From Litao Gao:

Implementation of IRemoteSCMActivator::RemoteCreateInstance and some minor bug fix

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7673

svn path=/trunk/; revision=44721

1 files changed, 1249 insertions, 15 deletions

diff --git a/epan/dissectors/packet-dcom-sysact.c b/epan/dissectors/packet-dcom-sysact.c
index 58b5303312..da4f098fd0 100644
--- a/epan/dissectors/packet-dcom-sysact.c
+++ b/epan/dissectors/packet-dcom-sysact.c
@@ -1,6 +1,7 @@
 /* packet-dcerpc-sysact.c
  * Routines for the ISystemActivator interface
  * Copyright 2004, Jelmer Vernooij <jelmer@samba.org>
+ * Copyright 2012, Litao Gao <ltgao@juniper.net>
  *
  * $Id$
  *
@@ -35,41 +36,1094 @@
 
 static int proto_ISystemActivator = -1;
 
+static gint ett_isystemactivator = -1;
 static int hf_opnum = -1;
+static int hf_sysact_actproperties = -1;
 static int hf_sysact_unknown = -1;
 
-static gint ett_ISystemActivator = -1;
+static gint ett_actproperties = -1;
+static int hf_sysact_totalsize = -1;
+static int hf_sysact_res = -1;
+
+static gint ett_commonheader = -1;
+static gint ett_propguids = -1;
+static gint ett_properties = -1;
+static int hf_sysact_customhdrsize = -1;
+static int hf_sysact_dstctx = -1;
+static int hf_sysact_actpropnumber = -1;
+static int hf_sysact_actpropclsinfoid = -1;
+static int hf_sysact_actpropclsids = -1;
+static int hf_sysact_actpropclsid = -1;
+static int hf_sysact_actpropsizes = -1;
+static int hf_sysact_actpropsize = -1;
+
+
+static gint ett_dcom_spclsysprop = -1;
+static gint ett_dcom_reserved = -1;
+static int hf_sysact_spsysprop_sid = -1;
+static int hf_sysact_spsysprop_remotethissid = -1;
+static int hf_sysact_spsysprop_cltimpersonating = -1;
+static int hf_sysact_spsysprop_partitionid = -1;
+static int hf_sysact_spsysprop_defauthlvl = -1;
+static int hf_sysact_spsysprop_partition = -1;
+static int hf_sysact_spsysprop_procrqstflgs = -1;
+static int hf_sysact_spsysprop_origclsctx = -1;
+static int hf_sysact_spsysprop_flags = -1;
+static int hf_sysact_spsysprop_procid = -1;
+static int hf_sysact_spsysprop_hwnd = -1;
+
+static gint ett_dcom_instantianinfo = -1;
+static int hf_sysact_instninfo_clsid = -1;
+static int hf_sysact_instninfo_clsctx = -1;
+static int hf_sysact_instninfo_actflags = -1;
+static int hf_sysact_instninfo_issurrogate = -1;
+static int hf_sysact_instninfo_iidcount = -1;
+static int hf_sysact_instninfo_instflags = -1;
+static int hf_sysact_instninfo_entiresize = -1;
+static int hf_sysact_instninfo_iid = -1;
+
+static gint ett_dcom_actctxinfo = -1;
+static int hf_sysact_actctxinfo_cltok = -1;
+static int hf_sysact_context = -1;
+
+static gint ett_dcom_context = -1;
+static int hf_sysact_ctx_id = -1;
+static int hf_sysact_ctx_flags = -1;
+static int hf_sysact_ctx_res = -1;
+static int hf_sysact_ctx_numextents = -1;
+static int hf_sysact_ctx_extentscnt = -1;
+static int hf_sysact_ctx_mashflags = -1;
+static int hf_sysact_ctx_count = -1;
+static int hf_sysact_ctx_frozen = -1;
+
+static gint ett_dcom_securityinfo = -1;
+static int hf_sysact_si_authflalgs = -1;
+static int hf_sysact_si_ci_res = -1;
+static int hf_sysact_si_ci_string = -1;
+static int hf_sysact_si_serverinfo = -1;
+
+static gint ett_dcom_locationinfo = -1;
+static int hf_sysact_li_string = -1;
+static int hf_sysact_li_procid = -1;
+static int hf_sysact_li_apartid = -1;
+static int hf_sysact_li_ctxid = -1;
+
+static gint ett_dcom_scmrqstinfo = -1;
+static gint ett_dcom_rmtrqst = -1;
+
+static int hf_sysact_sri_cltimplvl = -1;
+static int hf_sysact_sri_protseqnum = -1;
+static int hf_sysact_sri_protseq = -1;
+
+static gint ett_dcom_propsoutput = -1;
+static int hf_sysact_pi_ifnum = -1;
+static int hf_sysact_pi_retval = -1;
+static int hf_sysact_pi_interf = -1;
+static int hf_sysact_pi_iid = -1;
+
+static gint ett_dcom_scmrespinfo = -1;
+static gint ett_dcom_rmtresp = -1;
+static gint ett_dcom_oxidbinding = -1;
+static int hf_sysact_scmri_rmtunknid = -1;
+static int hf_sysact_scmri_authhint = -1;
+static int hf_sysact_scmri_binding = -1;
+static int hf_sysact_scmri_oxid = -1;
+
+static gint ett_typeszcommhdr = -1;
+static gint ett_typeszprivhdr = -1;
+static int hf_typeszch = -1;
+static int hf_typeszph = -1;
+static int hf_typesz_ver = -1;
+static int hf_typesz_endianess = -1;
+static int hf_typesz_commhdrlen = -1;
+static int hf_typesz_filler = -1;
+static int hf_typesz_buflen = -1;
 
 static e_uuid_t uuid_ISystemActivator = { 0x000001a0, 0x0000, 0x0000, { 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 } };
 static guint16  ver_ISystemActivator = 0;
 
+/*static e_uuid_t clsid_ActivationPropertiesIn = { 0x00000338, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
+/*static e_uuid_t clsid_ActivationPropertiesOut = { 0x00000339, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
+static e_uuid_t iid_ActivationPropertiesIn = { 0x000001a2, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t iid_ActivationPropertiesOut = { 0x000001a3, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+
+static e_uuid_t clsid_SpecialSystemProperties = { 0x000001b9, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_InstantiationInfo = { 0x000001ab, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_ActivationContextInfo = { 0x000001a5, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_ContextMarshaler = { 0x0000033b, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_SecurityInfo = { 0x000001a6, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_ServerLocationInfo = { 0x000001a4, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_ScmRequestInfo = { 0x000001aa, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_PropsOutInfo = { 0x00000339, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+static e_uuid_t clsid_ScmReplyInfo = { 0x000001b6, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
+/*static e_uuid_t clsid_InstanceInfo = { 0x000001ad, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
+
+
+static const value_string instninfo_actflags[] = {
+    { 0x00000002, "ACTVFLAGS_DISABLE_AAA" },
+    { 0x00000004, "ACTVFLAGS_ACTIVATE_32_BIT_SERVER" },
+    { 0x00000008, "ACTVFLAGS_ACTIVATE_64_BIT_SERVER" },
+    { 0x00000020, "ACTVFLAGS_NO_FAILURE_LOG" },
+    { 0,  NULL }
+};
+
+static const value_string boolean_flag_vals[] = {
+    { 0x00000001, "TRUE" },
+    { 0x00000000, "FALSE" },
+    { 0,  NULL }
+};
+
+static const value_string dcom_context_flag_vals[] = {
+    { 0x00000002, "MarshalByValue" },
+    { 0,  NULL }
+};
+
+static const value_string ts_endian_vals[] = {
+    { 0x10, "Little-endian" },
+    { 0x00, "Big-endian" },
+    { 0,  NULL }
+};
+
+/* MS-DCOM 2.2.28.1 */
+#define MIN_ACTPROP_LIMIT 1
+#define MAX_ACTPROP_LIMIT 10
+
+typedef struct property_guids {
+    e_uuid_t guid[MAX_ACTPROP_LIMIT];
+    guint32  size[MAX_ACTPROP_LIMIT];
+    guint32  id_idx;
+    guint32  size_idx;
+} property_guids_t;
+
+/* Type Serialization Version 1 */
+int
+dissect_TypeSzCommPrivHdr(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    guint8 drep_tmp;
+    guint8 endian = 0x10;
+    gint   old_offset;
+
+    /* Common Header use little endian */
+    sub_item = proto_tree_add_item(tree, hf_typeszch, tvb, offset, 0, ENC_NA);
+    sub_tree = proto_item_add_subtree(sub_item, ett_typeszcommhdr);
+
+    old_offset = offset;
+    offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, drep,
+            hf_typesz_ver, NULL);
+
+    offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, drep,
+            hf_typesz_endianess, &endian);
+    if (endian == 0x10)
+        *drep = DREP_LITTLE_ENDIAN;
+    else
+        *drep &= ~DREP_LITTLE_ENDIAN;
+
+    drep_tmp = DREP_LITTLE_ENDIAN;
+    offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, &drep_tmp,
+            hf_typesz_commhdrlen, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, &drep_tmp,
+            hf_typesz_filler, NULL);
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    /* Private Header */
+    old_offset = offset;
+    sub_item = proto_tree_add_item(tree, hf_typeszph, tvb, offset, 0, ENC_NA);
+    sub_tree = proto_item_add_subtree(sub_item, ett_typeszprivhdr);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_typesz_buflen, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_typesz_filler, NULL);
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    return offset;
+}
+
+
+
+static int
+dissect_dcom_Property_Guid(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                            proto_tree *tree, guint8 *drep)
+{
+    dcerpc_info *di;
+    property_guids_t *pg;
+
+    di = pinfo->private_data;
+    pg = (property_guids_t*)di->private_data;
+
+    DISSECTOR_ASSERT(pg->id_idx < MAX_ACTPROP_LIMIT);
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, drep,
+                        hf_sysact_actpropclsid, &pg->guid[pg->id_idx++]);
+
+    return offset;
+}
+
+static int
+dissect_dcom_ActivationPropertiesCustomerHdr_PropertyGuids(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, dissect_dcom_Property_Guid);
+    return offset;
+}
+
+static int
+dissect_dcom_Property_Size(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                            proto_tree *tree, guint8 *drep)
+{
+    dcerpc_info *di;
+    property_guids_t *pg;
+
+    di = pinfo->private_data;
+    pg = (property_guids_t*)di->private_data;
+
+    DISSECTOR_ASSERT(pg->size_idx < MAX_ACTPROP_LIMIT);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
+                        hf_sysact_actpropsize, &pg->size[pg->size_idx++]);
+
+    return offset;
+}
+
+static int
+dissect_dcom_ActivationPropertiesCustomerHdr_PropertySizes(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, dissect_dcom_Property_Size);
+    return offset;
+}
+
+static int
+dissect_dcom_ActivationPropertiesCustomerHdr(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep)
+{
+    guint32   u32TotalSize;
+    guint32   u32CustomHdrSize;
+    guint32   u32ActPropNumber;
+    gint      old_offset;
+
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, 0, "CustomHeader");
+
+    sub_tree = proto_item_add_subtree(sub_item, ett_commonheader);
+
+    old_offset = offset;
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_totalsize, &u32TotalSize);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_customhdrsize, &u32CustomHdrSize);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_res, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_dstctx, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_actpropnumber, &u32ActPropNumber);
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_actpropclsinfoid, NULL);
+
+    /* ClsIdPtr, SizesPtr */
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_ActivationPropertiesCustomerHdr_PropertyGuids, NDR_POINTER_UNIQUE,
+            "ClsIdPtr",hf_sysact_actpropclsid);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_ActivationPropertiesCustomerHdr_PropertySizes, NDR_POINTER_UNIQUE,
+            "ClsSizesPtr",hf_sysact_actpropclsid);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            NULL, NDR_POINTER_UNIQUE, "OpaqueDataPtr: Pointer To NULL", 0);
+
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    return offset;
+}
+
+
+static int
+dissect_dcom_ActivationProperty(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, e_uuid_t *clsid, gint size)
+{
+    dcom_dissect_fn_t routine = NULL;
+
+    /* the following data depends on the clsid, get the routine by clsid */
+    routine = dcom_get_rountine_by_uuid(clsid);
+    if (routine){
+        offset = routine(tvb, offset, pinfo, tree, drep, size);
+    }
+
+    return offset;
+}
+
+
+
+static int
+dissect_dcom_ActivationPropertiesBody(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep)
+{
+    gint      old_offset;
+
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    dcerpc_info *di;
+    property_guids_t *pg;
+    guint32 i;
+
+    di = pinfo->private_data;
+    pg = (property_guids_t*)di->private_data;
+
+    DISSECTOR_ASSERT(pg->id_idx == pg->size_idx);
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, 0, "Properties");
+    sub_tree = proto_item_add_subtree(sub_item, ett_properties);
+
+    old_offset = offset;
+    for (i = 0; i < pg->id_idx; i++) {
+        offset = dissect_dcom_ActivationProperty(tvb, offset, pinfo, sub_tree, drep,
+                                                    &pg->guid[i], pg->size[i]);
+    }
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    return offset;
+}
+
+int
+dissect_dcom_ActivationProperties(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+        proto_tree *tree, guint8 *drep, gint size _U_)
+{
+    dcerpc_info *di;
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+
+    guint32    u32TotalSize;
+    guint32    u32Res;
+
+    sub_item = proto_tree_add_item(tree, hf_sysact_actproperties, tvb, offset, 0, ENC_NA);
+    sub_tree = proto_item_add_subtree(sub_item, ett_actproperties);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_totalsize, &u32TotalSize);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_res, &u32Res);
+
+    di = pinfo->private_data;
+    if (di->private_data) {
+        g_free(di->private_data);
+    }
+    di->private_data = g_malloc(sizeof(property_guids_t));
+    memset(di->private_data, 0, sizeof(property_guids_t));
+
+    offset = dissect_dcom_ActivationPropertiesCustomerHdr(tvb, offset, pinfo, sub_tree, drep);
+    offset = dissect_dcom_ActivationPropertiesBody(tvb, offset, pinfo, sub_tree, drep);
+
+    g_free(di->private_data);
+
+    return offset;
+}
+
+static int
+dissect_dcom_ContextMarshaler(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size _U_)
+{
+    proto_item  *sub_item;
+    proto_tree  *sub_tree;
+    gint        old_offset;
+
+    guint32    u32Count;
+
+    old_offset = offset;
+    sub_item = proto_tree_add_text(tree, tvb, offset, 0, "Context");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_context);
+
+    offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, drep,
+                NULL, NULL);
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_id, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_flags, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_res, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_numextents, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_extentscnt, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_mashflags, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_count, &u32Count);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_ctx_frozen, NULL);
+
+    if (u32Count) {
+        /*PropMarshalHeader array*/
+        /*TBD*/
+    }
+
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    return offset;
+}
+
+static int
+dissect_dcom_SpecialSystemProperties(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item, *it;
+    proto_tree *sub_tree, *tr;
+    gint old_offset, len, i;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "SpecialSystemProperties");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_spclsysprop);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_sid, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_remotethissid, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_cltimpersonating, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_partitionid, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_defauthlvl, NULL);
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_partition, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_procrqstflgs, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_origclsctx, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_spsysprop_flags, NULL);
+/*
+ *
+ *    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+ *            hf_sysact_spsysprop_procid, NULL);
+ *    offset = dissect_dcom_I8(tvb, offset, pinfo, sub_tree, drep,
+ *            hf_sysact_spsysprop_hwnd, NULL);
+ *
+ */
+    it = proto_tree_add_text(sub_tree, tvb, offset, sizeof(guint32)*8,
+                             "Reserved: 8 DWORDs");
+    tr = proto_item_add_subtree(it, ett_dcom_reserved);
+    for (i = 0; i < 8; i++) {
+        offset = dissect_dcom_DWORD(tvb, offset, pinfo, tr, drep,
+                hf_sysact_res, NULL);
+    }
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+    return offset;
+}
+
+static int
+dissect_dcom_InterfaceId(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                            proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, drep,
+                        hf_sysact_instninfo_iid, NULL);
+    return offset;
+}
+
+static int
+dissect_InstantiationInfoIids(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+            dissect_dcom_InterfaceId);
+
+    return offset;
+}
+
+static int
+dissect_dcom_InstantiationInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset, len;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "InstantiationInfo");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_instantianinfo);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_instninfo_clsid, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_instninfo_clsctx, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_instninfo_actflags, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_instninfo_issurrogate, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_instninfo_iidcount, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_instninfo_instflags, NULL);
+
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_InstantiationInfoIids, NDR_POINTER_UNIQUE,
+            "InterfaceIdsPtr", -1);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_instninfo_entiresize, NULL);
+    offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, drep,
+            NULL, NULL);
+
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+    return offset;
+}
+
+static int
+dissect_ActCtxInfo_PropCtx(tvbuff_t *tvb _U_, gint offset _U_,
+        packet_info *pinfo _U_, proto_tree *tree _U_, guint8 *drep _U_)
+{
+    /*TBD*/
+    return offset;
+}
+
+
+static int
+dissect_ActCtxInfo_CltCtx(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    dcerpc_info *di;
+
+    di = pinfo->private_data;
+    if (di->conformant_run) {
+        return offset;
+    }
+
+    offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, drep,
+            hf_sysact_context, NULL);
+    return offset;
+}
+
+static int
+dissect_dcom_ActivationContextInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset, len;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "ActivationContextInfo");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_actctxinfo);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_actctxinfo_cltok, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_res, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_res, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_res, NULL);
+
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_ActCtxInfo_CltCtx, NDR_POINTER_UNIQUE,
+            "ClientPtr", -1);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_ActCtxInfo_PropCtx, NDR_POINTER_UNIQUE,
+            "PrototypePtr", -1);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+    return offset;
+}
+
+
+static int
+dissect_dcom_COSERVERINFO(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep, int hfindex)
+{
+    dcerpc_info *di;
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset;
+
+    di = pinfo->private_data;
+    if (di->conformant_run) {
+        return offset;
+    }
+
+    sub_item = proto_tree_add_item(tree, hfindex, tvb, offset, 0, ENC_NA);
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_securityinfo);
+
+    old_offset = offset;
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_si_ci_res, NULL);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Name(wstring)",
+            hf_sysact_si_ci_string);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            NULL, NDR_POINTER_UNIQUE, "AuthInfoPtr", -1);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_si_ci_res, NULL);
+
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    return offset;
+}
+
+static int
+dissect_dcom_SI_ServerInfo(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_dcom_COSERVERINFO(tvb, offset, pinfo, tree, drep,
+            hf_sysact_si_serverinfo);
+    return offset;
+}
+
+static int
+dissect_dcom_SecurtiyInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset, len;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "SecurityInfo");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_securityinfo);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_si_authflalgs, NULL);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_SI_ServerInfo, NDR_POINTER_UNIQUE, "ServerInfoPtr", -1);
+    /*This SHOULD be NULL and MUST be ignored on receipt*/
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            NULL, NDR_POINTER_UNIQUE, "ReservedPtr", -1);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+    return offset;
+}
+
+static int
+dissect_dcom_LocationInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset, len;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "LocationInfo");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_locationinfo);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "MachineNamePtr",
+            hf_sysact_li_string);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_li_procid, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_li_apartid, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_li_ctxid, NULL);
+
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+
+    return offset;
+}
+
+static int
+dissect_dcom_ProtoSeq(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                        proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, drep,
+                        hf_sysact_sri_protseq, NULL);
+
+    return offset;
+}
+
+static int
+dissect_dcom_ProtoSeqArray(tvbuff_t *tvb, gint offset,
+                    packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+            dissect_dcom_ProtoSeq);
+    return offset;
+}
+
+static int
+dissect_dcom_customREMOTE_REQUEST_SCM_INFO(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    dcerpc_info *di;
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset;
+
+    di = pinfo->private_data;
+    if (di->conformant_run) {
+        return offset;
+    }
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, 0, "RemoteRequest");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_rmtrqst);
+
+    old_offset = offset;
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_sri_cltimplvl, NULL);
+    offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_sri_protseqnum, NULL);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_ProtoSeqArray, NDR_POINTER_UNIQUE, "ProtocolSeqsArrayPtr", -1);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    return offset;
+}
+
+static int
+dissect_dcom_ScmRqstInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset, len;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "ScmRequestInfo");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_scmrqstinfo);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    /*This MUST be set to NULL and MUST be ignored on receipt*/
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            NULL, NDR_POINTER_UNIQUE, "Ptr", -1);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_customREMOTE_REQUEST_SCM_INFO, NDR_POINTER_UNIQUE,
+            "RemoteRequestPtr", -1);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+
+    return offset;
+}
+
+static int
+dissect_dcom_IfId(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                        proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, drep,
+            hf_sysact_pi_iid, NULL);
+    return offset;
+}
+
+static int
+dissect_dcom_IfIds(tvbuff_t *tvb, gint offset,
+                    packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+            dissect_dcom_IfId);
+    return offset;
+}
+
+static int
+dissect_dcom_ReturnVal(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                            proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep,
+                        hf_sysact_pi_retval, NULL);
+    return offset;
+}
+
+static int
+dissect_dcom_ReturnVals(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+            dissect_dcom_ReturnVal);
+    return offset;
+}
+
+static int
+dissect_OneInterfData(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, drep,
+            hf_sysact_pi_interf, NULL);
+    return offset;
+}
+
+static int
+dissect_dcom_OneInterfDataPtr(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                            proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, drep,
+            dissect_OneInterfData, NDR_POINTER_UNIQUE, "InterfacePtr", -1);
+    return offset;
+}
+
+/*
+ * This MUST be an array of MInterfacePointer pointers containing the OBJREFs for
+ * the interfaces returned by the server.
+ */
+static int
+dissect_dcom_InterfData(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+            dissect_dcom_OneInterfDataPtr);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+    return offset;
+}
+
+static int
+dissect_dcom_PropsOutInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset, len;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "PropertiesOutput");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_propsoutput);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_pi_ifnum, NULL);
+
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_IfIds, NDR_POINTER_UNIQUE, "InterfaceIdsPtr", -1);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_ReturnVals, NDR_POINTER_UNIQUE, "ReturnValuesPtr", -1);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_InterfData, NDR_POINTER_UNIQUE, "InterfacePtrsPtr", -1);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+
+    return offset;
+}
+
+
+/*
+ *typedef struct tagDUALSTRINGARRAY {
+ *  unsigned short wNumEntries;
+ *  unsigned short wSecurityOffset;
+ *  [size_is(wNumEntries)] unsigned short aStringArray[];
+ *} DUALSTRINGARRAY;
+ */
+static int
+dissect_dcom_OxidBindings(tvbuff_t *tvb, gint offset,
+                    packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    dcerpc_info *di;
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset;
+
+    di = pinfo->private_data;
+    if (di->conformant_run) {
+        return offset;
+    }
+
+    old_offset = offset;
+    sub_item = proto_tree_add_text(tree, tvb, offset, 0, "OxidBindings");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_oxidbinding);
+
+    offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, sub_tree, drep, NULL);
+    offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_scmri_binding, NULL);
+
+    proto_item_set_len(sub_item, offset - old_offset);
+    return offset;
+}
+
+
+static int
+dissect_dcom_customREMOTE_REPLY_SCM_INFO(tvbuff_t *tvb, gint offset,
+        packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+    dcerpc_info *di;
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset;
+
+    di = pinfo->private_data;
+    if (di->conformant_run) {
+        return offset;
+    }
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, 0, "RemoteReply");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_rmtresp);
+
+    old_offset = offset;
+    offset = dissect_dcom_ID(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_scmri_oxid, NULL);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_OxidBindings, NDR_POINTER_UNIQUE, "OxidBindingsPtr", -1);
+    offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_scmri_rmtunknid, NULL);
+    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep,
+            hf_sysact_scmri_authhint, NULL);
+    offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, drep,
+                NULL, NULL);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    proto_item_set_len(sub_item, offset - old_offset);
+
+    return offset;
+}
+
+
+static int
+dissect_dcom_ScmReplyInfo(tvbuff_t *tvb, gint offset, packet_info *pinfo,
+                       proto_tree *tree, guint8 *drep, gint size)
+{
+    proto_item *sub_item;
+    proto_tree *sub_tree;
+    gint old_offset, len;
+
+    old_offset = offset;
+
+    sub_item = proto_tree_add_text(tree, tvb, offset, size, "ScmReplyInfo");
+    sub_tree = proto_item_add_subtree(sub_item, ett_dcom_scmrespinfo);
+
+    offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, drep);
+
+    /*This MUST be set to NULL and MUST be ignored on receipt*/
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            NULL, NDR_POINTER_UNIQUE, "Ptr", -1);
+    offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, drep,
+            dissect_dcom_customREMOTE_REPLY_SCM_INFO, NDR_POINTER_UNIQUE,
+            "RemoteRequestPtr", -1);
+    offset = dissect_deferred_pointers(pinfo, tvb, offset, drep);
+
+    len = offset - old_offset;
+    DISSECTOR_ASSERT(len <= size);
+    if (size-len) {
+        proto_tree_add_text(sub_tree, tvb, offset, size - len,
+                "UnusedBuffer: %d bytes", size - len);
+    }
+
+    offset = old_offset + size;
+
+    return offset;
+}
+
+void
+sysact_register_routines(void)
+{
+    dcom_register_rountine(dissect_dcom_ActivationProperties, &iid_ActivationPropertiesIn);
+    dcom_register_rountine(dissect_dcom_ActivationProperties, &iid_ActivationPropertiesOut);
+    dcom_register_rountine(dissect_dcom_SpecialSystemProperties, &clsid_SpecialSystemProperties);
+    dcom_register_rountine(dissect_dcom_InstantiationInfo, &clsid_InstantiationInfo);
+    dcom_register_rountine(dissect_dcom_ActivationContextInfo, &clsid_ActivationContextInfo);
+    dcom_register_rountine(dissect_dcom_ContextMarshaler, &clsid_ContextMarshaler);
+    dcom_register_rountine(dissect_dcom_SecurtiyInfo, &clsid_SecurityInfo);
+    dcom_register_rountine(dissect_dcom_LocationInfo, &clsid_ServerLocationInfo);
+    dcom_register_rountine(dissect_dcom_ScmRqstInfo, &clsid_ScmRequestInfo);
+    dcom_register_rountine(dissect_dcom_PropsOutInfo, &clsid_PropsOutInfo);
+    dcom_register_rountine(dissect_dcom_ScmReplyInfo, &clsid_ScmReplyInfo);
+
+    return;
+}
 
 static int
 dissect_remsysact_remotecreateinstance_rqst(tvbuff_t *tvb, int offset,
     packet_info *pinfo, proto_tree *tree, guint8 *drep)
 {
 
+    sysact_register_routines();
+
     offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep);
 
     /* XXX - what is this? */
     offset = dissect_dcom_nospec_data(tvb, offset, pinfo, tree, drep, 4);
-
     offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, drep,
-                        hf_sysact_unknown, NULL /* XXX */);
-
+                        hf_sysact_actproperties, NULL /* XXX */);
     return offset;
 }
 
-
 static int
 dissect_remsysact_remotecreateinstance_resp(tvbuff_t *tvb, int offset,
     packet_info *pinfo, proto_tree *tree, guint8 *drep)
 {
+    sysact_register_routines();
 
     offset = dissect_dcom_that(tvb, offset, pinfo, tree, drep);
 
     offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, drep,
-                        hf_sysact_unknown, NULL /* XXX */);
+                        hf_sysact_actproperties, NULL /* XXX */);
 
     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep,
                      NULL /* pu32HResult */);
@@ -78,8 +1132,6 @@ dissect_remsysact_remotecreateinstance_resp(tvbuff_t *tvb, int offset,
 }
 
 
-
-
 static dcerpc_sub_dissector ISystemActivator_dissectors[] = {
     { 0, "QueryInterfaceIRemoteSCMActivator", NULL, NULL },
     { 1, "AddRefIRemoteISCMActivator", NULL, NULL },
@@ -92,19 +1144,202 @@ static dcerpc_sub_dissector ISystemActivator_dissectors[] = {
 void
 proto_register_ISystemActivator (void)
 {
+    /* fields */
     static hf_register_info hf[] = {
         { &hf_opnum,
           { "Operation", "isystemactivator.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_actproperties,
+        { "IActProperties", "isystemactivator.actproperties", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
         { &hf_sysact_unknown,
         { "IUnknown", "isystemactivator.unknown", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
     };
+
+    static hf_register_info hf_actproperties[] = {
+        { &hf_sysact_totalsize,
+        { "Totalsize", "isystemactivator.actproperties.size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_res,
+        { "Reserved", "isystemactivator.actproperties.resv", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+
+        { &hf_sysact_customhdrsize,
+        { "CustomHeaderSize", "isystemactivator.customhdr.size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_dstctx,
+        { "DestinationContext", "isystemactivator.customhdr.dc", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_actpropnumber,
+        { "NumActivationPropertyStructs", "isystemactivator.customhdr.actpropnumber", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_actpropclsinfoid,
+        { "ClassInfoClsid", "isystemactivator.customhdr.clsinfoid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_actpropclsids,
+        { "PropertyGuids", "isystemactivator.customhdr.clsids", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_actpropclsid,
+        { "PropertyStructGuid", "isystemactivator.customhdr.clsid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_actpropsizes,
+        { "PropertyDataSizes", "isystemactivator.customhdr.datasizes", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_actpropsize,
+        { "PropertyDataSize", "isystemactivator.customhdr.datasize", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+
+        /*SpecialSystemProperties*/
+        { &hf_sysact_spsysprop_sid,
+        { "SessionID", "isystemactivator.properties.spcl.sid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, "A value that uniquely identifies a logon session on the server", HFILL }},
+        { &hf_sysact_spsysprop_remotethissid,
+        { "RemoteThisSessionID", "isystemactivator.properties.spcl.remotesid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_cltimpersonating,
+        { "ClientImpersonating", "isystemactivator.properties.spcl.cltimp", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_partitionid,
+        { "PartitionIDPresent", "isystemactivator.properties.spcl.cltimp", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_defauthlvl,
+        { "DefaultAuthnLevel", "isystemactivator.properties.spcl.defauthlvl", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_partition,
+        { "PartitionGuid", "isystemactivator.properties.spcl.partition", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_procrqstflgs,
+        { "ProcessRequestFlags", "isystemactivator.properties.spcl.procreqstflgs", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_origclsctx,
+        { "OriginalClassContext", "isystemactivator.properties.spcl.origclsctx", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_flags,
+        { "Flags", "isystemactivator.properties.spcl.flags", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_procid,
+        { "ProcessID", "isystemactivator.properties.spcl.procid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_spsysprop_hwnd,
+        { "hWnd", "isystemactivator.properties.spcl.hwnd", FT_UINT64, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+
+        /*InstantiationInfo*/
+        { &hf_sysact_instninfo_clsid,
+        { "InstantiatedObjectClsId", "isystemactivator.properties.instninfo.clsid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_instninfo_clsctx,
+        { "ClassContext", "isystemactivator.properties.instninfo.clsctx", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_instninfo_actflags,
+        { "ActivationFlags", "isystemactivator.properties.instninfo.actflags", FT_UINT32, BASE_DEC_HEX, VALS(instninfo_actflags), 0x0, NULL, HFILL }},
+        { &hf_sysact_instninfo_issurrogate,
+        { "FlagsSurrogate", "isystemactivator.properties.instninfo.actflags", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_instninfo_iidcount,
+        { "InterfaceIdCount", "isystemactivator.properties.instninfo.iidcount", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_instninfo_instflags,
+        { "InstantiationFlag", "isystemactivator.properties.instninfo.instflags", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_instninfo_entiresize,
+        { "EntirePropertySize", "isystemactivator.properties.instninfo.entiresize", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_instninfo_iid,
+        { "InterfaceIds", "isystemactivator.properties.instninfo.iid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+
+        /*ActivationContextInfo*/
+        { &hf_sysact_actctxinfo_cltok,
+        { "ClientOk", "isystemactivator.properties.actctxinfo.cltok", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_context,
+        { "ClientContext", "isystemactivator.properties.context", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+
+        /*dcom Context*/
+        { &hf_sysact_ctx_id,
+        { "ContextID", "isystemactivator.properties.context.id", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_ctx_flags,
+        { "Flags", "isystemactivator.properties.context.flags", FT_UINT32, BASE_HEX, VALS(dcom_context_flag_vals), 0x0, NULL, HFILL }},
+        { &hf_sysact_ctx_res,
+        { "Reserved", "isystemactivator.properties.context.res", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_ctx_numextents,
+        { "NumExtents", "isystemactivator.properties.context.numext", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_ctx_extentscnt,
+        { "ExtentCount", "isystemactivator.properties.context.extcnt", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_ctx_mashflags,
+        { "MarshalFlags", "isystemactivator.properties.context.mashflags", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_ctx_count,
+        { "ContextPropertyCount", "isystemactivator.properties.context.cnt", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_ctx_frozen,
+        { "Frozen", "isystemactivator.properties.context.frz", FT_UINT32, BASE_HEX, VALS(boolean_flag_vals), 0x0, NULL, HFILL }},
+
+        /*Security Info*/
+        { &hf_sysact_si_authflalgs,
+        { "AuthenticationFlags", "isystemactivator.properties.si.authflags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_si_serverinfo,
+        { "ServerInfo", "isystemactivator.properties.si.ci", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
+        { &hf_sysact_si_ci_res,
+        { "Reserved", "isystemactivator.properties.si.ci.res", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_si_ci_string,
+        { "String", "isystemactivator.properties.si.ci.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+
+        /*Location info*/
+        { &hf_sysact_li_string,
+        { "String", "isystemactivator.properties.li.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
+        { &hf_sysact_li_procid,
+        { "ProcessId", "isystemactivator.properties.li.procid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_li_apartid,
+        { "ApartmentId", "isystemactivator.properties.li.apartid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_li_ctxid,
+        { "ContextId", "isystemactivator.properties.li.ctxid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
+
+        /*ScmRequst info*/
+        { &hf_sysact_sri_cltimplvl,
+        { "ClientImpersonationLevel", "isystemactivator.properties.sri.cltimplvl", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_sri_protseqnum,
+        { "NumProtocolSequences", "isystemactivator.properties.sri.protseqnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_sri_protseq,
+        { "ProtocolSeq", "isystemactivator.properties.sri.protseq", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+
+        /*PropsOutInfo*/
+        { &hf_sysact_pi_ifnum,
+        { "NumInterfaces", "isystemactivator.properties.pi.ifnum", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_pi_retval,
+        { "ReturnValue", "isystemactivator.properties.retval", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_pi_interf,
+        { "Interface", "isystemactivator.properties.interf", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_pi_iid,
+        { "IID", "isystemactivator.properties.iid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+
+        /*ScmReply info*/
+        { &hf_sysact_scmri_rmtunknid,
+        { "IRemUnknownInterfacePointerId", "isystemactivator.properties.scmresp.rmtunknid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_scmri_authhint,
+        { "AuthenticationHint", "isystemactivator.properties.scmresp.authhint", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_scmri_binding,
+        { "Bindings", "isystemactivator.properties.scmresp.binding", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_sysact_scmri_oxid,
+        { "OXID", "isystemactivator.properties.scmresp.oxid", FT_UINT64, BASE_HEX, NULL, 0x0, NULL, HFILL }},
+    };
+
+    static hf_register_info hf_tshdr[] = {
+        { &hf_typeszch,
+        { "CommonHeader", "isystemactivator.actproperties.ts.hdr", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_typeszph,
+        { "PrivateHeader", "isystemactivator.actproperties.ts.hdr", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
+        { &hf_typesz_ver,
+        { "Version", "isystemactivator.actproperties.ts.ver", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_typesz_endianess,
+        { "Endianess", "isystemactivator.actproperties.ts.end", FT_UINT8, BASE_HEX, VALS(ts_endian_vals), 0x0, NULL, HFILL }},
+        { &hf_typesz_commhdrlen,
+        { "CommonHeaderLength", "isystemactivator.actproperties.ts.chl", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+        { &hf_typesz_filler,
+        { "Filler", "isystemactivator.actproperties.ts.fil", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
+        { &hf_typesz_buflen,
+        { "ObjectBufferLength", "isystemactivator.actproperties.ts.buflen", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
+    };
+
+
+    /* Tree */
     static gint *ett[] = {
-        &ett_ISystemActivator
+        &ett_isystemactivator,
+        &ett_actproperties,
+        &ett_properties,
+        &ett_commonheader,
+        &ett_propguids,
+        &ett_typeszcommhdr,
+        &ett_typeszprivhdr,
+        &ett_dcom_spclsysprop,
+        &ett_dcom_reserved,
+        &ett_dcom_instantianinfo,
+        &ett_dcom_actctxinfo,
+        &ett_dcom_context,
+        &ett_dcom_securityinfo,
+        &ett_dcom_locationinfo,
+        &ett_dcom_scmrqstinfo,
+        &ett_dcom_rmtrqst,
+
+        &ett_dcom_propsoutput,
+        &ett_dcom_scmrespinfo,
+        &ett_dcom_rmtresp,
+        &ett_dcom_oxidbinding,
+
     };
-    proto_ISystemActivator = proto_register_protocol ("ISystemActivator ISystemActivator Resolver",
-                                                      "ISystemActivator",
-                                                      "isystemactivator");
+
+    proto_ISystemActivator = proto_register_protocol ("ISystemActivator ISystemActivator Resolver", "ISystemActivator", "isystemactivator");
     proto_register_field_array (proto_ISystemActivator, hf, array_length (hf));
+    proto_register_field_array (proto_ISystemActivator, hf_actproperties, array_length (hf_actproperties));
+    proto_register_field_array(proto_ISystemActivator, hf_tshdr, array_length(hf_tshdr));
     proto_register_subtree_array (ett, array_length (ett));
 }
 
@@ -112,7 +1347,6 @@ void
 proto_reg_handoff_ISystemActivator (void)
 {
     /* Register the protocol as dcerpc */
-    dcerpc_init_uuid (proto_ISystemActivator, ett_ISystemActivator,
-                      &uuid_ISystemActivator, ver_ISystemActivator,
-                      ISystemActivator_dissectors, hf_opnum);
+    dcerpc_init_uuid (proto_ISystemActivator, ett_isystemactivator, &uuid_ISystemActivator,
+            ver_ISystemActivator, ISystemActivator_dissectors, hf_opnum);
 }