0ea9e2281e1dff5305871ae0d5993e97792f8949 /epan/dissectors/packet-dcerpc-lsa.c | |
| parent | 1119eb692bc53b06c3e3fec0d6a05a0f4108c73b (diff) | |
Regenerate DCE RPC dissectors with the current pidl.
Change-Id: I3cfb9399a9e5ed783083fa5b26a39646fb53875f
Reviewed-on: https://code.wireshark.org/review/5101
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Diffstat (limited to 'epan/dissectors/packet-dcerpc-lsa.c')
| -rw-r--r-- | epan/dissectors/packet-dcerpc-lsa.c | 2756 |
1 files changed, 1437 insertions, 1319 deletions
diff --git a/epan/dissectors/packet-dcerpc-lsa.c b/epan/dissectors/packet-dcerpc-lsa.c index d4a6faa4b4..56833a151f 100644 --- a/epan/dissectors/packet-dcerpc-lsa.c +++ b/epan/dissectors/packet-dcerpc-lsa.c @@ -96,427 +96,427 @@ static gint ett_lsarpc_lsa_ForestTrustInformation = -1; /* Header field declarations */ -static gint hf_lsarpc_lsa_AsciiStringLarge_size = -1; -static gint hf_lsarpc_lsa_LookupPrivName_luid = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count = -1; -static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS = -1; -static gint hf_lsarpc_lsa_Delete_handle = -1; -static gint hf_lsarpc_lsa_PolicyInformation_account_domain = -1; -static gint hf_lsarpc_lsa_DomainInfoKerberos_clock_skew = -1; -static gint hf_lsarpc_lsa_ForestTrustData_domain_info = -1; +static gint hf_lsarpc_String_name = -1; +static gint hf_lsarpc_account_access_mask = -1; +static gint hf_lsarpc_domain_access_mask = -1; +static gint hf_lsarpc_efs_blob_len = -1; +static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES = -1; +static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS = -1; +static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS = -1; +static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW = -1; +static gint hf_lsarpc_lsa_AddAccountRights_handle = -1; +static gint hf_lsarpc_lsa_AddAccountRights_rights = -1; +static gint hf_lsarpc_lsa_AddAccountRights_sid = -1; static gint hf_lsarpc_lsa_AddPrivilegesToAccount_handle = -1; -static gint hf_lsarpc_lsa_ObjectAttribute_sec_qos = -1; -static gint hf_lsarpc_lsa_LookupNames3_handle = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomain_sid = -1; -static gint hf_lsarpc_lsa_EnumAccounts_handle = -1; -static gint hf_lsarpc_lsa_CreateAccount_sid = -1; -static gint hf_lsarpc_lsa_ReplicaSourceInfo_account = -1; -static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_handle = -1; -static gint hf_lsarpc_lsa_CreateTrustedDomain_info = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS = -1; -static gint hf_lsarpc_lsa_PrivilegeSet_set = -1; -static gint hf_lsarpc_lsa_QuerySecret_new_val = -1; -static gint hf_lsarpc_lsa_TranslatedSid2_unknown = -1; -static gint hf_lsarpc_lsa_LookupSids2_handle = -1; -static gint hf_lsarpc_lsa_DomainListEx_domains = -1; -static gint hf_lsarpc_lsa_LookupNames3_num_names = -1; -static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size = -1; -static gint hf_lsarpc_lsa_LookupPrivName_handle = -1; -static gint hf_lsarpc_lsa_OpenAccount_handle = -1; -static gint hf_lsarpc_lsa_OpenSecret_access_mask = -1; -static gint hf_lsarpc_lsa_QuerySecurity_sdbuf = -1; -static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain = -1; -static gint hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle = -1; -static gint hf_lsarpc_lsa_EnumPrivs_handle = -1; -static gint hf_lsarpc_lsa_LUID_high = -1; -static gint hf_lsarpc_lsa_QueryInfoPolicy_handle = -1; -static gint hf_lsarpc_lsa_PolicyInformation_audit_events = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_auth_info = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE = -1; -static gint hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime = -1; -static gint hf_lsarpc_lsa_CreateSecret_access_mask = -1; -static gint hf_lsarpc_lsa_GetUserName_authority_name = -1; +static gint hf_lsarpc_lsa_AddPrivilegesToAccount_privs = -1; +static gint hf_lsarpc_lsa_AsciiStringLarge_length = -1; +static gint hf_lsarpc_lsa_AsciiStringLarge_size = -1; +static gint hf_lsarpc_lsa_AsciiStringLarge_string = -1; +static gint hf_lsarpc_lsa_AsciiString_length = -1; +static gint hf_lsarpc_lsa_AsciiString_size = -1; +static gint hf_lsarpc_lsa_AsciiString_string = -1; +static gint hf_lsarpc_lsa_AuditEventsInfo_auditing_mode = -1; +static gint hf_lsarpc_lsa_AuditEventsInfo_count = -1; +static gint hf_lsarpc_lsa_AuditEventsInfo_settings = -1; +static gint hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full = -1; +static gint hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full = -1; +static gint hf_lsarpc_lsa_AuditFullQueryInfo_unknown = -1; static gint hf_lsarpc_lsa_AuditFullSetInfo_shutdown_on_full = -1; -static gint hf_lsarpc_lsa_RemoveAccountRights_unknown = -1; -static gint hf_lsarpc_lsa_LookupNames4_unknown1 = -1; -static gint hf_lsarpc_secret_access_mask = -1; -static gint hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid = -1; -static gint hf_lsarpc_lsa_LookupNames4_names = -1; -static gint hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data = -1; -static gint hf_lsarpc_lsa_PolicyInformation_role = -1; -static gint hf_lsarpc_lsa_PolicyInformation_audit_log = -1; -static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME = -1; -static gint hf_lsarpc_lsa_PolicyInformation_dns = -1; -static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_trusted_domain_name = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain = -1; -static gint hf_lsarpc_lsa_OpenPolicy2_handle = -1; -static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_handle = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count = -1; -static gint hf_lsarpc_lsa_RemoveAccountRights_rights = -1; -static gint hf_lsarpc_lsa_SetSecret_sec_handle = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask = -1; -static gint hf_lsarpc_lsa_RightAttribute_name = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoPassword_old_password = -1; -static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime = -1; -static gint hf_lsarpc_lsa_LUID_low = -1; -static gint hf_lsarpc_lsa_LookupNames3_names = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid = -1; -static gint hf_lsarpc_lsa_TrustDomainInfo11_info_ex = -1; -static gint hf_lsarpc_lsa_LookupSids_names = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomain_access_mask = -1; -static gint hf_lsarpc_lsa_RefDomainList_max_size = -1; -static gint hf_lsarpc_lsa_TransSidArray_sids = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes = -1; -static gint hf_lsarpc_lsa_CreateSecret_sec_handle = -1; -static gint hf_lsarpc_lsa_SetSecret_old_val = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time = -1; -static gint hf_lsarpc_lsa_DnsDomainInfo_dns_forest = -1; -static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_info = -1; -static gint hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction = -1; -static gint hf_lsarpc_lsa_LookupNames3_sids = -1; -static gint hf_lsarpc_lsa_AuditLogInfo_unknown = -1; +static gint hf_lsarpc_lsa_AuditLogInfo_log_size = -1; +static gint hf_lsarpc_lsa_AuditLogInfo_next_audit_record = -1; +static gint hf_lsarpc_lsa_AuditLogInfo_percent_full = -1; static gint hf_lsarpc_lsa_AuditLogInfo_retention_time = -1; -static gint hf_lsarpc_lsa_ObjectAttribute_sec_desc = -1; -static gint hf_lsarpc_lsa_DnsDomainInfo_name = -1; -static gint hf_lsarpc_efs_blob_len = -1; -static gint hf_lsarpc_lsa_TranslatedSid2_sid_index = -1; -static gint hf_lsarpc_lsa_QuerySecret_old_mtime = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomain_handle = -1; -static gint hf_lsarpc_lsa_TransNameArray_names = -1; -static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS = -1; -static gint hf_lsarpc_lsa_RefDomainList_count = -1; -static gint hf_lsarpc_lsa_QueryInfoPolicy2_info = -1; -static gint hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info = -1; -static gint hf_lsarpc_lsa_QueryInfoPolicy_info = -1; -static gint hf_lsarpc_lsa_CreateAccount_acct_handle = -1; static gint hf_lsarpc_lsa_AuditLogInfo_shutdown_in_progress = -1; -static gint hf_lsarpc_lsa_OpenSecret_handle = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoName_netbios_name = -1; -static gint hf_lsarpc_lsa_LookupNames_handle = -1; -static gint hf_lsarpc_lsa_EnumTrustDom_max_size = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoPassword_password = -1; -static gint hf_lsarpc_lsa_ObjectAttribute_object_name = -1; +static gint hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown = -1; +static gint hf_lsarpc_lsa_AuditLogInfo_unknown = -1; +static gint hf_lsarpc_lsa_CloseTrustedDomainEx_handle = -1; +static gint hf_lsarpc_lsa_Close_handle = -1; +static gint hf_lsarpc_lsa_CreateAccount_access_mask = -1; +static gint hf_lsarpc_lsa_CreateAccount_acct_handle = -1; +static gint hf_lsarpc_lsa_CreateAccount_handle = -1; +static gint hf_lsarpc_lsa_CreateAccount_sid = -1; +static gint hf_lsarpc_lsa_CreateSecret_access_mask = -1; +static gint hf_lsarpc_lsa_CreateSecret_handle = -1; +static gint hf_lsarpc_lsa_CreateSecret_name = -1; +static gint hf_lsarpc_lsa_CreateSecret_sec_handle = -1; +static gint hf_lsarpc_lsa_CreateTrustedDomain_access_mask = -1; static gint hf_lsarpc_lsa_CreateTrustedDomain_handle = -1; -static gint hf_lsarpc_lsa_EnumTrustDom_resume_handle = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_info11 = -1; -static gint hf_lsarpc_lsa_QosInfo_impersonation_level = -1; -static gint hf_lsarpc_lsa_QueryInfoPolicy2_level = -1; -static gint hf_lsarpc_lsa_TranslatedSid3_sid = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN = -1; -static gint hf_lsarpc_lsa_ForestTrustInformation_entries = -1; -static gint hf_lsarpc_lsa_ForestTrustData_top_level_name_ex = -1; +static gint hf_lsarpc_lsa_CreateTrustedDomain_info = -1; +static gint hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle = -1; +static gint hf_lsarpc_lsa_DATA_BUF2_data = -1; +static gint hf_lsarpc_lsa_DATA_BUF2_size = -1; +static gint hf_lsarpc_lsa_DATA_BUF_PTR_buf = -1; +static gint hf_lsarpc_lsa_DATA_BUF_data = -1; +static gint hf_lsarpc_lsa_DATA_BUF_length = -1; +static gint hf_lsarpc_lsa_DATA_BUF_size = -1; +static gint hf_lsarpc_lsa_DefaultQuotaInfo_max_wss = -1; +static gint hf_lsarpc_lsa_DefaultQuotaInfo_min_wss = -1; static gint hf_lsarpc_lsa_DefaultQuotaInfo_non_paged_pool = -1; -static gint hf_lsarpc_lsa_ForestTrustBinaryData_length = -1; +static gint hf_lsarpc_lsa_DefaultQuotaInfo_paged_pool = -1; +static gint hf_lsarpc_lsa_DefaultQuotaInfo_pagefile = -1; static gint hf_lsarpc_lsa_DefaultQuotaInfo_unknown = -1; -static gint hf_lsarpc_lsa_QosInfo_len = -1; -static gint hf_lsarpc_lsa_AuditFullQueryInfo_unknown = -1; -static gint hf_lsarpc_lsa_LookupNames3_level = -1; -static gint hf_lsarpc_lsa_LookupPrivDisplayName_disp_name = -1; -static gint hf_lsarpc_lsa_LookupNames_level = -1; -static gint hf_lsarpc_lsa_LookupNames4_count = -1; -static gint hf_lsarpc_lsa_LookupNames_names = -1; -static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES = -1; -static gint hf_lsarpc_lsa_TrustDomainInfo11_data1 = -1; -static gint hf_lsarpc_lsa_PrivEntry_luid = -1; -static gint hf_lsarpc_lsa_EnumAccounts_resume_handle = -1; -static gint hf_lsarpc_lsa_LookupSids3_level = -1; -static gint hf_lsarpc_lsa_DATA_BUF_data = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomainByName_name = -1; -static gint hf_lsarpc_lsa_DomainListEx_count = -1; +static gint hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid = -1; +static gint hf_lsarpc_lsa_DeleteTrustedDomain_handle = -1; +static gint hf_lsarpc_lsa_Delete_handle = -1; +static gint hf_lsarpc_lsa_DnsDomainInfo_dns_domain = -1; +static gint hf_lsarpc_lsa_DnsDomainInfo_dns_forest = -1; +static gint hf_lsarpc_lsa_DnsDomainInfo_domain_guid = -1; +static gint hf_lsarpc_lsa_DnsDomainInfo_name = -1; +static gint hf_lsarpc_lsa_DnsDomainInfo_sid = -1; static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH = -1; -static gint hf_lsarpc_lsa_DefaultQuotaInfo_pagefile = -1; -static gint hf_lsarpc_lsa_DefaultQuotaInfo_min_wss = -1; -static gint hf_lsarpc_lsa_ForestTrustData_top_level_name = -1; -static gint hf_lsarpc_lsa_TranslatedName2_sid_type = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex = -1; -static gint hf_lsarpc_lsa_DATA_BUF2_data = -1; -static gint hf_lsarpc_lsa_RemoveAccountRights_handle = -1; -static gint hf_lsarpc_lsa_LookupNames3_count = -1; -static gint hf_lsarpc_lsa_LookupNames2_unknown2 = -1; -static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle = -1; -static gint hf_lsarpc_lsa_TransNameArray2_count = -1; -static gint hf_lsarpc_lsa_DomainInfo_sid = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info = -1; -static gint hf_lsarpc_lsa_LookupNames3_domains = -1; -static gint hf_lsarpc_lsa_SetSecret_new_val = -1; -static gint hf_lsarpc_lsa_String_string = -1; -static gint hf_lsarpc_lsa_PrivArray_count = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_level = -1; -static gint hf_lsarpc_lsa_DATA_BUF_size = -1; -static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_level = -1; +static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS = -1; +static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME = -1; +static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX = -1; static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH = -1; -static gint hf_lsarpc_lsa_StringLarge_string = -1; -static gint hf_lsarpc_lsa_DomainInfo_name = -1; -static gint hf_lsarpc_lsa_AsciiString_size = -1; -static gint hf_lsarpc_lsa_LookupNames2_sids = -1; +static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS = -1; static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX = -1; -static gint hf_lsarpc_lsa_SetDomainInformationPolicy_level = -1; -static gint hf_lsarpc_account_access_mask = -1; -static gint hf_lsarpc_lsa_SetInfoPolicy2_info = -1; -static gint hf_lsarpc_lsa_AsciiStringLarge_string = -1; -static gint hf_lsarpc_lsa_LookupSids2_level = -1; -static gint hf_lsarpc_lsa_OpenSecret_sec_handle = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info = -1; -static gint hf_lsarpc_lsa_DomainInformationPolicy_efs_info = -1; -static gint hf_lsarpc_lsa_EnumAccounts_sids = -1; -static gint hf_lsarpc_lsa_ReplicaSourceInfo_source = -1; -static gint hf_lsarpc_lsa_LookupNames3_unknown1 = -1; -static gint hf_lsarpc_lsa_QuerySecurity_sec_info = -1; +static gint hf_lsarpc_lsa_DomainInfoEfs_blob_size = -1; +static gint hf_lsarpc_lsa_DomainInfoEfs_efs_blob = -1; +static gint hf_lsarpc_lsa_DomainInfoKerberos_clock_skew = -1; static gint hf_lsarpc_lsa_DomainInfoKerberos_enforce_restrictions = -1; -static gint hf_lsarpc_lsa_LookupSids2_domains = -1; -static gint hf_lsarpc_policy_access_mask = -1; -static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_domains = -1; -static gint hf_lsarpc_lsa_EnumAccounts_num_entries = -1; -static gint hf_lsarpc_domain_access_mask = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_info_all = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_type = -1; -static gint hf_lsarpc_lsa_DnsDomainInfo_sid = -1; -static gint hf_lsarpc_lsa_LookupNames_num_names = -1; -static gint hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid = -1; -static gint hf_lsarpc_lsa_LookupSids_handle = -1; -static gint hf_lsarpc_lsa_AsciiString_string = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_info_ex = -1; -static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle = -1; -static gint hf_lsarpc_lsa_CreateAccount_handle = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_name = -1; -static gint hf_lsarpc_lsa_LookupNames4_unknown2 = -1; +static gint hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime = -1; +static gint hf_lsarpc_lsa_DomainInfoKerberos_unknown6 = -1; +static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime = -1; +static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime = -1; +static gint hf_lsarpc_lsa_DomainInfo_name = -1; +static gint hf_lsarpc_lsa_DomainInfo_sid = -1; +static gint hf_lsarpc_lsa_DomainInformationPolicy_efs_info = -1; +static gint hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info = -1; +static gint hf_lsarpc_lsa_DomainListEx_count = -1; +static gint hf_lsarpc_lsa_DomainListEx_domains = -1; +static gint hf_lsarpc_lsa_DomainList_count = -1; +static gint hf_lsarpc_lsa_DomainList_domains = -1; +static gint hf_lsarpc_lsa_EnumAccountRights_handle = -1; static gint hf_lsarpc_lsa_EnumAccountRights_rights = -1; -static gint hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX = -1; -static gint hf_lsarpc_lsa_LookupPrivDisplayName_name = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION = -1; -static gint hf_lsarpc_lsa_OpenPolicy2_access_mask = -1; -static gint hf_lsarpc_lsa_SetInfoPolicy2_handle = -1; -static gint hf_lsarpc_sec_desc_buf_len = -1; -static gint hf_lsarpc_lsa_LookupNames2_num_names = -1; -static gint hf_lsarpc_lsa_SetInfoPolicy2_level = -1; +static gint hf_lsarpc_lsa_EnumAccountRights_sid = -1; +static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_handle = -1; +static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_name = -1; +static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_sids = -1; +static gint hf_lsarpc_lsa_EnumAccounts_handle = -1; +static gint hf_lsarpc_lsa_EnumAccounts_num_entries = -1; +static gint hf_lsarpc_lsa_EnumAccounts_resume_handle = -1; +static gint hf_lsarpc_lsa_EnumAccounts_sids = -1; +static gint hf_lsarpc_lsa_EnumPrivsAccount_handle = -1; static gint hf_lsarpc_lsa_EnumPrivsAccount_privs = -1; -static gint hf_lsarpc_lsa_OpenAccount_access_mask = -1; +static gint hf_lsarpc_lsa_EnumPrivs_handle = -1; +static gint hf_lsarpc_lsa_EnumPrivs_max_count = -1; static gint hf_lsarpc_lsa_EnumPrivs_privs = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN = -1; -static gint hf_lsarpc_lsa_AuditLogInfo_percent_full = -1; -static gint hf_lsarpc_lsa_PolicyInformation_quota = -1; -static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs = -1; -static gint hf_lsarpc_lsa_TranslatedSid3_unknown = -1; -static gint hf_lsarpc_lsa_TranslatedName_sid_type = -1; -static gint hf_lsarpc_lsa_LookupSids2_names = -1; -static gint hf_lsarpc_lsa_EnumPrivsAccount_handle = -1; -static gint hf_lsarpc_lsa_SidArray_sids = -1; -static gint hf_lsarpc_lsa_RemoveAccountRights_sid = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_info = -1; -static gint hf_lsarpc_lsa_String_length = -1; -static gint hf_lsarpc_opnum = -1; -static gint hf_lsarpc_lsa_PrivilegeSet_count = -1; -static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_level = -1; -static gint hf_lsarpc_lsa_LookupPrivDisplayName_language_id = -1; -static gint hf_lsarpc_lsa_TransSidArray3_sids = -1; -static gint hf_lsarpc_status = -1; -static gint hf_lsarpc_lsa_LookupNames_count = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_previous_auth_info = -1; -static gint hf_lsarpc_lsa_LookupPrivValue_name = -1; -static gint hf_lsarpc_lsa_ForestTrustBinaryData_data = -1; -static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS = -1; -static gint hf_lsarpc_lsa_TranslatedSid_sid_index = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT = -1; -static gint hf_lsarpc_lsa_AsciiStringLarge_length = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle = -1; -static gint hf_lsarpc_lsa_TransNameArray2_names = -1; +static gint hf_lsarpc_lsa_EnumPrivs_resume_handle = -1; +static gint hf_lsarpc_lsa_EnumTrustDom_domains = -1; static gint hf_lsarpc_lsa_EnumTrustDom_handle = -1; -static gint hf_lsarpc_lsa_CreateAccount_access_mask = -1; -static gint hf_lsarpc_lsa_OpenPolicy2_attr = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name = -1; +static gint hf_lsarpc_lsa_EnumTrustDom_max_size = -1; +static gint hf_lsarpc_lsa_EnumTrustDom_resume_handle = -1; +static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_domains = -1; +static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_handle = -1; +static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size = -1; +static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle = -1; +static gint hf_lsarpc_lsa_ForestTrustBinaryData_data = -1; +static gint hf_lsarpc_lsa_ForestTrustBinaryData_length = -1; +static gint hf_lsarpc_lsa_ForestTrustData_data = -1; +static gint hf_lsarpc_lsa_ForestTrustData_domain_info = -1; +static gint hf_lsarpc_lsa_ForestTrustData_top_level_name = -1; +static gint hf_lsarpc_lsa_ForestTrustData_top_level_name_ex = -1; +static gint hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name = -1; +static gint hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid = -1; +static gint hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name = -1; +static gint hf_lsarpc_lsa_ForestTrustInformation_count = -1; +static gint hf_lsarpc_lsa_ForestTrustInformation_entries = -1; static gint hf_lsarpc_lsa_ForestTrustRecord_flags = -1; -static gint hf_lsarpc_lsa_OpenPolicy_system_name = -1; -static gint hf_lsarpc_lsa_LookupSids2_sids = -1; -static gint hf_lsarpc_lsa_TranslatedName_sid_index = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_password = -1; -static gint hf_lsarpc_lsa_ModificationInfo_db_create_time = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION = -1; -static gint hf_lsarpc_lsa_PolicyInformation_domain = -1; -static gint hf_lsarpc_lsa_DATA_BUF2_size = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS = -1; +static gint hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data = -1; +static gint hf_lsarpc_lsa_ForestTrustRecord_level = -1; +static gint hf_lsarpc_lsa_ForestTrustRecord_unknown = -1; +static gint hf_lsarpc_lsa_GetUserName_account_name = -1; +static gint hf_lsarpc_lsa_GetUserName_authority_name = -1; +static gint hf_lsarpc_lsa_GetUserName_system_name = -1; +static gint hf_lsarpc_lsa_LUIDAttribute_attribute = -1; +static gint hf_lsarpc_lsa_LUIDAttribute_luid = -1; +static gint hf_lsarpc_lsa_LUID_high = -1; +static gint hf_lsarpc_lsa_LUID_low = -1; +static gint hf_lsarpc_lsa_LookupNames2_count = -1; +static gint hf_lsarpc_lsa_LookupNames2_domains = -1; +static gint hf_lsarpc_lsa_LookupNames2_handle = -1; +static gint hf_lsarpc_lsa_LookupNames2_level = -1; +static gint hf_lsarpc_lsa_LookupNames2_names = -1; +static gint hf_lsarpc_lsa_LookupNames2_num_names = -1; +static gint hf_lsarpc_lsa_LookupNames2_sids = -1; static gint hf_lsarpc_lsa_LookupNames2_unknown1 = -1; +static gint hf_lsarpc_lsa_LookupNames2_unknown2 = -1; +static gint hf_lsarpc_lsa_LookupNames3_count = -1; +static gint hf_lsarpc_lsa_LookupNames3_domains = -1; +static gint hf_lsarpc_lsa_LookupNames3_handle = -1; +static gint hf_lsarpc_lsa_LookupNames3_level = -1; +static gint hf_lsarpc_lsa_LookupNames3_names = -1; +static gint hf_lsarpc_lsa_LookupNames3_num_names = -1; +static gint hf_lsarpc_lsa_LookupNames3_sids = -1; +static gint hf_lsarpc_lsa_LookupNames3_unknown1 = -1; +static gint hf_lsarpc_lsa_LookupNames3_unknown2 = -1; +static gint hf_lsarpc_lsa_LookupNames4_count = -1; static gint hf_lsarpc_lsa_LookupNames4_domains = -1; -static gint hf_lsarpc_lsa_LookupSids3_unknown2 = -1; -static gint hf_lsarpc_lsa_TranslatedSid_sid_type = -1; -static gint hf_lsarpc_lsa_LookupNames2_count = -1; -static gint hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name = -1; -static gint hf_lsarpc_lsa_AuditLogInfo_next_audit_record = -1; -static gint hf_lsarpc_lsa_PrivArray_privs = -1; -static gint hf_lsarpc_lsa_TransSidArray2_sids = -1; -static gint hf_lsarpc_lsa_TransSidArray3_count = -1; -static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle = -1; -static gint hf_lsarpc_lsa_DomainList_count = -1; -static gint hf_lsarpc_lsa_QuerySecret_sec_handle = -1; -static gint hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full = -1; -static gint hf_lsarpc_lsa_GetUserName_system_name = -1; -static gint hf_lsarpc_lsa_SidArray_num_sids = -1; static gint hf_lsarpc_lsa_LookupNames4_level = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle = -1; -static gint hf_lsarpc_lsa_RightSet_names = -1; +static gint hf_lsarpc_lsa_LookupNames4_names = -1; +static gint hf_lsarpc_lsa_LookupNames4_num_names = -1; +static gint hf_lsarpc_lsa_LookupNames4_sids = -1; +static gint hf_lsarpc_lsa_LookupNames4_unknown1 = -1; +static gint hf_lsarpc_lsa_LookupNames4_unknown2 = -1; +static gint hf_lsarpc_lsa_LookupNames_count = -1; static gint hf_lsarpc_lsa_LookupNames_domains = -1; -static gint hf_lsarpc_lsa_LookupSids2_unknown2 = -1; +static gint hf_lsarpc_lsa_LookupNames_handle = -1; +static gint hf_lsarpc_lsa_LookupNames_level = -1; +static gint hf_lsarpc_lsa_LookupNames_names = -1; +static gint hf_lsarpc_lsa_LookupNames_num_names = -1; static gint hf_lsarpc_lsa_LookupNames_sids = -1; -static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_name = -1; +static gint hf_lsarpc_lsa_LookupPrivDisplayName_disp_name = -1; +static gint hf_lsarpc_lsa_LookupPrivDisplayName_handle = -1; +static gint hf_lsarpc_lsa_LookupPrivDisplayName_language_id = -1; +static gint hf_lsarpc_lsa_LookupPrivDisplayName_name = -1; +static gint hf_lsarpc_lsa_LookupPrivDisplayName_unknown = -1; +static gint hf_lsarpc_lsa_LookupPrivName_handle = -1; +static gint hf_lsarpc_lsa_LookupPrivName_luid = -1; static gint hf_lsarpc_lsa_LookupPrivName_name = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION = -1; -static gint hf_lsarpc_lsa_LookupNames4_sids = -1; -static gint hf_lsarpc_lsa_RefDomainList_domains = -1; -static gint hf_lsarpc_lsa_SetDomainInformationPolicy_info = -1; -static gint hf_lsarpc_lsa_SetDomainInformationPolicy_handle = -1; -static gint hf_lsarpc_lsa_PolicyInformation_replica = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex = -1; -static gint hf_lsarpc_lsa_TransSidArray_count = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info = -1; -static gint hf_lsarpc_lsa_EnumAccountRights_handle = -1; -static gint hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown = -1; -static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name = -1; -static gint hf_lsarpc_lsa_LookupSids3_unknown1 = -1; +static gint hf_lsarpc_lsa_LookupPrivValue_handle = -1; +static gint hf_lsarpc_lsa_LookupPrivValue_luid = -1; +static gint hf_lsarpc_lsa_LookupPrivValue_name = -1; static gint hf_lsarpc_lsa_LookupSids2_count = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_info_basic = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset = -1; -static gint hf_lsarpc_lsa_OpenSecret_name = -1; -static gint hf_lsarpc_lsa_PolicyInformation_db = -1; -static gint hf_lsarpc_String_name = -1; -static gint hf_lsarpc_lsa_GetUserName_account_name = -1; -static gint hf_lsarpc_lsa_LUIDAttribute_attribute = -1; -static gint hf_lsarpc_lsa_DATA_BUF_PTR_buf = -1; -static gint hf_lsarpc_lsa_OpenPolicy_access_mask = -1; -static gint hf_lsarpc_lsa_LookupSids3_sids = -1; -static gint hf_lsarpc_lsa_String_size = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info = -1; -static gint hf_lsarpc_lsa_TrustedDomainInfo_posix_offset = -1; -static gint hf_lsarpc_lsa_DomainInfoKerberos_unknown6 = -1; +static gint hf_lsarpc_lsa_LookupSids2_domains = -1; +static gint hf_lsarpc_lsa_LookupSids2_handle = -1; +static gint hf_lsarpc_lsa_LookupSids2_level = -1; +static gint hf_lsarpc_lsa_LookupSids2_names = -1; +static gint hf_lsarpc_lsa_LookupSids2_sids = -1; static gint hf_lsarpc_lsa_LookupSids2_unknown1 = -1; -static gint hf_lsarpc_lsa_OpenAccount_sid = -1; -static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle = -1; -static gint hf_lsarpc_lsa_DnsDomainInfo_domain_guid = -1; -static gint hf_lsarpc_lsa_LUIDAttribute_luid = -1; -static gint hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime = -1; -static gint hf_lsarpc_lsa_AddAccountRights_rights = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1 = -1; -static gint hf_lsarpc_lsa_PrivilegeSet_unknown = -1; -static gint hf_lsarpc_lsa_ObjectAttribute_root_dir = -1; +static gint hf_lsarpc_lsa_LookupSids2_unknown2 = -1; +static gint hf_lsarpc_lsa_LookupSids3_count = -1; +static gint hf_lsarpc_lsa_LookupSids3_domains = -1; +static gint hf_lsarpc_lsa_LookupSids3_level = -1; static gint hf_lsarpc_lsa_LookupSids3_names = -1; -static gint hf_lsarpc_lsa_CreateSecret_handle = -1; -static gint hf_lsarpc_lsa_StringLarge_length = -1; -static gint hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS = -1; -static gint hf_lsarpc_lsa_LookupNames2_names = -1; +static gint hf_lsarpc_lsa_LookupSids3_sids = -1; +static gint hf_lsarpc_lsa_LookupSids3_unknown1 = -1; +static gint hf_lsarpc_lsa_LookupSids3_unknown2 = -1; +static gint hf_lsarpc_lsa_LookupSids_count = -1; +static gint hf_lsarpc_lsa_LookupSids_domains = -1; +static gint hf_lsarpc_lsa_LookupSids_handle = -1; +static gint hf_lsarpc_lsa_LookupSids_level = -1; +static gint hf_lsarpc_lsa_LookupSids_names = -1; +static gint hf_lsarpc_lsa_LookupSids_sids = -1; +static gint hf_lsarpc_lsa_ModificationInfo_db_create_time = -1; +static gint hf_lsarpc_lsa_ModificationInfo_modified_id = -1; +static gint hf_lsarpc_lsa_ObjectAttribute_attributes = -1; +static gint hf_lsarpc_lsa_ObjectAttribute_len = -1; +static gint hf_lsarpc_lsa_ObjectAttribute_object_name = -1; +static gint hf_lsarpc_lsa_ObjectAttribute_root_dir = -1; +static gint hf_lsarpc_lsa_ObjectAttribute_sec_desc = -1; +static gint hf_lsarpc_lsa_ObjectAttribute_sec_qos = -1; +static gint hf_lsarpc_lsa_OpenAccount_access_mask = -1; static gint hf_lsarpc_lsa_OpenAccount_acct_handle = -1; -static gint hf_lsarpc_lsa_StringPointer_string = -1; +static gint hf_lsarpc_lsa_OpenAccount_handle = -1; +static gint hf_lsarpc_lsa_OpenAccount_sid = -1; +static gint hf_lsarpc_lsa_OpenPolicy2_access_mask = -1; +static gint hf_lsarpc_lsa_OpenPolicy2_attr = -1; +static gint hf_lsarpc_lsa_OpenPolicy2_handle = -1; +static gint hf_lsarpc_lsa_OpenPolicy2_system_name = -1; +static gint hf_lsarpc_lsa_OpenPolicy_access_mask = -1; +static gint hf_lsarpc_lsa_OpenPolicy_attr = -1; +static gint hf_lsarpc_lsa_OpenPolicy_handle = -1; +static gint hf_lsarpc_lsa_OpenPolicy_system_name = -1; +static gint hf_lsarpc_lsa_OpenSecret_access_mask = -1; +static gint hf_lsarpc_lsa_OpenSecret_handle = -1; +static gint hf_lsarpc_lsa_OpenSecret_name = -1; +static gint hf_lsarpc_lsa_OpenSecret_sec_handle = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomainByName_handle = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomainByName_name = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomain_access_mask = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomain_handle = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomain_sid = -1; +static gint hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle = -1; +static gint hf_lsarpc_lsa_PDAccountInfo_name = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION = -1; static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION = -1; +static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION = -1; +static gint hf_lsarpc_lsa_PolicyInformation_account_domain = -1; +static gint hf_lsarpc_lsa_PolicyInformation_audit_events = -1; +static gint hf_lsarpc_lsa_PolicyInformation_audit_log = -1; +static gint hf_lsarpc_lsa_PolicyInformation_auditfullquery = -1; +static gint hf_lsarpc_lsa_PolicyInformation_auditfullset = -1; +static gint hf_lsarpc_lsa_PolicyInformation_db = -1; +static gint hf_lsarpc_lsa_PolicyInformation_dns = -1; +static gint hf_lsarpc_lsa_PolicyInformation_domain = -1; +static gint hf_lsarpc_lsa_PolicyInformation_pd = -1; +static gint hf_lsarpc_lsa_PolicyInformation_quota = -1; +static gint hf_lsarpc_lsa_PolicyInformation_replica = -1; +static gint hf_lsarpc_lsa_PolicyInformation_role = -1; +static gint hf_lsarpc_lsa_PrivArray_count = -1; +static gint hf_lsarpc_lsa_PrivArray_privs = -1; +static gint hf_lsarpc_lsa_PrivEntry_luid = -1; +static gint hf_lsarpc_lsa_PrivEntry_name = -1; +static gint hf_lsarpc_lsa_PrivilegeSet_count = -1; +static gint hf_lsarpc_lsa_PrivilegeSet_set = -1; +static gint hf_lsarpc_lsa_PrivilegeSet_unknown = -1; +static gint hf_lsarpc_lsa_QosInfo_context_mode = -1; +static gint hf_lsarpc_lsa_QosInfo_effective_only = -1; +static gint hf_lsarpc_lsa_QosInfo_impersonation_level = -1; +static gint hf_lsarpc_lsa_QosInfo_len = -1; +static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_handle = -1; +static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_info = -1; +static gint hf_lsarpc_lsa_QueryDomainInformationPolicy_level = -1; +static gint hf_lsarpc_lsa_QueryInfoPolicy2_handle = -1; +static gint hf_lsarpc_lsa_QueryInfoPolicy2_info = -1; +static gint hf_lsarpc_lsa_QueryInfoPolicy2_level = -1; +static gint hf_lsarpc_lsa_QueryInfoPolicy_handle = -1; +static gint hf_lsarpc_lsa_QueryInfoPolicy_info = -1; +static gint hf_lsarpc_lsa_QueryInfoPolicy_level = -1; +static gint hf_lsarpc_lsa_QuerySecret_new_mtime = -1; +static gint hf_lsarpc_lsa_QuerySecret_new_val = -1; +static gint hf_lsarpc_lsa_QuerySecret_old_mtime = -1; static gint hf_lsarpc_lsa_QuerySecret_old_val = -1; -static gint hf_lsarpc_lsa_DeleteTrustedDomain_handle = -1; -static gint hf_lsarpc_lsa_LookupPrivDisplayName_handle = -1; -static gint hf_lsarpc_lsa_LookupNames2_domains = -1; -static gint hf_lsarpc_lsa_EnumPrivs_resume_handle = -1; -static gint hf_lsarpc_lsa_LookupNames2_handle = -1; -static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_info = -1; -static gint hf_lsarpc_lsa_AddPrivilegesToAccount_privs = -1; -static gint hf_lsarpc_lsa_Close_handle = -1; -static gint hf_lsarpc_lsa_TranslatedName2_name = -1; -static gint hf_lsarpc_lsa_AddAccountRights_sid = -1; -static gint hf_lsarpc_lsa_LookupPrivValue_luid = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES = -1; -static gint hf_lsarpc_lsa_TranslatedName2_unknown = -1; -static gint hf_lsarpc_lsa_ForestTrustRecord_unknown = -1; -static gint hf_lsarpc_lsa_CreateTrustedDomain_access_mask = -1; -static gint hf_lsarpc_lsa_DomainList_domains = -1; -static gint hf_lsarpc_lsa_CreateSecret_name = -1; -static gint hf_lsarpc_lsa_AuditEventsInfo_auditing_mode = -1; +static gint hf_lsarpc_lsa_QuerySecret_sec_handle = -1; +static gint hf_lsarpc_lsa_QuerySecurity_handle = -1; +static gint hf_lsarpc_lsa_QuerySecurity_sdbuf = -1; +static gint hf_lsarpc_lsa_QuerySecurity_sec_info = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle = -1; static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_info = -1; -static gint hf_lsarpc_lsa_EnumAccountsWithUserRight_sids = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_info = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_level = -1; +static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle = -1; +static gint hf_lsarpc_lsa_RefDomainList_count = -1; +static gint hf_lsarpc_lsa_RefDomainList_domains = -1; +static gint hf_lsarpc_lsa_RefDomainList_max_size = -1; +static gint hf_lsarpc_lsa_RemoveAccountRights_handle = -1; +static gint hf_lsarpc_lsa_RemoveAccountRights_rights = -1; +static gint hf_lsarpc_lsa_RemoveAccountRights_sid = -1; +static gint hf_lsarpc_lsa_RemoveAccountRights_unknown = -1; +static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle = -1; +static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs = -1; +static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all = -1; +static gint hf_lsarpc_lsa_ReplicaSourceInfo_account = -1; +static gint hf_lsarpc_lsa_ReplicaSourceInfo_source = -1; +static gint hf_lsarpc_lsa_RightAttribute_name = -1; +static gint hf_lsarpc_lsa_RightSet_count = -1; +static gint hf_lsarpc_lsa_RightSet_names = -1; +static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE = -1; +static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE = -1; +static gint hf_lsarpc_lsa_ServerRole_role = -1; +static gint hf_lsarpc_lsa_SetDomainInformationPolicy_handle = -1; +static gint hf_lsarpc_lsa_SetDomainInformationPolicy_info = -1; +static gint hf_lsarpc_lsa_SetDomainInformationPolicy_level = -1; +static gint hf_lsarpc_lsa_SetInfoPolicy2_handle = -1; +static gint hf_lsarpc_lsa_SetInfoPolicy2_info = -1; +static gint hf_lsarpc_lsa_SetInfoPolicy2_level = -1; +static gint hf_lsarpc_lsa_SetInfoPolicy_handle = -1; static gint hf_lsarpc_lsa_SetInfoPolicy_info = -1; +static gint hf_lsarpc_lsa_SetInfoPolicy_level = -1; +static gint hf_lsarpc_lsa_SetSecret_new_val = -1; +static gint hf_lsarpc_lsa_SetSecret_old_val = -1; +static gint hf_lsarpc_lsa_SetSecret_sec_handle = -1; +static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle = -1; +static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_info = -1; +static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_level = -1; +static gint hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain = -1; +static gint hf_lsarpc_lsa_SidArray_num_sids = -1; +static gint hf_lsarpc_lsa_SidArray_sids = -1; static gint hf_lsarpc_lsa_SidPtr_sid = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info = -1; -static gint hf_lsarpc_names = -1; -static gint hf_lsarpc_lsa_PDAccountInfo_name = -1; -static gint hf_lsarpc_lsa_QuerySecurity_handle = -1; -static gint hf_lsarpc_lsa_ForestTrustInformation_count = -1; -static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown = -1; -static gint hf_lsarpc_lsa_LookupSids3_domains = -1; -static gint hf_lsarpc_lsa_Strings_count = -1; -static gint hf_lsarpc_lsa_QueryInfoPolicy2_handle = -1; -static gint hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_data = -1; -static gint hf_lsarpc_lsa_ObjectAttribute_attributes = -1; +static gint hf_lsarpc_lsa_StringLarge_length = -1; static gint hf_lsarpc_lsa_StringLarge_size = -1; -static gint hf_lsarpc_lsa_QosInfo_effective_only = -1; -static gint hf_lsarpc_lsa_ObjectAttribute_len = -1; -static gint hf_lsarpc_lsa_OpenPolicy_attr = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoBasic_sid = -1; -static gint hf_lsarpc_lsa_PrivEntry_name = -1; -static gint hf_lsarpc_lsa_ServerRole_role = -1; -static gint hf_lsarpc_lsa_TranslatedSid3_sid_type = -1; -static gint hf_lsarpc_lsa_LookupNames4_num_names = -1; -static gint hf_lsarpc_lsa_ForestTrustRecord_level = -1; -static gint hf_lsarpc_lsa_EnumPrivs_max_count = -1; -static gint hf_lsarpc_lsa_LookupNames2_level = -1; -static gint hf_lsarpc_lsa_LookupNames3_unknown2 = -1; -static gint hf_lsarpc_lsa_DATA_BUF_length = -1; +static gint hf_lsarpc_lsa_StringLarge_string = -1; +static gint hf_lsarpc_lsa_StringPointer_string = -1; +static gint hf_lsarpc_lsa_String_length = -1; +static gint hf_lsarpc_lsa_String_size = -1; +static gint hf_lsarpc_lsa_String_string = -1; +static gint hf_lsarpc_lsa_Strings_count = -1; static gint hf_lsarpc_lsa_Strings_names = -1; -static gint hf_lsarpc_lsa_LookupPrivDisplayName_unknown = -1; -static gint hf_lsarpc_lsa_PolicyInformation_auditfullset = -1; -static gint hf_lsarpc_lsa_ForestTrustData_data = -1; -static gint hf_lsarpc_lsa_OpenPolicy_handle = -1; -static gint hf_lsarpc_lsa_LookupSids_count = -1; -static gint hf_lsarpc_lsa_DnsDomainInfo_dns_domain = -1; +static gint hf_lsarpc_lsa_TransNameArray2_count = -1; +static gint hf_lsarpc_lsa_TransNameArray2_names = -1; +static gint hf_lsarpc_lsa_TransNameArray_count = -1; +static gint hf_lsarpc_lsa_TransNameArray_names = -1; +static gint hf_lsarpc_lsa_TransSidArray2_count = -1; +static gint hf_lsarpc_lsa_TransSidArray2_sids = -1; +static gint hf_lsarpc_lsa_TransSidArray3_count = -1; +static gint hf_lsarpc_lsa_TransSidArray3_sids = -1; +static gint hf_lsarpc_lsa_TransSidArray_count = -1; +static gint hf_lsarpc_lsa_TransSidArray_sids = -1; +static gint hf_lsarpc_lsa_TranslatedName2_name = -1; +static gint hf_lsarpc_lsa_TranslatedName2_sid_index = -1; +static gint hf_lsarpc_lsa_TranslatedName2_sid_type = -1; +static gint hf_lsarpc_lsa_TranslatedName2_unknown = -1; static gint hf_lsarpc_lsa_TranslatedName_name = -1; -static gint hf_lsarpc_lsa_QueryInfoPolicy_level = -1; -static gint hf_lsarpc_lsa_LookupSids_domains = -1; -static gint hf_lsarpc_lsa_TranslatedSid_rid = -1; -static gint hf_lsarpc_lsa_DomainInfoEfs_efs_blob = -1; -static gint hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all = -1; -static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE = -1; -static gint hf_lsarpc_lsa_AddAccountRights_handle = -1; -static gint hf_lsarpc_lsa_DomainInfoEfs_blob_size = -1; -static gint hf_lsarpc_lsa_OpenPolicy2_system_name = -1; -static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info = -1; -static gint hf_lsarpc_lsa_DefaultQuotaInfo_max_wss = -1; -static gint hf_lsarpc_lsa_DefaultQuotaInfo_paged_pool = -1; -static gint hf_lsarpc_lsa_LookupSids_level = -1; -static gint hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full = -1; -static gint hf_lsarpc_lsa_RightSet_count = -1; -static gint hf_lsarpc_lsa_AuditLogInfo_log_size = -1; -static gint hf_lsarpc_lsa_AuditEventsInfo_settings = -1; +static gint hf_lsarpc_lsa_TranslatedName_sid_index = -1; +static gint hf_lsarpc_lsa_TranslatedName_sid_type = -1; static gint hf_lsarpc_lsa_TranslatedSid2_rid = -1; +static gint hf_lsarpc_lsa_TranslatedSid2_sid_index = -1; static gint hf_lsarpc_lsa_TranslatedSid2_sid_type = -1; -static gint hf_lsarpc_lsa_OpenTrustedDomainByName_handle = -1; -static gint hf_lsarpc_lsa_EnumTrustedDomainsEx_handle = -1; -static gint hf_lsarpc_lsa_AsciiString_length = -1; -static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset = -1; -static gint hf_lsarpc_lsa_EnumAccountRights_sid = -1; -static gint hf_lsarpc_lsa_LookupSids_sids = -1; +static gint hf_lsarpc_lsa_TranslatedSid2_unknown = -1; +static gint hf_lsarpc_lsa_TranslatedSid3_sid = -1; +static gint hf_lsarpc_lsa_TranslatedSid3_sid_index = -1; +static gint hf_lsarpc_lsa_TranslatedSid3_sid_type = -1; +static gint hf_lsarpc_lsa_TranslatedSid3_unknown = -1; +static gint hf_lsarpc_lsa_TranslatedSid_rid = -1; +static gint hf_lsarpc_lsa_TranslatedSid_sid_index = -1; +static gint hf_lsarpc_lsa_TranslatedSid_sid_type = -1; +static gint hf_lsarpc_lsa_TrustDomainInfo11_data1 = -1; +static gint hf_lsarpc_lsa_TrustDomainInfo11_info_ex = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_previous_auth_info = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoBasic_sid = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_data = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset = -1; static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_auth_info = -1; -static gint hf_lsarpc_lsa_CloseTrustedDomainEx_handle = -1; -static gint hf_lsarpc_lsa_QosInfo_context_mode = -1; -static gint hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION = -1; -static gint hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE = -1; -static gint hf_lsarpc_lsa_EnumTrustDom_domains = -1; -static gint hf_lsarpc_lsa_TransNameArray_count = -1; -static gint hf_lsarpc_lsa_PolicyInformation_pd = -1; -static gint hf_lsarpc_lsa_TranslatedName2_sid_index = -1; -static gint hf_lsarpc_lsa_PolicyInformation_auditfullquery = -1; -static gint hf_lsarpc_lsa_ModificationInfo_modified_id = -1; -static gint hf_lsarpc_lsa_QuerySecret_new_mtime = -1; -static gint hf_lsarpc_lsa_LookupPrivValue_handle = -1; -static gint hf_lsarpc_lsa_TransSidArray2_count = -1; -static gint hf_lsarpc_lsa_AuditEventsInfo_count = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1 = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_type = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoName_netbios_name = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoPassword_old_password = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoPassword_password = -1; +static gint hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_auth_info = -1; static gint hf_lsarpc_lsa_TrustedDomainInfo_full_info = -1; -static gint hf_lsarpc_lsa_SetInfoPolicy_level = -1; -static gint hf_lsarpc_lsa_LookupSids3_count = -1; -static gint hf_lsarpc_lsa_TranslatedSid3_sid_index = -1; -static gint hf_lsarpc_lsa_SetInfoPolicy_handle = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_info11 = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_info_all = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_info_basic = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_info_ex = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_name = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_password = -1; +static gint hf_lsarpc_lsa_TrustedDomainInfo_posix_offset = -1; +static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info = -1; +static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle = -1; +static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_trusted_domain_name = -1; +static gint hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown = -1; +static gint hf_lsarpc_names = -1; +static gint hf_lsarpc_opnum = -1; +static gint hf_lsarpc_policy_access_mask = -1; +static gint hf_lsarpc_sec_desc_buf_len = -1; +static gint hf_lsarpc_secret_access_mask = -1; +static gint hf_lsarpc_status = -1; static gint proto_dcerpc_lsarpc = -1; /* Version information */ @@ -1642,7 +1642,7 @@ lsarpc_dissect_bitmap_security_secinfo(tvbuff_t *tvb _U_, int offset _U_, packet /* IDL: struct { */ /* IDL: [value(2*strlen_m(string))] uint16 length; */ /* IDL: [value(2*strlen_m(string))] uint16 size; */ -/* IDL: [unique(1)] [charset(UTF16)] [length_is(length/2)] [size_is(size/2)] uint16 *string; */ +/* IDL: [charset(UTF16)] [length_is(length/2)] [size_is(size/2)] [unique(1)] uint16 *string; */ /* IDL: } */ static int @@ -1678,6 +1678,8 @@ lsarpc_dissect_struct_lsa_String(tvbuff_t *tvb _U_, int offset _U_, packet_info ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -1706,7 +1708,7 @@ lsarpc_dissect_struct_lsa_String(tvbuff_t *tvb _U_, int offset _U_, packet_info /* IDL: struct { */ /* IDL: [value(2*strlen_m(string))] uint16 length; */ /* IDL: [value(2*strlen_m_term(string))] uint16 size; */ -/* IDL: [unique(1)] [charset(UTF16)] [length_is(length/2)] [size_is(size/2)] uint16 *string; */ +/* IDL: [charset(UTF16)] [length_is(length/2)] [size_is(size/2)] [unique(1)] uint16 *string; */ /* IDL: } */ static int @@ -1742,6 +1744,8 @@ lsarpc_dissect_struct_lsa_StringLarge(tvbuff_t *tvb _U_, int offset _U_, packet_ ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -1769,7 +1773,7 @@ lsarpc_dissect_struct_lsa_StringLarge(tvbuff_t *tvb _U_, int offset _U_, packet_ /* IDL: struct { */ /* IDL: uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_String *names; */ +/* IDL: [size_is(count)] [unique(1)] lsa_String *names; */ /* IDL: } */ static int @@ -1813,6 +1817,8 @@ lsarpc_dissect_struct_lsa_Strings(tvbuff_t *tvb _U_, int offset _U_, packet_info ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -1839,7 +1845,7 @@ lsarpc_dissect_struct_lsa_Strings(tvbuff_t *tvb _U_, int offset _U_, packet_info /* IDL: struct { */ /* IDL: [value(strlen_m(string))] uint16 length; */ /* IDL: [value(strlen_m(string))] uint16 size; */ -/* IDL: [unique(1)] [charset(DOS)] [length_is(length)] [size_is(size)] uint8 *string; */ +/* IDL: [charset(DOS)] [length_is(length)] [size_is(size)] [unique(1)] uint8 *string; */ /* IDL: } */ static int @@ -1891,6 +1897,8 @@ lsarpc_dissect_struct_lsa_AsciiString(tvbuff_t *tvb _U_, int offset _U_, packet_ ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -1919,7 +1927,7 @@ lsarpc_dissect_struct_lsa_AsciiString(tvbuff_t *tvb _U_, int offset _U_, packet_ /* IDL: struct { */ /* IDL: [value(strlen_m(string))] uint16 length; */ /* IDL: [value(strlen_m_term(string))] uint16 size; */ -/* IDL: [unique(1)] [charset(DOS)] [length_is(length)] [size_is(size)] uint8 *string; */ +/* IDL: [charset(DOS)] [length_is(length)] [size_is(size)] [unique(1)] uint8 *string; */ /* IDL: } */ static int @@ -1971,6 +1979,8 @@ lsarpc_dissect_struct_lsa_AsciiStringLarge(tvbuff_t *tvb _U_, int offset _U_, pa ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2026,6 +2036,8 @@ lsarpc_dissect_struct_lsa_LUID(tvbuff_t *tvb _U_, int offset _U_, packet_info *p ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -2079,6 +2091,8 @@ lsarpc_dissect_struct_lsa_PrivEntry(tvbuff_t *tvb _U_, int offset _U_, packet_in ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2104,7 +2118,7 @@ lsarpc_dissect_struct_lsa_PrivEntry(tvbuff_t *tvb _U_, int offset _U_, packet_in /* IDL: struct { */ /* IDL: uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_PrivEntry *privs; */ +/* IDL: [size_is(count)] [unique(1)] lsa_PrivEntry *privs; */ /* IDL: } */ static int @@ -2148,6 +2162,8 @@ lsarpc_dissect_struct_lsa_PrivArray(tvbuff_t *tvb _U_, int offset _U_, packet_in ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2182,12 +2198,12 @@ int lsarpc_dissect_enum_lsa_SecurityImpersonationLevel(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -2241,6 +2257,8 @@ lsarpc_dissect_struct_lsa_QosInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -2271,7 +2289,7 @@ lsarpc_dissect_struct_lsa_QosInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info /* IDL: struct { */ /* IDL: uint32 len; */ /* IDL: [unique(1)] uint8 *root_dir; */ -/* IDL: [unique(1)] [charset(UTF16)] uint16 *object_name; */ +/* IDL: [charset(UTF16)] [unique(1)] uint16 *object_name; */ /* IDL: uint32 attributes; */ /* IDL: [unique(1)] security_descriptor *sec_desc; */ /* IDL: [unique(1)] lsa_QosInfo *sec_qos; */ @@ -2369,6 +2387,8 @@ lsarpc_dissect_struct_lsa_ObjectAttribute(tvbuff_t *tvb _U_, int offset _U_, pac ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2475,6 +2495,8 @@ lsarpc_dissect_struct_lsa_AuditLogInfo(tvbuff_t *tvb _U_, int offset _U_, packet ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -2520,12 +2542,12 @@ int lsarpc_dissect_enum_lsa_PolicyAuditPolicy(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 *param _U_) { guint32 parameter=0; - if(param){ - parameter=(guint32)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -2547,12 +2569,12 @@ int lsarpc_dissect_enum_lsa_PolicyAuditEventType(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -2560,7 +2582,7 @@ lsarpc_dissect_enum_lsa_PolicyAuditEventType(tvbuff_t *tvb _U_, int offset _U_, /* IDL: struct { */ /* IDL: uint32 auditing_mode; */ -/* IDL: [unique(1)] [size_is(count)] lsa_PolicyAuditPolicy *settings; */ +/* IDL: [size_is(count)] [unique(1)] lsa_PolicyAuditPolicy *settings; */ /* IDL: uint32 count; */ /* IDL: } */ @@ -2613,6 +2635,8 @@ lsarpc_dissect_struct_lsa_AuditEventsInfo(tvbuff_t *tvb _U_, int offset _U_, pac ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2676,6 +2700,8 @@ lsarpc_dissect_struct_lsa_DomainInfo(tvbuff_t *tvb _U_, int offset _U_, packet_i ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2720,6 +2746,8 @@ lsarpc_dissect_struct_lsa_PDAccountInfo(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2750,12 +2778,12 @@ int lsarpc_dissect_enum_lsa_PolicyServerRole(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -2782,6 +2810,8 @@ lsarpc_dissect_struct_lsa_ServerRole(tvbuff_t *tvb _U_, int offset _U_, packet_i ALIGN_TO_3_BYTES; + ALIGN_TO_3_BYTES; + old_offset = offset; if (parent_tree) { @@ -2833,6 +2863,8 @@ lsarpc_dissect_struct_lsa_ReplicaSourceInfo(tvbuff_t *tvb _U_, int offset _U_, p ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -2922,6 +2954,8 @@ lsarpc_dissect_struct_lsa_DefaultQuotaInfo(tvbuff_t *tvb _U_, int offset _U_, pa ALIGN_TO_8_BYTES; + ALIGN_TO_8_BYTES; + old_offset = offset; if (parent_tree) { @@ -2983,6 +3017,8 @@ lsarpc_dissect_struct_lsa_ModificationInfo(tvbuff_t *tvb _U_, int offset _U_, pa ALIGN_TO_8_BYTES; + ALIGN_TO_8_BYTES; + old_offset = offset; if (parent_tree) { @@ -3082,6 +3118,8 @@ lsarpc_dissect_struct_lsa_AuditFullQueryInfo(tvbuff_t *tvb _U_, int offset _U_, ALIGN_TO_2_BYTES; + ALIGN_TO_2_BYTES; + old_offset = offset; if (parent_tree) { @@ -3172,6 +3210,8 @@ lsarpc_dissect_struct_lsa_DnsDomainInfo(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -3222,12 +3262,12 @@ int lsarpc_dissect_enum_lsa_PolicyInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -3444,6 +3484,8 @@ lsarpc_dissect_struct_lsa_SidPtr(tvbuff_t *tvb _U_, int offset _U_, packet_info ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -3467,7 +3509,7 @@ lsarpc_dissect_struct_lsa_SidPtr(tvbuff_t *tvb _U_, int offset _U_, packet_info /* IDL: struct { */ /* IDL: [range(0,1000)] uint32 num_sids; */ -/* IDL: [unique(1)] [size_is(num_sids)] lsa_SidPtr *sids; */ +/* IDL: [size_is(num_sids)] [unique(1)] lsa_SidPtr *sids; */ /* IDL: } */ static int @@ -3511,6 +3553,8 @@ lsarpc_dissect_struct_lsa_SidArray(tvbuff_t *tvb _U_, int offset _U_, packet_inf ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -3536,7 +3580,7 @@ lsarpc_dissect_struct_lsa_SidArray(tvbuff_t *tvb _U_, int offset _U_, packet_inf /* IDL: struct { */ /* IDL: uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_DomainInfo *domains; */ +/* IDL: [size_is(count)] [unique(1)] lsa_DomainInfo *domains; */ /* IDL: } */ static int @@ -3580,6 +3624,8 @@ lsarpc_dissect_struct_lsa_DomainList(tvbuff_t *tvb _U_, int offset _U_, packet_i ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -3620,12 +3666,12 @@ int lsarpc_dissect_enum_lsa_SidType(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -3670,6 +3716,8 @@ lsarpc_dissect_struct_lsa_TranslatedSid(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -3697,7 +3745,7 @@ lsarpc_dissect_struct_lsa_TranslatedSid(tvbuff_t *tvb _U_, int offset _U_, packe /* IDL: struct { */ /* IDL: [range(0,1000)] uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_TranslatedSid *sids; */ +/* IDL: [size_is(count)] [unique(1)] lsa_TranslatedSid *sids; */ /* IDL: } */ static int @@ -3741,6 +3789,8 @@ lsarpc_dissect_struct_lsa_TransSidArray(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -3766,7 +3816,7 @@ lsarpc_dissect_struct_lsa_TransSidArray(tvbuff_t *tvb _U_, int offset _U_, packe /* IDL: struct { */ /* IDL: [range(0,1000)] uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_DomainInfo *domains; */ +/* IDL: [size_is(count)] [unique(1)] lsa_DomainInfo *domains; */ /* IDL: uint32 max_size; */ /* IDL: } */ @@ -3819,6 +3869,8 @@ lsarpc_dissect_struct_lsa_RefDomainList(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -3857,12 +3909,12 @@ int lsarpc_dissect_enum_lsa_LookupNamesLevel(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -3907,6 +3959,8 @@ lsarpc_dissect_struct_lsa_TranslatedName(tvbuff_t *tvb _U_, int offset _U_, pack ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -3934,7 +3988,7 @@ lsarpc_dissect_struct_lsa_TranslatedName(tvbuff_t *tvb _U_, int offset _U_, pack /* IDL: struct { */ /* IDL: [range(0,1000)] uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_TranslatedName *names; */ +/* IDL: [size_is(count)] [unique(1)] lsa_TranslatedName *names; */ /* IDL: } */ static int @@ -3978,6 +4032,8 @@ lsarpc_dissect_struct_lsa_TransNameArray(tvbuff_t *tvb _U_, int offset _U_, pack ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4031,6 +4087,8 @@ lsarpc_dissect_struct_lsa_LUIDAttribute(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -4101,6 +4159,8 @@ lsarpc_dissect_struct_lsa_PrivilegeSet(tvbuff_t *tvb _U_, int offset _U_, packet ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -4129,7 +4189,7 @@ lsarpc_dissect_struct_lsa_PrivilegeSet(tvbuff_t *tvb _U_, int offset _U_, packet /* IDL: struct { */ /* IDL: uint32 length; */ /* IDL: uint32 size; */ -/* IDL: [unique(1)] [length_is(length)] [size_is(size)] uint8 *data; */ +/* IDL: [length_is(length)] [size_is(size)] [unique(1)] uint8 *data; */ /* IDL: } */ static int @@ -4181,6 +4241,8 @@ lsarpc_dissect_struct_lsa_DATA_BUF(tvbuff_t *tvb _U_, int offset _U_, packet_inf ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4208,7 +4270,7 @@ lsarpc_dissect_struct_lsa_DATA_BUF(tvbuff_t *tvb _U_, int offset _U_, packet_inf /* IDL: struct { */ /* IDL: [range(0,65536)] uint32 size; */ -/* IDL: [unique(1)] [size_is(size)] uint8 *data; */ +/* IDL: [size_is(size)] [unique(1)] uint8 *data; */ /* IDL: } */ static int @@ -4252,6 +4314,8 @@ lsarpc_dissect_struct_lsa_DATA_BUF2(tvbuff_t *tvb _U_, int offset _U_, packet_in ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4292,12 +4356,12 @@ int lsarpc_dissect_enum_lsa_TrustDomInfoEnum(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -4324,6 +4388,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoName(tvbuff_t *tvb _U_, int offset _U_, ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4366,6 +4432,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoPosixOffset(tvbuff_t *tvb _U_, int offs ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -4433,6 +4501,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoPassword(tvbuff_t *tvb _U_, int offset ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4494,6 +4564,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoBasic(tvbuff_t *tvb _U_, int offset _U_ ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4591,6 +4663,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoInfoEx(tvbuff_t *tvb _U_, int offset _U ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4661,6 +4735,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoBuffer(tvbuff_t *tvb _U_, int offset _U ALIGN_TO_8_BYTES; + ALIGN_TO_8_BYTES; + old_offset = offset; if (parent_tree) { @@ -4784,6 +4860,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoAuthInfo(tvbuff_t *tvb _U_, int offset ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4854,6 +4932,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoFullInfo(tvbuff_t *tvb _U_, int offset ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4909,6 +4989,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfo11(tvbuff_t *tvb _U_, int offset _U_, p ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -4980,6 +5062,8 @@ lsarpc_dissect_struct_lsa_TrustDomainInfoInfoAll(tvbuff_t *tvb _U_, int offset _ ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5179,6 +5263,8 @@ lsarpc_dissect_struct_lsa_DATA_BUF_PTR(tvbuff_t *tvb _U_, int offset _U_, packet ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5201,7 +5287,7 @@ lsarpc_dissect_struct_lsa_DATA_BUF_PTR(tvbuff_t *tvb _U_, int offset _U_, packet /* IDL: struct { */ -/* IDL: [unique(1)] [charset(UTF16)] uint16 *name; */ +/* IDL: [charset(UTF16)] [unique(1)] uint16 *name; */ /* IDL: } */ static int @@ -5232,6 +5318,8 @@ lsarpc_dissect_struct_lsa_RightAttribute(tvbuff_t *tvb _U_, int offset _U_, pack ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5255,7 +5343,7 @@ lsarpc_dissect_struct_lsa_RightAttribute(tvbuff_t *tvb _U_, int offset _U_, pack /* IDL: struct { */ /* IDL: uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_StringLarge *names; */ +/* IDL: [size_is(count)] [unique(1)] lsa_StringLarge *names; */ /* IDL: } */ static int @@ -5299,6 +5387,8 @@ lsarpc_dissect_struct_lsa_RightSet(tvbuff_t *tvb _U_, int offset _U_, packet_inf ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5351,6 +5441,8 @@ lsarpc_dissect_struct_lsa_StringPointer(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5374,7 +5466,7 @@ lsarpc_dissect_struct_lsa_StringPointer(tvbuff_t *tvb _U_, int offset _U_, packe /* IDL: struct { */ /* IDL: uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_TrustDomainInfoInfoEx *domains; */ +/* IDL: [size_is(count)] [unique(1)] lsa_TrustDomainInfoInfoEx *domains; */ /* IDL: } */ static int @@ -5418,6 +5510,8 @@ lsarpc_dissect_struct_lsa_DomainListEx(tvbuff_t *tvb _U_, int offset _U_, packet ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5507,6 +5601,8 @@ lsarpc_dissect_struct_lsa_DomainInfoKerberos(tvbuff_t *tvb _U_, int offset _U_, ALIGN_TO_8_BYTES; + ALIGN_TO_8_BYTES; + old_offset = offset; if (parent_tree) { @@ -5540,7 +5636,7 @@ lsarpc_dissect_struct_lsa_DomainInfoKerberos(tvbuff_t *tvb _U_, int offset _U_, /* IDL: struct { */ /* IDL: uint32 blob_size; */ -/* IDL: [unique(1)] [size_is(blob_size)] uint8 *efs_blob; */ +/* IDL: [size_is(blob_size)] [unique(1)] uint8 *efs_blob; */ /* IDL: } */ static int @@ -5568,6 +5664,8 @@ lsarpc_dissect_struct_lsa_DomainInfoEfs(tvbuff_t *tvb _U_, int offset _U_, packe ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5601,12 +5699,12 @@ int lsarpc_dissect_enum_lsa_DomainInfoEnum(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint1632 *param _U_) { guint1632 parameter=0; - if(param){ - parameter=(guint1632)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -5712,6 +5810,8 @@ lsarpc_dissect_struct_lsa_TranslatedName2(tvbuff_t *tvb _U_, int offset _U_, pac ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5741,7 +5841,7 @@ lsarpc_dissect_struct_lsa_TranslatedName2(tvbuff_t *tvb _U_, int offset _U_, pac /* IDL: struct { */ /* IDL: [range(0,1000)] uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_TranslatedName2 *names; */ +/* IDL: [size_is(count)] [unique(1)] lsa_TranslatedName2 *names; */ /* IDL: } */ static int @@ -5785,6 +5885,8 @@ lsarpc_dissect_struct_lsa_TransNameArray2(tvbuff_t *tvb _U_, int offset _U_, pac ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -5856,6 +5958,8 @@ lsarpc_dissect_struct_lsa_TranslatedSid2(tvbuff_t *tvb _U_, int offset _U_, pack ALIGN_TO_4_BYTES; + ALIGN_TO_4_BYTES; + old_offset = offset; if (parent_tree) { @@ -5885,7 +5989,7 @@ lsarpc_dissect_struct_lsa_TranslatedSid2(tvbuff_t *tvb _U_, int offset _U_, pack /* IDL: struct { */ /* IDL: [range(0,1000)] uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_TranslatedSid2 *sids; */ +/* IDL: [size_is(count)] [unique(1)] lsa_TranslatedSid2 *sids; */ /* IDL: } */ static int @@ -5929,6 +6033,8 @@ lsarpc_dissect_struct_lsa_TransSidArray2(tvbuff_t *tvb _U_, int offset _U_, pack ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -6008,6 +6114,8 @@ lsarpc_dissect_struct_lsa_TranslatedSid3(tvbuff_t *tvb _U_, int offset _U_, pack ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -6037,7 +6145,7 @@ lsarpc_dissect_struct_lsa_TranslatedSid3(tvbuff_t *tvb _U_, int offset _U_, pack /* IDL: struct { */ /* IDL: [range(0,1000)] uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_TranslatedSid3 *sids; */ +/* IDL: [size_is(count)] [unique(1)] lsa_TranslatedSid3 *sids; */ /* IDL: } */ static int @@ -6081,6 +6189,8 @@ lsarpc_dissect_struct_lsa_TransSidArray3(tvbuff_t *tvb _U_, int offset _U_, pack ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -6106,7 +6216,7 @@ lsarpc_dissect_struct_lsa_TransSidArray3(tvbuff_t *tvb _U_, int offset _U_, pack /* IDL: struct { */ /* IDL: [range(0,131072)] uint32 length; */ -/* IDL: [unique(1)] [size_is(length)] uint8 *data; */ +/* IDL: [size_is(length)] [unique(1)] uint8 *data; */ /* IDL: } */ static int @@ -6150,6 +6260,8 @@ lsarpc_dissect_struct_lsa_ForestTrustBinaryData(tvbuff_t *tvb _U_, int offset _U ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -6220,6 +6332,8 @@ lsarpc_dissect_struct_lsa_ForestTrustDomainInfo(tvbuff_t *tvb _U_, int offset _U ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -6334,12 +6448,12 @@ int lsarpc_dissect_enum_lsa_ForestTrustRecordType(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 *param _U_) { guint32 parameter=0; - if(param){ - parameter=(guint32)*param; + if (param) { + parameter = *param; } offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, ¶meter); - if(param){ - *param=(guint32)parameter; + if (param) { + *param = parameter; } return offset; } @@ -6394,6 +6508,8 @@ lsarpc_dissect_struct_lsa_ForestTrustRecord(tvbuff_t *tvb _U_, int offset _U_, p ALIGN_TO_8_BYTES; + ALIGN_TO_8_BYTES; + old_offset = offset; if (parent_tree) { @@ -6423,7 +6539,7 @@ lsarpc_dissect_struct_lsa_ForestTrustRecord(tvbuff_t *tvb _U_, int offset _U_, p /* IDL: struct { */ /* IDL: [range(0,4000)] uint32 count; */ -/* IDL: [unique(1)] [size_is(count)] lsa_ForestTrustRecord **entries; */ +/* IDL: [size_is(count)] [unique(1)] lsa_ForestTrustRecord **entries; */ /* IDL: } */ static int @@ -6475,6 +6591,8 @@ lsarpc_dissect_struct_lsa_ForestTrustInformation(tvbuff_t *tvb _U_, int offset _ ALIGN_TO_5_BYTES; + ALIGN_TO_5_BYTES; + old_offset = offset; if (parent_tree) { @@ -6514,7 +6632,7 @@ lsarpc_dissect_element_lsa_Close_handle_(tvbuff_t *tvb _U_, int offset _U_, pack } /* IDL: NTSTATUS lsa_Close( */ -/* IDL: [out] [ref] [in] policy_handle *handle */ +/* IDL: [in] [out] [ref] policy_handle *handle */ /* IDL: ); */ static int @@ -6560,7 +6678,7 @@ lsarpc_dissect_element_lsa_Delete_handle_(tvbuff_t *tvb _U_, int offset _U_, pac } /* IDL: NTSTATUS lsa_Delete( */ -/* IDL: [ref] [in] policy_handle *handle */ +/* IDL: [in] [ref] policy_handle *handle */ /* IDL: ); */ static int @@ -6643,8 +6761,8 @@ lsarpc_dissect_element_lsa_EnumPrivs_privs_(tvbuff_t *tvb _U_, int offset _U_, p } /* IDL: NTSTATUS lsa_EnumPrivs( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [out] [ref] [in] uint32 *resume_handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [out] [ref] uint32 *resume_handle, */ /* IDL: [in] uint32 max_count, */ /* IDL: [out] [ref] lsa_PrivArray *privs */ /* IDL: ); */ @@ -6723,7 +6841,7 @@ lsarpc_dissect_element_lsa_QuerySecurity_sdbuf_(tvbuff_t *tvb _U_, int offset _U } /* IDL: NTSTATUS lsa_QuerySecurity( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] security_secinfo sec_info, */ /* IDL: [out] [unique(1)] sec_desc_buf *sdbuf */ /* IDL: ); */ @@ -6863,8 +6981,8 @@ lsarpc_dissect_element_lsa_OpenPolicy_handle_(tvbuff_t *tvb _U_, int offset _U_, } /* IDL: NTSTATUS lsa_OpenPolicy( */ -/* IDL: [unique(1)] [in] uint16 *system_name, */ -/* IDL: [ref] [in] lsa_ObjectAttribute *attr, */ +/* IDL: [in] [unique(1)] uint16 *system_name, */ +/* IDL: [in] [ref] lsa_ObjectAttribute *attr, */ /* IDL: [in] lsa_PolicyAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *handle */ /* IDL: ); */ @@ -6940,9 +7058,9 @@ lsarpc_dissect_element_lsa_QueryInfoPolicy_info_(tvbuff_t *tvb _U_, int offset _ } /* IDL: NTSTATUS lsa_QueryInfoPolicy( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_PolicyInfo level, */ -/* IDL: [unique(1)] [out] [switch_is(level)] lsa_PolicyInformation *info */ +/* IDL: [out] [switch_is(level)] [unique(1)] lsa_PolicyInformation *info */ /* IDL: ); */ static int @@ -7014,9 +7132,9 @@ lsarpc_dissect_element_lsa_SetInfoPolicy_info_(tvbuff_t *tvb _U_, int offset _U_ } /* IDL: NTSTATUS lsa_SetInfoPolicy( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_PolicyInfo level, */ -/* IDL: [ref] [in] [switch_is(level)] lsa_PolicyInformation *info */ +/* IDL: [in] [ref] [switch_is(level)] lsa_PolicyInformation *info */ /* IDL: ); */ static int @@ -7128,8 +7246,8 @@ lsarpc_dissect_element_lsa_CreateAccount_acct_handle_(tvbuff_t *tvb _U_, int off } /* IDL: NTSTATUS lsa_CreateAccount( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *sid, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *sid, */ /* IDL: [in] lsa_AccountAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *acct_handle */ /* IDL: ); */ @@ -7221,8 +7339,8 @@ lsarpc_dissect_element_lsa_EnumAccounts_sids_(tvbuff_t *tvb _U_, int offset _U_, } /* IDL: NTSTATUS lsa_EnumAccounts( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [out] [ref] [in] uint32 *resume_handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [out] [ref] uint32 *resume_handle, */ /* IDL: [in] [range(0,8192)] uint32 num_entries, */ /* IDL: [out] [ref] lsa_SidArray *sids */ /* IDL: ); */ @@ -7317,8 +7435,8 @@ lsarpc_dissect_element_lsa_CreateTrustedDomain_trustdom_handle_(tvbuff_t *tvb _U } /* IDL: NTSTATUS lsa_CreateTrustedDomain( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] lsa_DomainInfo *info, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] lsa_DomainInfo *info, */ /* IDL: [in] lsa_DomainAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *trustdom_handle */ /* IDL: ); */ @@ -7410,8 +7528,8 @@ lsarpc_dissect_element_lsa_EnumTrustDom_domains_(tvbuff_t *tvb _U_, int offset _ } /* IDL: NTSTATUS lsa_EnumTrustDom( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [out] [ref] [in] uint32 *resume_handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [out] [ref] uint32 *resume_handle, */ /* IDL: [in] uint32 max_size, */ /* IDL: [out] [ref] lsa_DomainList *domains */ /* IDL: ); */ @@ -7530,13 +7648,13 @@ lsarpc_dissect_element_lsa_LookupNames_count_(tvbuff_t *tvb _U_, int offset _U_, } /* IDL: NTSTATUS lsa_LookupNames( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] [range(0,1000)] uint32 num_names, */ /* IDL: [in] [size_is(num_names)] lsa_String names[*], */ /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */ -/* IDL: [out] [ref] [in] lsa_TransSidArray *sids, */ +/* IDL: [in] [out] [ref] lsa_TransSidArray *sids, */ /* IDL: [in] lsa_LookupNamesLevel level, */ -/* IDL: [out] [ref] [in] uint32 *count */ +/* IDL: [in] [out] [ref] uint32 *count */ /* IDL: ); */ static int @@ -7670,12 +7788,12 @@ lsarpc_dissect_element_lsa_LookupSids_count_(tvbuff_t *tvb _U_, int offset _U_, } /* IDL: NTSTATUS lsa_LookupSids( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] lsa_SidArray *sids, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] lsa_SidArray *sids, */ /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */ -/* IDL: [out] [ref] [in] lsa_TransNameArray *names, */ +/* IDL: [in] [out] [ref] lsa_TransNameArray *names, */ /* IDL: [in] uint16 level, */ -/* IDL: [out] [ref] [in] uint32 *count */ +/* IDL: [in] [out] [ref] uint32 *count */ /* IDL: ); */ static int @@ -7767,7 +7885,7 @@ lsarpc_dissect_element_lsa_CreateSecret_sec_handle_(tvbuff_t *tvb _U_, int offse } /* IDL: NTSTATUS lsa_CreateSecret( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_String name, */ /* IDL: [in] lsa_SecretAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *sec_handle */ @@ -7860,8 +7978,8 @@ lsarpc_dissect_element_lsa_OpenAccount_acct_handle_(tvbuff_t *tvb _U_, int offse } /* IDL: NTSTATUS lsa_OpenAccount( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *sid, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *sid, */ /* IDL: [in] lsa_AccountAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *acct_handle */ /* IDL: ); */ @@ -7929,7 +8047,7 @@ lsarpc_dissect_element_lsa_EnumPrivsAccount_privs_(tvbuff_t *tvb _U_, int offset } /* IDL: NTSTATUS lsa_EnumPrivsAccount( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [out] [unique(1)] lsa_PrivilegeSet *privs */ /* IDL: ); */ @@ -7992,8 +8110,8 @@ lsarpc_dissect_element_lsa_AddPrivilegesToAccount_privs_(tvbuff_t *tvb _U_, int } /* IDL: NTSTATUS lsa_AddPrivilegesToAccount( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] lsa_PrivilegeSet *privs */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] lsa_PrivilegeSet *privs */ /* IDL: ); */ static int @@ -8062,9 +8180,9 @@ lsarpc_dissect_element_lsa_RemovePrivilegesFromAccount_privs_(tvbuff_t *tvb _U_, } /* IDL: NTSTATUS lsa_RemovePrivilegesFromAccount( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] uint8 remove_all, */ -/* IDL: [unique(1)] [in] lsa_PrivilegeSet *privs */ +/* IDL: [in] [unique(1)] lsa_PrivilegeSet *privs */ /* IDL: ); */ static int @@ -8251,8 +8369,8 @@ lsarpc_dissect_element_lsa_OpenTrustedDomain_trustdom_handle_(tvbuff_t *tvb _U_, } /* IDL: NTSTATUS lsa_OpenTrustedDomain( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *sid, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *sid, */ /* IDL: [in] lsa_DomainAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *trustdom_handle */ /* IDL: ); */ @@ -8328,9 +8446,9 @@ lsarpc_dissect_element_lsa_QueryTrustedDomainInfo_info_(tvbuff_t *tvb _U_, int o } /* IDL: NTSTATUS lsa_QueryTrustedDomainInfo( */ -/* IDL: [ref] [in] policy_handle *trustdom_handle, */ +/* IDL: [in] [ref] policy_handle *trustdom_handle, */ /* IDL: [in] lsa_TrustDomInfoEnum level, */ -/* IDL: [out] [unique(1)] [switch_is(level)] lsa_TrustedDomainInfo *info */ +/* IDL: [out] [switch_is(level)] [unique(1)] lsa_TrustedDomainInfo *info */ /* IDL: ); */ static int @@ -8435,7 +8553,7 @@ lsarpc_dissect_element_lsa_OpenSecret_sec_handle_(tvbuff_t *tvb _U_, int offset } /* IDL: NTSTATUS lsa_OpenSecret( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_String name, */ /* IDL: [in] lsa_SecretAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *sec_handle */ @@ -8520,9 +8638,9 @@ lsarpc_dissect_element_lsa_SetSecret_old_val_(tvbuff_t *tvb _U_, int offset _U_, } /* IDL: NTSTATUS lsa_SetSecret( */ -/* IDL: [ref] [in] policy_handle *sec_handle, */ -/* IDL: [unique(1)] [in] lsa_DATA_BUF *new_val, */ -/* IDL: [unique(1)] [in] lsa_DATA_BUF *old_val */ +/* IDL: [in] [ref] policy_handle *sec_handle, */ +/* IDL: [in] [unique(1)] lsa_DATA_BUF *new_val, */ +/* IDL: [in] [unique(1)] lsa_DATA_BUF *old_val */ /* IDL: ); */ static int @@ -8633,11 +8751,11 @@ lsarpc_dissect_element_lsa_QuerySecret_old_mtime_(tvbuff_t *tvb _U_, int offset } /* IDL: NTSTATUS lsa_QuerySecret( */ -/* IDL: [ref] [in] policy_handle *sec_handle, */ -/* IDL: [out] [unique(1)] [in] lsa_DATA_BUF_PTR *new_val, */ -/* IDL: [out] [unique(1)] [in] NTTIME_hyper *new_mtime, */ -/* IDL: [out] [unique(1)] [in] lsa_DATA_BUF_PTR *old_val, */ -/* IDL: [out] [unique(1)] [in] NTTIME_hyper *old_mtime */ +/* IDL: [in] [ref] policy_handle *sec_handle, */ +/* IDL: [in] [out] [unique(1)] lsa_DATA_BUF_PTR *new_val, */ +/* IDL: [in] [out] [unique(1)] NTTIME_hyper *new_mtime, */ +/* IDL: [in] [out] [unique(1)] lsa_DATA_BUF_PTR *old_val, */ +/* IDL: [in] [out] [unique(1)] NTTIME_hyper *old_mtime */ /* IDL: ); */ static int @@ -8732,8 +8850,8 @@ lsarpc_dissect_element_lsa_LookupPrivValue_luid_(tvbuff_t *tvb _U_, int offset _ } /* IDL: NTSTATUS lsa_LookupPrivValue( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] lsa_String *name, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] lsa_String *name, */ /* IDL: [out] [ref] lsa_LUID *luid */ /* IDL: ); */ @@ -8814,8 +8932,8 @@ lsarpc_dissect_element_lsa_LookupPrivName_name_(tvbuff_t *tvb _U_, int offset _U } /* IDL: NTSTATUS lsa_LookupPrivName( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] lsa_LUID *luid, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] lsa_LUID *luid, */ /* IDL: [out] [unique(1)] lsa_StringLarge *name */ /* IDL: ); */ @@ -8920,10 +9038,10 @@ lsarpc_dissect_element_lsa_LookupPrivDisplayName_unknown(tvbuff_t *tvb _U_, int } /* IDL: NTSTATUS lsa_LookupPrivDisplayName( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] lsa_String *name, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] lsa_String *name, */ /* IDL: [out] [unique(1)] lsa_StringLarge *disp_name, */ -/* IDL: [out] [ref] [in] uint16 *language_id, */ +/* IDL: [in] [out] [ref] uint16 *language_id, */ /* IDL: [in] uint16 unknown */ /* IDL: ); */ @@ -9036,8 +9154,8 @@ lsarpc_dissect_element_lsa_EnumAccountsWithUserRight_sids_(tvbuff_t *tvb _U_, in } /* IDL: NTSTATUS lsa_EnumAccountsWithUserRight( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [unique(1)] [in] lsa_String *name, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [unique(1)] lsa_String *name, */ /* IDL: [out] [ref] lsa_SidArray *sids */ /* IDL: ); */ @@ -9118,8 +9236,8 @@ lsarpc_dissect_element_lsa_EnumAccountRights_rights_(tvbuff_t *tvb _U_, int offs } /* IDL: NTSTATUS lsa_EnumAccountRights( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *sid, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *sid, */ /* IDL: [out] [ref] lsa_RightSet *rights */ /* IDL: ); */ @@ -9200,9 +9318,9 @@ lsarpc_dissect_element_lsa_AddAccountRights_rights_(tvbuff_t *tvb _U_, int offse } /* IDL: NTSTATUS lsa_AddAccountRights( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *sid, */ -/* IDL: [ref] [in] lsa_RightSet *rights */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *sid, */ +/* IDL: [in] [ref] lsa_RightSet *rights */ /* IDL: ); */ static int @@ -9289,10 +9407,10 @@ lsarpc_dissect_element_lsa_RemoveAccountRights_rights_(tvbuff_t *tvb _U_, int of } /* IDL: NTSTATUS lsa_RemoveAccountRights( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *sid, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *sid, */ /* IDL: [in] uint32 unknown, */ -/* IDL: [ref] [in] lsa_RightSet *rights */ +/* IDL: [in] [ref] lsa_RightSet *rights */ /* IDL: ); */ static int @@ -9381,10 +9499,10 @@ lsarpc_dissect_element_lsa_QueryTrustedDomainInfoBySid_info_(tvbuff_t *tvb _U_, } /* IDL: NTSTATUS lsa_QueryTrustedDomainInfoBySid( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *dom_sid, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *dom_sid, */ /* IDL: [in] lsa_TrustDomInfoEnum level, */ -/* IDL: [out] [unique(1)] [switch_is(level)] lsa_TrustedDomainInfo *info */ +/* IDL: [out] [switch_is(level)] [unique(1)] lsa_TrustedDomainInfo *info */ /* IDL: ); */ static int @@ -9475,8 +9593,8 @@ lsarpc_dissect_element_lsa_DeleteTrustedDomain_dom_sid_(tvbuff_t *tvb _U_, int o } /* IDL: NTSTATUS lsa_DeleteTrustedDomain( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] dom_sid2 *dom_sid */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] dom_sid2 *dom_sid */ /* IDL: ); */ static int @@ -9614,8 +9732,8 @@ lsarpc_dissect_element_lsa_OpenPolicy2_handle_(tvbuff_t *tvb _U_, int offset _U_ } /* IDL: NTSTATUS lsa_OpenPolicy2( */ -/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *system_name, */ -/* IDL: [ref] [in] lsa_ObjectAttribute *attr, */ +/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *system_name, */ +/* IDL: [in] [ref] lsa_ObjectAttribute *attr, */ /* IDL: [in] lsa_PolicyAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *handle */ /* IDL: ); */ @@ -9702,9 +9820,9 @@ lsarpc_dissect_element_lsa_GetUserName_authority_name_(tvbuff_t *tvb _U_, int of } /* IDL: NTSTATUS lsa_GetUserName( */ -/* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *system_name, */ -/* IDL: [out] [unique(1)] [in] lsa_String *account_name, */ -/* IDL: [out] [unique(1)] [in] lsa_StringPointer *authority_name */ +/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *system_name, */ +/* IDL: [in] [out] [unique(1)] lsa_String *account_name, */ +/* IDL: [in] [out] [unique(1)] lsa_StringPointer *authority_name */ /* IDL: ); */ static int @@ -9781,9 +9899,9 @@ lsarpc_dissect_element_lsa_QueryInfoPolicy2_info_(tvbuff_t *tvb _U_, int offset } /* IDL: NTSTATUS lsa_QueryInfoPolicy2( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_PolicyInfo level, */ -/* IDL: [unique(1)] [out] [switch_is(level)] lsa_PolicyInformation *info */ +/* IDL: [out] [switch_is(level)] [unique(1)] lsa_PolicyInformation *info */ /* IDL: ); */ static int @@ -9855,9 +9973,9 @@ lsarpc_dissect_element_lsa_SetInfoPolicy2_info_(tvbuff_t *tvb _U_, int offset _U } /* IDL: NTSTATUS lsa_SetInfoPolicy2( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_PolicyInfo level, */ -/* IDL: [ref] [in] [switch_is(level)] lsa_PolicyInformation *info */ +/* IDL: [in] [ref] [switch_is(level)] lsa_PolicyInformation *info */ /* IDL: ); */ static int @@ -9936,10 +10054,10 @@ lsarpc_dissect_element_lsa_QueryTrustedDomainInfoByName_info_(tvbuff_t *tvb _U_, } /* IDL: NTSTATUS lsa_QueryTrustedDomainInfoByName( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_String trusted_domain, */ /* IDL: [in] lsa_TrustDomInfoEnum level, */ -/* IDL: [unique(1)] [out] [switch_is(level)] lsa_TrustedDomainInfo *info */ +/* IDL: [out] [switch_is(level)] [unique(1)] lsa_TrustedDomainInfo *info */ /* IDL: ); */ static int @@ -10021,10 +10139,10 @@ lsarpc_dissect_element_lsa_SetTrustedDomainInfoByName_info_(tvbuff_t *tvb _U_, i } /* IDL: NTSTATUS lsa_SetTrustedDomainInfoByName( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_String trusted_domain, */ /* IDL: [in] lsa_TrustDomInfoEnum level, */ -/* IDL: [unique(1)] [in] [switch_is(level)] lsa_TrustedDomainInfo *info */ +/* IDL: [in] [switch_is(level)] [unique(1)] lsa_TrustedDomainInfo *info */ /* IDL: ); */ static int @@ -10113,8 +10231,8 @@ lsarpc_dissect_element_lsa_EnumTrustedDomainsEx_max_size(tvbuff_t *tvb _U_, int } /* IDL: NTSTATUS lsa_EnumTrustedDomainsEx( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [out] [ref] [in] uint32 *resume_handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [out] [ref] uint32 *resume_handle, */ /* IDL: [out] [ref] lsa_DomainListEx *domains, */ /* IDL: [in] uint32 max_size */ /* IDL: ); */ @@ -10194,7 +10312,7 @@ lsarpc_dissect_element_lsa_CloseTrustedDomainEx_handle_(tvbuff_t *tvb _U_, int o } /* IDL: NTSTATUS lsa_CloseTrustedDomainEx( */ -/* IDL: [out] [ref] [in] policy_handle *handle */ +/* IDL: [in] [out] [ref] policy_handle *handle */ /* IDL: ); */ static int @@ -10264,9 +10382,9 @@ lsarpc_dissect_element_lsa_QueryDomainInformationPolicy_info_(tvbuff_t *tvb _U_, } /* IDL: NTSTATUS lsa_QueryDomainInformationPolicy( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_DomainInfoEnum level, */ -/* IDL: [unique(1)] [out] [switch_is(level)] lsa_DomainInformationPolicy *info */ +/* IDL: [out] [switch_is(level)] [unique(1)] lsa_DomainInformationPolicy *info */ /* IDL: ); */ static int @@ -10338,9 +10456,9 @@ lsarpc_dissect_element_lsa_SetDomainInformationPolicy_info_(tvbuff_t *tvb _U_, i } /* IDL: NTSTATUS lsa_SetDomainInformationPolicy( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_DomainInfoEnum level, */ -/* IDL: [unique(1)] [in] [switch_is(level)] lsa_DomainInformationPolicy *info */ +/* IDL: [in] [switch_is(level)] [unique(1)] lsa_DomainInformationPolicy *info */ /* IDL: ); */ static int @@ -10419,7 +10537,7 @@ lsarpc_dissect_element_lsa_OpenTrustedDomainByName_trustdom_handle_(tvbuff_t *tv } /* IDL: NTSTATUS lsa_OpenTrustedDomainByName( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] lsa_String name, */ /* IDL: [in] lsa_DomainAccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *trustdom_handle */ @@ -10585,12 +10703,12 @@ lsarpc_dissect_element_lsa_LookupSids2_unknown2(tvbuff_t *tvb _U_, int offset _U } /* IDL: NTSTATUS lsa_LookupSids2( */ -/* IDL: [ref] [in] policy_handle *handle, */ -/* IDL: [ref] [in] lsa_SidArray *sids, */ +/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [in] [ref] lsa_SidArray *sids, */ /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */ -/* IDL: [out] [ref] [in] lsa_TransNameArray2 *names, */ +/* IDL: [in] [out] [ref] lsa_TransNameArray2 *names, */ /* IDL: [in] uint16 level, */ -/* IDL: [out] [ref] [in] uint32 *count, */ +/* IDL: [in] [out] [ref] uint32 *count, */ /* IDL: [in] uint32 unknown1, */ /* IDL: [in] uint32 unknown2 */ /* IDL: ); */ @@ -10736,13 +10854,13 @@ lsarpc_dissect_element_lsa_LookupNames2_unknown2(tvbuff_t *tvb _U_, int offset _ } /* IDL: NTSTATUS lsa_LookupNames2( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] [range(0,1000)] uint32 num_names, */ /* IDL: [in] [size_is(num_names)] lsa_String names[*], */ /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */ -/* IDL: [out] [ref] [in] lsa_TransSidArray2 *sids, */ +/* IDL: [in] [out] [ref] lsa_TransSidArray2 *sids, */ /* IDL: [in] lsa_LookupNamesLevel level, */ -/* IDL: [out] [ref] [in] uint32 *count, */ +/* IDL: [in] [out] [ref] uint32 *count, */ /* IDL: [in] uint32 unknown1, */ /* IDL: [in] uint32 unknown2 */ /* IDL: ); */ @@ -11123,13 +11241,13 @@ lsarpc_dissect_element_lsa_LookupNames3_unknown2(tvbuff_t *tvb _U_, int offset _ } /* IDL: NTSTATUS lsa_LookupNames3( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] [range(0,1000)] uint32 num_names, */ /* IDL: [in] [size_is(num_names)] lsa_String names[*], */ /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */ -/* IDL: [out] [ref] [in] lsa_TransSidArray3 *sids, */ +/* IDL: [in] [out] [ref] lsa_TransSidArray3 *sids, */ /* IDL: [in] lsa_LookupNamesLevel level, */ -/* IDL: [out] [ref] [in] uint32 *count, */ +/* IDL: [in] [out] [ref] uint32 *count, */ /* IDL: [in] uint32 unknown1, */ /* IDL: [in] uint32 unknown2 */ /* IDL: ); */ @@ -11345,7 +11463,7 @@ lsarpc_dissect_element_lsa_lsaRQueryForestTrustInformation_forest_trust_info__(t } /* IDL: NTSTATUS lsa_lsaRQueryForestTrustInformation( */ -/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] [ref] lsa_String *trusted_domain_name, */ /* IDL: [in] uint16 unknown, */ /* IDL: [out] [ref] lsa_ForestTrustInformation **forest_trust_info */ @@ -11520,11 +11638,11 @@ lsarpc_dissect_element_lsa_LookupSids3_unknown2(tvbuff_t *tvb _U_, int offset _U } /* IDL: NTSTATUS lsa_LookupSids3( */ -/* IDL: [ref] [in] lsa_SidArray *sids, */ +/* IDL: [in] [ref] lsa_SidArray *sids, */ /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */ -/* IDL: [out] [ref] [in] lsa_TransNameArray2 *names, */ +/* IDL: [in] [out] [ref] lsa_TransNameArray2 *names, */ /* IDL: [in] uint16 level, */ -/* IDL: [out] [ref] [in] uint32 *count, */ +/* IDL: [in] [out] [ref] uint32 *count, */ /* IDL: [in] uint32 unknown1, */ /* IDL: [in] uint32 unknown2 */ /* IDL: ); */ @@ -11655,9 +11773,9 @@ lsarpc_dissect_element_lsa_LookupNames4_unknown2(tvbuff_t *tvb _U_, int offset _ /* IDL: [in] [range(0,1000)] uint32 num_names, */ /* IDL: [in] [size_is(num_names)] lsa_String names[*], */ /* IDL: [out] [unique(1)] lsa_RefDomainList *domains, */ -/* IDL: [out] [ref] [in] lsa_TransSidArray3 *sids, */ +/* IDL: [in] [out] [ref] lsa_TransSidArray3 *sids, */ /* IDL: [in] lsa_LookupNamesLevel level, */ -/* IDL: [out] [ref] [in] uint32 *count, */ +/* IDL: [in] [out] [ref] uint32 *count, */ /* IDL: [in] uint32 unknown1, */ /* IDL: [in] uint32 unknown2 */ /* IDL: ); */ @@ -11978,848 +12096,848 @@ static dcerpc_sub_dissector lsarpc_dissectors[] = { void proto_register_dcerpc_lsarpc(void) { static hf_register_info hf[] = { - { &hf_lsarpc_lsa_AsciiStringLarge_size, - { "Size", "lsarpc.lsa_AsciiStringLarge.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivName_luid, - { "Luid", "lsarpc.lsa_LookupPrivName.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count, - { "Outgoing Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS, - { "Lsa Domain Set Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS_tfs), ( 0x00000004 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_Delete_handle, - { "Handle", "lsarpc.lsa_Delete.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_account_domain, - { "Account Domain", "lsarpc.lsa_PolicyInformation.account_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfoKerberos_clock_skew, - { "Clock Skew", "lsarpc.lsa_DomainInfoKerberos.clock_skew", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustData_domain_info, - { "Domain Info", "lsarpc.lsa_ForestTrustData.domain_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_String_name, + { "String", "lsarpc.lsa.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_account_access_mask, + { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_domain_access_mask, + { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_efs_blob_len, + { "EFS blob size", "lsarpc.efs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES, + { "Lsa Account Adjust Privileges", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_PRIVILEGES", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES_tfs), ( 0x00000002 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS, + { "Lsa Account Adjust Quotas", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_QUOTAS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS_tfs), ( 0x00000004 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS, + { "Lsa Account Adjust System Access", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS_tfs), ( 0x00000008 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW, + { "Lsa Account View", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_VIEW", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_VIEW_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_AddAccountRights_handle, + { "Handle", "lsarpc.lsa_AddAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AddAccountRights_rights, + { "Rights", "lsarpc.lsa_AddAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AddAccountRights_sid, + { "Sid", "lsarpc.lsa_AddAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_AddPrivilegesToAccount_handle, { "Handle", "lsarpc.lsa_AddPrivilegesToAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ObjectAttribute_sec_qos, - { "Sec Qos", "lsarpc.lsa_ObjectAttribute.sec_qos", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_handle, - { "Handle", "lsarpc.lsa_LookupNames3.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level, - { "Level", "lsarpc.lsa_QueryTrustedDomainInfoBySid.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomain_sid, - { "Sid", "lsarpc.lsa_OpenTrustedDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccounts_handle, - { "Handle", "lsarpc.lsa_EnumAccounts.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateAccount_sid, - { "Sid", "lsarpc.lsa_CreateAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ReplicaSourceInfo_account, - { "Account", "lsarpc.lsa_ReplicaSourceInfo.account", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryDomainInformationPolicy_handle, - { "Handle", "lsarpc.lsa_QueryDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateTrustedDomain_info, - { "Info", "lsarpc.lsa_CreateTrustedDomain.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS, - { "Lsa Policy Set Default Quota Limits", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS_tfs), ( 0x00000080 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_PrivilegeSet_set, - { "Set", "lsarpc.lsa_PrivilegeSet.set", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QuerySecret_new_val, - { "New Val", "lsarpc.lsa_QuerySecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid2_unknown, - { "Unknown", "lsarpc.lsa_TranslatedSid2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids2_handle, - { "Handle", "lsarpc.lsa_LookupSids2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainListEx_domains, - { "Domains", "lsarpc.lsa_DomainListEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_num_names, - { "Num Names", "lsarpc.lsa_LookupNames3.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size, - { "Max Size", "lsarpc.lsa_EnumTrustedDomainsEx.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivName_handle, - { "Handle", "lsarpc.lsa_LookupPrivName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenAccount_handle, - { "Handle", "lsarpc.lsa_OpenAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenSecret_access_mask, - { "Access Mask", "lsarpc.lsa_OpenSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QuerySecurity_sdbuf, - { "Sdbuf", "lsarpc.lsa_QuerySecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain, - { "Trusted Domain", "lsarpc.lsa_SetTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle, - { "Trustdom Handle", "lsarpc.lsa_CreateTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumPrivs_handle, - { "Handle", "lsarpc.lsa_EnumPrivs.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LUID_high, - { "High", "lsarpc.lsa_LUID.high", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryInfoPolicy_handle, - { "Handle", "lsarpc.lsa_QueryInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_audit_events, - { "Audit Events", "lsarpc.lsa_PolicyInformation.audit_events", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_auth_info, - { "Auth Info", "lsarpc.lsa_TrustedDomainInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE, - { "Lsa Policy Create Privilege", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_PRIVILEGE", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE_tfs), ( 0x00000040 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime, - { "Service Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.service_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateSecret_access_mask, - { "Access Mask", "lsarpc.lsa_CreateSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_GetUserName_authority_name, - { "Authority Name", "lsarpc.lsa_GetUserName.authority_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AddPrivilegesToAccount_privs, + { "Privs", "lsarpc.lsa_AddPrivilegesToAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AsciiStringLarge_length, + { "Length", "lsarpc.lsa_AsciiStringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AsciiStringLarge_size, + { "Size", "lsarpc.lsa_AsciiStringLarge.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AsciiStringLarge_string, + { "String", "lsarpc.lsa_AsciiStringLarge.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AsciiString_length, + { "Length", "lsarpc.lsa_AsciiString.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AsciiString_size, + { "Size", "lsarpc.lsa_AsciiString.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AsciiString_string, + { "String", "lsarpc.lsa_AsciiString.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditEventsInfo_auditing_mode, + { "Auditing Mode", "lsarpc.lsa_AuditEventsInfo.auditing_mode", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditEventsInfo_count, + { "Count", "lsarpc.lsa_AuditEventsInfo.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditEventsInfo_settings, + { "Settings", "lsarpc.lsa_AuditEventsInfo.settings", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_PolicyAuditPolicy_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full, + { "Log Is Full", "lsarpc.lsa_AuditFullQueryInfo.log_is_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full, + { "Shutdown On Full", "lsarpc.lsa_AuditFullQueryInfo.shutdown_on_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditFullQueryInfo_unknown, + { "Unknown", "lsarpc.lsa_AuditFullQueryInfo.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_AuditFullSetInfo_shutdown_on_full, { "Shutdown On Full", "lsarpc.lsa_AuditFullSetInfo.shutdown_on_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RemoveAccountRights_unknown, - { "Unknown", "lsarpc.lsa_RemoveAccountRights.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames4_unknown1, - { "Unknown1", "lsarpc.lsa_LookupNames4.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_secret_access_mask, - { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid, - { "Dom Sid", "lsarpc.lsa_DeleteTrustedDomain.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames4_names, - { "Names", "lsarpc.lsa_LookupNames4.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data, - { "Forest Trust Data", "lsarpc.lsa_ForestTrustRecord.forest_trust_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_role, - { "Role", "lsarpc.lsa_PolicyInformation.role", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_audit_log, - { "Audit Log", "lsarpc.lsa_PolicyInformation.audit_log", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME, - { "Lsa Domain Query Domain Name", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_DOMAIN_NAME", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME_tfs), ( 0x00000001 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_dns, - { "Dns", "lsarpc.lsa_PolicyInformation.dns", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_trusted_domain_name, - { "Trusted Domain Name", "lsarpc.lsa_lsaRQueryForestTrustInformation.trusted_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain, - { "Trusted Domain", "lsarpc.lsa_QueryTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy2_handle, - { "Handle", "lsarpc.lsa_OpenPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccountsWithUserRight_handle, - { "Handle", "lsarpc.lsa_EnumAccountsWithUserRight.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count, - { "Incoming Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RemoveAccountRights_rights, - { "Rights", "lsarpc.lsa_RemoveAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetSecret_sec_handle, - { "Sec Handle", "lsarpc.lsa_SetSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET, - { "Lsa Policy Create Secret", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_SECRET", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET_tfs), ( 0x00000020 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask, - { "Access Mask", "lsarpc.lsa_OpenTrustedDomainByName.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RightAttribute_name, - { "Name", "lsarpc.lsa_RightAttribute.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoPassword_old_password, - { "Old Password", "lsarpc.lsa_TrustDomainInfoPassword.old_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime, - { "User Tkt Renewaltime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_renewaltime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LUID_low, - { "Low", "lsarpc.lsa_LUID.low", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_names, - { "Names", "lsarpc.lsa_LookupNames3.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid, - { "Dom Sid", "lsarpc.lsa_QueryTrustedDomainInfoBySid.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfo11_info_ex, - { "Info Ex", "lsarpc.lsa_TrustDomainInfo11.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids_names, - { "Names", "lsarpc.lsa_LookupSids.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomain_access_mask, - { "Access Mask", "lsarpc.lsa_OpenTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RefDomainList_max_size, - { "Max Size", "lsarpc.lsa_RefDomainList.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransSidArray_sids, - { "Sids", "lsarpc.lsa_TransSidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes, - { "Trust Attributes", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateSecret_sec_handle, - { "Sec Handle", "lsarpc.lsa_CreateSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetSecret_old_val, - { "Old Val", "lsarpc.lsa_SetSecret.old_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time, - { "Last Update Time", "lsarpc.lsa_TrustDomainInfoBuffer.last_update_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DnsDomainInfo_dns_forest, - { "Dns Forest", "lsarpc.lsa_DnsDomainInfo.dns_forest", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryDomainInformationPolicy_info, - { "Info", "lsarpc.lsa_QueryDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name, - { "Netbios Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.netbios_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction, - { "Trust Direction", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_direction", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_sids, - { "Sids", "lsarpc.lsa_LookupNames3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditLogInfo_unknown, - { "Unknown", "lsarpc.lsa_AuditLogInfo.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditLogInfo_log_size, + { "Log Size", "lsarpc.lsa_AuditLogInfo.log_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditLogInfo_next_audit_record, + { "Next Audit Record", "lsarpc.lsa_AuditLogInfo.next_audit_record", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditLogInfo_percent_full, + { "Percent Full", "lsarpc.lsa_AuditLogInfo.percent_full", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_AuditLogInfo_retention_time, { "Retention Time", "lsarpc.lsa_AuditLogInfo.retention_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ObjectAttribute_sec_desc, - { "Sec Desc", "lsarpc.lsa_ObjectAttribute.sec_desc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DnsDomainInfo_name, - { "Name", "lsarpc.lsa_DnsDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_efs_blob_len, - { "EFS blob size", "lsarpc.efs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid2_sid_index, - { "Sid Index", "lsarpc.lsa_TranslatedSid2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QuerySecret_old_mtime, - { "Old Mtime", "lsarpc.lsa_QuerySecret.old_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomain_handle, - { "Handle", "lsarpc.lsa_OpenTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransNameArray_names, - { "Names", "lsarpc.lsa_TransNameArray.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS, - { "Lsa Domain Query Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS_tfs), ( 0x00000002 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_RefDomainList_count, - { "Count", "lsarpc.lsa_RefDomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryInfoPolicy2_info, - { "Info", "lsarpc.lsa_QueryInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info, - { "Kerberos Info", "lsarpc.lsa_DomainInformationPolicy.kerberos_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryInfoPolicy_info, - { "Info", "lsarpc.lsa_QueryInfoPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateAccount_acct_handle, - { "Acct Handle", "lsarpc.lsa_CreateAccount.acct_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_AuditLogInfo_shutdown_in_progress, { "Shutdown In Progress", "lsarpc.lsa_AuditLogInfo.shutdown_in_progress", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenSecret_handle, - { "Handle", "lsarpc.lsa_OpenSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type, - { "Secret Type", "lsarpc.lsa_TrustDomainInfoBuffer.secret_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoName_netbios_name, - { "Netbios Name", "lsarpc.lsa_TrustDomainInfoName.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames_handle, - { "Handle", "lsarpc.lsa_LookupNames.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumTrustDom_max_size, - { "Max Size", "lsarpc.lsa_EnumTrustDom.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoPassword_password, - { "Password", "lsarpc.lsa_TrustDomainInfoPassword.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ObjectAttribute_object_name, - { "Object Name", "lsarpc.lsa_ObjectAttribute.object_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown, + { "Time To Shutdown", "lsarpc.lsa_AuditLogInfo.time_to_shutdown", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_AuditLogInfo_unknown, + { "Unknown", "lsarpc.lsa_AuditLogInfo.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CloseTrustedDomainEx_handle, + { "Handle", "lsarpc.lsa_CloseTrustedDomainEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_Close_handle, + { "Handle", "lsarpc.lsa_Close.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateAccount_access_mask, + { "Access Mask", "lsarpc.lsa_CreateAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateAccount_acct_handle, + { "Acct Handle", "lsarpc.lsa_CreateAccount.acct_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateAccount_handle, + { "Handle", "lsarpc.lsa_CreateAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateAccount_sid, + { "Sid", "lsarpc.lsa_CreateAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateSecret_access_mask, + { "Access Mask", "lsarpc.lsa_CreateSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateSecret_handle, + { "Handle", "lsarpc.lsa_CreateSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateSecret_name, + { "Name", "lsarpc.lsa_CreateSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateSecret_sec_handle, + { "Sec Handle", "lsarpc.lsa_CreateSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateTrustedDomain_access_mask, + { "Access Mask", "lsarpc.lsa_CreateTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_CreateTrustedDomain_handle, { "Handle", "lsarpc.lsa_CreateTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumTrustDom_resume_handle, - { "Resume Handle", "lsarpc.lsa_EnumTrustDom.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_info11, - { "Info11", "lsarpc.lsa_TrustedDomainInfo.info11", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QosInfo_impersonation_level, - { "Impersonation Level", "lsarpc.lsa_QosInfo.impersonation_level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SecurityImpersonationLevel_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryInfoPolicy2_level, - { "Level", "lsarpc.lsa_QueryInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid3_sid, - { "Sid", "lsarpc.lsa_TranslatedSid3.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name, - { "Netbios Name", "lsarpc.lsa_TrustDomainInfoBasic.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN, - { "Lsa Policy Audit Log Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_AUDIT_LOG_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN_tfs), ( 0x00000200 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustInformation_entries, - { "Entries", "lsarpc.lsa_ForestTrustInformation.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustData_top_level_name_ex, - { "Top Level Name Ex", "lsarpc.lsa_ForestTrustData.top_level_name_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateTrustedDomain_info, + { "Info", "lsarpc.lsa_CreateTrustedDomain.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_CreateTrustedDomain_trustdom_handle, + { "Trustdom Handle", "lsarpc.lsa_CreateTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DATA_BUF2_data, + { "Data", "lsarpc.lsa_DATA_BUF2.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DATA_BUF2_size, + { "Size", "lsarpc.lsa_DATA_BUF2.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DATA_BUF_PTR_buf, + { "Buf", "lsarpc.lsa_DATA_BUF_PTR.buf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DATA_BUF_data, + { "Data", "lsarpc.lsa_DATA_BUF.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DATA_BUF_length, + { "Length", "lsarpc.lsa_DATA_BUF.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DATA_BUF_size, + { "Size", "lsarpc.lsa_DATA_BUF.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DefaultQuotaInfo_max_wss, + { "Max Wss", "lsarpc.lsa_DefaultQuotaInfo.max_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DefaultQuotaInfo_min_wss, + { "Min Wss", "lsarpc.lsa_DefaultQuotaInfo.min_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_DefaultQuotaInfo_non_paged_pool, { "Non Paged Pool", "lsarpc.lsa_DefaultQuotaInfo.non_paged_pool", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustBinaryData_length, - { "Length", "lsarpc.lsa_ForestTrustBinaryData.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DefaultQuotaInfo_paged_pool, + { "Paged Pool", "lsarpc.lsa_DefaultQuotaInfo.paged_pool", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DefaultQuotaInfo_pagefile, + { "Pagefile", "lsarpc.lsa_DefaultQuotaInfo.pagefile", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_DefaultQuotaInfo_unknown, { "Unknown", "lsarpc.lsa_DefaultQuotaInfo.unknown", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QosInfo_len, - { "Len", "lsarpc.lsa_QosInfo.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditFullQueryInfo_unknown, - { "Unknown", "lsarpc.lsa_AuditFullQueryInfo.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_level, - { "Level", "lsarpc.lsa_LookupNames3.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivDisplayName_disp_name, - { "Disp Name", "lsarpc.lsa_LookupPrivDisplayName.disp_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames_level, - { "Level", "lsarpc.lsa_LookupNames.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames4_count, - { "Count", "lsarpc.lsa_LookupNames4.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames_names, - { "Names", "lsarpc.lsa_LookupNames.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES, - { "Lsa Account Adjust Privileges", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_PRIVILEGES", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_PRIVILEGES_tfs), ( 0x00000002 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfo11_data1, - { "Data1", "lsarpc.lsa_TrustDomainInfo11.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PrivEntry_luid, - { "Luid", "lsarpc.lsa_PrivEntry.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccounts_resume_handle, - { "Resume Handle", "lsarpc.lsa_EnumAccounts.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids3_level, - { "Level", "lsarpc.lsa_LookupSids3.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DATA_BUF_data, - { "Data", "lsarpc.lsa_DATA_BUF.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomainByName_name, - { "Name", "lsarpc.lsa_OpenTrustedDomainByName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainListEx_count, - { "Count", "lsarpc.lsa_DomainListEx.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DeleteTrustedDomain_dom_sid, + { "Dom Sid", "lsarpc.lsa_DeleteTrustedDomain.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DeleteTrustedDomain_handle, + { "Handle", "lsarpc.lsa_DeleteTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_Delete_handle, + { "Handle", "lsarpc.lsa_Delete.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DnsDomainInfo_dns_domain, + { "Dns Domain", "lsarpc.lsa_DnsDomainInfo.dns_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DnsDomainInfo_dns_forest, + { "Dns Forest", "lsarpc.lsa_DnsDomainInfo.dns_forest", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DnsDomainInfo_domain_guid, + { "Domain Guid", "lsarpc.lsa_DnsDomainInfo.domain_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DnsDomainInfo_name, + { "Name", "lsarpc.lsa_DnsDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DnsDomainInfo_sid, + { "Sid", "lsarpc.lsa_DnsDomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH, { "Lsa Domain Query Auth", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_AUTH", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_AUTH_tfs), ( 0x00000040 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_DefaultQuotaInfo_pagefile, - { "Pagefile", "lsarpc.lsa_DefaultQuotaInfo.pagefile", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DefaultQuotaInfo_min_wss, - { "Min Wss", "lsarpc.lsa_DefaultQuotaInfo.min_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustData_top_level_name, - { "Top Level Name", "lsarpc.lsa_ForestTrustData.top_level_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedName2_sid_type, - { "Sid Type", "lsarpc.lsa_TranslatedName2.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle, - { "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex, - { "Info Ex", "lsarpc.lsa_TrustDomainInfoFullInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DATA_BUF2_data, - { "Data", "lsarpc.lsa_DATA_BUF2.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RemoveAccountRights_handle, - { "Handle", "lsarpc.lsa_RemoveAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_count, - { "Count", "lsarpc.lsa_LookupNames3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_unknown2, - { "Unknown2", "lsarpc.lsa_LookupNames2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle, - { "Resume Handle", "lsarpc.lsa_EnumTrustedDomainsEx.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransNameArray2_count, - { "Count", "lsarpc.lsa_TransNameArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfo_sid, - { "Sid", "lsarpc.lsa_DomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level, - { "Level", "lsarpc.lsa_QueryTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid, - { "Sid", "lsarpc.lsa_TrustDomainInfoInfoEx.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info, - { "Incoming Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_domains, - { "Domains", "lsarpc.lsa_LookupNames3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetSecret_new_val, - { "New Val", "lsarpc.lsa_SetSecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_String_string, - { "String", "lsarpc.lsa_String.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PrivArray_count, - { "Count", "lsarpc.lsa_PrivArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfo_level, - { "Level", "lsarpc.lsa_QueryTrustedDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DATA_BUF_size, - { "Size", "lsarpc.lsa_DATA_BUF.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryDomainInformationPolicy_level, - { "Level", "lsarpc.lsa_QueryDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS, + { "Lsa Domain Query Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_CONTROLLERS_tfs), ( 0x00000002 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME, + { "Lsa Domain Query Domain Name", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_DOMAIN_NAME", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_DOMAIN_NAME_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX, + { "Lsa Domain Query Posix", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_POSIX", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX_tfs), ( 0x00000008 ), NULL, HFILL }}, { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH, { "Lsa Domain Set Auth", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_AUTH", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_AUTH_tfs), ( 0x00000020 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_StringLarge_string, - { "String", "lsarpc.lsa_StringLarge.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfo_name, - { "Name", "lsarpc.lsa_DomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AsciiString_size, - { "Size", "lsarpc.lsa_AsciiString.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_sids, - { "Sids", "lsarpc.lsa_LookupNames2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS, + { "Lsa Domain Set Controllers", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_CONTROLLERS", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_CONTROLLERS_tfs), ( 0x00000004 ), NULL, HFILL }}, { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX, { "Lsa Domain Set Posix", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_SET_POSIX", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_SET_POSIX_tfs), ( 0x00000010 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_SetDomainInformationPolicy_level, - { "Level", "lsarpc.lsa_SetDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_account_access_mask, - { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetInfoPolicy2_info, - { "Info", "lsarpc.lsa_SetInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AsciiStringLarge_string, - { "String", "lsarpc.lsa_AsciiStringLarge.string", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids2_level, - { "Level", "lsarpc.lsa_LookupSids2.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenSecret_sec_handle, - { "Sec Handle", "lsarpc.lsa_OpenSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info, - { "Incoming Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInformationPolicy_efs_info, - { "Efs Info", "lsarpc.lsa_DomainInformationPolicy.efs_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccounts_sids, - { "Sids", "lsarpc.lsa_EnumAccounts.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ReplicaSourceInfo_source, - { "Source", "lsarpc.lsa_ReplicaSourceInfo.source", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_unknown1, - { "Unknown1", "lsarpc.lsa_LookupNames3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QuerySecurity_sec_info, - { "Sec Info", "lsarpc.lsa_QuerySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfoEfs_blob_size, + { "Blob Size", "lsarpc.lsa_DomainInfoEfs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfoEfs_efs_blob, + { "Efs Blob", "lsarpc.lsa_DomainInfoEfs.efs_blob", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfoKerberos_clock_skew, + { "Clock Skew", "lsarpc.lsa_DomainInfoKerberos.clock_skew", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_DomainInfoKerberos_enforce_restrictions, { "Enforce Restrictions", "lsarpc.lsa_DomainInfoKerberos.enforce_restrictions", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids2_domains, - { "Domains", "lsarpc.lsa_LookupSids2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_policy_access_mask, - { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumTrustedDomainsEx_domains, - { "Domains", "lsarpc.lsa_EnumTrustedDomainsEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccounts_num_entries, - { "Num Entries", "lsarpc.lsa_EnumAccounts.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_domain_access_mask, - { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_info_all, - { "Info All", "lsarpc.lsa_TrustedDomainInfo.info_all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset, - { "Posix Offset", "lsarpc.lsa_TrustDomainInfoFullInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_type, - { "Trust Type", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DnsDomainInfo_sid, - { "Sid", "lsarpc.lsa_DnsDomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames_num_names, - { "Num Names", "lsarpc.lsa_LookupNames.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid, - { "Domain Sid", "lsarpc.lsa_ForestTrustDomainInfo.domain_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids_handle, - { "Handle", "lsarpc.lsa_LookupSids.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AsciiString_string, - { "String", "lsarpc.lsa_AsciiString.string", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_info_ex, - { "Info Ex", "lsarpc.lsa_TrustedDomainInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle, - { "Handle", "lsarpc.lsa_RemovePrivilegesFromAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateAccount_handle, - { "Handle", "lsarpc.lsa_CreateAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_name, - { "Name", "lsarpc.lsa_TrustedDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames4_unknown2, - { "Unknown2", "lsarpc.lsa_LookupNames4.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfoKerberos_service_tkt_lifetime, + { "Service Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.service_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfoKerberos_unknown6, + { "Unknown6", "lsarpc.lsa_DomainInfoKerberos.unknown6", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime, + { "User Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_renewaltime, + { "User Tkt Renewaltime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_renewaltime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfo_name, + { "Name", "lsarpc.lsa_DomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInfo_sid, + { "Sid", "lsarpc.lsa_DomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInformationPolicy_efs_info, + { "Efs Info", "lsarpc.lsa_DomainInformationPolicy.efs_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainInformationPolicy_kerberos_info, + { "Kerberos Info", "lsarpc.lsa_DomainInformationPolicy.kerberos_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainListEx_count, + { "Count", "lsarpc.lsa_DomainListEx.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainListEx_domains, + { "Domains", "lsarpc.lsa_DomainListEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainList_count, + { "Count", "lsarpc.lsa_DomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_DomainList_domains, + { "Domains", "lsarpc.lsa_DomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccountRights_handle, + { "Handle", "lsarpc.lsa_EnumAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_EnumAccountRights_rights, { "Rights", "lsarpc.lsa_EnumAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX, - { "Lsa Domain Query Posix", "lsarpc.lsa_DomainAccessMask.LSA_DOMAIN_QUERY_POSIX", FT_BOOLEAN, 32, TFS(&lsa_DomainAccessMask_LSA_DOMAIN_QUERY_POSIX_tfs), ( 0x00000008 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivDisplayName_name, - { "Name", "lsarpc.lsa_LookupPrivDisplayName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION, - { "Lsa Policy Get Private Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_GET_PRIVATE_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION_tfs), ( 0x00000004 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy2_access_mask, - { "Access Mask", "lsarpc.lsa_OpenPolicy2.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetInfoPolicy2_handle, - { "Handle", "lsarpc.lsa_SetInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_sec_desc_buf_len, - { "Sec Desc Buf Len", "lsarpc.sec_desc_buf_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_num_names, - { "Num Names", "lsarpc.lsa_LookupNames2.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetInfoPolicy2_level, - { "Level", "lsarpc.lsa_SetInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccountRights_sid, + { "Sid", "lsarpc.lsa_EnumAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccountsWithUserRight_handle, + { "Handle", "lsarpc.lsa_EnumAccountsWithUserRight.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccountsWithUserRight_name, + { "Name", "lsarpc.lsa_EnumAccountsWithUserRight.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccountsWithUserRight_sids, + { "Sids", "lsarpc.lsa_EnumAccountsWithUserRight.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccounts_handle, + { "Handle", "lsarpc.lsa_EnumAccounts.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccounts_num_entries, + { "Num Entries", "lsarpc.lsa_EnumAccounts.num_entries", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccounts_resume_handle, + { "Resume Handle", "lsarpc.lsa_EnumAccounts.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumAccounts_sids, + { "Sids", "lsarpc.lsa_EnumAccounts.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumPrivsAccount_handle, + { "Handle", "lsarpc.lsa_EnumPrivsAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_EnumPrivsAccount_privs, { "Privs", "lsarpc.lsa_EnumPrivsAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenAccount_access_mask, - { "Access Mask", "lsarpc.lsa_OpenAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumPrivs_handle, + { "Handle", "lsarpc.lsa_EnumPrivs.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumPrivs_max_count, + { "Max Count", "lsarpc.lsa_EnumPrivs.max_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_EnumPrivs_privs, { "Privs", "lsarpc.lsa_EnumPrivs.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN, - { "Lsa Policy Trust Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_TRUST_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN_tfs), ( 0x00000008 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditLogInfo_percent_full, - { "Percent Full", "lsarpc.lsa_AuditLogInfo.percent_full", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_quota, - { "Quota", "lsarpc.lsa_PolicyInformation.quota", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs, - { "Privs", "lsarpc.lsa_RemovePrivilegesFromAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid3_unknown, - { "Unknown", "lsarpc.lsa_TranslatedSid3.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedName_sid_type, - { "Sid Type", "lsarpc.lsa_TranslatedName.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids2_names, - { "Names", "lsarpc.lsa_LookupSids2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumPrivsAccount_handle, - { "Handle", "lsarpc.lsa_EnumPrivsAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SidArray_sids, - { "Sids", "lsarpc.lsa_SidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RemoveAccountRights_sid, - { "Sid", "lsarpc.lsa_RemoveAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfo_info, - { "Info", "lsarpc.lsa_QueryTrustedDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_String_length, - { "Length", "lsarpc.lsa_String.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_opnum, - { "Operation", "lsarpc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PrivilegeSet_count, - { "Count", "lsarpc.lsa_PrivilegeSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_level, - { "Level", "lsarpc.lsa_SetTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivDisplayName_language_id, - { "Language Id", "lsarpc.lsa_LookupPrivDisplayName.language_id", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransSidArray3_sids, - { "Sids", "lsarpc.lsa_TransSidArray3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_status, - { "NT Error", "lsarpc.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames_count, - { "Count", "lsarpc.lsa_LookupNames.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_previous_auth_info, - { "Outgoing Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivValue_name, - { "Name", "lsarpc.lsa_LookupPrivValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustBinaryData_data, - { "Data", "lsarpc.lsa_ForestTrustBinaryData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS, - { "Lsa Account Adjust System Access", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS_tfs), ( 0x00000008 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid_sid_index, - { "Sid Index", "lsarpc.lsa_TranslatedSid.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT, - { "Lsa Policy Create Account", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_ACCOUNT", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT_tfs), ( 0x00000010 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_AsciiStringLarge_length, - { "Length", "lsarpc.lsa_AsciiStringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle, - { "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomainByName.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransNameArray2_names, - { "Names", "lsarpc.lsa_TransNameArray2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumPrivs_resume_handle, + { "Resume Handle", "lsarpc.lsa_EnumPrivs.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumTrustDom_domains, + { "Domains", "lsarpc.lsa_EnumTrustDom.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_EnumTrustDom_handle, { "Handle", "lsarpc.lsa_EnumTrustDom.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateAccount_access_mask, - { "Access Mask", "lsarpc.lsa_CreateAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy2_attr, - { "Attr", "lsarpc.lsa_OpenPolicy2.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name, - { "Netbios Name", "lsarpc.lsa_TrustDomainInfoInfoEx.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumTrustDom_max_size, + { "Max Size", "lsarpc.lsa_EnumTrustDom.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumTrustDom_resume_handle, + { "Resume Handle", "lsarpc.lsa_EnumTrustDom.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumTrustedDomainsEx_domains, + { "Domains", "lsarpc.lsa_EnumTrustedDomainsEx.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumTrustedDomainsEx_handle, + { "Handle", "lsarpc.lsa_EnumTrustedDomainsEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumTrustedDomainsEx_max_size, + { "Max Size", "lsarpc.lsa_EnumTrustedDomainsEx.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_EnumTrustedDomainsEx_resume_handle, + { "Resume Handle", "lsarpc.lsa_EnumTrustedDomainsEx.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustBinaryData_data, + { "Data", "lsarpc.lsa_ForestTrustBinaryData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustBinaryData_length, + { "Length", "lsarpc.lsa_ForestTrustBinaryData.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustData_data, + { "Data", "lsarpc.lsa_ForestTrustData.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustData_domain_info, + { "Domain Info", "lsarpc.lsa_ForestTrustData.domain_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustData_top_level_name, + { "Top Level Name", "lsarpc.lsa_ForestTrustData.top_level_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustData_top_level_name_ex, + { "Top Level Name Ex", "lsarpc.lsa_ForestTrustData.top_level_name_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name, + { "Dns Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.dns_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustDomainInfo_domain_sid, + { "Domain Sid", "lsarpc.lsa_ForestTrustDomainInfo.domain_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustDomainInfo_netbios_domain_name, + { "Netbios Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.netbios_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustInformation_count, + { "Count", "lsarpc.lsa_ForestTrustInformation.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustInformation_entries, + { "Entries", "lsarpc.lsa_ForestTrustInformation.entries", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_ForestTrustRecord_flags, { "Flags", "lsarpc.lsa_ForestTrustRecord.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy_system_name, - { "System Name", "lsarpc.lsa_OpenPolicy.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids2_sids, - { "Sids", "lsarpc.lsa_LookupSids2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedName_sid_index, - { "Sid Index", "lsarpc.lsa_TranslatedName.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_password, - { "Password", "lsarpc.lsa_TrustedDomainInfo.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ModificationInfo_db_create_time, - { "Db Create Time", "lsarpc.lsa_ModificationInfo.db_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION, - { "Lsa Policy Notification", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_NOTIFICATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION_tfs), ( 0x00001000 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_domain, - { "Domain", "lsarpc.lsa_PolicyInformation.domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DATA_BUF2_size, - { "Size", "lsarpc.lsa_DATA_BUF2.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle, - { "Handle", "lsarpc.lsa_QueryTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS, - { "Lsa Policy Set Audit Requirements", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_AUDIT_REQUIREMENTS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS_tfs), ( 0x00000100 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustRecord_forest_trust_data, + { "Forest Trust Data", "lsarpc.lsa_ForestTrustRecord.forest_trust_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustRecord_level, + { "Level", "lsarpc.lsa_ForestTrustRecord.level", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_ForestTrustRecordType_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ForestTrustRecord_unknown, + { "Unknown", "lsarpc.lsa_ForestTrustRecord.unknown", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_GetUserName_account_name, + { "Account Name", "lsarpc.lsa_GetUserName.account_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_GetUserName_authority_name, + { "Authority Name", "lsarpc.lsa_GetUserName.authority_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_GetUserName_system_name, + { "System Name", "lsarpc.lsa_GetUserName.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LUIDAttribute_attribute, + { "Attribute", "lsarpc.lsa_LUIDAttribute.attribute", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LUIDAttribute_luid, + { "Luid", "lsarpc.lsa_LUIDAttribute.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LUID_high, + { "High", "lsarpc.lsa_LUID.high", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LUID_low, + { "Low", "lsarpc.lsa_LUID.low", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_count, + { "Count", "lsarpc.lsa_LookupNames2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_domains, + { "Domains", "lsarpc.lsa_LookupNames2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_handle, + { "Handle", "lsarpc.lsa_LookupNames2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_level, + { "Level", "lsarpc.lsa_LookupNames2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_names, + { "Names", "lsarpc.lsa_LookupNames2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_num_names, + { "Num Names", "lsarpc.lsa_LookupNames2.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_sids, + { "Sids", "lsarpc.lsa_LookupNames2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupNames2_unknown1, { "Unknown1", "lsarpc.lsa_LookupNames2.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames2_unknown2, + { "Unknown2", "lsarpc.lsa_LookupNames2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_count, + { "Count", "lsarpc.lsa_LookupNames3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_domains, + { "Domains", "lsarpc.lsa_LookupNames3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_handle, + { "Handle", "lsarpc.lsa_LookupNames3.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_level, + { "Level", "lsarpc.lsa_LookupNames3.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_names, + { "Names", "lsarpc.lsa_LookupNames3.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_num_names, + { "Num Names", "lsarpc.lsa_LookupNames3.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_sids, + { "Sids", "lsarpc.lsa_LookupNames3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_unknown1, + { "Unknown1", "lsarpc.lsa_LookupNames3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames3_unknown2, + { "Unknown2", "lsarpc.lsa_LookupNames3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames4_count, + { "Count", "lsarpc.lsa_LookupNames4.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupNames4_domains, { "Domains", "lsarpc.lsa_LookupNames4.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids3_unknown2, - { "Unknown2", "lsarpc.lsa_LookupSids3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid_sid_type, - { "Sid Type", "lsarpc.lsa_TranslatedSid.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_count, - { "Count", "lsarpc.lsa_LookupNames2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustDomainInfo_dns_domain_name, - { "Dns Domain Name", "lsarpc.lsa_ForestTrustDomainInfo.dns_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditLogInfo_next_audit_record, - { "Next Audit Record", "lsarpc.lsa_AuditLogInfo.next_audit_record", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PrivArray_privs, - { "Privs", "lsarpc.lsa_PrivArray.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransSidArray2_sids, - { "Sids", "lsarpc.lsa_TransSidArray2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransSidArray3_count, - { "Count", "lsarpc.lsa_TransSidArray3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle, - { "Handle", "lsarpc.lsa_lsaRQueryForestTrustInformation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainList_count, - { "Count", "lsarpc.lsa_DomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QuerySecret_sec_handle, - { "Sec Handle", "lsarpc.lsa_QuerySecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditFullQueryInfo_shutdown_on_full, - { "Shutdown On Full", "lsarpc.lsa_AuditFullQueryInfo.shutdown_on_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_GetUserName_system_name, - { "System Name", "lsarpc.lsa_GetUserName.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SidArray_num_sids, - { "Num Sids", "lsarpc.lsa_SidArray.num_sids", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupNames4_level, { "Level", "lsarpc.lsa_LookupNames4.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle, - { "Handle", "lsarpc.lsa_QueryTrustedDomainInfoBySid.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RightSet_names, - { "Names", "lsarpc.lsa_RightSet.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames4_names, + { "Names", "lsarpc.lsa_LookupNames4.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames4_num_names, + { "Num Names", "lsarpc.lsa_LookupNames4.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames4_sids, + { "Sids", "lsarpc.lsa_LookupNames4.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames4_unknown1, + { "Unknown1", "lsarpc.lsa_LookupNames4.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames4_unknown2, + { "Unknown2", "lsarpc.lsa_LookupNames4.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames_count, + { "Count", "lsarpc.lsa_LookupNames.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupNames_domains, { "Domains", "lsarpc.lsa_LookupNames.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids2_unknown2, - { "Unknown2", "lsarpc.lsa_LookupSids2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames_handle, + { "Handle", "lsarpc.lsa_LookupNames.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames_level, + { "Level", "lsarpc.lsa_LookupNames.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames_names, + { "Names", "lsarpc.lsa_LookupNames.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupNames_num_names, + { "Num Names", "lsarpc.lsa_LookupNames.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupNames_sids, { "Sids", "lsarpc.lsa_LookupNames.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccountsWithUserRight_name, - { "Name", "lsarpc.lsa_EnumAccountsWithUserRight.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivDisplayName_disp_name, + { "Disp Name", "lsarpc.lsa_LookupPrivDisplayName.disp_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivDisplayName_handle, + { "Handle", "lsarpc.lsa_LookupPrivDisplayName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivDisplayName_language_id, + { "Language Id", "lsarpc.lsa_LookupPrivDisplayName.language_id", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivDisplayName_name, + { "Name", "lsarpc.lsa_LookupPrivDisplayName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivDisplayName_unknown, + { "Unknown", "lsarpc.lsa_LookupPrivDisplayName.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivName_handle, + { "Handle", "lsarpc.lsa_LookupPrivName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivName_luid, + { "Luid", "lsarpc.lsa_LookupPrivName.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupPrivName_name, { "Name", "lsarpc.lsa_LookupPrivName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION, - { "Lsa Policy View Local Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_LOCAL_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION_tfs), ( 0x00000001 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames4_sids, - { "Sids", "lsarpc.lsa_LookupNames4.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RefDomainList_domains, - { "Domains", "lsarpc.lsa_RefDomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetDomainInformationPolicy_info, - { "Info", "lsarpc.lsa_SetDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetDomainInformationPolicy_handle, - { "Handle", "lsarpc.lsa_SetDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_replica, - { "Replica", "lsarpc.lsa_PolicyInformation.replica", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex, - { "Info Ex", "lsarpc.lsa_TrustDomainInfoInfoAll.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransSidArray_count, - { "Count", "lsarpc.lsa_TransSidArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info, - { "Auth Info", "lsarpc.lsa_TrustDomainInfoFullInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccountRights_handle, - { "Handle", "lsarpc.lsa_EnumAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditLogInfo_time_to_shutdown, - { "Time To Shutdown", "lsarpc.lsa_AuditLogInfo.time_to_shutdown", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_VIEW, - { "Lsa Account View", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_VIEW", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_VIEW_tfs), ( 0x00000001 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name, - { "Domain Name", "lsarpc.lsa_TrustDomainInfoInfoEx.domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids3_unknown1, - { "Unknown1", "lsarpc.lsa_LookupSids3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivValue_handle, + { "Handle", "lsarpc.lsa_LookupPrivValue.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivValue_luid, + { "Luid", "lsarpc.lsa_LookupPrivValue.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupPrivValue_name, + { "Name", "lsarpc.lsa_LookupPrivValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupSids2_count, { "Count", "lsarpc.lsa_LookupSids2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_info_basic, - { "Info Basic", "lsarpc.lsa_TrustedDomainInfo.info_basic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset, - { "Posix Offset", "lsarpc.lsa_TrustDomainInfoPosixOffset.posix_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenSecret_name, - { "Name", "lsarpc.lsa_OpenSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_db, - { "Db", "lsarpc.lsa_PolicyInformation.db", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_String_name, - { "String", "lsarpc.lsa.string", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_GetUserName_account_name, - { "Account Name", "lsarpc.lsa_GetUserName.account_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LUIDAttribute_attribute, - { "Attribute", "lsarpc.lsa_LUIDAttribute.attribute", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DATA_BUF_PTR_buf, - { "Buf", "lsarpc.lsa_DATA_BUF_PTR.buf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy_access_mask, - { "Access Mask", "lsarpc.lsa_OpenPolicy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids3_sids, - { "Sids", "lsarpc.lsa_LookupSids3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_String_size, - { "Size", "lsarpc.lsa_String.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info, - { "Outgoing Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustedDomainInfo_posix_offset, - { "Posix Offset", "lsarpc.lsa_TrustedDomainInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfoKerberos_unknown6, - { "Unknown6", "lsarpc.lsa_DomainInfoKerberos.unknown6", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids2_domains, + { "Domains", "lsarpc.lsa_LookupSids2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids2_handle, + { "Handle", "lsarpc.lsa_LookupSids2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids2_level, + { "Level", "lsarpc.lsa_LookupSids2.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids2_names, + { "Names", "lsarpc.lsa_LookupSids2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids2_sids, + { "Sids", "lsarpc.lsa_LookupSids2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupSids2_unknown1, { "Unknown1", "lsarpc.lsa_LookupSids2.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenAccount_sid, - { "Sid", "lsarpc.lsa_OpenAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle, - { "Handle", "lsarpc.lsa_SetTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DnsDomainInfo_domain_guid, - { "Domain Guid", "lsarpc.lsa_DnsDomainInfo.domain_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LUIDAttribute_luid, - { "Luid", "lsarpc.lsa_LUIDAttribute.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfoKerberos_user_tkt_lifetime, - { "User Tkt Lifetime", "lsarpc.lsa_DomainInfoKerberos.user_tkt_lifetime", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AddAccountRights_rights, - { "Rights", "lsarpc.lsa_AddAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1, - { "Data1", "lsarpc.lsa_TrustDomainInfoInfoAll.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PrivilegeSet_unknown, - { "Unknown", "lsarpc.lsa_PrivilegeSet.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ObjectAttribute_root_dir, - { "Root Dir", "lsarpc.lsa_ObjectAttribute.root_dir", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids2_unknown2, + { "Unknown2", "lsarpc.lsa_LookupSids2.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids3_count, + { "Count", "lsarpc.lsa_LookupSids3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids3_domains, + { "Domains", "lsarpc.lsa_LookupSids3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids3_level, + { "Level", "lsarpc.lsa_LookupSids3.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_LookupSids3_names, { "Names", "lsarpc.lsa_LookupSids3.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateSecret_handle, - { "Handle", "lsarpc.lsa_CreateSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_StringLarge_length, - { "Length", "lsarpc.lsa_StringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS, - { "Lsa Account Adjust Quotas", "lsarpc.lsa_AccountAccessMask.LSA_ACCOUNT_ADJUST_QUOTAS", FT_BOOLEAN, 32, TFS(&lsa_AccountAccessMask_LSA_ACCOUNT_ADJUST_QUOTAS_tfs), ( 0x00000004 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_names, - { "Names", "lsarpc.lsa_LookupNames2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids3_sids, + { "Sids", "lsarpc.lsa_LookupSids3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids3_unknown1, + { "Unknown1", "lsarpc.lsa_LookupSids3.unknown1", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids3_unknown2, + { "Unknown2", "lsarpc.lsa_LookupSids3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids_count, + { "Count", "lsarpc.lsa_LookupSids.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids_domains, + { "Domains", "lsarpc.lsa_LookupSids.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids_handle, + { "Handle", "lsarpc.lsa_LookupSids.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids_level, + { "Level", "lsarpc.lsa_LookupSids.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids_names, + { "Names", "lsarpc.lsa_LookupSids.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_LookupSids_sids, + { "Sids", "lsarpc.lsa_LookupSids.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ModificationInfo_db_create_time, + { "Db Create Time", "lsarpc.lsa_ModificationInfo.db_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ModificationInfo_modified_id, + { "Modified Id", "lsarpc.lsa_ModificationInfo.modified_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ObjectAttribute_attributes, + { "Attributes", "lsarpc.lsa_ObjectAttribute.attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ObjectAttribute_len, + { "Len", "lsarpc.lsa_ObjectAttribute.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ObjectAttribute_object_name, + { "Object Name", "lsarpc.lsa_ObjectAttribute.object_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ObjectAttribute_root_dir, + { "Root Dir", "lsarpc.lsa_ObjectAttribute.root_dir", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ObjectAttribute_sec_desc, + { "Sec Desc", "lsarpc.lsa_ObjectAttribute.sec_desc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ObjectAttribute_sec_qos, + { "Sec Qos", "lsarpc.lsa_ObjectAttribute.sec_qos", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenAccount_access_mask, + { "Access Mask", "lsarpc.lsa_OpenAccount.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_OpenAccount_acct_handle, { "Acct Handle", "lsarpc.lsa_OpenAccount.acct_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_StringPointer_string, - { "String", "lsarpc.lsa_StringPointer.string", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenAccount_handle, + { "Handle", "lsarpc.lsa_OpenAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenAccount_sid, + { "Sid", "lsarpc.lsa_OpenAccount.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy2_access_mask, + { "Access Mask", "lsarpc.lsa_OpenPolicy2.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy2_attr, + { "Attr", "lsarpc.lsa_OpenPolicy2.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy2_handle, + { "Handle", "lsarpc.lsa_OpenPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy2_system_name, + { "System Name", "lsarpc.lsa_OpenPolicy2.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy_access_mask, + { "Access Mask", "lsarpc.lsa_OpenPolicy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy_attr, + { "Attr", "lsarpc.lsa_OpenPolicy.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy_handle, + { "Handle", "lsarpc.lsa_OpenPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenPolicy_system_name, + { "System Name", "lsarpc.lsa_OpenPolicy.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenSecret_access_mask, + { "Access Mask", "lsarpc.lsa_OpenSecret.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenSecret_handle, + { "Handle", "lsarpc.lsa_OpenSecret.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenSecret_name, + { "Name", "lsarpc.lsa_OpenSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenSecret_sec_handle, + { "Sec Handle", "lsarpc.lsa_OpenSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomainByName_access_mask, + { "Access Mask", "lsarpc.lsa_OpenTrustedDomainByName.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomainByName_handle, + { "Handle", "lsarpc.lsa_OpenTrustedDomainByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomainByName_name, + { "Name", "lsarpc.lsa_OpenTrustedDomainByName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomainByName_trustdom_handle, + { "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomainByName.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomain_access_mask, + { "Access Mask", "lsarpc.lsa_OpenTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomain_handle, + { "Handle", "lsarpc.lsa_OpenTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomain_sid, + { "Sid", "lsarpc.lsa_OpenTrustedDomain.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_OpenTrustedDomain_trustdom_handle, + { "Trustdom Handle", "lsarpc.lsa_OpenTrustedDomain.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PDAccountInfo_name, + { "Name", "lsarpc.lsa_PDAccountInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN, + { "Lsa Policy Audit Log Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_AUDIT_LOG_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_AUDIT_LOG_ADMIN_tfs), ( 0x00000200 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT, + { "Lsa Policy Create Account", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_ACCOUNT", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_ACCOUNT_tfs), ( 0x00000010 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE, + { "Lsa Policy Create Privilege", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_PRIVILEGE", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_PRIVILEGE_tfs), ( 0x00000040 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET, + { "Lsa Policy Create Secret", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_CREATE_SECRET", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_CREATE_SECRET_tfs), ( 0x00000020 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION, + { "Lsa Policy Get Private Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_GET_PRIVATE_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_GET_PRIVATE_INFORMATION_tfs), ( 0x00000004 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES, + { "Lsa Policy Lookup Names", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_LOOKUP_NAMES", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES_tfs), ( 0x00000800 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION, + { "Lsa Policy Notification", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_NOTIFICATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_NOTIFICATION_tfs), ( 0x00001000 ), NULL, HFILL }}, { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN, { "Lsa Policy Server Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SERVER_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SERVER_ADMIN_tfs), ( 0x00000400 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS, + { "Lsa Policy Set Audit Requirements", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_AUDIT_REQUIREMENTS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_AUDIT_REQUIREMENTS_tfs), ( 0x00000100 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS, + { "Lsa Policy Set Default Quota Limits", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS_tfs), ( 0x00000080 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN, + { "Lsa Policy Trust Admin", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_TRUST_ADMIN", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_TRUST_ADMIN_tfs), ( 0x00000008 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION, + { "Lsa Policy View Audit Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_AUDIT_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION_tfs), ( 0x00000002 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION, + { "Lsa Policy View Local Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_LOCAL_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_LOCAL_INFORMATION_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_account_domain, + { "Account Domain", "lsarpc.lsa_PolicyInformation.account_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_audit_events, + { "Audit Events", "lsarpc.lsa_PolicyInformation.audit_events", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_audit_log, + { "Audit Log", "lsarpc.lsa_PolicyInformation.audit_log", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_auditfullquery, + { "Auditfullquery", "lsarpc.lsa_PolicyInformation.auditfullquery", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_auditfullset, + { "Auditfullset", "lsarpc.lsa_PolicyInformation.auditfullset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_db, + { "Db", "lsarpc.lsa_PolicyInformation.db", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_dns, + { "Dns", "lsarpc.lsa_PolicyInformation.dns", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_domain, + { "Domain", "lsarpc.lsa_PolicyInformation.domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_pd, + { "Pd", "lsarpc.lsa_PolicyInformation.pd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_quota, + { "Quota", "lsarpc.lsa_PolicyInformation.quota", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_replica, + { "Replica", "lsarpc.lsa_PolicyInformation.replica", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PolicyInformation_role, + { "Role", "lsarpc.lsa_PolicyInformation.role", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PrivArray_count, + { "Count", "lsarpc.lsa_PrivArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PrivArray_privs, + { "Privs", "lsarpc.lsa_PrivArray.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PrivEntry_luid, + { "Luid", "lsarpc.lsa_PrivEntry.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PrivEntry_name, + { "Name", "lsarpc.lsa_PrivEntry.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PrivilegeSet_count, + { "Count", "lsarpc.lsa_PrivilegeSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PrivilegeSet_set, + { "Set", "lsarpc.lsa_PrivilegeSet.set", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_PrivilegeSet_unknown, + { "Unknown", "lsarpc.lsa_PrivilegeSet.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QosInfo_context_mode, + { "Context Mode", "lsarpc.lsa_QosInfo.context_mode", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QosInfo_effective_only, + { "Effective Only", "lsarpc.lsa_QosInfo.effective_only", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QosInfo_impersonation_level, + { "Impersonation Level", "lsarpc.lsa_QosInfo.impersonation_level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SecurityImpersonationLevel_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QosInfo_len, + { "Len", "lsarpc.lsa_QosInfo.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryDomainInformationPolicy_handle, + { "Handle", "lsarpc.lsa_QueryDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryDomainInformationPolicy_info, + { "Info", "lsarpc.lsa_QueryDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryDomainInformationPolicy_level, + { "Level", "lsarpc.lsa_QueryDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryInfoPolicy2_handle, + { "Handle", "lsarpc.lsa_QueryInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryInfoPolicy2_info, + { "Info", "lsarpc.lsa_QueryInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryInfoPolicy2_level, + { "Level", "lsarpc.lsa_QueryInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryInfoPolicy_handle, + { "Handle", "lsarpc.lsa_QueryInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryInfoPolicy_info, + { "Info", "lsarpc.lsa_QueryInfoPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryInfoPolicy_level, + { "Level", "lsarpc.lsa_QueryInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QuerySecret_new_mtime, + { "New Mtime", "lsarpc.lsa_QuerySecret.new_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QuerySecret_new_val, + { "New Val", "lsarpc.lsa_QuerySecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QuerySecret_old_mtime, + { "Old Mtime", "lsarpc.lsa_QuerySecret.old_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_QuerySecret_old_val, { "Old Val", "lsarpc.lsa_QuerySecret.old_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DeleteTrustedDomain_handle, - { "Handle", "lsarpc.lsa_DeleteTrustedDomain.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivDisplayName_handle, - { "Handle", "lsarpc.lsa_LookupPrivDisplayName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_domains, - { "Domains", "lsarpc.lsa_LookupNames2.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumPrivs_resume_handle, - { "Resume Handle", "lsarpc.lsa_EnumPrivs.resume_handle", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_handle, - { "Handle", "lsarpc.lsa_LookupNames2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_info, - { "Info", "lsarpc.lsa_SetTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AddPrivilegesToAccount_privs, - { "Privs", "lsarpc.lsa_AddPrivilegesToAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_Close_handle, - { "Handle", "lsarpc.lsa_Close.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedName2_name, - { "Name", "lsarpc.lsa_TranslatedName2.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AddAccountRights_sid, - { "Sid", "lsarpc.lsa_AddAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivValue_luid, - { "Luid", "lsarpc.lsa_LookupPrivValue.luid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES, - { "Lsa Policy Lookup Names", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_LOOKUP_NAMES", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_LOOKUP_NAMES_tfs), ( 0x00000800 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedName2_unknown, - { "Unknown", "lsarpc.lsa_TranslatedName2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustRecord_unknown, - { "Unknown", "lsarpc.lsa_ForestTrustRecord.unknown", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateTrustedDomain_access_mask, - { "Access Mask", "lsarpc.lsa_CreateTrustedDomain.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainList_domains, - { "Domains", "lsarpc.lsa_DomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CreateSecret_name, - { "Name", "lsarpc.lsa_CreateSecret.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditEventsInfo_auditing_mode, - { "Auditing Mode", "lsarpc.lsa_AuditEventsInfo.auditing_mode", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QuerySecret_sec_handle, + { "Sec Handle", "lsarpc.lsa_QuerySecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QuerySecurity_handle, + { "Handle", "lsarpc.lsa_QuerySecurity.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QuerySecurity_sdbuf, + { "Sdbuf", "lsarpc.lsa_QuerySecurity.sdbuf", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QuerySecurity_sec_info, + { "Sec Info", "lsarpc.lsa_QuerySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_handle, + { "Handle", "lsarpc.lsa_QueryTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info, + { "Info", "lsarpc.lsa_QueryTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_level, + { "Level", "lsarpc.lsa_QueryTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_trusted_domain, + { "Trusted Domain", "lsarpc.lsa_QueryTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_dom_sid, + { "Dom Sid", "lsarpc.lsa_QueryTrustedDomainInfoBySid.dom_sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_handle, + { "Handle", "lsarpc.lsa_QueryTrustedDomainInfoBySid.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_info, { "Info", "lsarpc.lsa_QueryTrustedDomainInfoBySid.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccountsWithUserRight_sids, - { "Sids", "lsarpc.lsa_EnumAccountsWithUserRight.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfoBySid_level, + { "Level", "lsarpc.lsa_QueryTrustedDomainInfoBySid.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfo_info, + { "Info", "lsarpc.lsa_QueryTrustedDomainInfo.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfo_level, + { "Level", "lsarpc.lsa_QueryTrustedDomainInfo.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle, + { "Trustdom Handle", "lsarpc.lsa_QueryTrustedDomainInfo.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RefDomainList_count, + { "Count", "lsarpc.lsa_RefDomainList.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RefDomainList_domains, + { "Domains", "lsarpc.lsa_RefDomainList.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RefDomainList_max_size, + { "Max Size", "lsarpc.lsa_RefDomainList.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RemoveAccountRights_handle, + { "Handle", "lsarpc.lsa_RemoveAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RemoveAccountRights_rights, + { "Rights", "lsarpc.lsa_RemoveAccountRights.rights", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RemoveAccountRights_sid, + { "Sid", "lsarpc.lsa_RemoveAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RemoveAccountRights_unknown, + { "Unknown", "lsarpc.lsa_RemoveAccountRights.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RemovePrivilegesFromAccount_handle, + { "Handle", "lsarpc.lsa_RemovePrivilegesFromAccount.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RemovePrivilegesFromAccount_privs, + { "Privs", "lsarpc.lsa_RemovePrivilegesFromAccount.privs", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all, + { "Remove All", "lsarpc.lsa_RemovePrivilegesFromAccount.remove_all", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ReplicaSourceInfo_account, + { "Account", "lsarpc.lsa_ReplicaSourceInfo.account", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_ReplicaSourceInfo_source, + { "Source", "lsarpc.lsa_ReplicaSourceInfo.source", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RightAttribute_name, + { "Name", "lsarpc.lsa_RightAttribute.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RightSet_count, + { "Count", "lsarpc.lsa_RightSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_RightSet_names, + { "Names", "lsarpc.lsa_RightSet.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE, + { "Lsa Secret Query Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE_tfs), ( 0x00000002 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE, + { "Lsa Secret Set Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_SET_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_SET_VALUE_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_lsarpc_lsa_ServerRole_role, + { "Role", "lsarpc.lsa_ServerRole.role", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyServerRole_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetDomainInformationPolicy_handle, + { "Handle", "lsarpc.lsa_SetDomainInformationPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetDomainInformationPolicy_info, + { "Info", "lsarpc.lsa_SetDomainInformationPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetDomainInformationPolicy_level, + { "Level", "lsarpc.lsa_SetDomainInformationPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_DomainInfoEnum_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetInfoPolicy2_handle, + { "Handle", "lsarpc.lsa_SetInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetInfoPolicy2_info, + { "Info", "lsarpc.lsa_SetInfoPolicy2.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetInfoPolicy2_level, + { "Level", "lsarpc.lsa_SetInfoPolicy2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetInfoPolicy_handle, + { "Handle", "lsarpc.lsa_SetInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_SetInfoPolicy_info, { "Info", "lsarpc.lsa_SetInfoPolicy.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetInfoPolicy_level, + { "Level", "lsarpc.lsa_SetInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetSecret_new_val, + { "New Val", "lsarpc.lsa_SetSecret.new_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetSecret_old_val, + { "Old Val", "lsarpc.lsa_SetSecret.old_val", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetSecret_sec_handle, + { "Sec Handle", "lsarpc.lsa_SetSecret.sec_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_handle, + { "Handle", "lsarpc.lsa_SetTrustedDomainInfoByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_info, + { "Info", "lsarpc.lsa_SetTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_level, + { "Level", "lsarpc.lsa_SetTrustedDomainInfoByName.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_TrustDomInfoEnum_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SetTrustedDomainInfoByName_trusted_domain, + { "Trusted Domain", "lsarpc.lsa_SetTrustedDomainInfoByName.trusted_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SidArray_num_sids, + { "Num Sids", "lsarpc.lsa_SidArray.num_sids", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_SidArray_sids, + { "Sids", "lsarpc.lsa_SidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_SidPtr_sid, { "Sid", "lsarpc.lsa_SidPtr.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfoByName_info, - { "Info", "lsarpc.lsa_QueryTrustedDomainInfoByName.info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_names, - { "Names", "lsarpc.lookup.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PDAccountInfo_name, - { "Name", "lsarpc.lsa_PDAccountInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QuerySecurity_handle, - { "Handle", "lsarpc.lsa_QuerySecurity.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustInformation_count, - { "Count", "lsarpc.lsa_ForestTrustInformation.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown, - { "Unknown", "lsarpc.lsa_lsaRQueryForestTrustInformation.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids3_domains, - { "Domains", "lsarpc.lsa_LookupSids3.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_Strings_count, - { "Count", "lsarpc.lsa_Strings.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryInfoPolicy2_handle, - { "Handle", "lsarpc.lsa_QueryInfoPolicy2.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryTrustedDomainInfo_trustdom_handle, - { "Trustdom Handle", "lsarpc.lsa_QueryTrustedDomainInfo.trustdom_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoBuffer_data, - { "Data", "lsarpc.lsa_TrustDomainInfoBuffer.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ObjectAttribute_attributes, - { "Attributes", "lsarpc.lsa_ObjectAttribute.attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_StringLarge_length, + { "Length", "lsarpc.lsa_StringLarge.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_StringLarge_size, { "Size", "lsarpc.lsa_StringLarge.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QosInfo_effective_only, - { "Effective Only", "lsarpc.lsa_QosInfo.effective_only", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ObjectAttribute_len, - { "Len", "lsarpc.lsa_ObjectAttribute.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy_attr, - { "Attr", "lsarpc.lsa_OpenPolicy.attr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoBasic_sid, - { "Sid", "lsarpc.lsa_TrustDomainInfoBasic.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PrivEntry_name, - { "Name", "lsarpc.lsa_PrivEntry.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ServerRole_role, - { "Role", "lsarpc.lsa_ServerRole.role", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyServerRole_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid3_sid_type, - { "Sid Type", "lsarpc.lsa_TranslatedSid3.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames4_num_names, - { "Num Names", "lsarpc.lsa_LookupNames4.num_names", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustRecord_level, - { "Level", "lsarpc.lsa_ForestTrustRecord.level", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_ForestTrustRecordType_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumPrivs_max_count, - { "Max Count", "lsarpc.lsa_EnumPrivs.max_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames2_level, - { "Level", "lsarpc.lsa_LookupNames2.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_LookupNamesLevel_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupNames3_unknown2, - { "Unknown2", "lsarpc.lsa_LookupNames3.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DATA_BUF_length, - { "Length", "lsarpc.lsa_DATA_BUF.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_StringLarge_string, + { "String", "lsarpc.lsa_StringLarge.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_StringPointer_string, + { "String", "lsarpc.lsa_StringPointer.string", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_String_length, + { "Length", "lsarpc.lsa_String.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_String_size, + { "Size", "lsarpc.lsa_String.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_String_string, + { "String", "lsarpc.lsa_String.string", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_Strings_count, + { "Count", "lsarpc.lsa_Strings.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_Strings_names, { "Names", "lsarpc.lsa_Strings.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivDisplayName_unknown, - { "Unknown", "lsarpc.lsa_LookupPrivDisplayName.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_auditfullset, - { "Auditfullset", "lsarpc.lsa_PolicyInformation.auditfullset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ForestTrustData_data, - { "Data", "lsarpc.lsa_ForestTrustData.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy_handle, - { "Handle", "lsarpc.lsa_OpenPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids_count, - { "Count", "lsarpc.lsa_LookupSids.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DnsDomainInfo_dns_domain, - { "Dns Domain", "lsarpc.lsa_DnsDomainInfo.dns_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransNameArray2_count, + { "Count", "lsarpc.lsa_TransNameArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransNameArray2_names, + { "Names", "lsarpc.lsa_TransNameArray2.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransNameArray_count, + { "Count", "lsarpc.lsa_TransNameArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransNameArray_names, + { "Names", "lsarpc.lsa_TransNameArray.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransSidArray2_count, + { "Count", "lsarpc.lsa_TransSidArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransSidArray2_sids, + { "Sids", "lsarpc.lsa_TransSidArray2.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransSidArray3_count, + { "Count", "lsarpc.lsa_TransSidArray3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransSidArray3_sids, + { "Sids", "lsarpc.lsa_TransSidArray3.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransSidArray_count, + { "Count", "lsarpc.lsa_TransSidArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TransSidArray_sids, + { "Sids", "lsarpc.lsa_TransSidArray.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedName2_name, + { "Name", "lsarpc.lsa_TranslatedName2.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedName2_sid_index, + { "Sid Index", "lsarpc.lsa_TranslatedName2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedName2_sid_type, + { "Sid Type", "lsarpc.lsa_TranslatedName2.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedName2_unknown, + { "Unknown", "lsarpc.lsa_TranslatedName2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_TranslatedName_name, { "Name", "lsarpc.lsa_TranslatedName.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QueryInfoPolicy_level, - { "Level", "lsarpc.lsa_QueryInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids_domains, - { "Domains", "lsarpc.lsa_LookupSids.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid_rid, - { "Rid", "lsarpc.lsa_TranslatedSid.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfoEfs_efs_blob, - { "Efs Blob", "lsarpc.lsa_DomainInfoEfs.efs_blob", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RemovePrivilegesFromAccount_remove_all, - { "Remove All", "lsarpc.lsa_RemovePrivilegesFromAccount.remove_all", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE, - { "Lsa Secret Query Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_QUERY_VALUE_tfs), ( 0x00000002 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_AddAccountRights_handle, - { "Handle", "lsarpc.lsa_AddAccountRights.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DomainInfoEfs_blob_size, - { "Blob Size", "lsarpc.lsa_DomainInfoEfs.blob_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenPolicy2_system_name, - { "System Name", "lsarpc.lsa_OpenPolicy2.system_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info, - { "Forest Trust Info", "lsarpc.lsa_lsaRQueryForestTrustInformation.forest_trust_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DefaultQuotaInfo_max_wss, - { "Max Wss", "lsarpc.lsa_DefaultQuotaInfo.max_wss", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_DefaultQuotaInfo_paged_pool, - { "Paged Pool", "lsarpc.lsa_DefaultQuotaInfo.paged_pool", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids_level, - { "Level", "lsarpc.lsa_LookupSids.level", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditFullQueryInfo_log_is_full, - { "Log Is Full", "lsarpc.lsa_AuditFullQueryInfo.log_is_full", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_RightSet_count, - { "Count", "lsarpc.lsa_RightSet.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditLogInfo_log_size, - { "Log Size", "lsarpc.lsa_AuditLogInfo.log_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditEventsInfo_settings, - { "Settings", "lsarpc.lsa_AuditEventsInfo.settings", FT_UINT32, BASE_DEC, VALS(lsarpc_lsa_PolicyAuditPolicy_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedName_sid_index, + { "Sid Index", "lsarpc.lsa_TranslatedName.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedName_sid_type, + { "Sid Type", "lsarpc.lsa_TranslatedName.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, { &hf_lsarpc_lsa_TranslatedSid2_rid, { "Rid", "lsarpc.lsa_TranslatedSid2.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid2_sid_index, + { "Sid Index", "lsarpc.lsa_TranslatedSid2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_TranslatedSid2_sid_type, { "Sid Type", "lsarpc.lsa_TranslatedSid2.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_OpenTrustedDomainByName_handle, - { "Handle", "lsarpc.lsa_OpenTrustedDomainByName.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumTrustedDomainsEx_handle, - { "Handle", "lsarpc.lsa_EnumTrustedDomainsEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AsciiString_length, - { "Length", "lsarpc.lsa_AsciiString.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset, - { "Posix Offset", "lsarpc.lsa_TrustDomainInfoInfoAll.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumAccountRights_sid, - { "Sid", "lsarpc.lsa_EnumAccountRights.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids_sids, - { "Sids", "lsarpc.lsa_LookupSids.sids", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid2_unknown, + { "Unknown", "lsarpc.lsa_TranslatedSid2.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid3_sid, + { "Sid", "lsarpc.lsa_TranslatedSid3.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid3_sid_index, + { "Sid Index", "lsarpc.lsa_TranslatedSid3.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid3_sid_type, + { "Sid Type", "lsarpc.lsa_TranslatedSid3.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid3_unknown, + { "Unknown", "lsarpc.lsa_TranslatedSid3.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid_rid, + { "Rid", "lsarpc.lsa_TranslatedSid.rid", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid_sid_index, + { "Sid Index", "lsarpc.lsa_TranslatedSid.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TranslatedSid_sid_type, + { "Sid Type", "lsarpc.lsa_TranslatedSid.sid_type", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_SidType_vals), 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfo11_data1, + { "Data1", "lsarpc.lsa_TrustDomainInfo11.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfo11_info_ex, + { "Info Ex", "lsarpc.lsa_TrustDomainInfo11.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_count, + { "Incoming Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_current_auth_info, + { "Incoming Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_incoming_previous_auth_info, + { "Incoming Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.incoming_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_count, + { "Outgoing Count", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_current_auth_info, + { "Outgoing Current Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_current_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoAuthInfo_outgoing_previous_auth_info, + { "Outgoing Previous Auth Info", "lsarpc.lsa_TrustDomainInfoAuthInfo.outgoing_previous_auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoBasic_netbios_name, + { "Netbios Name", "lsarpc.lsa_TrustDomainInfoBasic.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoBasic_sid, + { "Sid", "lsarpc.lsa_TrustDomainInfoBasic.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoBuffer_data, + { "Data", "lsarpc.lsa_TrustDomainInfoBuffer.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoBuffer_last_update_time, + { "Last Update Time", "lsarpc.lsa_TrustDomainInfoBuffer.last_update_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoBuffer_secret_type, + { "Secret Type", "lsarpc.lsa_TrustDomainInfoBuffer.secret_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoFullInfo_auth_info, + { "Auth Info", "lsarpc.lsa_TrustDomainInfoFullInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoFullInfo_info_ex, + { "Info Ex", "lsarpc.lsa_TrustDomainInfoFullInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoFullInfo_posix_offset, + { "Posix Offset", "lsarpc.lsa_TrustDomainInfoFullInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_TrustDomainInfoInfoAll_auth_info, { "Auth Info", "lsarpc.lsa_TrustDomainInfoInfoAll.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_CloseTrustedDomainEx_handle, - { "Handle", "lsarpc.lsa_CloseTrustedDomainEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QosInfo_context_mode, - { "Context Mode", "lsarpc.lsa_QosInfo.context_mode", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION, - { "Lsa Policy View Audit Information", "lsarpc.lsa_PolicyAccessMask.LSA_POLICY_VIEW_AUDIT_INFORMATION", FT_BOOLEAN, 32, TFS(&lsa_PolicyAccessMask_LSA_POLICY_VIEW_AUDIT_INFORMATION_tfs), ( 0x00000002 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_SecretAccessMask_LSA_SECRET_SET_VALUE, - { "Lsa Secret Set Value", "lsarpc.lsa_SecretAccessMask.LSA_SECRET_SET_VALUE", FT_BOOLEAN, 32, TFS(&lsa_SecretAccessMask_LSA_SECRET_SET_VALUE_tfs), ( 0x00000001 ), NULL, HFILL }}, - { &hf_lsarpc_lsa_EnumTrustDom_domains, - { "Domains", "lsarpc.lsa_EnumTrustDom.domains", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransNameArray_count, - { "Count", "lsarpc.lsa_TransNameArray.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_pd, - { "Pd", "lsarpc.lsa_PolicyInformation.pd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedName2_sid_index, - { "Sid Index", "lsarpc.lsa_TranslatedName2.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_PolicyInformation_auditfullquery, - { "Auditfullquery", "lsarpc.lsa_PolicyInformation.auditfullquery", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_ModificationInfo_modified_id, - { "Modified Id", "lsarpc.lsa_ModificationInfo.modified_id", FT_UINT64, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_QuerySecret_new_mtime, - { "New Mtime", "lsarpc.lsa_QuerySecret.new_mtime", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupPrivValue_handle, - { "Handle", "lsarpc.lsa_LookupPrivValue.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TransSidArray2_count, - { "Count", "lsarpc.lsa_TransSidArray2.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_AuditEventsInfo_count, - { "Count", "lsarpc.lsa_AuditEventsInfo.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoAll_data1, + { "Data1", "lsarpc.lsa_TrustDomainInfoInfoAll.data1", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoAll_info_ex, + { "Info Ex", "lsarpc.lsa_TrustDomainInfoInfoAll.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoAll_posix_offset, + { "Posix Offset", "lsarpc.lsa_TrustDomainInfoInfoAll.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_domain_name, + { "Domain Name", "lsarpc.lsa_TrustDomainInfoInfoEx.domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_netbios_name, + { "Netbios Name", "lsarpc.lsa_TrustDomainInfoInfoEx.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_sid, + { "Sid", "lsarpc.lsa_TrustDomainInfoInfoEx.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_attributes, + { "Trust Attributes", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_attributes", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_direction, + { "Trust Direction", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_direction", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoInfoEx_trust_type, + { "Trust Type", "lsarpc.lsa_TrustDomainInfoInfoEx.trust_type", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoName_netbios_name, + { "Netbios Name", "lsarpc.lsa_TrustDomainInfoName.netbios_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoPassword_old_password, + { "Old Password", "lsarpc.lsa_TrustDomainInfoPassword.old_password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoPassword_password, + { "Password", "lsarpc.lsa_TrustDomainInfoPassword.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustDomainInfoPosixOffset_posix_offset, + { "Posix Offset", "lsarpc.lsa_TrustDomainInfoPosixOffset.posix_offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_auth_info, + { "Auth Info", "lsarpc.lsa_TrustedDomainInfo.auth_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_lsarpc_lsa_TrustedDomainInfo_full_info, { "Full Info", "lsarpc.lsa_TrustedDomainInfo.full_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetInfoPolicy_level, - { "Level", "lsarpc.lsa_SetInfoPolicy.level", FT_UINT1632, BASE_DEC, VALS(lsarpc_lsa_PolicyInfo_vals), 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_LookupSids3_count, - { "Count", "lsarpc.lsa_LookupSids3.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_TranslatedSid3_sid_index, - { "Sid Index", "lsarpc.lsa_TranslatedSid3.sid_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_lsarpc_lsa_SetInfoPolicy_handle, - { "Handle", "lsarpc.lsa_SetInfoPolicy.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_info11, + { "Info11", "lsarpc.lsa_TrustedDomainInfo.info11", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_info_all, + { "Info All", "lsarpc.lsa_TrustedDomainInfo.info_all", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_info_basic, + { "Info Basic", "lsarpc.lsa_TrustedDomainInfo.info_basic", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_info_ex, + { "Info Ex", "lsarpc.lsa_TrustedDomainInfo.info_ex", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_name, + { "Name", "lsarpc.lsa_TrustedDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_password, + { "Password", "lsarpc.lsa_TrustedDomainInfo.password", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_TrustedDomainInfo_posix_offset, + { "Posix Offset", "lsarpc.lsa_TrustedDomainInfo.posix_offset", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_forest_trust_info, + { "Forest Trust Info", "lsarpc.lsa_lsaRQueryForestTrustInformation.forest_trust_info", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_handle, + { "Handle", "lsarpc.lsa_lsaRQueryForestTrustInformation.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_trusted_domain_name, + { "Trusted Domain Name", "lsarpc.lsa_lsaRQueryForestTrustInformation.trusted_domain_name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_lsa_lsaRQueryForestTrustInformation_unknown, + { "Unknown", "lsarpc.lsa_lsaRQueryForestTrustInformation.unknown", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_names, + { "Names", "lsarpc.lookup.names", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_opnum, + { "Operation", "lsarpc.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_policy_access_mask, + { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_sec_desc_buf_len, + { "Sec Desc Buf Len", "lsarpc.sec_desc_buf_len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_secret_access_mask, + { "Access Mask", "lsarpc.policy.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_lsarpc_status, + { "NT Error", "lsarpc.status", FT_UINT32, BASE_HEX, VALS(NT_errors), 0, NULL, HFILL }}, }; |