From 5b87714ec81288e5f999f082653bf106200185e6 Mon Sep 17 00:00:00 2001 From: Hiddencodes Sec Date: Mon, 1 Jan 2024 17:16:28 -0800 Subject: Add parsing support for IWbemServices and WMIO --- epan/dissectors/CMakeLists.txt | 2 + epan/dissectors/packet-dcerpc-iwbemservices.c | 1338 ++++++++++++++++++++ epan/dissectors/packet-dcerpc-iwbemservices.h | 20 + epan/dissectors/packet-dcom.c | 2 +- epan/dissectors/packet-wmio.c | 1242 ++++++++++++++++++ epan/dissectors/pidl/CMakeLists.txt | 4 + epan/dissectors/pidl/Makefile.pidl | 7 + epan/dissectors/pidl/README | 1 + .../pidl/iwbemservices/iwbemservices.cnf | 111 ++ .../pidl/iwbemservices/iwbemservices.idl | 158 +++ 10 files changed, 2884 insertions(+), 1 deletion(-) create mode 100644 epan/dissectors/packet-dcerpc-iwbemservices.c create mode 100644 epan/dissectors/packet-dcerpc-iwbemservices.h create mode 100644 epan/dissectors/packet-wmio.c create mode 100644 epan/dissectors/pidl/iwbemservices/iwbemservices.cnf create mode 100644 epan/dissectors/pidl/iwbemservices/iwbemservices.idl diff --git a/epan/dissectors/CMakeLists.txt b/epan/dissectors/CMakeLists.txt index f21456f9b5..5cf461cddb 100644 --- a/epan/dissectors/CMakeLists.txt +++ b/epan/dissectors/CMakeLists.txt @@ -56,6 +56,7 @@ set(PIDL_DISSECTOR_SRC ${CMAKE_CURRENT_SOURCE_DIR}/packet-dcerpc-iwbemlevel1login.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-dcerpc-iwbemloginclientid.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-dcerpc-iwbemloginclientidex.c + ${CMAKE_CURRENT_SOURCE_DIR}/packet-dcerpc-iwbemservices.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-dcerpc-lsa.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-dcerpc-mapi.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-dcerpc-mdssvc.c @@ -2077,6 +2078,7 @@ set(DISSECTOR_SRC ${CMAKE_CURRENT_SOURCE_DIR}/packet-winsrepl.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-wisun.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-wlccp.c + ${CMAKE_CURRENT_SOURCE_DIR}/packet-wmio.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-wol.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-wow.c ${CMAKE_CURRENT_SOURCE_DIR}/packet-woww.c diff --git a/epan/dissectors/packet-dcerpc-iwbemservices.c b/epan/dissectors/packet-dcerpc-iwbemservices.c new file mode 100644 index 0000000000..1c4e9ae091 --- /dev/null +++ b/epan/dissectors/packet-dcerpc-iwbemservices.c @@ -0,0 +1,1338 @@ +/* DO NOT EDIT + This file was automatically generated by Pidl + from iwbemservices.idl and iwbemservices.cnf. + + Pidl is a perl based IDL compiler for DCE/RPC idl files. + It is maintained by the Samba team, not the Wireshark team. + Instructions on how to download and install Pidl can be + found at https://gitlab.com/wireshark/wireshark/-/wikis/Pidl +*/ + + +#include "config.h" +#include +#include +#include + +#include "packet-dcerpc.h" +#include "packet-dcerpc-nt.h" +#include "packet-windows-common.h" +#include "packet-dcerpc-iwbemservices.h" +void proto_register_dcerpc_IWbemServices(void); +void proto_reg_handoff_dcerpc_IWbemServices(void); + +/* Ett declarations */ +static gint ett_IWbemServices_GetObject_orpcthis = -1; +static gint ett_IWbemServices_GetObject_orpcthat = -1; +static gint ett_IWbemServices_ExecMethod_orpcthis = -1; +static gint ett_IWbemServices_ExecMethod_orpcthat = -1; +static gint ett_dcerpc_IWbemServices = -1; +static gint ett_IWbemServices_ORPCTHIS = -1; +static gint ett_IWbemServices_ORPCTHAT = -1; +static gint ett_IWbemServices_IWbemCallResult = -1; +static gint ett_IWbemServices_IWbemClassObject = -1; +static gint ett_IWbemServices_MInterfacePointer = -1; +static gint ett_IWbemServices_IWbemContext = -1; + + +/* Header field declarations */ +static gint hf_IWbemServices_ExecMethod_lFlags = -1; +static gint hf_IWbemServices_ExecMethod_orpcthat = -1; +static gint hf_IWbemServices_ExecMethod_orpcthis = -1; +static gint hf_IWbemServices_ExecMethod_strMethodName = -1; +static gint hf_IWbemServices_ExecMethod_strObjectPath = -1; +static gint hf_IWbemServices_GetObject_lFlags = -1; +static gint hf_IWbemServices_GetObject_orpcthat = -1; +static gint hf_IWbemServices_GetObject_orpcthis = -1; +static gint hf_IWbemServices_GetObject_pCtx = -1; +static gint hf_IWbemServices_GetObject_ppCallResult = -1; +static gint hf_IWbemServices_GetObject_ppObject = -1; +static gint hf_IWbemServices_GetObject_strObjectPath = -1; +static gint hf_IWbemServices_IWbemClassObject_count = -1; +static gint hf_IWbemServices_IWbemClassObject_objects = -1; +static gint hf_IWbemServices_IWbemContext_intPtr = -1; +static gint hf_IWbemServices_IWbemContext_u = -1; +static gint hf_IWbemServices_MInterfacePointer_abData = -1; +static gint hf_IWbemServices_MInterfacePointer_ulCntData = -1; +static gint hf_IWbemServices_opnum = -1; +static gint hf_IWbemServices_werror = -1; + +static gint proto_dcerpc_IWbemServices = -1; +/* Version information */ + + +static e_guid_t uuid_dcerpc_IWbemServices = { + 0x9556dc99, 0x828c, 0x11cf, + { 0xa3, 0x7e, 0x00, 0xaa, 0x00, 0x32, 0x40, 0xc7 } +}; +static guint16 ver_dcerpc_IWbemServices = 0; + +static int IWbemServices_dissect_element_IWbemClassObject_count(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_IWbemClassObject_objects(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_MInterfacePointer_ulCntData(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_MInterfacePointer_abData(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_MInterfacePointer_abData_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_IWbemContext_u(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_IWbemContext_intPtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_IWbemContext_intPtr_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_orpcthis(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_strObjectPath(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_lFlags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_pCtx(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_pCtx_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_orpcthat(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_orpcthat_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_ppObject(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_ppObject_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_ppObject__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_ppCallResult(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_ppCallResult_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_GetObject_ppCallResult__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_orpcthis(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_strObjectPath(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_strObjectPath_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_strMethodName(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_strMethodName_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_lFlags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_orpcthat(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); +static int IWbemServices_dissect_element_ExecMethod_orpcthat_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_); + #include "packet-dcom.h" +static int +IWbemServices_dissect_element_IWbemClassObject_objects_(tvbuff_t *tvb, int offset, int length, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep); +static int +IWbemServices_dissect_element_GetObject_strObjectPath_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep); +extern void register_dcom_wmio (void); +/* GetObject */ +static int +IWbemServices_dissect_element_GetObject_orpcthis(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +{ + proto_item *sub_item; + proto_tree *sub_tree; + sub_item = proto_tree_add_item(tree, hf_IWbemServices_GetObject_orpcthis, tvb, offset, 0, ENC_NA); + sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_GetObject_orpcthis); + return dissect_dcom_this(tvb, offset, pinfo, sub_tree, di, drep); +} +static int +IWbemServices_dissect_element_GetObject_orpcthat_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +{ + proto_item *sub_item; + proto_tree *sub_tree; + register_dcom_wmio(); + sub_item = proto_tree_add_item(tree, hf_IWbemServices_GetObject_orpcthat, tvb, offset, 0, ENC_NA); + sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_GetObject_orpcthat); + return dissect_dcom_that(tvb, offset, pinfo, sub_tree, di, drep); +} +/* ExecMethod */ +static int +IWbemServices_dissect_element_ExecMethod_orpcthis(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +{ + proto_item *sub_item; + proto_tree *sub_tree; + sub_item = proto_tree_add_item(tree, hf_IWbemServices_ExecMethod_orpcthis, tvb, offset, 0, ENC_NA); + sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_ExecMethod_orpcthis); + return dissect_dcom_this(tvb, offset, pinfo, sub_tree, di, drep); +} +static int +IWbemServices_dissect_element_ExecMethod_orpcthat_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +{ + proto_item *sub_item; + proto_tree *sub_tree; + register_dcom_wmio(); + sub_item = proto_tree_add_item(tree, hf_IWbemServices_ExecMethod_orpcthat, tvb, offset, 0, ENC_NA); + sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_ExecMethod_orpcthat); + return dissect_dcom_that(tvb, offset, pinfo, sub_tree, di, drep); +} +static int +IWbemServices_dissect_element_IWbemClassObject_objects(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +{ + return dissect_ndr_ucarray_block(tvb, offset, pinfo, tree, di, drep, &IWbemServices_dissect_element_IWbemClassObject_objects_); +} +static int +IWbemServices_dissect_element_IWbemClassObject_objects_(tvbuff_t *tvb, int offset, int length, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + dissect_dcom_OBJREF(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_IWbemClassObject_objects, NULL); + return offset + length; +} +static int +IWbemServices_dissect_element_GetObject_strObjectPath_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep) +{ + char *data = NULL; + offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_IWbemServices_GetObject_strObjectPath, FALSE, &data); + if (data){ + proto_item_append_text(tree, ": %s", data); + col_append_fstr(pinfo->cinfo, COL_INFO, " Object=%s", data); + } + return offset; +} + + +/* IDL: struct { */ +/* IDL: } */ + +int +IWbemServices_dissect_struct_ORPCTHIS(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_) +{ + proto_item *item = NULL; + int old_offset; + + old_offset = offset; + + if (parent_tree) { + item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA); + } + + + proto_item_set_len(item, offset-old_offset); + + + return offset; +} + + +/* IDL: struct { */ +/* IDL: } */ + +int +IWbemServices_dissect_struct_ORPCTHAT(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_) +{ + proto_item *item = NULL; + int old_offset; + + old_offset = offset; + + if (parent_tree) { + item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA); + } + + + proto_item_set_len(item, offset-old_offset); + + + return offset; +} + + +/* IDL: struct { */ +/* IDL: } */ + +int +IWbemServices_dissect_struct_IWbemCallResult(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_) +{ + proto_item *item = NULL; + int old_offset; + + old_offset = offset; + + if (parent_tree) { + item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA); + } + + + proto_item_set_len(item, offset-old_offset); + + + return offset; +} + + +/* IDL: struct { */ +/* IDL: uint32 count; */ +/* IDL: [size_is(count)] uint8 objects[*]; */ +/* IDL: } */ + +static int +IWbemServices_dissect_element_IWbemClassObject_count(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_IWbemClassObject_count, 0); + + return offset; +} + +int +IWbemServices_dissect_struct_IWbemClassObject(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + int old_offset; + + ALIGN_TO_4_BYTES; + + old_offset = offset; + + if (parent_tree) { + item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_IWbemServices_IWbemClassObject); + } + + offset = IWbemServices_dissect_element_IWbemClassObject_count(tvb, offset, pinfo, tree, di, drep); + + offset = IWbemServices_dissect_element_IWbemClassObject_objects(tvb, offset, pinfo, tree, di, drep); + + + proto_item_set_len(item, offset-old_offset); + + + if (di->call_data->flags & DCERPC_IS_NDR64) { + ALIGN_TO_4_BYTES; + } + + return offset; +} + + +/* IDL: struct { */ +/* IDL: uint32 ulCntData; */ +/* IDL: [size_is(count)] uint8 abData[*]; */ +/* IDL: } */ + +static int +IWbemServices_dissect_element_MInterfacePointer_ulCntData(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_MInterfacePointer_ulCntData, 0); + + return offset; +} + +static int +IWbemServices_dissect_element_MInterfacePointer_abData(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_MInterfacePointer_abData_); + + return offset; +} + +static int +IWbemServices_dissect_element_MInterfacePointer_abData_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = PIDL_dissect_uint8(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_MInterfacePointer_abData, 0); + + return offset; +} + +int +IWbemServices_dissect_struct_MInterfacePointer(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + int old_offset; + + ALIGN_TO_4_BYTES; + + old_offset = offset; + + if (parent_tree) { + item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_IWbemServices_MInterfacePointer); + } + + offset = IWbemServices_dissect_element_MInterfacePointer_ulCntData(tvb, offset, pinfo, tree, di, drep); + + offset = IWbemServices_dissect_element_MInterfacePointer_abData(tvb, offset, pinfo, tree, di, drep); + + + proto_item_set_len(item, offset-old_offset); + + + if (di->call_data->flags & DCERPC_IS_NDR64) { + ALIGN_TO_4_BYTES; + } + + return offset; +} + + +/* IDL: struct { */ +/* IDL: uint32 u; */ +/* IDL: [unique(1)] MInterfacePointer *intPtr; */ +/* IDL: } */ + +static int +IWbemServices_dissect_element_IWbemContext_u(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_IWbemContext_u, 0); + + return offset; +} + +static int +IWbemServices_dissect_element_IWbemContext_intPtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_IWbemContext_intPtr_, NDR_POINTER_UNIQUE, "Pointer to IntPtr (MInterfacePointer)",hf_IWbemServices_IWbemContext_intPtr); + + return offset; +} + +static int +IWbemServices_dissect_element_IWbemContext_intPtr_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = IWbemServices_dissect_struct_MInterfacePointer(tvb,offset,pinfo,tree,di,drep,hf_IWbemServices_IWbemContext_intPtr,0); + + return offset; +} + +int +IWbemServices_dissect_struct_IWbemContext(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + int old_offset; + + ALIGN_TO_5_BYTES; + + old_offset = offset; + + if (parent_tree) { + item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_IWbemServices_IWbemContext); + } + + offset = IWbemServices_dissect_element_IWbemContext_u(tvb, offset, pinfo, tree, di, drep); + + offset = IWbemServices_dissect_element_IWbemContext_intPtr(tvb, offset, pinfo, tree, di, drep); + + + proto_item_set_len(item, offset-old_offset); + + + if (di->call_data->flags & DCERPC_IS_NDR64) { + ALIGN_TO_5_BYTES; + } + + return offset; +} + +/* IDL: WERROR iwbemservices_opnum0( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum0_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum0"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum0_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum0"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum1( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum1_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum1"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum1_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum1"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum2( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum2_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum2"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum2_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum2"; + return offset; +} + +/* IDL: WERROR iwbemservices_OpenNamespace( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_OpenNamespace_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_OpenNamespace"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_OpenNamespace_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_OpenNamespace"; + return offset; +} + +/* IDL: WERROR iwbemservices_CancelAsyncCall( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_CancelAsyncCall_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_CancelAsyncCall"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_CancelAsyncCall_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_CancelAsyncCall"; + return offset; +} + +/* IDL: WERROR iwbemservices_QueryObjectSink( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_QueryObjectSink_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_QueryObjectSink"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_QueryObjectSink_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_QueryObjectSink"; + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_strObjectPath(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_GetObject_strObjectPath_, NDR_POINTER_UNIQUE, "Pointer to StrObjectPath (uint16)",hf_IWbemServices_GetObject_strObjectPath); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_lFlags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_GetObject_lFlags, 0); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_pCtx(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_GetObject_pCtx_, NDR_POINTER_REF, "Pointer to PCtx (IWbemContext)",hf_IWbemServices_GetObject_pCtx); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_pCtx_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = IWbemServices_dissect_struct_IWbemContext(tvb,offset,pinfo,tree,di,drep,hf_IWbemServices_GetObject_pCtx,0); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_orpcthat(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_GetObject_orpcthat_, NDR_POINTER_REF, "Pointer to Orpcthat (ORPCTHAT)",hf_IWbemServices_GetObject_orpcthat); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_ppObject(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_GetObject_ppObject_, NDR_POINTER_UNIQUE, "Pointer to PpObject (IWbemClassObject)",hf_IWbemServices_GetObject_ppObject); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_ppObject_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_GetObject_ppObject__, NDR_POINTER_UNIQUE, "Pointer to PpObject (IWbemClassObject)",hf_IWbemServices_GetObject_ppObject); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_ppObject__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = IWbemServices_dissect_struct_IWbemClassObject(tvb,offset,pinfo,tree,di,drep,hf_IWbemServices_GetObject_ppObject,0); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_ppCallResult(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_GetObject_ppCallResult_, NDR_POINTER_UNIQUE, "Pointer to PpCallResult (IWbemCallResult)",hf_IWbemServices_GetObject_ppCallResult); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_ppCallResult_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_GetObject_ppCallResult__, NDR_POINTER_UNIQUE, "Pointer to PpCallResult (IWbemCallResult)",hf_IWbemServices_GetObject_ppCallResult); + + return offset; +} + +static int +IWbemServices_dissect_element_GetObject_ppCallResult__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = IWbemServices_dissect_struct_IWbemCallResult(tvb,offset,pinfo,tree,di,drep,hf_IWbemServices_GetObject_ppCallResult,0); + + return offset; +} + +/* IDL: WERROR GetObject( */ +/* IDL: [in] ORPCTHIS orpcthis, */ +/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *strObjectPath, */ +/* IDL: [in] uint32 lFlags, */ +/* IDL: [in] [ref] IWbemContext *pCtx, */ +/* IDL: [out] [ref] ORPCTHAT *orpcthat, */ +/* IDL: [in] [out] [unique(1)] IWbemClassObject **ppObject, */ +/* IDL: [in] [out] [unique(1)] IWbemCallResult **ppCallResult */ +/* IDL: ); */ + +static int +IWbemServices_dissect_GetObject_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="GetObject"; + offset = IWbemServices_dissect_element_GetObject_orpcthat(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + + offset = IWbemServices_dissect_element_GetObject_ppObject(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + + offset = IWbemServices_dissect_element_GetObject_ppCallResult(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_GetObject_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="GetObject"; + offset = IWbemServices_dissect_element_GetObject_orpcthis(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_GetObject_strObjectPath(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_GetObject_lFlags(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_GetObject_pCtx(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_GetObject_ppObject(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_GetObject_ppCallResult(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + return offset; +} + +/* IDL: WERROR iwbemservices_opnum7( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum7_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum7"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum7_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum7"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum8( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum8_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum8"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum8_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum8"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum9( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum9_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum9"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum9_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum9"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum10( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum10_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum10"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum10_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum10"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum11( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum11_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum11"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum11_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum11"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum12( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum12_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum12"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum12_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum12"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum13( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum13_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum13"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum13_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum13"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum14( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum14_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum14"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum14_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum14"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum15( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum15_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum15"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum15_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum15"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum16( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum16_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum16"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum16_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum16"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum17( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum17_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum17"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum17_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum17"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum18( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum18_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum18"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum18_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum18"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum19( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum19_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum19"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum19_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum19"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum20( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum20_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum20"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum20_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum20"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum21( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum21_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum21"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum21_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum21"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum22( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum22_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum22"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum22_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum22"; + return offset; +} + +/* IDL: WERROR iwbemservices_opnum23( */ +/* IDL: */ +/* IDL: ); */ + +static int +IWbemServices_dissect_iwbemservices_opnum23_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="iwbemservices_opnum23"; + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_iwbemservices_opnum23_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="iwbemservices_opnum23"; + return offset; +} + +static int +IWbemServices_dissect_element_ExecMethod_strObjectPath(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_ExecMethod_strObjectPath_, NDR_POINTER_UNIQUE, "Pointer to StrObjectPath (uint16)",hf_IWbemServices_ExecMethod_strObjectPath); + + return offset; +} + +static int +IWbemServices_dissect_element_ExecMethod_strObjectPath_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + char *data; + + offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_IWbemServices_ExecMethod_strObjectPath, FALSE, &data); + proto_item_append_text(tree, ": %s", data); + + return offset; +} + +static int +IWbemServices_dissect_element_ExecMethod_strMethodName(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_ExecMethod_strMethodName_, NDR_POINTER_UNIQUE, "Pointer to StrMethodName (uint16)",hf_IWbemServices_ExecMethod_strMethodName); + + return offset; +} + +static int +IWbemServices_dissect_element_ExecMethod_strMethodName_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + char *data; + + offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_IWbemServices_ExecMethod_strMethodName, FALSE, &data); + proto_item_append_text(tree, ": %s", data); + + return offset; +} + +static int +IWbemServices_dissect_element_ExecMethod_lFlags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_ExecMethod_lFlags, 0); + + return offset; +} + +static int +IWbemServices_dissect_element_ExecMethod_orpcthat(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, IWbemServices_dissect_element_ExecMethod_orpcthat_, NDR_POINTER_REF, "Pointer to Orpcthat (ORPCTHAT)",hf_IWbemServices_ExecMethod_orpcthat); + + return offset; +} + +/* IDL: WERROR ExecMethod( */ +/* IDL: [in] ORPCTHIS orpcthis, */ +/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *strObjectPath, */ +/* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *strMethodName, */ +/* IDL: [in] uint32 lFlags, */ +/* IDL: [out] [ref] ORPCTHAT *orpcthat */ +/* IDL: ); */ + +static int +IWbemServices_dissect_ExecMethod_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + guint32 status; + + di->dcerpc_procedure_name="ExecMethod"; + offset = IWbemServices_dissect_element_ExecMethod_orpcthat(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_werror, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x")); + + return offset; +} + +static int +IWbemServices_dissect_ExecMethod_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_) +{ + di->dcerpc_procedure_name="ExecMethod"; + offset = IWbemServices_dissect_element_ExecMethod_orpcthis(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_ExecMethod_strObjectPath(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_ExecMethod_strMethodName(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + offset = IWbemServices_dissect_element_ExecMethod_lFlags(tvb, offset, pinfo, tree, di, drep); + offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep); + return offset; +} + + +static dcerpc_sub_dissector IWbemServices_dissectors[] = { + { 0, "iwbemservices_opnum0", + IWbemServices_dissect_iwbemservices_opnum0_request, IWbemServices_dissect_iwbemservices_opnum0_response}, + { 1, "iwbemservices_opnum1", + IWbemServices_dissect_iwbemservices_opnum1_request, IWbemServices_dissect_iwbemservices_opnum1_response}, + { 2, "iwbemservices_opnum2", + IWbemServices_dissect_iwbemservices_opnum2_request, IWbemServices_dissect_iwbemservices_opnum2_response}, + { 3, "iwbemservices_OpenNamespace", + IWbemServices_dissect_iwbemservices_OpenNamespace_request, IWbemServices_dissect_iwbemservices_OpenNamespace_response}, + { 4, "iwbemservices_CancelAsyncCall", + IWbemServices_dissect_iwbemservices_CancelAsyncCall_request, IWbemServices_dissect_iwbemservices_CancelAsyncCall_response}, + { 5, "iwbemservices_QueryObjectSink", + IWbemServices_dissect_iwbemservices_QueryObjectSink_request, IWbemServices_dissect_iwbemservices_QueryObjectSink_response}, + { 6, "GetObject", + IWbemServices_dissect_GetObject_request, IWbemServices_dissect_GetObject_response}, + { 7, "iwbemservices_opnum7", + IWbemServices_dissect_iwbemservices_opnum7_request, IWbemServices_dissect_iwbemservices_opnum7_response}, + { 8, "iwbemservices_opnum8", + IWbemServices_dissect_iwbemservices_opnum8_request, IWbemServices_dissect_iwbemservices_opnum8_response}, + { 9, "iwbemservices_opnum9", + IWbemServices_dissect_iwbemservices_opnum9_request, IWbemServices_dissect_iwbemservices_opnum9_response}, + { 10, "iwbemservices_opnum10", + IWbemServices_dissect_iwbemservices_opnum10_request, IWbemServices_dissect_iwbemservices_opnum10_response}, + { 11, "iwbemservices_opnum11", + IWbemServices_dissect_iwbemservices_opnum11_request, IWbemServices_dissect_iwbemservices_opnum11_response}, + { 12, "iwbemservices_opnum12", + IWbemServices_dissect_iwbemservices_opnum12_request, IWbemServices_dissect_iwbemservices_opnum12_response}, + { 13, "iwbemservices_opnum13", + IWbemServices_dissect_iwbemservices_opnum13_request, IWbemServices_dissect_iwbemservices_opnum13_response}, + { 14, "iwbemservices_opnum14", + IWbemServices_dissect_iwbemservices_opnum14_request, IWbemServices_dissect_iwbemservices_opnum14_response}, + { 15, "iwbemservices_opnum15", + IWbemServices_dissect_iwbemservices_opnum15_request, IWbemServices_dissect_iwbemservices_opnum15_response}, + { 16, "iwbemservices_opnum16", + IWbemServices_dissect_iwbemservices_opnum16_request, IWbemServices_dissect_iwbemservices_opnum16_response}, + { 17, "iwbemservices_opnum17", + IWbemServices_dissect_iwbemservices_opnum17_request, IWbemServices_dissect_iwbemservices_opnum17_response}, + { 18, "iwbemservices_opnum18", + IWbemServices_dissect_iwbemservices_opnum18_request, IWbemServices_dissect_iwbemservices_opnum18_response}, + { 19, "iwbemservices_opnum19", + IWbemServices_dissect_iwbemservices_opnum19_request, IWbemServices_dissect_iwbemservices_opnum19_response}, + { 20, "iwbemservices_opnum20", + IWbemServices_dissect_iwbemservices_opnum20_request, IWbemServices_dissect_iwbemservices_opnum20_response}, + { 21, "iwbemservices_opnum21", + IWbemServices_dissect_iwbemservices_opnum21_request, IWbemServices_dissect_iwbemservices_opnum21_response}, + { 22, "iwbemservices_opnum22", + IWbemServices_dissect_iwbemservices_opnum22_request, IWbemServices_dissect_iwbemservices_opnum22_response}, + { 23, "iwbemservices_opnum23", + IWbemServices_dissect_iwbemservices_opnum23_request, IWbemServices_dissect_iwbemservices_opnum23_response}, + { 24, "ExecMethod", + IWbemServices_dissect_ExecMethod_request, IWbemServices_dissect_ExecMethod_response}, + { 0, NULL, NULL, NULL } +}; + +void proto_register_dcerpc_IWbemServices(void) +{ + static hf_register_info hf[] = { + { &hf_IWbemServices_ExecMethod_lFlags, + { "LFlags", "IWbemServices.ExecMethod.lFlags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_ExecMethod_orpcthat, + { "Orpcthat", "IWbemServices.ExecMethod.orpcthat", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_ExecMethod_orpcthis, + { "Orpcthis", "IWbemServices.ExecMethod.orpcthis", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_ExecMethod_strMethodName, + { "StrMethodName", "IWbemServices.ExecMethod.strMethodName", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_ExecMethod_strObjectPath, + { "StrObjectPath", "IWbemServices.ExecMethod.strObjectPath", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_GetObject_lFlags, + { "LFlags", "IWbemServices.GetObject.lFlags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_GetObject_orpcthat, + { "Orpcthat", "IWbemServices.GetObject.orpcthat", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_GetObject_orpcthis, + { "Orpcthis", "IWbemServices.GetObject.orpcthis", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_GetObject_pCtx, + { "PCtx", "IWbemServices.GetObject.pCtx", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_GetObject_ppCallResult, + { "PpCallResult", "IWbemServices.GetObject.ppCallResult", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_GetObject_ppObject, + { "PpObject", "IWbemServices.GetObject.ppObject", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_GetObject_strObjectPath, + { "StrObjectPath", "IWbemServices.GetObject.strObjectPath", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_IWbemClassObject_count, + { "Count", "IWbemServices.IWbemClassObject.count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_IWbemClassObject_objects, + { "Objects", "IWbemServices.IWbemClassObject.objects", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_IWbemContext_intPtr, + { "IntPtr", "IWbemServices.IWbemContext.intPtr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_IWbemContext_u, + { "U", "IWbemServices.IWbemContext.u", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_MInterfacePointer_abData, + { "AbData", "IWbemServices.MInterfacePointer.abData", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_MInterfacePointer_ulCntData, + { "UlCntData", "IWbemServices.MInterfacePointer.ulCntData", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_opnum, + { "Operation", "IWbemServices.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_IWbemServices_werror, + { "Windows Error", "IWbemServices.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }}, + }; + + + static gint *ett[] = { + &ett_IWbemServices_GetObject_orpcthis, + &ett_IWbemServices_GetObject_orpcthat, + &ett_IWbemServices_ExecMethod_orpcthis, + &ett_IWbemServices_ExecMethod_orpcthat, + &ett_dcerpc_IWbemServices, + &ett_IWbemServices_ORPCTHIS, + &ett_IWbemServices_ORPCTHAT, + &ett_IWbemServices_IWbemCallResult, + &ett_IWbemServices_IWbemClassObject, + &ett_IWbemServices_MInterfacePointer, + &ett_IWbemServices_IWbemContext, + }; + + proto_dcerpc_IWbemServices = proto_register_protocol("IWBEMSERVICES (pidl)", "IWBEMSERVICES", "IWbemServices"); + proto_register_field_array(proto_dcerpc_IWbemServices, hf, array_length (hf)); + proto_register_subtree_array(ett, array_length(ett)); +} + +void proto_reg_handoff_dcerpc_IWbemServices(void) +{ + dcerpc_init_uuid(proto_dcerpc_IWbemServices, ett_dcerpc_IWbemServices, + &uuid_dcerpc_IWbemServices, ver_dcerpc_IWbemServices, + IWbemServices_dissectors, hf_IWbemServices_opnum); +} diff --git a/epan/dissectors/packet-dcerpc-iwbemservices.h b/epan/dissectors/packet-dcerpc-iwbemservices.h new file mode 100644 index 0000000000..5f332bc99f --- /dev/null +++ b/epan/dissectors/packet-dcerpc-iwbemservices.h @@ -0,0 +1,20 @@ +/* DO NOT EDIT + This file was automatically generated by Pidl + from iwbemservices.idl and iwbemservices.cnf. + + Pidl is a perl based IDL compiler for DCE/RPC idl files. + It is maintained by the Samba team, not the Wireshark team. + Instructions on how to download and install Pidl can be + found at https://gitlab.com/wireshark/wireshark/-/wikis/Pidl +*/ + +#ifndef __PACKET_DCERPC_IWBEMSERVICES_H +#define __PACKET_DCERPC_IWBEMSERVICES_H + +int IWbemServices_dissect_struct_ORPCTHIS(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_); +int IWbemServices_dissect_struct_ORPCTHAT(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_); +int IWbemServices_dissect_struct_IWbemCallResult(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_); +int IWbemServices_dissect_struct_IWbemClassObject(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_); +int IWbemServices_dissect_struct_MInterfacePointer(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_); +int IWbemServices_dissect_struct_IWbemContext(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_); +#endif /* __PACKET_DCERPC_IWBEMSERVICES_H */ diff --git a/epan/dissectors/packet-dcom.c b/epan/dissectors/packet-dcom.c index 4b621748ac..f01065bf3b 100644 --- a/epan/dissectors/packet-dcom.c +++ b/epan/dissectors/packet-dcom.c @@ -2017,7 +2017,7 @@ dissect_dcom_CUSTOBJREF(tvbuff_t *tvb, gint offset, packet_info *pinfo, /* the following data depends on the iid, get the routine by iid */ routine = dcom_get_routine_by_uuid(iid); if (routine){ - offset = routine(tvb, offset, pinfo, sub_tree, di, drep, 0); + offset = routine(tvb, offset, pinfo, sub_tree, di, drep, u32Size); } /* append info to subtree header */ diff --git a/epan/dissectors/packet-wmio.c b/epan/dissectors/packet-wmio.c new file mode 100644 index 0000000000..cd28c214c4 --- /dev/null +++ b/epan/dissectors/packet-wmio.c @@ -0,0 +1,1242 @@ +/* packet-wmio.c + * Wireshark's WMIO dissector. + * + * Copyright 2024, Hiddencodes Sec + * + * Wireshark - Network traffic analyzer + * By Gerald Combs + * Copyright 1998 Gerald Combs + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "config.h" + +#include +#include "packet-dcerpc.h" +#include + +void proto_register_WMIO (void); +void proto_reg_handoff_WMIO (void); + +static int proto_WMIO; + +/* IWbemClassObject Interface + * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wmi/46710c5c-d7ab-4e4c-b4a5-ebff311fdcd1 + * dc12a681-737f-11cf-884d-00aa004b2e24 + */ +static e_guid_t iid_WMIO = { 0xdc12a681, 0x737f, 0x11cf, { 0x88, 0x4d, 0x00, 0xaa, 0x00, 0x4b, 0x2e, 0x24} }; + +static guint32 wmio_signature = 0x12345678; + +#define CLASS_HEADER_LENGTH 13 + +#define WMIO_OBJECT_FLAG_CIM_CLASS 0X01 +#define WMIO_OBJECT_FLAG_CIM_INSTANCE 0X02 +#define WMIO_OBJECT_FLAG_HAS_DECORATION 0X04 +#define WMIO_OBJECT_FLAG_PROTOTYPE_RESULT_OBJECT 0X10 +#define WMIO_OBJECT_FLAG_KEY_PROPERTY_MISSING 0X40 + +#define WBEM_FLAVOR_FLAG_PROPAGATE_TO_INSTANCE 0x01 +#define WBEM_FLAVOR_FLAG_PROPAGATE_TO_DERIVED_CLASS 0x02 +#define WBEM_FLAVOR_NOT_OVERRIDABLE 0x10 +#define WBEM_FLAVOR_ORIGIN_PROPAGATED 0x20 +#define WBEM_FLAVOR_ORIGIN_SYSTEM 0x40 +#define WBEM_FLAVOR_AMENDED 0x80 + +#define CIM_ARRAY_FLAG 0x2000 +#define INHERITED_PROPERTY_TYPE 0x4000 + +/* CimType + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/e137e6c6-c1cc-449e-a0b4-76fabf534480 + * CimType is a 32-bit value of which only the lower 16 bits are used. + */ +#define CIM_TYPE_SINT16 2 +#define CIM_TYPE_SINT32 3 +#define CIM_TYPE_REAL32 4 +#define CIM_TYPE_REAL64 5 +#define CIM_TYPE_STRING 8 +#define CIM_TYPE_BOOLEAN 11 +#define CIM_TYPE_OBJECT 13 +#define CIM_TYPE_SINT8 16 +#define CIM_TYPE_UINT8 17 +#define CIM_TYPE_UINT16 18 +#define CIM_TYPE_UINT32 19 +#define CIM_TYPE_SINT64 20 +#define CIM_TYPE_UINT64 21 +#define CIM_TYPE_DATETIME 101 +#define CIM_TYPE_REFERENCE 102 +#define CIM_TYPE_CHAR16 103 + +#define CIM_ARRAY_TYPE(X) (CIM_ARRAY_FLAG | X) + +#define CIM_ARRAY_SINT8 CIM_ARRAY_TYPE(CIM_TYPE_SINT8) +#define CIM_ARRAY_UINT8 CIM_ARRAY_TYPE(CIM_TYPE_UINT8) +#define CIM_ARRAY_SINT16 CIM_ARRAY_TYPE(CIM_TYPE_SINT16) +#define CIM_ARRAY_UINT16 CIM_ARRAY_TYPE(CIM_TYPE_UINT16) +#define CIM_ARRAY_SINT32 CIM_ARRAY_TYPE(CIM_TYPE_SINT32) +#define CIM_ARRAY_UINT32 CIM_ARRAY_TYPE(CIM_TYPE_UINT32) +#define CIM_ARRAY_SINT64 CIM_ARRAY_TYPE(CIM_TYPE_SINT64) +#define CIM_ARRAY_UINT64 CIM_ARRAY_TYPE(CIM_TYPE_UINT64) +#define CIM_ARRAY_REAL32 CIM_ARRAY_TYPE(CIM_TYPE_REAL32) +#define CIM_ARRAY_REAL64 CIM_ARRAY_TYPE(CIM_TYPE_REAL64) +#define CIM_ARRAY_BOOLEAN CIM_ARRAY_TYPE(CIM_TYPE_BOOLEAN) +#define CIM_ARRAY_STRING CIM_ARRAY_TYPE(CIM_TYPE_STRING) +#define CIM_ARRAY_DATETIME CIM_ARRAY_TYPE(CIM_TYPE_DATETIME) +#define CIM_ARRAY_REFERENCE CIM_ARRAY_TYPE(CIM_TYPE_REFERENCE) +#define CIM_ARRAY_CHAR16 CIM_ARRAY_TYPE(CIM_TYPE_CHAR16) +#define CIM_ARRAY_OBJECT CIM_ARRAY_TYPE(CIM_TYPE_OBJECT) + +#define STRINGFY(X) { X, #X} + +static const value_string cim_types[] = { + STRINGFY(CIM_TYPE_SINT8), + STRINGFY(CIM_TYPE_UINT8), + STRINGFY(CIM_TYPE_SINT16), + STRINGFY(CIM_TYPE_UINT16), + STRINGFY(CIM_TYPE_SINT32), + STRINGFY(CIM_TYPE_UINT32), + STRINGFY(CIM_TYPE_SINT64), + STRINGFY(CIM_TYPE_UINT64), + STRINGFY(CIM_TYPE_REAL32), + STRINGFY(CIM_TYPE_REAL64), + STRINGFY(CIM_TYPE_BOOLEAN), + STRINGFY(CIM_TYPE_STRING), + STRINGFY(CIM_TYPE_DATETIME), + STRINGFY(CIM_TYPE_REFERENCE), + STRINGFY(CIM_TYPE_CHAR16), + STRINGFY(CIM_TYPE_OBJECT), + STRINGFY(CIM_ARRAY_SINT8), + STRINGFY(CIM_ARRAY_UINT8), + STRINGFY(CIM_ARRAY_SINT16), + STRINGFY(CIM_ARRAY_UINT16), + STRINGFY(CIM_ARRAY_SINT32), + STRINGFY(CIM_ARRAY_UINT32), + STRINGFY(CIM_ARRAY_SINT64), + STRINGFY(CIM_ARRAY_UINT64), + STRINGFY(CIM_ARRAY_REAL32), + STRINGFY(CIM_ARRAY_REAL64), + STRINGFY(CIM_ARRAY_BOOLEAN), + STRINGFY(CIM_ARRAY_STRING), + STRINGFY(CIM_ARRAY_DATETIME), + STRINGFY(CIM_ARRAY_REFERENCE), + STRINGFY(CIM_ARRAY_CHAR16), + STRINGFY(CIM_ARRAY_OBJECT), + { 0, NULL } }; + +static int hf_wmio; +static int hf_wmio_signature; +static int hf_wmio_objectencodinglength; +static int hf_wmio_object_flags; +static int hf_wmio_object_flags_cim_class; +static int hf_wmio_object_flags_cim_instance; +static int hf_wmio_object_flags_has_decoration; +static int hf_wmio_object_flags_prototype_result_object; +static int hf_wmio_object_flags_key_property_missing; +static int hf_wmio_decoration; +static int hf_wmio_decoration_server_name; +static int hf_wmio_decoration_namespace; +static int hf_wmio_encoded_string; +static int hf_wmio_encoded_string_flags; +static int hf_wmio_encoded_string_flags_unicode; +static int hf_wmio_class_part; +static int hf_wmio_class_header; +static int hf_wmio_class_header_partlength; +static int hf_wmio_class_header_nameref; +static int hf_wmio_class_header_ndtablevaluetablelength; +static int hf_wmio_class_derivation; +static int hf_wmio_class_derivation_length; +static int hf_wmio_derivation_classname; +static int hf_wmio_class_name_length; +static int hf_wmio_qualifierset; +static int hf_wmio_qualifierset_length; +static int hf_wmio_qualifier; +static int hf_wmio_qualifiername; +static int hf_wmio_cimtype; +static int hf_wmio_qualifiervalue; +static int hf_wmio_bytes; +static int hf_wmio_flavor; +static int hf_wmio_flavor_propagate_to_instance; +static int hf_wmio_flavor_propagate_to_derived_class; +static int hf_wmio_flavor_not_overridable; +static int hf_wmio_flavor_origin_propagated; +static int hf_wmio_flavor_origin_system; +static int hf_wmio_flavor_amended; +static int hf_wmio_propertylookuptable; +static int hf_wmio_propertylookuptable_count; +static int hf_wmio_propertylookup; +static int hf_wmio_propertynameref; +static int hf_wmio_propertyinforef; +static int hf_wmio_ndtable; +static int hf_wmio_heap; +static int hf_wmio_heap_length; +static int hf_methodspart; +static int hf_methodspart_length; +static int hf_methodspart_methodcount; +static int hf_methodspart_methods; +static int hf_methodspart_methoddescription; +static int hf_methoddescription_methodname; +static int hf_methoddescription_methodflags; +static int hf_methoddescription_methodqualifiers; +static int hf_parentclass; +static int hf_currentclass; +static int hf_methoddescription_methodorigin; +static int hf_methoddescription_inputsignature; +static int hf_methoddescription_outputsignature; +static int hf_heap_offset; +static int hf_property_info; +static int hf_declaration_order; +static int hf_propertyinfo_inherited; +static int hf_propertyinfo_valuetableoffset; +static int hf_propertyinfo_classoforigin; +static int hf_methodsignature_offset; + +static hf_register_info hf[] = { + { &hf_wmio, + { "WMIO", "wmio", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_signature, + { "Signature", "wmio.signature", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_objectencodinglength, + { "Object Encoding Length", "wmio.objectencodinglength", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_object_flags, + { "Object flags", "wmio.objectflags", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_object_flags_cim_class, + { "CIM Class", "wmio.objectflags.cim_class", FT_BOOLEAN, 8, NULL, WMIO_OBJECT_FLAG_CIM_CLASS, NULL, HFILL }}, + { &hf_wmio_object_flags_cim_instance, + { "CIM Instance", "wmio.objectflags.cim_Instance", FT_BOOLEAN, 8, NULL, WMIO_OBJECT_FLAG_CIM_INSTANCE, NULL, HFILL }}, + { &hf_wmio_object_flags_has_decoration, + { "Has Decoration", "wmio.objectflags.has_decoration", FT_BOOLEAN, 8, NULL, WMIO_OBJECT_FLAG_HAS_DECORATION, NULL, HFILL }}, + { &hf_wmio_object_flags_prototype_result_object, + { "Prototype Result Object", "wmio.objectflags.prototype_result_object", FT_BOOLEAN, 8, NULL, WMIO_OBJECT_FLAG_PROTOTYPE_RESULT_OBJECT, NULL, HFILL }}, + { &hf_wmio_object_flags_key_property_missing, + { "Key Property Missing", "wmio.objectflags.key_property_missing", FT_BOOLEAN, 8, NULL, WMIO_OBJECT_FLAG_KEY_PROPERTY_MISSING, NULL, HFILL }}, + { &hf_wmio_encoded_string, + { "Encoded String", "wmio.encoded_string", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_encoded_string_flags, + { "Flag", "wmio.encoded_string.flags", FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_wmio_encoded_string_flags_unicode, + { "Unicode", "wmio.encoded_string.flags.unicode", FT_BOOLEAN, 8, NULL, 0x1, NULL, HFILL }}, + { &hf_wmio_decoration, + { "Decoration", "wmio.decoration", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_decoration_server_name, + { "CIM Server Name", "wmio.decoration.server_name", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_decoration_namespace, + { "CIM Namespace", "wmio.decoration.namespace", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_class_part, + { "Class Part", "wmio.class.part", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_wmio_class_header, + { "Class Header", "wmio.class.header", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_wmio_class_header_partlength, + { "Class Header ClassPart Length", "wmio.class.header.length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_class_header_nameref, + { "Class Name Reference", "wmio.class.header.nameref", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_class_header_ndtablevaluetablelength, + { "NdTable ValueTable Length", "wmio.class.header.ndtablevaluetablelength", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_class_derivation, + { "Class Derivation", "wmio.class.derivation", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_wmio_class_derivation_length, + { "Class Derivation Length", "wmio.class.derivation.length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_derivation_classname, + { "Derivation", "wmio.derivation.classname", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_class_name_length, + { "Class Name Length", "wmio.derivation.classname_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_qualifierset, + { "Qualifier Set", "wmio.qualifierset", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_qualifierset_length, + { "Qualifier Length", "wmio.derivation.qualifier_length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_qualifier, + { "Qualifier", "wmio.qualifier", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_qualifiername, + { "Qualifier Name", "wmio.qualifier_name", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_flavor, + { "Flavor", "wmio.flavor", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_flavor_propagate_to_instance, + { "Propagate To Derived Instance", "wmio.flavor.propagate_to_instance", FT_BOOLEAN, 8, NULL, WBEM_FLAVOR_FLAG_PROPAGATE_TO_INSTANCE, NULL, HFILL }}, + { &hf_wmio_flavor_propagate_to_derived_class, + { "Propagate To Derived Class", "wmio.flavor.propagate_to_derived_class", FT_BOOLEAN, 8, NULL, WBEM_FLAVOR_FLAG_PROPAGATE_TO_DERIVED_CLASS, NULL, HFILL }}, + { &hf_wmio_flavor_not_overridable, + { "Not Overridable", "wmio.flavor.not_overridable", FT_BOOLEAN, 8, NULL, WBEM_FLAVOR_NOT_OVERRIDABLE, NULL, HFILL }}, + { &hf_wmio_flavor_origin_propagated, + { "Origin Propagated", "wmio.flavor.origin_propagated", FT_BOOLEAN, 8, NULL, WBEM_FLAVOR_ORIGIN_PROPAGATED, NULL, HFILL }}, + { &hf_wmio_flavor_origin_system, + { "Origin System", "wmio.flavor.origin_system", FT_BOOLEAN, 8, NULL, WBEM_FLAVOR_ORIGIN_SYSTEM, NULL, HFILL }}, + { &hf_wmio_flavor_amended, + { "Amended", "wmio.flavor.amended", FT_BOOLEAN, 8, NULL, WBEM_FLAVOR_AMENDED, NULL, HFILL }}, + { &hf_wmio_cimtype, + { "CIM Type", "wmio.cim_type", FT_UINT32, BASE_HEX, VALS(cim_types), 0, NULL, HFILL }}, + { &hf_wmio_propertylookuptable, + { "Property Lookup Table", "wmio.property_lookup_table", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_propertylookuptable_count, + { "Property Lookup Table Count", "wmio.property_lookup_table.count", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_ndtable, + { "NdTable", "wmio.ndtable", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_propertylookup, + { "Property Lookup", "wmio.property_lookup", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_propertynameref, + { "Property Name Ref", "wmio.property_lookup.propertynameref", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_propertyinforef, + { "Property Info Ref", "wmio.property_lookup.propertyinforef", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_heap, + { "Heap", "wmio.heap", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_heap_length, + { "HeapLength", "wmio.heap.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_wmio_bytes, + { "WMIO Bytes", "wmio.bytes", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_methodspart, + { "Methodspart", "wmio.methodspart", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_methodspart_length, + { "Methodspart Length", "wmio.methodspart.length", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_methodspart_methodcount, + { "Methods Count", "wmio.methodspart.methodcount", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_methodspart_methods, + { "Methods", "wmio.methodspart.methods", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_methodspart_methoddescription, + { "MethodDescription", "wmio.methodspart.methoddescription", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_methoddescription_methodname, + { "Methodname", "wmio.methodspart.methoddescription.methodname", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_methoddescription_methodflags, + { "Methodflags", "wmio.methodspart.methoddescription.methodflags", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_methoddescription_methodorigin, + { "Methodorigin", "wmio.methodspart.methoddescription.methodorigin", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_methoddescription_methodqualifiers, + { "Methodqualifiers", "wmio.methodspart.methoddescription.methodqualifiers", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_methoddescription_inputsignature, + { "Inputsignature", "wmio.methodspart.methoddescription.inputsignature", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_methoddescription_outputsignature, + { "Outputsignature", "wmio.methodspart.methoddescription.outputsignature", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_parentclass, + { "Parent Class", "wmio.parentclass", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_currentclass, + { "Current Class", "wmio.currentclass", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_heap_offset, + { "Heap Offset", "wmio.heapoffset", FT_UINT32, BASE_HEX_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_wmio_qualifiervalue, + { "Qualifier Value", "wmio.qualifier_value", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_property_info, + { "Property Info", "wmio.property_info", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }}, + { &hf_declaration_order, + { "Declaration Order", "wmio.declaration_order", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_propertyinfo_inherited, + { "Inherited", "wmio.propertytype.inherited", FT_BOOLEAN, 32, NULL, INHERITED_PROPERTY_TYPE, NULL, HFILL }}, + { &hf_propertyinfo_valuetableoffset, + { "ValueTable Offset", "wmio.propertytype.valuetableoffset", FT_UINT32, BASE_HEX_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_propertyinfo_classoforigin, + { "ClassOfOrigin", "wmio.propertytype.classoforigin", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }}, + { &hf_methodsignature_offset, + { "Methodsignature Offset", "wmio.methodsignature.offset", FT_UINT32, BASE_HEX_DEC, NULL, 0x0, NULL, HFILL }}, +}; + +static int * const wmio_object_flags[] = { + &hf_wmio_object_flags_cim_class, + &hf_wmio_object_flags_cim_instance, + &hf_wmio_object_flags_has_decoration, + &hf_wmio_object_flags_prototype_result_object, + &hf_wmio_object_flags_key_property_missing, + NULL +}; + +static int * const wmio_flavor[] = { + &hf_wmio_flavor_propagate_to_instance, + &hf_wmio_flavor_propagate_to_derived_class, + &hf_wmio_flavor_not_overridable, + &hf_wmio_flavor_origin_propagated, + &hf_wmio_flavor_origin_system, + &hf_wmio_flavor_amended, + NULL +}; + +static int * const wmio_encoded_string_flags[] = { + &hf_wmio_encoded_string_flags_unicode, + NULL +}; + +static gint ett_wmio; +static gint ett_wmio_object_flags; +static gint ett_wmio_encoded_string; +static gint ett_wmio_encoded_string_flags; +static gint ett_wmio_class_part; +static gint ett_wmio_class_header; +static gint ett_wmio_decoration; +static gint ett_wmio_class_derivation; +static gint ett_wmio_qualifierset; +static gint ett_wmio_qualifier; +static gint ett_wmio_flavor; +static gint ett_wmio_propertylookuptable; +static gint ett_wmio_propertylookup; +static gint ett_wmio_heap; +static gint ett_methodspart; +static gint ett_parentclass; +static gint ett_currentclass; +static gint ett_methodspart_methods; +static gint ett_methodspart_methoddescription; +static gint ett_methodsignature; +static gint ett_property_info; + +/* Tree */ +static gint *ett[] = { + &ett_wmio, + &ett_wmio_object_flags, + &ett_wmio_encoded_string, + &ett_wmio_encoded_string_flags, + &ett_wmio_class_part, + &ett_wmio_class_header, + &ett_wmio_decoration, + &ett_wmio_class_derivation, + &ett_wmio_qualifierset, + &ett_wmio_qualifier, + &ett_wmio_flavor, + &ett_wmio_propertylookuptable, + &ett_wmio_propertylookup, + &ett_wmio_heap, + &ett_methodspart, + &ett_methodspart_methods, + &ett_methodspart_methoddescription, + &ett_methodsignature, + &ett_parentclass, + &ett_currentclass, + &ett_property_info, +}; + +static int dissect_wmio_objectblock(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree); +static int dissect_wmio_object_decoration(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree); +static int dissect_wmio_encoded_string(tvbuff_t *tvb, gint offset, int hfindex, packet_info *pinfo, proto_tree *tree, gboolean withlength, gint heapoffset); +static int dissect_wmio_encoding_classtype(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree); +static int dissect_wmio_encoding_classandmethodspart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, int hf_index, gint ett, bool methods); +static int dissect_wmio_encoding_classpart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree); +static int dissect_wmio_encoding_classheader(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, guint32 *pPartlength, guint32 *pNdLength, gint classheapoffset); +static int dissect_wmio_encoding_methodpart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree); +static int dissect_wmio_encoding_methodpart_methods(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, guint32 methodscount, gint methodsheapoffset); +static int dissect_wmio_encoding_methodpart_methoddescription(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, gint methodsheapoffset); +static int dissect_wmio_encoding_derivationlist(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree); +static int dissect_wmio_encoding_qualifierset(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *parent_tree, gint classheapoffset); + +/* DictionaryReference + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/40adf451-f5bc-4b0a-ab97-d620bb638470 + */ +const gchar* stringDictionary[] = + { "'" + , "key" + , "" + , "read" + , "write" + , "volatile" + , "provider" + , "dynamic" + , "cimwin32" + , "DWORD" + , "CIMTYPE" + }; + +/* Encoded-String + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/2f3afcf6-169e-41ff-80c2-367f2f74285b + * Encoded-String = Encoded-String-Flag *Character Null + * Encoded-String-Flag = OCTET + * Character = AnsiCharacter / UnicodeCharacter + * Null = Character + * AnsiCharacter = OCTET + * UnicodeCharacter = 2OCTET + */ +static int +dissect_wmio_encoded_string(tvbuff_t *tvb, gint offset, int hfindex, packet_info *pinfo, + proto_tree *tree, gboolean withlength, gint heapoffset) +{ + proto_item *sub_item; + proto_tree *sub_tree; + gint old_offset = offset; + int fn_len = 0; + header_field_info *hfinfo; + char *s= NULL; + guint32 foffset = 0; + + /* Make sure this really is a string field. */ + hfinfo = proto_registrar_get_nth(hfindex); + DISSECTOR_ASSERT_FIELD_TYPE(hfinfo, FT_STRINGZ); + + if(heapoffset > 0){ + /* HeapRef + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/f9d22d98-ed26-45d7-8792-aa0f210cffb2 + * HeapRef is a reference to any HeapItem and is expressed in 31 bits. If the HeapItem referred to is a string, + * and the most significant bit of the 32-bit HeapStringRef value is set, the reference is actually to an implied + * dictionary-based string entry and does not point to a literal Encoded-String within the Heap. + */ + foffset = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + + if (foffset < 0x80000000){ + offset = heapoffset + foffset; + } + } + + sub_item = proto_tree_add_item(tree, hf_wmio_encoded_string, tvb, offset, -1, ENC_NA); + sub_tree = proto_item_add_subtree(sub_item, ett_wmio_encoded_string); + + if((heapoffset > 0) && (foffset >= 0x80000000)){ + proto_tree_add_item(sub_tree, hf_heap_offset, tvb, old_offset, 4, ENC_LITTLE_ENDIAN); + /* https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/f9d22d98-ed26-45d7-8792-aa0f210cffb2 + * If the value of HeapRef is 0xFFFFFFFF, then HeapItem is not present and MUST be considered NULL. + */ + if(foffset == 0xFFFFFFFF){ + /* NULL String */ + proto_item_set_text(sub_tree, "%s: %s", proto_registrar_get_name(hfindex), "NULL"); + proto_item_set_len(sub_item, 4); + } else { + if (foffset & 0x80000000){ + foffset = 0x7FFFFFFF & foffset; + if (foffset < (sizeof(stringDictionary)/sizeof(stringDictionary[0]))){ + proto_item_set_text(sub_tree, "%s: %s", proto_registrar_get_name(hfindex), stringDictionary[foffset]); + } else { + proto_item_set_text(sub_tree, "%s: Unknown Index %d", proto_registrar_get_name(hfindex), hfindex); + } + proto_item_set_len(sub_item, 4); + } + } + } else { + guint64 encoded_string_flags; + + if(heapoffset > 0){ + proto_tree_add_item(sub_tree, hf_heap_offset, tvb, old_offset, 4, ENC_LITTLE_ENDIAN); + } + + old_offset = offset; + + proto_tree_add_bitmask_ret_uint64(sub_tree, tvb, offset, hf_wmio_encoded_string_flags, ett_wmio_encoded_string_flags, wmio_encoded_string_flags, ENC_NA, &encoded_string_flags); + offset++; + + if (encoded_string_flags == 0){ + /* ASCII */ + proto_tree_add_item_ret_length(sub_tree, hfindex, tvb, offset, -1, ENC_ASCII, &fn_len); + s = tvb_get_string_enc(pinfo->pool, tvb, offset, fn_len, ENC_ASCII); + } else if (encoded_string_flags == 1){ + /* UNICODE */ + proto_tree_add_item_ret_length(sub_tree, hfindex, tvb, offset, -1, ENC_UTF_16|ENC_LITTLE_ENDIAN, &fn_len); + s = tvb_get_string_enc(pinfo->pool, tvb, offset, fn_len, ENC_UTF_16); + } + offset += fn_len; + + proto_item_set_text(sub_tree, "%s: %s", proto_registrar_get_name(hfindex), s); + + if(withlength){ + proto_tree_add_item(sub_tree, hf_wmio_class_name_length, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset += 4; + } + proto_item_set_len(sub_item, offset-old_offset); + } + return offset; +} + +/* ObjectBlock + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/4e74c9f9-4a47-4111-9e67-6476c896b7fb + * ObjectBlock = ObjectFlags [Decoration] Encoding + */ +static int +dissect_wmio_objectblock(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree) +{ + gint8 flags = tvb_get_guint8(tvb, offset); + + proto_tree_add_bitmask(tree, tvb, offset, hf_wmio_object_flags, + ett_wmio_object_flags, wmio_object_flags, ENC_NA); + offset+=1; + + if (WMIO_OBJECT_FLAG_HAS_DECORATION & flags){ + offset = dissect_wmio_object_decoration(tvb, offset, pinfo, tree); + } + + if (WMIO_OBJECT_FLAG_CIM_CLASS & flags){ + offset = dissect_wmio_encoding_classtype(tvb, offset, pinfo, tree); + } + + return offset; +} + +/* Decoration = DecServerName DecNamespaceName + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/0650ad93-88fa-49e9-aebc-e4462e4a7786 + * Decoration = DecServerName DecNamespaceName + */ +static int +dissect_wmio_object_decoration(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *parent_tree) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + item = proto_tree_add_item(parent_tree, hf_wmio_decoration, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_decoration); + + offset = dissect_wmio_encoded_string(tvb, offset, hf_wmio_decoration_server_name, pinfo, tree, FALSE, 0); + offset = dissect_wmio_encoded_string(tvb, offset, hf_wmio_decoration_namespace, pinfo, tree, FALSE, 0); + + proto_item_set_len(item, offset-old_offset); + + return offset; +} + +static int +dissect_wmio_encoding_classtype(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree) +{ + // ParentClass + offset = dissect_wmio_encoding_classandmethodspart(tvb, offset, pinfo, tree, hf_parentclass, ett_parentclass, true); + + // CurrentClass + offset = dissect_wmio_encoding_classandmethodspart(tvb, offset, pinfo, tree, hf_currentclass, ett_currentclass, true); + + return offset; +} + +/* ClassAndMethodsPart = ClassPart [MethodsPart] + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/35589520-cee8-4bb1-b09e-bb009d1d1b88 + * ClassAndMethodsPart = ClassPart [MethodsPart] + */ +static int +dissect_wmio_encoding_classandmethodspart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *parent_tree, int hf_index, gint ett_id, bool methods) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_id); + + offset = dissect_wmio_encoding_classpart(tvb, offset, pinfo, tree); + if (methods){ + offset = dissect_wmio_encoding_methodpart(tvb, offset, pinfo, tree); + } + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +/* Qualifier + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/f4c4ec0a-e38b-4591-8111-cbb03cc405c2 + * Qualifier = QualifierName QualifierFlavor QualifierType QualifierValue + */ +static int +dissect_wmio_qualifier(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, gint classheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + item = proto_tree_add_item(parent_tree, hf_wmio_qualifier, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_qualifier); + + dissect_wmio_encoded_string(tvb, offset, hf_wmio_qualifiername, pinfo, tree, FALSE, classheapoffset); + offset+= 4; + + proto_tree_add_bitmask(tree, tvb, offset, hf_wmio_flavor, ett_wmio_flavor, wmio_flavor, ENC_NA); + offset+= 1; + + // QualifierType = CimType + // CimType is a 32-bit value + gint32 cimType = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + proto_tree_add_item(tree, hf_wmio_cimtype, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset+= 4; + + // QualifierValue = EncodedValue + if (cimType & CIM_ARRAY_FLAG){ + guint32 array_count = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + offset += 4; + + // CimArrayType + switch(cimType){ + case CIM_ARRAY_SINT8: + offset += array_count; + break; + case CIM_ARRAY_UINT8: + offset += array_count; + break; + case CIM_ARRAY_SINT16: + offset += (sizeof(gint16) * array_count); + break; + case CIM_ARRAY_UINT16: + offset += (sizeof(guint16) * array_count); + break; + case CIM_ARRAY_SINT32: + offset += (sizeof(gint32) * array_count); + break; + case CIM_ARRAY_UINT32: + offset += (sizeof(guint32) * array_count); + break; + case CIM_ARRAY_SINT64: + offset += (sizeof(gint64) * array_count); + break; + case CIM_ARRAY_UINT64: + offset += (sizeof(guint64) * array_count); + break; + case CIM_ARRAY_REAL32: + offset += (sizeof(gint32) * array_count); + break; + case CIM_ARRAY_REAL64: + offset += (sizeof(gint64) * array_count); + break; + case CIM_ARRAY_BOOLEAN: + offset += (2 * array_count); + break; + case CIM_ARRAY_STRING: + case CIM_ARRAY_DATETIME: + case CIM_ARRAY_REFERENCE: + // TODO + break; + case CIM_ARRAY_CHAR16: + offset += (sizeof(gint16) * array_count); + break; + case CIM_ARRAY_OBJECT: + { + guint32 i = 0; + while (i < array_count){ + gint32 objEncLength = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + offset += objEncLength; + } + break; + } + default: + break; + } + } else { + // CimBaseType + switch(cimType){ + case CIM_TYPE_SINT8: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %d", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_gint8(tvb, offset)); + proto_item_set_len(vitem, 1); + offset+= 1; + } + break; + case CIM_TYPE_UINT8: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %u", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_gint8(tvb, offset)); + proto_item_set_len(vitem, 1); + offset+= 1; + } + break; + case CIM_TYPE_SINT16: + case CIM_TYPE_CHAR16: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %d", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_gint16(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 2); + offset+= 2; + } + break; + case CIM_TYPE_UINT16: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(tree, "%s: %u", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_guint16(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 2); + offset+= 2; + } + break; + case CIM_TYPE_SINT32: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %d", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_gint32(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 4); + offset+= 4; + } + break; + case CIM_TYPE_UINT32: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %u", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 4); + offset+= 4; + } + break; + case CIM_TYPE_SINT64: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %" PRIi64, proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_gint64(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 8); + offset+= 8; + } + break; + case CIM_TYPE_UINT64: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %" PRIu64, proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_guint64(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 8); + offset+= 8; + } + break; + case CIM_TYPE_REAL32: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %f", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_ieee_float(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 4); + offset+= 4; + } + break; + case CIM_TYPE_REAL64: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %lf", proto_registrar_get_name(hf_wmio_qualifiervalue), tvb_get_ieee_double(tvb, offset, ENC_LITTLE_ENDIAN)); + proto_item_set_len(vitem, 8); + offset+= 8; + } + break; + case CIM_TYPE_BOOLEAN: + { + proto_item *vitem = proto_tree_add_item(tree, hf_wmio_qualifiervalue, tvb, offset, -1, ENC_ASCII); + proto_item_set_text(vitem, "%s: %s", proto_registrar_get_name(hf_wmio_qualifiervalue), 0 != tvb_get_guint16(tvb, offset, ENC_LITTLE_ENDIAN) ? "TRUE" : "FALSE"); + proto_item_set_len(vitem, 2); + offset+= 2; + } + break; + case CIM_TYPE_STRING: + case CIM_TYPE_DATETIME: + case CIM_TYPE_REFERENCE: + dissect_wmio_encoded_string(tvb, offset, hf_wmio_qualifiervalue, pinfo, tree, FALSE, classheapoffset); + offset+= 4; + break; + case CIM_TYPE_OBJECT: + { + gint32 objEncLength = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + offset += objEncLength; + } + break; + default: + break; + } + } + + proto_item_set_len(item, offset - old_offset); + + return offset; +} + +/* QualifierSet + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/224c7463-01df-4e09-bd71-650ec0b8adaf + * QualifierSet = EncodingLength *Qualifier + */ +static int +dissect_wmio_encoding_qualifierset(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, gint classheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + guint32 length; + + item = proto_tree_add_item(parent_tree, hf_wmio_qualifierset, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_qualifierset); + + proto_tree_add_item_ret_uint(tree, hf_wmio_qualifierset_length, tvb, offset, 4, ENC_LITTLE_ENDIAN, &length); + offset += 4; + + while((guint32)offset < (old_offset + length)){ + offset = dissect_wmio_qualifier(tvb, offset, pinfo, tree, classheapoffset); + } + + proto_item_set_len(item, offset - old_offset); + + return old_offset+length; +} + +/* PropertyInfo + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/563356b2-7bc7-4016-a88b-6685d3e09b59 + * PropertyInfo = PropertyType DeclarationOrder ValueTableOffset ClassOfOrigin PropertyQualifierSet + */ +static void +dissect_wmio_encoding_propertyinfo(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, gint classheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + guint32 propertyinfo_offset; + gint old_offset = 0; + + item = proto_tree_add_item(parent_tree, hf_property_info, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_property_info); + + proto_tree_add_item_ret_uint(tree, hf_wmio_propertyinforef, tvb, offset, 4, ENC_LITTLE_ENDIAN, &propertyinfo_offset); + + offset = classheapoffset + propertyinfo_offset; + old_offset = offset; + + gint32 propType = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + proto_tree_add_uint(tree, hf_wmio_cimtype, tvb, offset, 4, propType & 0x3FFF); + proto_tree_add_boolean(tree, hf_propertyinfo_inherited, tvb, offset, 4, propType); + offset += 4; + + proto_tree_add_item(tree, hf_declaration_order, tvb, offset, 2, ENC_LITTLE_ENDIAN); + offset += 2; + + proto_tree_add_item(tree, hf_propertyinfo_valuetableoffset, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset += 4; + + proto_tree_add_item(tree, hf_propertyinfo_classoforigin, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset += 4; + + offset = dissect_wmio_encoding_qualifierset(tvb, offset, pinfo, tree, classheapoffset); + + proto_item_set_len(item, offset - old_offset); +} + +/* PropertyLookup + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/e401de4a-58fa-423b-89e0-4b832a99d0e9 + * PropertyLookup = PropertyNameRef PropertyInfoRef + */ +static int +dissect_wmio_encoding_propertylookup(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, gint classheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + item = proto_tree_add_item(parent_tree, hf_wmio_propertylookup, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_propertylookup); + + dissect_wmio_encoded_string(tvb, offset, hf_wmio_propertynameref, pinfo, tree, FALSE, classheapoffset); + offset += 4; + + + dissect_wmio_encoding_propertyinfo(tvb, offset, pinfo, tree, classheapoffset); + offset += 4; + + proto_item_set_len(item, offset - old_offset); + + return offset; +} + +/* PropertyLookupTable + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/d4927ca8-b358-48eb-8879-a57ea4f090c3 + * PropertyLookupTable = PropertyCount *PropertyLookup + */ +static int +dissect_wmio_encoding_propertylookuptable(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, guint32 *property_count, gint classheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + guint32 count; + + item = proto_tree_add_item(parent_tree, hf_wmio_propertylookuptable, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_propertylookuptable); + + // PropertyCount + proto_tree_add_item_ret_uint(tree, hf_wmio_propertylookuptable_count, tvb, offset, 4, ENC_LITTLE_ENDIAN, &count); + offset += 4; + + for(guint32 i = 0; i < count; ++i){ + offset = dissect_wmio_encoding_propertylookup(tvb, offset, pinfo, tree, classheapoffset); + } + + *property_count = count; + + proto_item_set_len(item, offset - old_offset); + + return offset; +} + +/* ClassPart + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/06ec93f3-b4df-4f7e-b2ba-090cd435becc + * ClassPart = ClassHeader DerivationList ClassQualifierSet PropertyLookupTable [NdTable ValueTable] ClassHeap + */ +static int +dissect_wmio_encoding_classpart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *parent_tree) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + gint classheapoffset = 0; + + guint32 partlength, ndLength; + guint32 property_count; + + item = proto_tree_add_item(parent_tree, hf_wmio_class_part, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_class_part); + + { + /* Jump through the various structures to find the heap offset. */ + guint32 derivationListLength = tvb_get_guint32(tvb, offset + CLASS_HEADER_LENGTH, ENC_LITTLE_ENDIAN); + guint32 classQualifierSetLength = tvb_get_guint32(tvb, offset + CLASS_HEADER_LENGTH + derivationListLength, ENC_LITTLE_ENDIAN); + guint32 propertyLookupTableLength = 4 + 8 * tvb_get_guint32(tvb, offset + CLASS_HEADER_LENGTH + derivationListLength + classQualifierSetLength, ENC_LITTLE_ENDIAN); + guint32 ndTableLength = tvb_get_guint32(tvb, offset + (CLASS_HEADER_LENGTH - 4), ENC_LITTLE_ENDIAN); + + classheapoffset = offset /* Starting offset */ + + CLASS_HEADER_LENGTH /* ClassHeader */ + + derivationListLength /* DerivationList */ + + classQualifierSetLength /* ClassQualifierSet */ + + propertyLookupTableLength /* PropertyLookupTable */ + + ndTableLength; /* NdTable */ + } + + offset = dissect_wmio_encoding_classheader(tvb, offset, pinfo, tree, &partlength, &ndLength, classheapoffset+4); + offset = dissect_wmio_encoding_derivationlist(tvb, offset, pinfo, tree); + offset = dissect_wmio_encoding_qualifierset(tvb, offset, pinfo, tree,classheapoffset+4); + offset = dissect_wmio_encoding_propertylookuptable(tvb, offset, pinfo, tree, &property_count, classheapoffset+4); + + if(ndLength > 0){ + proto_tree_add_item(tree, hf_wmio_ndtable, tvb, offset, ndLength, ENC_NA); + offset += ndLength; + } + + { + proto_item *heapitem = NULL; + proto_tree *heaptree = NULL; + + heapitem = proto_tree_add_item(tree, hf_wmio_heap, tvb, offset, -1, ENC_NA); + heaptree = proto_item_add_subtree(heapitem, ett_wmio_heap); + + gint32 heaplength = 0x7FFFFFFF & tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + + proto_tree_add_uint(heaptree, hf_wmio_heap_length, tvb, offset, 4, heaplength); + + proto_item_set_len(heapitem, heaplength); + } + + proto_item_set_len(item, partlength); + + return old_offset + partlength; +} + +/* ClassHeader + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/b179b579-9585-47b8-bef8-8fdca9f5a94d + * ClassHeader = EncodingLength ReservedOctet ClassNameRef NdTableValueTableLength + */ +static int +dissect_wmio_encoding_classheader(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, guint32 *pPartlength, guint32 *pNdLength, gint classheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + guint32 partlength, length; + + item = proto_tree_add_item(parent_tree, hf_wmio_class_header, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_class_header); + + proto_tree_add_item_ret_uint(tree, hf_wmio_class_header_partlength, tvb, offset, 4, ENC_LITTLE_ENDIAN, &partlength); + offset+= 4; + *pPartlength = partlength; + + // ReservedOctet + offset+= 1; + + dissect_wmio_encoded_string(tvb, offset, hf_wmio_class_header_nameref, pinfo, tree, FALSE, classheapoffset); + offset+= 4; + + proto_tree_add_item_ret_uint(tree, hf_wmio_class_header_ndtablevaluetablelength, tvb, offset, 4, ENC_LITTLE_ENDIAN, &length); + offset+= 4; + *pNdLength = length; + + proto_item_set_len(item, offset-old_offset); + + return offset; +} + +/* DerivationList + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/3bfbcac6-318c-4b0a-ab87-13bfbc86f36f + * DerivationList = EncodingLength *ClassNameEncoding + */ +static int +dissect_wmio_encoding_derivationlist(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + guint32 length; + + item = proto_tree_add_item(parent_tree, hf_wmio_class_derivation, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_wmio_class_derivation); + + proto_tree_add_item_ret_uint(tree, hf_wmio_class_derivation_length, tvb, offset, 4, ENC_LITTLE_ENDIAN, &length); + offset+= 4; + + while((guint32)offset < (old_offset + length)){ + offset = dissect_wmio_encoded_string(tvb, offset, hf_wmio_derivation_classname, pinfo, tree, TRUE, 0); + } + + proto_item_set_len(item, length); + + return offset; +} + +/* MethodSignature + * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wmio/a9d7c0d1-f99a-4762-b460-e881a8c7d566 + * MethodSignature = HeapMethodSignatureBlockRef + */ +static void +dissect_wmio_encoding_methodsignature(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, int hfindex, gint methodsheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = 0; + + gint32 signatureHeapOffset = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + + old_offset = methodsheapoffset + signatureHeapOffset; + + item = proto_tree_add_item(parent_tree, hfindex, tvb, old_offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_methodsignature); + + proto_tree_add_item(tree, hf_methodsignature_offset, tvb, offset, 4, ENC_LITTLE_ENDIAN); + + offset = old_offset; + + proto_tree_add_item(tree, hf_wmio_objectencodinglength, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset+= 4; + + offset = dissect_wmio_objectblock(tvb, offset, pinfo, tree); + + proto_item_set_len(item, offset - old_offset); +} + +/* MethodDescription + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/8c81e4fa-634a-469f-8434-4ef87f2f256e + * MethodDescription = MethodName MethodFlags MethodPadding MethodOrigin MethodQualifiers InputSignature OutputSignature + */ +static int +dissect_wmio_encoding_methodpart_methoddescription(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, gint methodsheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + item = proto_tree_add_item(parent_tree, hf_methodspart_methoddescription, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_methodspart_methoddescription); + + dissect_wmio_encoded_string(tvb, offset, hf_methoddescription_methodname, pinfo, tree, FALSE, methodsheapoffset); + offset+= 4; + + proto_tree_add_item(tree, hf_methoddescription_methodflags, tvb, offset, 1, ENC_LITTLE_ENDIAN); + offset+= 1; + + // MethodPadding + offset+= 3; + + proto_tree_add_item(tree, hf_methoddescription_methodorigin, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset+= 4; + + proto_tree_add_item(tree, hf_methoddescription_methodqualifiers, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset+= 4; + + dissect_wmio_encoding_methodsignature(tvb, offset, pinfo, tree, hf_methoddescription_inputsignature, methodsheapoffset); + offset+= 4; + + dissect_wmio_encoding_methodsignature(tvb, offset, pinfo, tree, hf_methoddescription_outputsignature, methodsheapoffset); + offset+= 4; + + proto_item_set_len(item, offset - old_offset); + + return offset; +} + +static int +dissect_wmio_encoding_methodpart_methods(tvbuff_t *tvb, gint offset, packet_info *pinfo, + proto_tree *parent_tree, guint32 methodscount, gint methodsheapoffset) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + item = proto_tree_add_item(parent_tree, hf_methodspart_methods, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_methodspart_methods); + + for(guint32 methodi = 0; methodi < methodscount; ++methodi){ + offset = dissect_wmio_encoding_methodpart_methoddescription(tvb, offset, pinfo, tree, methodsheapoffset); + } + + proto_item_set_len(item, offset - old_offset); + return offset; +} + +/* MethodsPart + * https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-wmio/e00d7c6c-fa1e-4b1d-85c5-5a91a5d71299 + * MethodsPart = EncodingLength MethodCount MethodCountPadding *MethodDescription MethodHeap + */ +static int +dissect_wmio_encoding_methodpart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *parent_tree) +{ + proto_item *item = NULL; + proto_tree *tree = NULL; + gint old_offset = offset; + + guint32 length; + guint32 methodscount; + + item = proto_tree_add_item(parent_tree, hf_methodspart, tvb, offset, -1, ENC_NA); + tree = proto_item_add_subtree(item, ett_methodspart); + + proto_tree_add_item_ret_uint(tree, hf_methodspart_length, tvb, offset, 4, ENC_LITTLE_ENDIAN, &length); + offset+= 4; + + proto_tree_add_item_ret_uint(tree, hf_methodspart_methodcount, tvb, offset, 2, ENC_LITTLE_ENDIAN, &methodscount); + offset+= 2; + + // MethodCountPadding + offset+= 2; + + if(methodscount > 0){ + gint methodsHeapOffset = offset + (methodscount * 24); + methodsHeapOffset += 4; + offset = dissect_wmio_encoding_methodpart_methods(tvb, offset, pinfo, tree, methodscount, methodsHeapOffset); + } + + { + proto_item *heapitem = NULL; + proto_tree *heaptree = NULL; + + heapitem = proto_tree_add_item(tree, hf_wmio_heap, tvb, offset, -1, ENC_NA); + heaptree = proto_item_add_subtree(heapitem, ett_wmio_heap); + + gint32 heaplength = 0x7FFFFFFF & tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); + + proto_tree_add_uint(heaptree, hf_wmio_heap_length, tvb, offset, 4, heaplength); + + proto_item_set_len(heapitem, heaplength); + } + + proto_item_set_len(item, length); + + return old_offset+length; +} + + +static int +dissect_wmio(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di _U_, guint8 *drep _U_, gint size) +{ + proto_item *sub_item; + proto_tree *sub_tree; + int old_offset = offset; + guint32 signature; + + sub_item = proto_tree_add_item(tree, hf_wmio, tvb, offset, size, ENC_NA); + sub_tree = proto_item_add_subtree(sub_item, ett_wmio); + + proto_tree_add_item_ret_uint(sub_tree, hf_wmio_signature, tvb, offset, 4, ENC_LITTLE_ENDIAN, &signature); + offset+= 4; + + if (signature != wmio_signature){ + return old_offset + size; + } + + proto_tree_add_item(sub_tree, hf_wmio_objectencodinglength, tvb, offset, 4, ENC_LITTLE_ENDIAN); + offset+= 4; + + dissect_wmio_objectblock(tvb, offset, pinfo, sub_tree); + + return old_offset + size; +} + +void +register_dcom_wmio (void) +{ + dcom_register_routine(dissect_wmio, &iid_WMIO); +} + +void +proto_register_WMIO (void) +{ + proto_WMIO = proto_register_protocol ("WMIO", "WMIO", "WMIO"); + proto_register_field_array (proto_WMIO, hf, array_length (hf)); + proto_register_subtree_array (ett, array_length (ett)); +} \ No newline at end of file diff --git a/epan/dissectors/pidl/CMakeLists.txt b/epan/dissectors/pidl/CMakeLists.txt index 30e404397d..2c1747366c 100644 --- a/epan/dissectors/pidl/CMakeLists.txt +++ b/epan/dissectors/pidl/CMakeLists.txt @@ -24,6 +24,7 @@ set(PIDL_DISSECTOR_NAMES iwbemlevel1login iwbemloginclientid iwbemloginclientidex + iwbemservices lsa mapi mdssvc @@ -76,6 +77,9 @@ set(PIDL_DISSECTOR_iwbemloginclientid_EXTRA_DEPS set(PIDL_DISSECTOR_iwbemloginclientidex_EXTRA_DEPS idl_types.h ) +set(PIDL_DISSECTOR_iwbemservices_EXTRA_DEPS + idl_types.h +) set(PIDL_DISSECTOR_lsa_EXTRA_DEPS idl_types.h ) diff --git a/epan/dissectors/pidl/Makefile.pidl b/epan/dissectors/pidl/Makefile.pidl index 8ca5a2b5cc..ae1300109c 100644 --- a/epan/dissectors/pidl/Makefile.pidl +++ b/epan/dissectors/pidl/Makefile.pidl @@ -38,6 +38,7 @@ SUBDIRS = \ iwbemlevel1login \ iwbemloginclientid \ iwbemloginclientidex \ + iwbemservices \ lsa \ mapi \ mdssvc \ @@ -130,6 +131,12 @@ $(SUBDIRS) $(DONT_BUILD_SUBDIRS): %: ../packet-dcerpc-%.c ../packet-dcerpc-%.h idl_types.h cd $(cinfo, COL_INFO, " Object=%s", data); + } + + return offset; +} + +CODE END \ No newline at end of file diff --git a/epan/dissectors/pidl/iwbemservices/iwbemservices.idl b/epan/dissectors/pidl/iwbemservices/iwbemservices.idl new file mode 100644 index 0000000000..c4de5c55ce --- /dev/null +++ b/epan/dissectors/pidl/iwbemservices/iwbemservices.idl @@ -0,0 +1,158 @@ +#include "idl_types.h" + +/* + IWbemServices interface definitions +*/ +[ uuid("9556dc99-828c-11cf-a37e-00aa003240c7"), + restricted, + pointer_default(unique) +] +interface IWbemServices +{ + typedef struct + { + } ORPCTHIS; + + typedef struct + { + } ORPCTHAT; + + typedef struct + { + } IWbemCallResult; + + /*****************/ + /* Function 0 */ + [todo] WERROR iwbemservices_opnum0( + ); + /*****************/ + /* Function 1 */ + [todo] WERROR iwbemservices_opnum1( + ); + /*****************/ + /* Function 2 */ + [todo] WERROR iwbemservices_opnum2( + ); + /*****************/ + /* Function 3 */ + [todo] WERROR iwbemservices_OpenNamespace( + ); + /*****************/ + /* Function 4 */ + [todo] WERROR iwbemservices_CancelAsyncCall( + ); + /*****************/ + /* Function 5 */ + [todo] WERROR iwbemservices_QueryObjectSink( + ); + + typedef struct + { + uint32 count; + [size_is(count)] uint8 objects[]; + } IWbemClassObject; + + typedef struct + { + uint32 ulCntData; + [size_is(count)] uint8 abData[]; + } MInterfacePointer; + + typedef struct + { + uint32 u; + MInterfacePointer *intPtr; + } IWbemContext; + + /*****************/ + /* Function 6 */ + WERROR GetObject( + [in] ORPCTHIS orpcthis, + [in, unique, string, charset(UTF16)] uint16* strObjectPath, + [in] uint32 lFlags, + [in] IWbemContext* pCtx, + [out] ORPCTHAT* orpcthat, + [out, in, unique] IWbemClassObject** ppObject, + [out, in, unique] IWbemCallResult** ppCallResult + ); + + /*****************/ + /* Function 7 */ + [todo] WERROR iwbemservices_opnum7( + ); + /*****************/ + /* Function 8 */ + [todo] WERROR iwbemservices_opnum8( + ); + /*****************/ + /* Function 9 */ + [todo] WERROR iwbemservices_opnum9( + ); + /*****************/ + /* Function 10 */ + [todo] WERROR iwbemservices_opnum10( + ); + /*****************/ + /* Function 11 */ + [todo] WERROR iwbemservices_opnum11( + ); + /*****************/ + /* Function 12 */ + [todo] WERROR iwbemservices_opnum12( + ); + /*****************/ + /* Function 13 */ + [todo] WERROR iwbemservices_opnum13( + ); + /*****************/ + /* Function 14 */ + [todo] WERROR iwbemservices_opnum14( + ); + /*****************/ + /* Function 15 */ + [todo] WERROR iwbemservices_opnum15( + ); + /*****************/ + /* Function 16 */ + [todo] WERROR iwbemservices_opnum16( + ); + /*****************/ + /* Function 17 */ + [todo] WERROR iwbemservices_opnum17( + ); + /*****************/ + /* Function 18 */ + [todo] WERROR iwbemservices_opnum18( + ); + /*****************/ + /* Function 19 */ + [todo] WERROR iwbemservices_opnum19( + ); + /*****************/ + /* Function 20 */ + [todo] WERROR iwbemservices_opnum20( + ); + /*****************/ + /* Function 21 */ + [todo] WERROR iwbemservices_opnum21( + ); + /*****************/ + /* Function 22 */ + [todo] WERROR iwbemservices_opnum22( + ); + /*****************/ + /* Function 23 */ + [todo] WERROR iwbemservices_opnum23( + ); + + /*****************/ + /* Function 24 */ + WERROR ExecMethod( + [in] ORPCTHIS orpcthis, + [in, unique, string, charset(UTF16)] uint16* strObjectPath, + [in, unique, string, charset(UTF16)] uint16* strMethodName, + [in] uint32 lFlags, + [out] ORPCTHAT* orpcthat + ); + +}; \ No newline at end of file -- cgit v1.2.3