From a58c986f62a7be6fe7b69b9c372adcc2dab5f79e Mon Sep 17 00:00:00 2001 From: Michael Mann Date: Thu, 18 Sep 2014 00:10:51 -0400 Subject: Update generated DCE/RPC dissectors. Now all generated dissectors can successfully compile. Change-Id: I74728926915d5a9f1694cc49c753b80f213df767 Reviewed-on: https://code.wireshark.org/review/2598 Reviewed-by: Alexis La Goutte Reviewed-by: Michael Mann --- epan/dissectors/packet-dcerpc-winreg.c | 896 ++++++++++++++++----------------- 1 file changed, 448 insertions(+), 448 deletions(-) (limited to 'epan/dissectors/packet-dcerpc-winreg.c') diff --git a/epan/dissectors/packet-dcerpc-winreg.c b/epan/dissectors/packet-dcerpc-winreg.c index 8b0dbcc406..265293e9ee 100644 --- a/epan/dissectors/packet-dcerpc-winreg.c +++ b/epan/dissectors/packet-dcerpc-winreg.c @@ -1,5 +1,5 @@ /* DO NOT EDIT - This filter was automatically generated + This file was automatically generated by Pidl from winreg.idl and winreg.cnf. Pidl is a perl based IDL compiler for DCE/RPC idl files. @@ -43,155 +43,155 @@ static gint ett_winreg_QueryMultipleValue = -1; /* Header field declarations */ -static gint hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS = -1; -static gint hf_winreg_winreg_NotifyChangeKeyValue_string2 = -1; -static gint hf_winreg_winreg_InitiateSystemShutdown_message = -1; +static gint hf_winreg_winreg_OpenKey_access_mask = -1; static gint hf_winreg_winreg_String_name = -1; -static gint hf_winreg_winreg_InitiateSystemShutdownEx_message = -1; -static gint hf_winreg_winreg_EnumValue_enum_index = -1; -static gint hf_winreg_access_mask = -1; -static gint hf_winreg_winreg_CreateKey_options = -1; -static gint hf_winreg_winreg_InitiateSystemShutdownEx_timeout = -1; -static gint hf_winreg_handle = -1; -static gint hf_winreg_winreg_QueryInfoKey_max_valnamelen = -1; -static gint hf_winreg_winreg_SecBuf_length = -1; -static gint hf_winreg_winreg_InitiateSystemShutdown_do_reboot = -1; -static gint hf_winreg_winreg_DeleteKeyEx_handle = -1; +static gint hf_winreg_KeySecurityAttribute_data_size = -1; +static gint hf_winreg_winreg_QueryInfoKey_classname = -1; +static gint hf_winreg_winreg_QueryMultipleValues2_buffer = -1; +static gint hf_winreg_winreg_AccessMask_KEY_CREATE_LINK = -1; static gint hf_winreg_winreg_QueryMultipleValues_buffer_size = -1; -static gint hf_winreg_winreg_CreateKey_new_handle = -1; -static gint hf_winreg_winreg_QueryMultipleValues2_needed = -1; -static gint hf_winreg_QueryMultipleValue_ve_valuelen = -1; -static gint hf_winreg_KeySecurityAttribute_sec_data = -1; -static gint hf_winreg_winreg_GetKeySecurity_sec_info = -1; -static gint hf_winreg_winreg_SaveKeyEx_handle = -1; -static gint hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE = -1; -static gint hf_winreg_winreg_QueryMultipleValues2_num_values = -1; -static gint hf_winreg_winreg_SetKeySecurity_sec_info = -1; -static gint hf_winreg_winreg_StringBuf_size = -1; -static gint hf_winreg_winreg_SecBuf_sd = -1; -static gint hf_winreg_winreg_QueryInfoKey_secdescsize = -1; -static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY = -1; -static gint hf_winreg_winreg_SetValue_name = -1; -static gint hf_winreg_winreg_RestoreKey_flags = -1; -static gint hf_winreg_QueryMultipleValue_ve_type = -1; static gint hf_winreg_winreg_CreateKey_secdesc = -1; static gint hf_winreg_winreg_DeleteKeyEx_reserved = -1; -static gint hf_winreg_winreg_InitiateSystemShutdownEx_force_apps = -1; +static gint hf_winreg_winreg_QueryMultipleValues_key_handle = -1; +static gint hf_winreg_QueryMultipleValue_ve_valuename = -1; +static gint hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY = -1; +static gint hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS = -1; +static gint hf_winreg_QueryMultipleValue_ve_valueptr = -1; +static gint hf_winreg_KeySecurityData_data = -1; +static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES = -1; +static gint hf_winreg_winreg_CreateKey_keyclass = -1; static gint hf_winreg_winreg_SetValue_type = -1; -static gint hf_winreg_opnum = -1; +static gint hf_winreg_sd_offset = -1; +static gint hf_winreg_access_mask = -1; +static gint hf_winreg_winreg_CreateKey_action_taken = -1; +static gint hf_winreg_winreg_ValNameBuf_length = -1; static gint hf_winreg_winreg_EnumValue_name = -1; -static gint hf_winreg_winreg_LoadKey_filename = -1; -static gint hf_winreg_winreg_AccessMask_KEY_CREATE_LINK = -1; -static gint hf_winreg_winreg_DeleteValue_value = -1; -static gint hf_winreg_winreg_QueryMultipleValues2_offered = -1; -static gint hf_winreg_winreg_QueryMultipleValues_values_in = -1; -static gint hf_winreg_winreg_AccessMask_KEY_NOTIFY = -1; -static gint hf_winreg_winreg_OpenKey_parent_handle = -1; -static gint hf_winreg_winreg_QueryInfoKey_num_subkeys = -1; -static gint hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY = -1; -static gint hf_winreg_winreg_SaveKeyEx_sec_attrib = -1; -static gint hf_winreg_winreg_QueryInfoKey_last_changed_time = -1; -static gint hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK = -1; -static gint hf_winreg_winreg_OpenHKPD_access_mask = -1; -static gint hf_winreg_winreg_AbortSystemShutdown_server = -1; +static gint hf_winreg_winreg_QueryMultipleValues2_key_handle = -1; +static gint hf_winreg_winreg_SaveKey_handle = -1; +static gint hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY = -1; +static gint hf_winreg_winreg_InitiateSystemShutdownEx_reason = -1; +static gint hf_winreg_winreg_EnumValue_type = -1; +static gint hf_winreg_winreg_CreateKey_options = -1; static gint hf_winreg_winreg_QueryValue_type = -1; -static gint hf_winreg_sd_actual_size = -1; -static gint hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE = -1; +static gint hf_winreg_KeySecurityAttribute_sec_data = -1; +static gint hf_winreg_KeySecurityData_len = -1; +static gint hf_winreg_winreg_UnLoadKey_subkey = -1; +static gint hf_winreg_winreg_RestoreKey_filename = -1; +static gint hf_winreg_winreg_QueryInfoKey_max_valbufsize = -1; +static gint hf_winreg_winreg_SaveKeyEx_sec_attrib = -1; +static gint hf_winreg_QueryMultipleValue_ve_type = -1; static gint hf_winreg_winreg_SecBuf_inherit = -1; -static gint hf_winreg_winreg_SetValue_size = -1; -static gint hf_winreg_winreg_SaveKey_handle = -1; -static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET = -1; -static gint hf_winreg_winreg_ReplaceKey_handle = -1; -static gint hf_winreg_winreg_GetVersion_version = -1; -static gint hf_winreg_winreg_ReplaceKey_old_file = -1; -static gint hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE = -1; -static gint hf_winreg_winreg_CreateKey_action_taken = -1; -static gint hf_winreg_winreg_QueryInfoKey_num_values = -1; -static gint hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE = -1; -static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME = -1; +static gint hf_winreg_winreg_DeleteKeyEx_access_mask = -1; +static gint hf_winreg_winreg_InitiateSystemShutdownEx_message = -1; +static gint hf_winreg_winreg_EnumValue_length = -1; +static gint hf_winreg_winreg_QueryInfoKey_max_classlen = -1; +static gint hf_winreg_winreg_QueryValue_value_name = -1; +static gint hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK = -1; +static gint hf_winreg_winreg_String_name_len = -1; static gint hf_winreg_winreg_AccessMask_KEY_SET_VALUE = -1; -static gint hf_winreg_winreg_EnumKey_enum_index = -1; -static gint hf_winreg_winreg_RestoreKey_handle = -1; -static gint hf_winreg_winreg_SetValue_data = -1; -static gint hf_winreg_winreg_InitiateSystemShutdown_force_apps = -1; +static gint hf_winreg_winreg_EnumValue_value = -1; static gint hf_winreg_winreg_NotifyChangeKeyValue_string1 = -1; -static gint hf_winreg_winreg_SaveKeyEx_flags = -1; -static gint hf_winreg_winreg_QueryMultipleValues_buffer = -1; -static gint hf_winreg_winreg_QueryInfoKey_classname = -1; +static gint hf_winreg_winreg_QueryInfoKey_num_values = -1; +static gint hf_winreg_winreg_OpenHKCU_access_mask = -1; +static gint hf_winreg_winreg_QueryMultipleValues2_needed = -1; +static gint hf_winreg_winreg_CreateKey_name = -1; +static gint hf_winreg_winreg_InitiateSystemShutdownEx_hostname = -1; +static gint hf_winreg_winreg_GetVersion_version = -1; +static gint hf_winreg_winreg_QueryMultipleValues_values_in = -1; +static gint hf_winreg_winreg_InitiateSystemShutdown_force_apps = -1; +static gint hf_winreg_winreg_CreateKey_new_handle = -1; +static gint hf_winreg_winreg_SaveKeyEx_handle = -1; +static gint hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE = -1; +static gint hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree = -1; +static gint hf_winreg_winreg_QueryMultipleValues2_num_values = -1; +static gint hf_winreg_winreg_DeleteKeyEx_handle = -1; +static gint hf_winreg_winreg_QueryMultipleValues_values_out = -1; +static gint hf_winreg_winreg_StringBuf_name = -1; +static gint hf_winreg_winreg_OpenKey_keyname = -1; +static gint hf_winreg_winreg_SaveKeyEx_filename = -1; +static gint hf_winreg_winreg_ReplaceKey_old_file = -1; +static gint hf_winreg_winreg_QueryInfoKey_last_changed_time = -1; +static gint hf_winreg_winreg_EnumKey_last_changed_time = -1; +static gint hf_winreg_winreg_LoadKey_filename = -1; +static gint hf_winreg_winreg_SaveKey_filename = -1; static gint hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY = -1; +static gint hf_winreg_system_name = -1; +static gint hf_winreg_winreg_ValNameBuf_size = -1; +static gint hf_winreg_winreg_QueryValue_data_size = -1; +static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET = -1; static gint hf_winreg_winreg_ReplaceKey_subkey = -1; -static gint hf_winreg_sd_max_size = -1; -static gint hf_winreg_winreg_QueryInfoKey_max_classlen = -1; -static gint hf_winreg_winreg_ValNameBuf_length = -1; -static gint hf_winreg_winreg_NotifyChangeKeyValue_notify_filter = -1; -static gint hf_winreg_winreg_UnLoadKey_subkey = -1; -static gint hf_winreg_winreg_ReplaceKey_new_file = -1; -static gint hf_winreg_winreg_SaveKeyEx_filename = -1; -static gint hf_winreg_QueryMultipleValue_ve_valuename = -1; -static gint hf_winreg_winreg_QueryMultipleValues2_key_handle = -1; -static gint hf_winreg_KeySecurityData_size = -1; +static gint hf_winreg_winreg_QueryMultipleValues_buffer = -1; +static gint hf_winreg_winreg_RestoreKey_handle = -1; +static gint hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot = -1; +static gint hf_winreg_winreg_QueryInfoKey_max_subkeylen = -1; +static gint hf_winreg_winreg_EnumKey_enum_index = -1; static gint hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE = -1; +static gint hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE = -1; +static gint hf_winreg_winreg_GetKeySecurity_sec_info = -1; +static gint hf_winreg_winreg_EnumValue_enum_index = -1; static gint hf_winreg_winreg_EnumKey_name = -1; +static gint hf_winreg_winreg_SetValue_name = -1; +static gint hf_winreg_winreg_QueryInfoKey_num_subkeys = -1; +static gint hf_winreg_winreg_ReplaceKey_new_file = -1; +static gint hf_winreg_winreg_RestoreKey_flags = -1; static gint hf_winreg_winreg_LoadKey_keyname = -1; -static gint hf_winreg_winreg_QueryMultipleValues_key_handle = -1; -static gint hf_winreg_winreg_EnumValue_type = -1; -static gint hf_winreg_winreg_EnumKey_last_changed_time = -1; -static gint hf_winreg_winreg_EnumValue_size = -1; -static gint hf_winreg_winreg_SaveKey_sec_attrib = -1; +static gint hf_winreg_winreg_AccessMask_KEY_NOTIFY = -1; +static gint hf_winreg_winreg_QueryMultipleValues2_values_in = -1; +static gint hf_winreg_winreg_InitiateSystemShutdownEx_timeout = -1; static gint hf_winreg_sd = -1; -static gint hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK = -1; +static gint hf_winreg_winreg_StringBuf_size = -1; +static gint hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE = -1; +static gint hf_winreg_winreg_NotifyChangeKeyValue_notify_filter = -1; +static gint hf_winreg_winreg_AbortSystemShutdown_server = -1; +static gint hf_winreg_winreg_ReplaceKey_handle = -1; +static gint hf_winreg_winreg_DeleteKey_key = -1; +static gint hf_winreg_winreg_SecBuf_sd = -1; +static gint hf_winreg_opnum = -1; +static gint hf_winreg_winreg_SetValue_size = -1; +static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY = -1; +static gint hf_winreg_QueryMultipleValue_ve_valuelen = -1; +static gint hf_winreg_KeySecurityData_size = -1; +static gint hf_winreg_winreg_ValNameBuf_name = -1; static gint hf_winreg_winreg_OpenKey_options = -1; -static gint hf_winreg_winreg_SaveKey_filename = -1; +static gint hf_winreg_winreg_SecBuf_length = -1; +static gint hf_winreg_winreg_NotifyChangeKeyValue_string2 = -1; +static gint hf_winreg_werror = -1; +static gint hf_winreg_winreg_QueryMultipleValues2_values_out = -1; static gint hf_winreg_winreg_QueryValue_data = -1; -static gint hf_winreg_winreg_QueryMultipleValues2_buffer = -1; +static gint hf_winreg_winreg_OpenKey_parent_handle = -1; +static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown = -1; static gint hf_winreg_winreg_InitiateSystemShutdown_hostname = -1; +static gint hf_winreg_winreg_QueryMultipleValues_num_values = -1; +static gint hf_winreg_KeySecurityAttribute_inherit = -1; +static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME = -1; +static gint hf_winreg_winreg_EnumValue_size = -1; +static gint hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE = -1; static gint hf_winreg_winreg_UnLoadKey_handle = -1; -static gint hf_winreg_winreg_QueryMultipleValues_values_out = -1; -static gint hf_winreg_KeySecurityData_data = -1; -static gint hf_winreg_winreg_OpenKey_access_mask = -1; -static gint hf_winreg_winreg_OpenKey_keyname = -1; -static gint hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot = -1; -static gint hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree = -1; -static gint hf_winreg_winreg_DeleteKeyEx_access_mask = -1; -static gint hf_winreg_winreg_DeleteKeyEx_key = -1; +static gint hf_winreg_winreg_String_name_size = -1; static gint hf_winreg_winreg_QueryValue_data_length = -1; -static gint hf_winreg_KeySecurityData_len = -1; -static gint hf_winreg_winreg_ValNameBuf_size = -1; -static gint hf_winreg_winreg_CreateKey_name = -1; -static gint hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES = -1; -static gint hf_winreg_winreg_String_name_len = -1; -static gint hf_winreg_winreg_DeleteKey_key = -1; -static gint hf_winreg_winreg_QueryValue_data_size = -1; -static gint hf_winreg_system_name = -1; -static gint hf_winreg_QueryMultipleValue_ve_valueptr = -1; -static gint hf_winreg_KeySecurityAttribute_data_size = -1; -static gint hf_winreg_winreg_QueryMultipleValues_num_values = -1; -static gint hf_winreg_winreg_StringBuf_name = -1; +static gint hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH = -1; +static gint hf_winreg_winreg_OpenHKPD_access_mask = -1; +static gint hf_winreg_winreg_QueryInfoKey_secdescsize = -1; +static gint hf_winreg_handle = -1; +static gint hf_winreg_winreg_InitiateSystemShutdown_do_reboot = -1; +static gint hf_winreg_winreg_EnumKey_keyclass = -1; static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown2 = -1; -static gint hf_winreg_sd_offset = -1; -static gint hf_winreg_winreg_ValNameBuf_name = -1; -static gint hf_winreg_winreg_StringBuf_length = -1; -static gint hf_winreg_winreg_QueryMultipleValues2_values_in = -1; -static gint hf_winreg_winreg_String_name_size = -1; -static gint hf_winreg_winreg_NotifyChangeKeyValue_unknown = -1; -static gint hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY = -1; -static gint hf_winreg_winreg_RestoreKey_filename = -1; -static gint hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE = -1; -static gint hf_winreg_winreg_QueryInfoKey_max_valbufsize = -1; -static gint hf_winreg_winreg_InitiateSystemShutdownEx_reason = -1; -static gint hf_winreg_winreg_EnumValue_length = -1; -static gint hf_winreg_winreg_QueryInfoKey_max_subkeylen = -1; static gint hf_winreg_winreg_InitiateSystemShutdown_timeout = -1; -static gint hf_winreg_winreg_InitiateSystemShutdownEx_hostname = -1; -static gint hf_winreg_KeySecurityAttribute_inherit = -1; -static gint hf_winreg_werror = -1; -static gint hf_winreg_winreg_QueryMultipleValues2_values_out = -1; -static gint hf_winreg_winreg_EnumKey_keyclass = -1; -static gint hf_winreg_winreg_CreateKey_keyclass = -1; -static gint hf_winreg_winreg_EnumValue_value = -1; -static gint hf_winreg_winreg_OpenHKCU_access_mask = -1; -static gint hf_winreg_winreg_QueryValue_value_name = -1; -static gint hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH = -1; +static gint hf_winreg_winreg_StringBuf_length = -1; +static gint hf_winreg_sd_max_size = -1; +static gint hf_winreg_winreg_QueryInfoKey_max_valnamelen = -1; +static gint hf_winreg_winreg_InitiateSystemShutdown_message = -1; +static gint hf_winreg_winreg_SetKeySecurity_sec_info = -1; +static gint hf_winreg_winreg_SetValue_data = -1; +static gint hf_winreg_winreg_SaveKey_sec_attrib = -1; +static gint hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK = -1; +static gint hf_winreg_winreg_QueryMultipleValues2_offered = -1; +static gint hf_winreg_winreg_SaveKeyEx_flags = -1; +static gint hf_winreg_winreg_DeleteValue_value = -1; +static gint hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE = -1; +static gint hf_winreg_winreg_InitiateSystemShutdownEx_force_apps = -1; +static gint hf_winreg_winreg_DeleteKeyEx_key = -1; +static gint hf_winreg_sd_actual_size = -1; static gint proto_dcerpc_winreg = -1; /* Version information */ @@ -994,7 +994,7 @@ winreg_dissect_enum_CreateAction(tvbuff_t *tvb _U_, int offset _U_, packet_info /* IDL: struct { */ /* IDL: [value(strlen_m_term_null(name)*2)] uint16 length; */ /* IDL: uint16 size; */ -/* IDL: [unique(1)] [length_is(length/2)] [charset(UTF16)] [size_is(size/2)] uint16 *name; */ +/* IDL: [length_is(length/2)] [size_is(size/2)] [charset(UTF16)] [unique(1)] uint16 *name; */ /* IDL: } */ static int @@ -1074,7 +1074,7 @@ winreg_dissect_struct_StringBuf(tvbuff_t *tvb _U_, int offset _U_, packet_info * /* IDL: struct { */ /* IDL: [value(strlen_m_term(name)*2)] uint16 length; */ /* IDL: uint16 size; */ -/* IDL: [unique(1)] [length_is(length/2)] [charset(UTF16)] [size_is(size/2)] uint16 *name; */ +/* IDL: [unique(1)] [charset(UTF16)] [length_is(length/2)] [size_is(size/2)] uint16 *name; */ /* IDL: } */ static int @@ -1546,9 +1546,9 @@ winreg_dissect_element_OpenHKCU_handle_(tvbuff_t *tvb _U_, int offset _U_, packe } /* IDL: WERROR winreg_OpenHKCU( */ -/* IDL: [unique(1)] [in] uint16 *system_name, */ +/* IDL: [in] [unique(1)] uint16 *system_name, */ /* IDL: [in] winreg_AccessMask access_mask, */ -/* IDL: [out] [ref] policy_handle *handle */ +/* IDL: [ref] [out] policy_handle *handle */ /* IDL: ); */ static int @@ -1694,7 +1694,7 @@ winreg_dissect_element_OpenHKPD_handle_(tvbuff_t *tvb _U_, int offset _U_, packe } /* IDL: WERROR winreg_OpenHKPD( */ -/* IDL: [unique(1)] [in] uint16 *system_name, */ +/* IDL: [in] [unique(1)] uint16 *system_name, */ /* IDL: [in] winreg_AccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *handle */ /* IDL: ); */ @@ -1770,7 +1770,7 @@ winreg_dissect_element_OpenHKU_handle_(tvbuff_t *tvb _U_, int offset _U_, packet /* IDL: WERROR winreg_OpenHKU( */ /* IDL: [unique(1)] [in] uint16 *system_name, */ /* IDL: [in] winreg_AccessMask access_mask, */ -/* IDL: [out] [ref] policy_handle *handle */ +/* IDL: [ref] [out] policy_handle *handle */ /* IDL: ); */ static int @@ -1818,7 +1818,7 @@ winreg_dissect_element_CloseKey_handle_(tvbuff_t *tvb _U_, int offset _U_, packe } /* IDL: WERROR winreg_CloseKey( */ -/* IDL: [out] [in] [ref] policy_handle *handle */ +/* IDL: [in] [ref] [out] policy_handle *handle */ /* IDL: ); */ static int @@ -1949,9 +1949,9 @@ winreg_dissect_element_CreateKey_action_taken_(tvbuff_t *tvb _U_, int offset _U_ /* IDL: [in] winreg_String keyclass, */ /* IDL: [in] winreg_KeyOptions options, */ /* IDL: [in] winreg_AccessMask access_mask, */ -/* IDL: [unique(1)] [in] winreg_SecBuf *secdesc, */ -/* IDL: [out] [ref] policy_handle *new_handle, */ -/* IDL: [out] [unique(1)] [in] winreg_CreateAction *action_taken */ +/* IDL: [in] [unique(1)] winreg_SecBuf *secdesc, */ +/* IDL: [ref] [out] policy_handle *new_handle, */ +/* IDL: [unique(1)] [in] [out] winreg_CreateAction *action_taken */ /* IDL: ); */ static int @@ -2074,7 +2074,7 @@ winreg_dissect_element_DeleteValue_value(tvbuff_t *tvb _U_, int offset _U_, pack } /* IDL: WERROR winreg_DeleteValue( */ -/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [ref] [in] policy_handle *handle, */ /* IDL: [in] winreg_String value */ /* IDL: ); */ @@ -2338,11 +2338,11 @@ winreg_dissect_element_EnumValue_length_(tvbuff_t *tvb _U_, int offset _U_, pack /* IDL: WERROR winreg_EnumValue( */ /* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] uint32 enum_index, */ -/* IDL: [out] [in] [ref] winreg_ValNameBuf *name, */ -/* IDL: [out] [unique(1)] [in] winreg_Type *type, */ -/* IDL: [unique(1)] [out] [in] [range(0,0x4000000)] [length_is(length?*length:0)] [size_is(size?*size:0)] uint8 *value, */ -/* IDL: [out] [unique(1)] [in] uint32 *size, */ -/* IDL: [out] [unique(1)] [in] uint32 *length */ +/* IDL: [ref] [in] [out] winreg_ValNameBuf *name, */ +/* IDL: [out] [in] [unique(1)] winreg_Type *type, */ +/* IDL: [unique(1)] [range(0,0x4000000)] [in] [out] [size_is(size?*size:0)] [length_is(length?*length:0)] uint8 *value, */ +/* IDL: [unique(1)] [in] [out] uint32 *size, */ +/* IDL: [in] [unique(1)] [out] uint32 *length */ /* IDL: ); */ static int @@ -2412,7 +2412,7 @@ winreg_dissect_element_FlushKey_handle_(tvbuff_t *tvb _U_, int offset _U_, packe } /* IDL: WERROR winreg_FlushKey( */ -/* IDL: [in] [ref] policy_handle *handle */ +/* IDL: [ref] [in] policy_handle *handle */ /* IDL: ); */ static int @@ -2481,7 +2481,7 @@ winreg_dissect_element_GetKeySecurity_sd_(tvbuff_t *tvb _U_, int offset _U_, pac /* IDL: WERROR winreg_GetKeySecurity( */ /* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] security_secinfo sec_info, */ -/* IDL: [out] [in] [ref] KeySecurityData *sd */ +/* IDL: [ref] [in] [out] KeySecurityData *sd */ /* IDL: ); */ static int @@ -2660,7 +2660,7 @@ winreg_dissect_element_NotifyChangeKeyValue_unknown2(tvbuff_t *tvb _U_, int offs } /* IDL: WERROR winreg_NotifyChangeKeyValue( */ -/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [ref] [in] policy_handle *handle, */ /* IDL: [in] uint8 watch_subtree, */ /* IDL: [in] winreg_NotifyChangeType notify_filter, */ /* IDL: [in] uint32 unknown, */ @@ -2962,11 +2962,11 @@ winreg_dissect_element_QueryInfoKey_last_changed_time_(tvbuff_t *tvb _U_, int of /* IDL: WERROR winreg_QueryInfoKey( */ /* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [out] [in] [ref] winreg_String *classname, */ +/* IDL: [ref] [in] [out] winreg_String *classname, */ /* IDL: [out] [ref] uint32 *num_subkeys, */ -/* IDL: [out] [ref] uint32 *max_subkeylen, */ -/* IDL: [out] [ref] uint32 *max_classlen, */ -/* IDL: [out] [ref] uint32 *num_values, */ +/* IDL: [ref] [out] uint32 *max_subkeylen, */ +/* IDL: [ref] [out] uint32 *max_classlen, */ +/* IDL: [ref] [out] uint32 *num_values, */ /* IDL: [out] [ref] uint32 *max_valnamelen, */ /* IDL: [out] [ref] uint32 *max_valbufsize, */ /* IDL: [out] [ref] uint32 *secdescsize, */ @@ -3130,12 +3130,12 @@ winreg_dissect_element_QueryValue_data_length_(tvbuff_t *tvb _U_, int offset _U_ } /* IDL: WERROR winreg_QueryValue( */ -/* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [in] [ref] winreg_String *value_name, */ +/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [ref] [in] winreg_String *value_name, */ /* IDL: [out] [unique(1)] [in] winreg_Type *type, */ -/* IDL: [unique(1)] [out] [in] [range(0,0x4000000)] [length_is(data_length?*data_length:0)] [size_is(data_size?*data_size:0)] uint8 *data, */ +/* IDL: [length_is(data_length?*data_length:0)] [size_is(data_size?*data_size:0)] [out] [in] [range(0,0x4000000)] [unique(1)] uint8 *data, */ /* IDL: [out] [unique(1)] [in] uint32 *data_size, */ -/* IDL: [out] [unique(1)] [in] uint32 *data_length */ +/* IDL: [in] [unique(1)] [out] uint32 *data_length */ /* IDL: ); */ static int @@ -3248,10 +3248,10 @@ winreg_dissect_element_ReplaceKey_old_file_(tvbuff_t *tvb _U_, int offset _U_, p } /* IDL: WERROR winreg_ReplaceKey( */ -/* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [in] [ref] winreg_String *subkey, */ -/* IDL: [in] [ref] winreg_String *new_file, */ -/* IDL: [in] [ref] winreg_String *old_file */ +/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [ref] [in] winreg_String *subkey, */ +/* IDL: [ref] [in] winreg_String *new_file, */ +/* IDL: [ref] [in] winreg_String *old_file */ /* IDL: ); */ static int @@ -3325,7 +3325,7 @@ winreg_dissect_element_RestoreKey_flags(tvbuff_t *tvb _U_, int offset _U_, packe /* IDL: WERROR winreg_RestoreKey( */ /* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [in] [ref] winreg_String *filename, */ +/* IDL: [ref] [in] winreg_String *filename, */ /* IDL: [in] winreg_RestoreKeyFlags flags */ /* IDL: ); */ @@ -3405,9 +3405,9 @@ winreg_dissect_element_SaveKey_sec_attrib_(tvbuff_t *tvb _U_, int offset _U_, pa } /* IDL: WERROR winreg_SaveKey( */ -/* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [in] [ref] winreg_String *filename, */ -/* IDL: [unique(1)] [in] KeySecurityAttribute *sec_attrib */ +/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [ref] [in] winreg_String *filename, */ +/* IDL: [in] [unique(1)] KeySecurityAttribute *sec_attrib */ /* IDL: ); */ static int @@ -3478,7 +3478,7 @@ winreg_dissect_element_SetKeySecurity_sd_(tvbuff_t *tvb _U_, int offset _U_, pac } /* IDL: WERROR winreg_SetKeySecurity( */ -/* IDL: [in] [ref] policy_handle *handle, */ +/* IDL: [ref] [in] policy_handle *handle, */ /* IDL: [in] security_secinfo sec_info, */ /* IDL: [in] [ref] KeySecurityData *sd */ /* IDL: ); */ @@ -3578,7 +3578,7 @@ winreg_dissect_element_SetValue_size(tvbuff_t *tvb _U_, int offset _U_, packet_i /* IDL: [in] [ref] policy_handle *handle, */ /* IDL: [in] winreg_String name, */ /* IDL: [in] winreg_Type type, */ -/* IDL: [in] [ref] [size_is(size)] uint8 *data, */ +/* IDL: [size_is(size)] [ref] [in] uint8 *data, */ /* IDL: [in] uint32 size */ /* IDL: ); */ @@ -3646,8 +3646,8 @@ winreg_dissect_element_UnLoadKey_subkey_(tvbuff_t *tvb _U_, int offset _U_, pack } /* IDL: WERROR winreg_UnLoadKey( */ -/* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [in] [ref] winreg_String *subkey */ +/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [ref] [in] winreg_String *subkey */ /* IDL: ); */ static int @@ -3733,7 +3733,7 @@ winreg_dissect_element_InitiateSystemShutdown_do_reboot(tvbuff_t *tvb _U_, int o /* IDL: WERROR winreg_InitiateSystemShutdown( */ /* IDL: [unique(1)] [in] uint16 *hostname, */ -/* IDL: [unique(1)] [in] lsa_StringLarge *message, */ +/* IDL: [in] [unique(1)] lsa_StringLarge *message, */ /* IDL: [in] uint32 timeout, */ /* IDL: [in] uint8 force_apps, */ /* IDL: [in] uint8 do_reboot */ @@ -3787,7 +3787,7 @@ winreg_dissect_element_AbortSystemShutdown_server_(tvbuff_t *tvb _U_, int offset } /* IDL: WERROR winreg_AbortSystemShutdown( */ -/* IDL: [unique(1)] [in] uint16 *server */ +/* IDL: [in] [unique(1)] uint16 *server */ /* IDL: ); */ static int @@ -3846,8 +3846,8 @@ winreg_dissect_element_GetVersion_version_(tvbuff_t *tvb _U_, int offset _U_, pa } /* IDL: WERROR winreg_GetVersion( */ -/* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [out] [ref] uint32 *version */ +/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [ref] [out] uint32 *version */ /* IDL: ); */ static int @@ -3991,7 +3991,7 @@ winreg_dissect_element_OpenHKDD_handle_(tvbuff_t *tvb _U_, int offset _U_, packe } /* IDL: WERROR winreg_OpenHKDD( */ -/* IDL: [unique(1)] [in] uint16 *system_name, */ +/* IDL: [in] [unique(1)] uint16 *system_name, */ /* IDL: [in] winreg_AccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *handle */ /* IDL: ); */ @@ -4138,11 +4138,11 @@ winreg_dissect_element_QueryMultipleValues_buffer_size_(tvbuff_t *tvb _U_, int o /* IDL: WERROR winreg_QueryMultipleValues( */ /* IDL: [in] [ref] policy_handle *key_handle, */ -/* IDL: [in] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_in, */ -/* IDL: [out] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_out, */ +/* IDL: [length_is(num_values)] [size_is(num_values)] [ref] [in] QueryMultipleValue *values_in, */ +/* IDL: [ref] [length_is(num_values)] [size_is(num_values)] [out] QueryMultipleValue *values_out, */ /* IDL: [in] uint32 num_values, */ -/* IDL: [out] [unique(1)] [in] [length_is(*buffer_size)] [size_is(*buffer_size)] uint8 *buffer, */ -/* IDL: [out] [in] [ref] uint32 *buffer_size */ +/* IDL: [size_is(*buffer_size)] [length_is(*buffer_size)] [out] [in] [unique(1)] uint8 *buffer, */ +/* IDL: [ref] [in] [out] uint32 *buffer_size */ /* IDL: ); */ static int @@ -4250,8 +4250,8 @@ winreg_dissect_element_InitiateSystemShutdownEx_reason(tvbuff_t *tvb _U_, int of } /* IDL: WERROR winreg_InitiateSystemShutdownEx( */ -/* IDL: [unique(1)] [in] uint16 *hostname, */ -/* IDL: [unique(1)] [in] lsa_StringLarge *message, */ +/* IDL: [in] [unique(1)] uint16 *hostname, */ +/* IDL: [in] [unique(1)] lsa_StringLarge *message, */ /* IDL: [in] uint32 timeout, */ /* IDL: [in] uint8 force_apps, */ /* IDL: [in] uint8 do_reboot, */ @@ -4348,9 +4348,9 @@ winreg_dissect_element_SaveKeyEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet } /* IDL: WERROR winreg_SaveKeyEx( */ -/* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [in] [ref] winreg_String *filename, */ -/* IDL: [unique(1)] [in] KeySecurityAttribute *sec_attrib, */ +/* IDL: [ref] [in] policy_handle *handle, */ +/* IDL: [ref] [in] winreg_String *filename, */ +/* IDL: [in] [unique(1)] KeySecurityAttribute *sec_attrib, */ /* IDL: [in] uint32 flags */ /* IDL: ); */ @@ -4424,7 +4424,7 @@ winreg_dissect_element_OpenHKPT_handle_(tvbuff_t *tvb _U_, int offset _U_, packe } /* IDL: WERROR winreg_OpenHKPT( */ -/* IDL: [unique(1)] [in] uint16 *system_name, */ +/* IDL: [in] [unique(1)] uint16 *system_name, */ /* IDL: [in] winreg_AccessMask access_mask, */ /* IDL: [out] [ref] policy_handle *handle */ /* IDL: ); */ @@ -4498,9 +4498,9 @@ winreg_dissect_element_OpenHKPN_handle_(tvbuff_t *tvb _U_, int offset _U_, packe } /* IDL: WERROR winreg_OpenHKPN( */ -/* IDL: [unique(1)] [in] uint16 *system_name, */ +/* IDL: [in] [unique(1)] uint16 *system_name, */ /* IDL: [in] winreg_AccessMask access_mask, */ -/* IDL: [out] [ref] policy_handle *handle */ +/* IDL: [ref] [out] policy_handle *handle */ /* IDL: ); */ static int @@ -4660,11 +4660,11 @@ winreg_dissect_element_QueryMultipleValues2_needed_(tvbuff_t *tvb _U_, int offse } /* IDL: WERROR winreg_QueryMultipleValues2( */ -/* IDL: [in] [ref] policy_handle *key_handle, */ -/* IDL: [in] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_in, */ -/* IDL: [out] [ref] [length_is(num_values)] [size_is(num_values)] QueryMultipleValue *values_out, */ +/* IDL: [ref] [in] policy_handle *key_handle, */ +/* IDL: [length_is(num_values)] [size_is(num_values)] [ref] [in] QueryMultipleValue *values_in, */ +/* IDL: [length_is(num_values)] [size_is(num_values)] [out] [ref] QueryMultipleValue *values_out, */ /* IDL: [in] uint32 num_values, */ -/* IDL: [out] [unique(1)] [in] [length_is(*offered)] [size_is(*offered)] uint8 *buffer, */ +/* IDL: [length_is(*offered)] [size_is(*offered)] [out] [in] [unique(1)] uint8 *buffer, */ /* IDL: [in] [ref] uint32 *offered, */ /* IDL: [out] [ref] uint32 *needed */ /* IDL: ); */ @@ -4759,7 +4759,7 @@ winreg_dissect_element_DeleteKeyEx_reserved(tvbuff_t *tvb _U_, int offset _U_, p /* IDL: WERROR winreg_DeleteKeyEx( */ /* IDL: [in] [ref] policy_handle *handle, */ -/* IDL: [in] [ref] winreg_String *key, */ +/* IDL: [ref] [in] winreg_String *key, */ /* IDL: [in] winreg_AccessMask access_mask, */ /* IDL: [in] uint32 reserved */ /* IDL: ); */ @@ -4873,304 +4873,304 @@ static dcerpc_sub_dissector winreg_dissectors[] = { void proto_register_dcerpc_winreg(void) { static hf_register_info hf[] = { - { &hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS, - { "Key Enumerate Sub Keys", "winreg.winreg_AccessMask.KEY_ENUMERATE_SUB_KEYS", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS_tfs), ( 0x00008 ), NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeKeyValue_string2, - { "String2", "winreg.winreg_NotifyChangeKeyValue.string2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdown_message, - { "Message", "winreg.winreg_InitiateSystemShutdown.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_OpenKey_access_mask, + { "Access Mask", "winreg.winreg_OpenKey.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_String_name, { "Name", "winreg.winreg_String.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdownEx_message, - { "Message", "winreg.winreg_InitiateSystemShutdownEx.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_EnumValue_enum_index, - { "Enum Index", "winreg.winreg_EnumValue.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_access_mask, - { "Access Mask", "winreg.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_CreateKey_options, - { "Options", "winreg.winreg_CreateKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdownEx_timeout, - { "Timeout", "winreg.winreg_InitiateSystemShutdownEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_handle, - { "Handle", "winreg.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_max_valnamelen, - { "Max Valnamelen", "winreg.winreg_QueryInfoKey.max_valnamelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SecBuf_length, - { "Length", "winreg.winreg_SecBuf.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdown_do_reboot, - { "Do Reboot", "winreg.winreg_InitiateSystemShutdown.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_DeleteKeyEx_handle, - { "Handle", "winreg.winreg_DeleteKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_KeySecurityAttribute_data_size, + { "Data Size", "winreg.KeySecurityAttribute.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_classname, + { "Classname", "winreg.winreg_QueryInfoKey.classname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues2_buffer, + { "Buffer", "winreg.winreg_QueryMultipleValues2.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_AccessMask_KEY_CREATE_LINK, + { "Key Create Link", "winreg.winreg_AccessMask.KEY_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_LINK_tfs), ( 0x00020 ), NULL, HFILL }}, { &hf_winreg_winreg_QueryMultipleValues_buffer_size, { "Buffer Size", "winreg.winreg_QueryMultipleValues.buffer_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_CreateKey_new_handle, - { "New Handle", "winreg.winreg_CreateKey.new_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues2_needed, - { "Needed", "winreg.winreg_QueryMultipleValues2.needed", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_QueryMultipleValue_ve_valuelen, - { "Ve Valuelen", "winreg.QueryMultipleValue.ve_valuelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_KeySecurityAttribute_sec_data, - { "Sec Data", "winreg.KeySecurityAttribute.sec_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_GetKeySecurity_sec_info, - { "Sec Info", "winreg.winreg_GetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SaveKeyEx_handle, - { "Handle", "winreg.winreg_SaveKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE, - { "Reg Option Volatile", "winreg.winreg_KeyOptions.REG_OPTION_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues2_num_values, - { "Num Values", "winreg.winreg_QueryMultipleValues2.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SetKeySecurity_sec_info, - { "Sec Info", "winreg.winreg_SetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_StringBuf_size, - { "Size", "winreg.winreg_StringBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SecBuf_sd, - { "Sd", "winreg.winreg_SecBuf.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_secdescsize, - { "Secdescsize", "winreg.winreg_QueryInfoKey.secdescsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY, - { "Reg Notify Change Security", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_SECURITY", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY_tfs), ( 0x00000008 ), NULL, HFILL }}, - { &hf_winreg_winreg_SetValue_name, - { "Name", "winreg.winreg_SetValue.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_RestoreKey_flags, - { "Flags", "winreg.winreg_RestoreKey.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_QueryMultipleValue_ve_type, - { "Ve Type", "winreg.QueryMultipleValue.ve_type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_CreateKey_secdesc, { "Secdesc", "winreg.winreg_CreateKey.secdesc", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_DeleteKeyEx_reserved, { "Reserved", "winreg.winreg_DeleteKeyEx.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdownEx_force_apps, - { "Force Apps", "winreg.winreg_InitiateSystemShutdownEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues_key_handle, + { "Key Handle", "winreg.winreg_QueryMultipleValues.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_QueryMultipleValue_ve_valuename, + { "Ve Valuename", "winreg.QueryMultipleValue.ve_valuename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY, + { "Key Wow64 32key", "winreg.winreg_AccessMask.KEY_WOW64_32KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_32KEY_tfs), ( 0x00200 ), NULL, HFILL }}, + { &hf_winreg_winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS, + { "Key Enumerate Sub Keys", "winreg.winreg_AccessMask.KEY_ENUMERATE_SUB_KEYS", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_ENUMERATE_SUB_KEYS_tfs), ( 0x00008 ), NULL, HFILL }}, + { &hf_winreg_QueryMultipleValue_ve_valueptr, + { "Ve Valueptr", "winreg.QueryMultipleValue.ve_valueptr", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_KeySecurityData_data, + { "Data", "winreg.KeySecurityData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES, + { "Reg Notify Change Attributes", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES_tfs), ( 0x00000002 ), NULL, HFILL }}, + { &hf_winreg_winreg_CreateKey_keyclass, + { "Keyclass", "winreg.winreg_CreateKey.keyclass", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_SetValue_type, { "Type", "winreg.winreg_SetValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_opnum, - { "Operation", "winreg.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_sd_offset, + { "Offset", "winreg.sd.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_access_mask, + { "Access Mask", "winreg.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_CreateKey_action_taken, + { "Action Taken", "winreg.winreg_CreateKey.action_taken", FT_UINT32, BASE_DEC, VALS(winreg_winreg_CreateAction_vals), 0, NULL, HFILL }}, + { &hf_winreg_winreg_ValNameBuf_length, + { "Length", "winreg.winreg_ValNameBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_EnumValue_name, { "Name", "winreg.winreg_EnumValue.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_LoadKey_filename, - { "Filename", "winreg.winreg_LoadKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_AccessMask_KEY_CREATE_LINK, - { "Key Create Link", "winreg.winreg_AccessMask.KEY_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_LINK_tfs), ( 0x00020 ), NULL, HFILL }}, - { &hf_winreg_winreg_DeleteValue_value, - { "Value", "winreg.winreg_DeleteValue.value", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues2_offered, - { "Offered", "winreg.winreg_QueryMultipleValues2.offered", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues_values_in, - { "Values In", "winreg.winreg_QueryMultipleValues.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_AccessMask_KEY_NOTIFY, - { "Key Notify", "winreg.winreg_AccessMask.KEY_NOTIFY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_NOTIFY_tfs), ( 0x00010 ), NULL, HFILL }}, - { &hf_winreg_winreg_OpenKey_parent_handle, - { "Parent Handle", "winreg.winreg_OpenKey.parent_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_num_subkeys, - { "Num Subkeys", "winreg.winreg_QueryInfoKey.num_subkeys", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_AccessMask_KEY_WOW64_32KEY, - { "Key Wow64 32key", "winreg.winreg_AccessMask.KEY_WOW64_32KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_32KEY_tfs), ( 0x00200 ), NULL, HFILL }}, - { &hf_winreg_winreg_SaveKeyEx_sec_attrib, - { "Sec Attrib", "winreg.winreg_SaveKeyEx.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_last_changed_time, - { "Last Changed Time", "winreg.winreg_QueryInfoKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK, - { "Reg Option Open Link", "winreg.winreg_KeyOptions.REG_OPTION_OPEN_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_OPEN_LINK_tfs), ( 0x00000008 ), NULL, HFILL }}, - { &hf_winreg_winreg_OpenHKPD_access_mask, - { "Access Mask", "winreg.winreg_OpenHKPD.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_AbortSystemShutdown_server, - { "Server", "winreg.winreg_AbortSystemShutdown.server", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues2_key_handle, + { "Key Handle", "winreg.winreg_QueryMultipleValues2.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SaveKey_handle, + { "Handle", "winreg.winreg_SaveKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY, + { "Key Create Sub Key", "winreg.winreg_AccessMask.KEY_CREATE_SUB_KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_SUB_KEY_tfs), ( 0x00004 ), NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdownEx_reason, + { "Reason", "winreg.winreg_InitiateSystemShutdownEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumValue_type, + { "Type", "winreg.winreg_EnumValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_CreateKey_options, + { "Options", "winreg.winreg_CreateKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_QueryValue_type, { "Type", "winreg.winreg_QueryValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_sd_actual_size, - { "Actual Size", "winreg.sd.actual_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE, - { "Reg Force Restore", "winreg.winreg_RestoreKeyFlags.REG_FORCE_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_FORCE_RESTORE_tfs), ( 0x00000008 ), NULL, HFILL }}, + { &hf_winreg_KeySecurityAttribute_sec_data, + { "Sec Data", "winreg.KeySecurityAttribute.sec_data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_KeySecurityData_len, + { "Len", "winreg.KeySecurityData.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_UnLoadKey_subkey, + { "Subkey", "winreg.winreg_UnLoadKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_RestoreKey_filename, + { "Filename", "winreg.winreg_RestoreKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_max_valbufsize, + { "Max Valbufsize", "winreg.winreg_QueryInfoKey.max_valbufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SaveKeyEx_sec_attrib, + { "Sec Attrib", "winreg.winreg_SaveKeyEx.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_QueryMultipleValue_ve_type, + { "Ve Type", "winreg.QueryMultipleValue.ve_type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_SecBuf_inherit, { "Inherit", "winreg.winreg_SecBuf.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SetValue_size, - { "Size", "winreg.winreg_SetValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SaveKey_handle, - { "Handle", "winreg.winreg_SaveKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET, - { "Reg Notify Change Last Set", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_LAST_SET", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET_tfs), ( 0x00000004 ), NULL, HFILL }}, - { &hf_winreg_winreg_ReplaceKey_handle, - { "Handle", "winreg.winreg_ReplaceKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_GetVersion_version, - { "Version", "winreg.winreg_GetVersion.version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_ReplaceKey_old_file, - { "Old File", "winreg.winreg_ReplaceKey.old_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE, - { "Key Query Value", "winreg.winreg_AccessMask.KEY_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_QUERY_VALUE_tfs), ( 0x00001 ), NULL, HFILL }}, - { &hf_winreg_winreg_CreateKey_action_taken, - { "Action Taken", "winreg.winreg_CreateKey.action_taken", FT_UINT32, BASE_DEC, VALS(winreg_winreg_CreateAction_vals), 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_num_values, - { "Num Values", "winreg.winreg_QueryInfoKey.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE, - { "Reg Whole Hive Volatile", "winreg.winreg_RestoreKeyFlags.REG_WHOLE_HIVE_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME, - { "Reg Notify Change Name", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_NAME", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_winreg_winreg_DeleteKeyEx_access_mask, + { "Access Mask", "winreg.winreg_DeleteKeyEx.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdownEx_message, + { "Message", "winreg.winreg_InitiateSystemShutdownEx.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumValue_length, + { "Length", "winreg.winreg_EnumValue.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_max_classlen, + { "Max Classlen", "winreg.winreg_QueryInfoKey.max_classlen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryValue_value_name, + { "Value Name", "winreg.winreg_QueryValue.value_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK, + { "Reg Option Create Link", "winreg.winreg_KeyOptions.REG_OPTION_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_CREATE_LINK_tfs), ( 0x00000002 ), NULL, HFILL }}, + { &hf_winreg_winreg_String_name_len, + { "Name Len", "winreg.winreg_String.name_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_AccessMask_KEY_SET_VALUE, { "Key Set Value", "winreg.winreg_AccessMask.KEY_SET_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_SET_VALUE_tfs), ( 0x00002 ), NULL, HFILL }}, - { &hf_winreg_winreg_EnumKey_enum_index, - { "Enum Index", "winreg.winreg_EnumKey.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_RestoreKey_handle, - { "Handle", "winreg.winreg_RestoreKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SetValue_data, - { "Data", "winreg.winreg_SetValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdown_force_apps, - { "Force Apps", "winreg.winreg_InitiateSystemShutdown.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumValue_value, + { "Value", "winreg.winreg_EnumValue.value", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_NotifyChangeKeyValue_string1, { "String1", "winreg.winreg_NotifyChangeKeyValue.string1", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SaveKeyEx_flags, - { "Flags", "winreg.winreg_SaveKeyEx.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues_buffer, - { "Buffer", "winreg.winreg_QueryMultipleValues.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_classname, - { "Classname", "winreg.winreg_QueryInfoKey.classname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY, - { "Key Wow64 64key", "winreg.winreg_AccessMask.KEY_WOW64_64KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_64KEY_tfs), ( 0x00100 ), NULL, HFILL }}, - { &hf_winreg_winreg_ReplaceKey_subkey, - { "Subkey", "winreg.winreg_ReplaceKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_sd_max_size, - { "Max Size", "winreg.sd.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_max_classlen, - { "Max Classlen", "winreg.winreg_QueryInfoKey.max_classlen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_ValNameBuf_length, - { "Length", "winreg.winreg_ValNameBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeKeyValue_notify_filter, - { "Notify Filter", "winreg.winreg_NotifyChangeKeyValue.notify_filter", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_UnLoadKey_subkey, - { "Subkey", "winreg.winreg_UnLoadKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_ReplaceKey_new_file, - { "New File", "winreg.winreg_ReplaceKey.new_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SaveKeyEx_filename, - { "Filename", "winreg.winreg_SaveKeyEx.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_QueryMultipleValue_ve_valuename, - { "Ve Valuename", "winreg.QueryMultipleValue.ve_valuename", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues2_key_handle, - { "Key Handle", "winreg.winreg_QueryMultipleValues2.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_KeySecurityData_size, - { "Size", "winreg.KeySecurityData.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE, - { "Reg Option Backup Restore", "winreg.winreg_KeyOptions.REG_OPTION_BACKUP_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE_tfs), ( 0x00000004 ), NULL, HFILL }}, - { &hf_winreg_winreg_EnumKey_name, - { "Name", "winreg.winreg_EnumKey.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_LoadKey_keyname, - { "Keyname", "winreg.winreg_LoadKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues_key_handle, - { "Key Handle", "winreg.winreg_QueryMultipleValues.key_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_EnumValue_type, - { "Type", "winreg.winreg_EnumValue.type", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_EnumKey_last_changed_time, - { "Last Changed Time", "winreg.winreg_EnumKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_EnumValue_size, - { "Size", "winreg.winreg_EnumValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SaveKey_sec_attrib, - { "Sec Attrib", "winreg.winreg_SaveKey.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_sd, - { "KeySecurityData", "winreg.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_KeyOptions_REG_OPTION_CREATE_LINK, - { "Reg Option Create Link", "winreg.winreg_KeyOptions.REG_OPTION_CREATE_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_CREATE_LINK_tfs), ( 0x00000002 ), NULL, HFILL }}, - { &hf_winreg_winreg_OpenKey_options, - { "Options", "winreg.winreg_OpenKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_SaveKey_filename, - { "Filename", "winreg.winreg_SaveKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryValue_data, - { "Data", "winreg.winreg_QueryValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues2_buffer, - { "Buffer", "winreg.winreg_QueryMultipleValues2.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdown_hostname, - { "Hostname", "winreg.winreg_InitiateSystemShutdown.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_UnLoadKey_handle, - { "Handle", "winreg.winreg_UnLoadKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_num_values, + { "Num Values", "winreg.winreg_QueryInfoKey.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_OpenHKCU_access_mask, + { "Access Mask", "winreg.winreg_OpenHKCU.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues2_needed, + { "Needed", "winreg.winreg_QueryMultipleValues2.needed", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_CreateKey_name, + { "Name", "winreg.winreg_CreateKey.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdownEx_hostname, + { "Hostname", "winreg.winreg_InitiateSystemShutdownEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_GetVersion_version, + { "Version", "winreg.winreg_GetVersion.version", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues_values_in, + { "Values In", "winreg.winreg_QueryMultipleValues.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdown_force_apps, + { "Force Apps", "winreg.winreg_InitiateSystemShutdown.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_CreateKey_new_handle, + { "New Handle", "winreg.winreg_CreateKey.new_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SaveKeyEx_handle, + { "Handle", "winreg.winreg_SaveKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_RestoreKeyFlags_REG_FORCE_RESTORE, + { "Reg Force Restore", "winreg.winreg_RestoreKeyFlags.REG_FORCE_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_FORCE_RESTORE_tfs), ( 0x00000008 ), NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree, + { "Watch Subtree", "winreg.winreg_NotifyChangeKeyValue.watch_subtree", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues2_num_values, + { "Num Values", "winreg.winreg_QueryMultipleValues2.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_DeleteKeyEx_handle, + { "Handle", "winreg.winreg_DeleteKeyEx.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_QueryMultipleValues_values_out, { "Values Out", "winreg.winreg_QueryMultipleValues.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_KeySecurityData_data, - { "Data", "winreg.KeySecurityData.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_OpenKey_access_mask, - { "Access Mask", "winreg.winreg_OpenKey.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_StringBuf_name, + { "Name", "winreg.winreg_StringBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_OpenKey_keyname, { "Keyname", "winreg.winreg_OpenKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot, - { "Do Reboot", "winreg.winreg_InitiateSystemShutdownEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeKeyValue_watch_subtree, - { "Watch Subtree", "winreg.winreg_NotifyChangeKeyValue.watch_subtree", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_DeleteKeyEx_access_mask, - { "Access Mask", "winreg.winreg_DeleteKeyEx.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_DeleteKeyEx_key, - { "Key", "winreg.winreg_DeleteKeyEx.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryValue_data_length, - { "Data Length", "winreg.winreg_QueryValue.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_KeySecurityData_len, - { "Len", "winreg.KeySecurityData.len", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SaveKeyEx_filename, + { "Filename", "winreg.winreg_SaveKeyEx.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_ReplaceKey_old_file, + { "Old File", "winreg.winreg_ReplaceKey.old_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_last_changed_time, + { "Last Changed Time", "winreg.winreg_QueryInfoKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumKey_last_changed_time, + { "Last Changed Time", "winreg.winreg_EnumKey.last_changed_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_LoadKey_filename, + { "Filename", "winreg.winreg_LoadKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SaveKey_filename, + { "Filename", "winreg.winreg_SaveKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_AccessMask_KEY_WOW64_64KEY, + { "Key Wow64 64key", "winreg.winreg_AccessMask.KEY_WOW64_64KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_WOW64_64KEY_tfs), ( 0x00100 ), NULL, HFILL }}, + { &hf_winreg_system_name, + { "System Name", "winreg.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_ValNameBuf_size, { "Size", "winreg.winreg_ValNameBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_CreateKey_name, - { "Name", "winreg.winreg_CreateKey.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES, - { "Reg Notify Change Attributes", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_ATTRIBUTES", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_ATTRIBUTES_tfs), ( 0x00000002 ), NULL, HFILL }}, - { &hf_winreg_winreg_String_name_len, - { "Name Len", "winreg.winreg_String.name_len", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_DeleteKey_key, - { "Key", "winreg.winreg_DeleteKey.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_QueryValue_data_size, { "Data Size", "winreg.winreg_QueryValue.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_system_name, - { "System Name", "winreg.system_name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_QueryMultipleValue_ve_valueptr, - { "Ve Valueptr", "winreg.QueryMultipleValue.ve_valueptr", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_KeySecurityAttribute_data_size, - { "Data Size", "winreg.KeySecurityAttribute.data_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryMultipleValues_num_values, - { "Num Values", "winreg.winreg_QueryMultipleValues.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_StringBuf_name, - { "Name", "winreg.winreg_StringBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeKeyValue_unknown2, - { "Unknown2", "winreg.winreg_NotifyChangeKeyValue.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_sd_offset, - { "Offset", "winreg.sd.offset", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_ValNameBuf_name, - { "Name", "winreg.winreg_ValNameBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_StringBuf_length, - { "Length", "winreg.winreg_StringBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET, + { "Reg Notify Change Last Set", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_LAST_SET", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_LAST_SET_tfs), ( 0x00000004 ), NULL, HFILL }}, + { &hf_winreg_winreg_ReplaceKey_subkey, + { "Subkey", "winreg.winreg_ReplaceKey.subkey", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues_buffer, + { "Buffer", "winreg.winreg_QueryMultipleValues.buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_RestoreKey_handle, + { "Handle", "winreg.winreg_RestoreKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdownEx_do_reboot, + { "Do Reboot", "winreg.winreg_InitiateSystemShutdownEx.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_max_subkeylen, + { "Max Subkeylen", "winreg.winreg_QueryInfoKey.max_subkeylen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumKey_enum_index, + { "Enum Index", "winreg.winreg_EnumKey.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE, + { "Reg Option Backup Restore", "winreg.winreg_KeyOptions.REG_OPTION_BACKUP_RESTORE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_BACKUP_RESTORE_tfs), ( 0x00000004 ), NULL, HFILL }}, + { &hf_winreg_winreg_AccessMask_KEY_QUERY_VALUE, + { "Key Query Value", "winreg.winreg_AccessMask.KEY_QUERY_VALUE", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_QUERY_VALUE_tfs), ( 0x00001 ), NULL, HFILL }}, + { &hf_winreg_winreg_GetKeySecurity_sec_info, + { "Sec Info", "winreg.winreg_GetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumValue_enum_index, + { "Enum Index", "winreg.winreg_EnumValue.enum_index", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumKey_name, + { "Name", "winreg.winreg_EnumKey.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SetValue_name, + { "Name", "winreg.winreg_SetValue.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_num_subkeys, + { "Num Subkeys", "winreg.winreg_QueryInfoKey.num_subkeys", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_ReplaceKey_new_file, + { "New File", "winreg.winreg_ReplaceKey.new_file", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_RestoreKey_flags, + { "Flags", "winreg.winreg_RestoreKey.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_LoadKey_keyname, + { "Keyname", "winreg.winreg_LoadKey.keyname", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_AccessMask_KEY_NOTIFY, + { "Key Notify", "winreg.winreg_AccessMask.KEY_NOTIFY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_NOTIFY_tfs), ( 0x00010 ), NULL, HFILL }}, { &hf_winreg_winreg_QueryMultipleValues2_values_in, { "Values In", "winreg.winreg_QueryMultipleValues2.values_in", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_String_name_size, - { "Name Size", "winreg.winreg_String.name_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_NotifyChangeKeyValue_unknown, - { "Unknown", "winreg.winreg_NotifyChangeKeyValue.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_AccessMask_KEY_CREATE_SUB_KEY, - { "Key Create Sub Key", "winreg.winreg_AccessMask.KEY_CREATE_SUB_KEY", FT_BOOLEAN, 32, TFS(&winreg_AccessMask_KEY_CREATE_SUB_KEY_tfs), ( 0x00004 ), NULL, HFILL }}, - { &hf_winreg_winreg_RestoreKey_filename, - { "Filename", "winreg.winreg_RestoreKey.filename", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdownEx_timeout, + { "Timeout", "winreg.winreg_InitiateSystemShutdownEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_sd, + { "KeySecurityData", "winreg.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_StringBuf_size, + { "Size", "winreg.winreg_StringBuf.size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_RestoreKeyFlags_REG_REFRESH_HIVE, { "Reg Refresh Hive", "winreg.winreg_RestoreKeyFlags.REG_REFRESH_HIVE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_REFRESH_HIVE_tfs), ( 0x00000002 ), NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_max_valbufsize, - { "Max Valbufsize", "winreg.winreg_QueryInfoKey.max_valbufsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdownEx_reason, - { "Reason", "winreg.winreg_InitiateSystemShutdownEx.reason", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_EnumValue_length, - { "Length", "winreg.winreg_EnumValue.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryInfoKey_max_subkeylen, - { "Max Subkeylen", "winreg.winreg_QueryInfoKey.max_subkeylen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdown_timeout, - { "Timeout", "winreg.winreg_InitiateSystemShutdown.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_InitiateSystemShutdownEx_hostname, - { "Hostname", "winreg.winreg_InitiateSystemShutdownEx.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_KeySecurityAttribute_inherit, - { "Inherit", "winreg.KeySecurityAttribute.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeKeyValue_notify_filter, + { "Notify Filter", "winreg.winreg_NotifyChangeKeyValue.notify_filter", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_AbortSystemShutdown_server, + { "Server", "winreg.winreg_AbortSystemShutdown.server", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_ReplaceKey_handle, + { "Handle", "winreg.winreg_ReplaceKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_DeleteKey_key, + { "Key", "winreg.winreg_DeleteKey.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SecBuf_sd, + { "Sd", "winreg.winreg_SecBuf.sd", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_opnum, + { "Operation", "winreg.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SetValue_size, + { "Size", "winreg.winreg_SetValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY, + { "Reg Notify Change Security", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_SECURITY", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_SECURITY_tfs), ( 0x00000008 ), NULL, HFILL }}, + { &hf_winreg_QueryMultipleValue_ve_valuelen, + { "Ve Valuelen", "winreg.QueryMultipleValue.ve_valuelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_KeySecurityData_size, + { "Size", "winreg.KeySecurityData.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_ValNameBuf_name, + { "Name", "winreg.winreg_ValNameBuf.name", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_OpenKey_options, + { "Options", "winreg.winreg_OpenKey.options", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SecBuf_length, + { "Length", "winreg.winreg_SecBuf.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeKeyValue_string2, + { "String2", "winreg.winreg_NotifyChangeKeyValue.string2", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, { &hf_winreg_werror, { "Windows Error", "winreg.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }}, { &hf_winreg_winreg_QueryMultipleValues2_values_out, { "Values Out", "winreg.winreg_QueryMultipleValues2.values_out", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_EnumKey_keyclass, - { "Keyclass", "winreg.winreg_EnumKey.keyclass", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_CreateKey_keyclass, - { "Keyclass", "winreg.winreg_CreateKey.keyclass", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_EnumValue_value, - { "Value", "winreg.winreg_EnumValue.value", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_OpenHKCU_access_mask, - { "Access Mask", "winreg.winreg_OpenHKCU.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, - { &hf_winreg_winreg_QueryValue_value_name, - { "Value Name", "winreg.winreg_QueryValue.value_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryValue_data, + { "Data", "winreg.winreg_QueryValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_OpenKey_parent_handle, + { "Parent Handle", "winreg.winreg_OpenKey.parent_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeKeyValue_unknown, + { "Unknown", "winreg.winreg_NotifyChangeKeyValue.unknown", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdown_hostname, + { "Hostname", "winreg.winreg_InitiateSystemShutdown.hostname", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues_num_values, + { "Num Values", "winreg.winreg_QueryMultipleValues.num_values", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_KeySecurityAttribute_inherit, + { "Inherit", "winreg.KeySecurityAttribute.inherit", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME, + { "Reg Notify Change Name", "winreg.winreg_NotifyChangeType.REG_NOTIFY_CHANGE_NAME", FT_BOOLEAN, 32, TFS(&winreg_NotifyChangeType_REG_NOTIFY_CHANGE_NAME_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_winreg_winreg_EnumValue_size, + { "Size", "winreg.winreg_EnumValue.size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE, + { "Reg Whole Hive Volatile", "winreg.winreg_RestoreKeyFlags.REG_WHOLE_HIVE_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_WHOLE_HIVE_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_winreg_winreg_UnLoadKey_handle, + { "Handle", "winreg.winreg_UnLoadKey.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_String_name_size, + { "Name Size", "winreg.winreg_String.name_size", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryValue_data_length, + { "Data Length", "winreg.winreg_QueryValue.data_length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, { &hf_winreg_winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH, { "Reg No Lazy Flush", "winreg.winreg_RestoreKeyFlags.REG_NO_LAZY_FLUSH", FT_BOOLEAN, 32, TFS(&winreg_RestoreKeyFlags_REG_NO_LAZY_FLUSH_tfs), ( 0x00000004 ), NULL, HFILL }}, + { &hf_winreg_winreg_OpenHKPD_access_mask, + { "Access Mask", "winreg.winreg_OpenHKPD.access_mask", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_secdescsize, + { "Secdescsize", "winreg.winreg_QueryInfoKey.secdescsize", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_handle, + { "Handle", "winreg.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdown_do_reboot, + { "Do Reboot", "winreg.winreg_InitiateSystemShutdown.do_reboot", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_EnumKey_keyclass, + { "Keyclass", "winreg.winreg_EnumKey.keyclass", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_NotifyChangeKeyValue_unknown2, + { "Unknown2", "winreg.winreg_NotifyChangeKeyValue.unknown2", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdown_timeout, + { "Timeout", "winreg.winreg_InitiateSystemShutdown.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_StringBuf_length, + { "Length", "winreg.winreg_StringBuf.length", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_sd_max_size, + { "Max Size", "winreg.sd.max_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_QueryInfoKey_max_valnamelen, + { "Max Valnamelen", "winreg.winreg_QueryInfoKey.max_valnamelen", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdown_message, + { "Message", "winreg.winreg_InitiateSystemShutdown.message", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SetKeySecurity_sec_info, + { "Sec Info", "winreg.winreg_SetKeySecurity.sec_info", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SetValue_data, + { "Data", "winreg.winreg_SetValue.data", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SaveKey_sec_attrib, + { "Sec Attrib", "winreg.winreg_SaveKey.sec_attrib", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_KeyOptions_REG_OPTION_OPEN_LINK, + { "Reg Option Open Link", "winreg.winreg_KeyOptions.REG_OPTION_OPEN_LINK", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_OPEN_LINK_tfs), ( 0x00000008 ), NULL, HFILL }}, + { &hf_winreg_winreg_QueryMultipleValues2_offered, + { "Offered", "winreg.winreg_QueryMultipleValues2.offered", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_SaveKeyEx_flags, + { "Flags", "winreg.winreg_SaveKeyEx.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_DeleteValue_value, + { "Value", "winreg.winreg_DeleteValue.value", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_KeyOptions_REG_OPTION_VOLATILE, + { "Reg Option Volatile", "winreg.winreg_KeyOptions.REG_OPTION_VOLATILE", FT_BOOLEAN, 32, TFS(&winreg_KeyOptions_REG_OPTION_VOLATILE_tfs), ( 0x00000001 ), NULL, HFILL }}, + { &hf_winreg_winreg_InitiateSystemShutdownEx_force_apps, + { "Force Apps", "winreg.winreg_InitiateSystemShutdownEx.force_apps", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }}, + { &hf_winreg_winreg_DeleteKeyEx_key, + { "Key", "winreg.winreg_DeleteKeyEx.key", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_winreg_sd_actual_size, + { "Actual Size", "winreg.sd.actual_size", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }}, }; -- cgit v1.2.3