1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
# conformance file for SRVSVC
#
MANUAL srvsvc_dissect_element_NetShareInfo_info1501_
MANUAL srvsvc_dissect_element_NetGetFileSecurity_sd_buf_
MANUAL srvsvc_dissect_element_NetSetFileSecurity_sd_buf
MANUAL srvsvc_dissect_element_NetShareCtr1501_array__
MANUAL srvsvc_dissect_element_NetShareInfo502_sd_
NOEMIT srvsvc_dissect_element_NetShareInfo502_sd__
# we wont need to manually define servertype once svcctl is autogenerated
MANUAL srvsvc_dissect_element_NetSrvInfo101_server_type
MANUAL srvsvc_dissect_element_NetSrvInfo102_server_type
# until we get secinfo
MANUAL srvsvc_dissect_element_NetGetFileSecurity_securityinformation
MANUAL srvsvc_dissect_element_NetSetFileSecurity_securityinformation
MANUAL srvsvc_dissect_element_NetShareInfo502_sd_buf
MANUAL srvsvc_dissect_element_NetShareInfoCtr_ctr
NOEMIT srvsvc_dissect_element_NetDiskInfo0_disk_
NOEMIT srvsvc_dissect_element_NetGetFileSecurity_sd_buf__
NOEMIT srvsvc_dissect_element_NetSetFileSecurity_sd_buf_
HF_FIELD hf_srvsvc_sec_desc_buf_len "Sec Desc Buf Len" "srvsvc.sec_desc_buf_len" FT_UINT32 BASE_DEC NULL 0 "" "" ""
#
#
# Prettifications
PARAM_VALUE srvsvc_dissect_element_NetCharDevEnum_server_unc_ 1|PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetCharDevEnum_level_ PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetCharDevQEnum_server_unc_ 1|PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetCharDevQEnum_user_ 1|PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetCharDevQEnum_level_ PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetConnEnum_server_unc_ 1|PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetConnEnum_path_ 1|PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetConnEnum_level_ PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetFileEnum_server_unc_ 1|PIDL_SET_COL_INFO
PARAM_VALUE srvsvc_dissect_element_NetFileEnum_level_ PIDL_SET_COL_INFO
CODE START
#include "packet-smb.h"
#include "packet-smb-browse.h"
static int
srvsvc_dissect_NetShareCtr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_);
static int
srvsvc_dissect_element_NetShareInfoCtr_ctr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, guint32 *level)
{
ALIGN_TO_5_BYTES
offset = srvsvc_dissect_NetShareCtr(tvb, offset, pinfo, tree, di, drep, hf_srvsvc_srvsvc_NetShareInfoCtr_ctr, *level);
return offset;
}
static int
srvsvc_dissect_sec_desc_buf(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep);
static int
srvsvc_dissect_sec_desc_buf(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
guint32 len;
if(di->conformant_run){
/*just a run to handle conformant arrays, nothing to dissect */
return offset;
}
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep,
hf_srvsvc_sec_desc_buf_len, &len);
dissect_nt_sec_desc(tvb, offset, pinfo, tree, drep, TRUE, len,
NULL);
offset += len;
return offset;
}
static int
srvsvc_dissect_element_NetShareInfo_info1501_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep);
}
static int
srvsvc_dissect_element_NetGetFileSecurity_sd_buf_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep);
}
static int
srvsvc_dissect_element_NetSetFileSecurity_sd_buf(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep);
}
static int
srvsvc_dissect_element_NetShareCtr1501_array__(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep);
}
static int
srvsvc_dissect_element_NetShareInfo502_sd_buf(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
{
return srvsvc_dissect_sec_desc_buf(tvb,offset,pinfo,tree,di,drep);
}
static int
srvsvc_dissect_ServerType(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
if(di->conformant_run){
/*just a run to handle conformant arrays, nothing to dissect */
return offset;
}
offset=dissect_smb_server_type_flags(tvb, offset, pinfo, tree,
drep, 0);
return offset;
}
static int
srvsvc_dissect_element_NetSrvInfo101_server_type(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_ServerType(tvb, offset, pinfo, tree, di, drep);
}
static int
srvsvc_dissect_element_NetSrvInfo102_server_type(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_ServerType(tvb, offset, pinfo, tree, di, drep);
}
static int
srvsvc_dissect_secinfo(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, dcerpc_info* di, guint8 *drep _U_)
{
if(di->conformant_run){
/*just a run to handle conformant arrays, nothing to dissect */
return offset;
}
offset=dissect_security_information_mask(tvb, tree, offset);
return offset;
}
static int
srvsvc_dissect_element_NetGetFileSecurity_securityinformation(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_secinfo(tvb, offset, pinfo, tree, di, drep);
}
static int
srvsvc_dissect_element_NetSetFileSecurity_securityinformation(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, guint8 *drep)
{
return srvsvc_dissect_secinfo(tvb, offset, pinfo, tree, di, drep);
}
CODE END
|
