diff options
author | Alex Sirr <alexsirruw@gmail.com> | 2021-04-18 03:38:09 -0700 |
---|---|---|
committer | Wireshark GitLab Utility <gerald+gitlab-utility@wireshark.org> | 2021-04-27 20:11:59 +0000 |
commit | 17ae0f6be262c854185dd91d5b86a61d41a9d3b2 (patch) | |
tree | 339f27b88ea52369dafd536b5cc08065b5e3879f /epan/dissectors/packet-dcerpc-taskschedulerservice.c | |
parent | ec14bbd89267adfae4a31d96545d8946c88e9d90 (diff) |
DCERPC - Add dissector for ITaskSchedulerService
Diffstat (limited to 'epan/dissectors/packet-dcerpc-taskschedulerservice.c')
-rw-r--r-- | epan/dissectors/packet-dcerpc-taskschedulerservice.c | 90 |
1 files changed, 90 insertions, 0 deletions
diff --git a/epan/dissectors/packet-dcerpc-taskschedulerservice.c b/epan/dissectors/packet-dcerpc-taskschedulerservice.c new file mode 100644 index 0000000000..7360cba3d6 --- /dev/null +++ b/epan/dissectors/packet-dcerpc-taskschedulerservice.c @@ -0,0 +1,90 @@ +/* packet-dcerpc-taskschedulerservice.c + * Routines for DCE/RPC ITaskSchedulerService + * Copyright 2021, Alex Sirr <alexsirruw@gmail.com> + * + * Wireshark - Network traffic analyzer + * By Gerald Combs <gerald@wireshark.org> + * Copyright 1998 Gerald Combs + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +/* see packet-dcom.c for details about DCOM */ + +#include "config.h" + +#include <epan/packet.h> +#include "packet-dcerpc.h" + +void proto_register_dcerpc_taskschedulerservice(void); +void proto_reg_handoff_dcerpc_taskschedulerservice(void); + +static int hf_taskschedulerservice_opnum = -1; + +static e_guid_t uuid_taskschedulerservice = {0x86d35949, 0x83c9, 0x4044, {0xb4, 0x24, 0xdb, 0x36, 0x32, 0x31, 0xfd, 0x0c}}; +static guint16 ver_taskschedulerservice = 1; +static gint ett_taskschedulerservice = -1; +static int proto_taskschedulerservice = -1; + +/* sub dissector table of ITaskSchedulerService interface */ +static dcerpc_sub_dissector taskschedulerservice_dissectors[] = { + /* Just map operations for now. Payloads are encrypted due to PKT_PRIVACY */ + {0, "SchRpcHighestVersion", NULL, NULL}, + {1, "SchRpcRegisterTask", NULL, NULL}, + {2, "SchRpcRetrieveTask", NULL, NULL}, + {3, "SchRpcCreateFolder", NULL, NULL}, + {4, "SchRpcSetSecurity", NULL, NULL}, + {5, "SchRpcGetSecurity", NULL, NULL}, + {6, "SchRpcEnumFolders", NULL, NULL}, + {7, "SchRpcEnumTasks", NULL, NULL}, + {8, "SchRpcEnumInstances", NULL, NULL}, + {9, "SchRpcGetInstanceInfo", NULL, NULL}, + {10, "SchRpcStopInstance", NULL, NULL}, + {11, "SchRpcStop", NULL, NULL}, + {12, "SchRpcRun", NULL, NULL}, + {13, "SchRpcDelete", NULL, NULL}, + {14, "SchRpcRename", NULL, NULL}, + {15, "SchRpcScheduledRuntimes", NULL, NULL}, + {16, "SchRpcGetLastRunInfo", NULL, NULL}, + {17, "SchRpcGetTaskInfo", NULL, NULL}, + {18, "SchRpcGetNumberOfMissedRuns", NULL, NULL}, + {19, "SchRpcEnableTask", NULL, NULL}, + {0, NULL, NULL, NULL}, +}; + +void proto_register_dcerpc_taskschedulerservice(void) +{ + static hf_register_info hf_taskschedulerservice_array[] = { + {&hf_taskschedulerservice_opnum, + {"Operation", "taskschedulerservice.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL}}, + }; + + + static gint *ett[] = { + &ett_taskschedulerservice, + }; + + proto_taskschedulerservice = proto_register_protocol("ITaskSchedulerService", "ITaskSchedulerService", "taskschedulerservice"); + proto_register_field_array(proto_taskschedulerservice, hf_taskschedulerservice_array, array_length (hf_taskschedulerservice_array)); + proto_register_subtree_array(ett, array_length(ett)); +} + +void proto_reg_handoff_dcerpc_taskschedulerservice(void) +{ + dcerpc_init_uuid(proto_taskschedulerservice, ett_taskschedulerservice, + &uuid_taskschedulerservice, ver_taskschedulerservice, + taskschedulerservice_dissectors, hf_taskschedulerservice_opnum); +} + +/* + * Editor modelines - https://www.wireshark.org/tools/modelines.html + * + * Local variables: + * c-basic-offset: 8 + * tab-width: 8 + * indent-tabs-mode: t + * End: + * + * vi: set shiftwidth=8 tabstop=8 noexpandtab: + * :indentSize=8:tabSize=8:noTabs=false: + */ |