static int dissect_oxid_server_alive2_resp(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, guint8 *drep) { guint16 u16VersionMajor; guint16 u16VersionMinor; offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, tree, drep, &u16VersionMajor, &u16VersionMinor); /* XXX - understand what those 8 bytes mean! don't skip'em!*/ dissect_dcerpc_uint64(tvb , offset, pinfo, tree, drep, hf_oxid_Unknown1, NULL); offset += 8; offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, tree, drep, hf_oxid_ds_array, NULL); /* unknown field 2 */ dissect_dcerpc_uint64(tvb, offset, pinfo, tree, drep, hf_oxid_Unknown2, NULL); offset += 8; return offset; }
int PIDL_dissect_uint64 (tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, guint8 *drep, int hfindex, guint32 param _U_) { dcerpc_info *di; guint64 val; di=pinfo->private_data; if(di->conformant_run){ /* just a run to handle conformant arrays, no scalars to dissect */ return offset; } if (offset % 8) { offset += 8 - (offset % 8); } offset=dissect_dcerpc_uint64 (tvb, offset, pinfo, tree, drep, hfindex, &val); if(param&PIDL_SET_COL_INFO){ header_field_info *hf_info; char *valstr; hf_info=proto_registrar_get_nth(hfindex); valstr=ep_alloc(64); valstr[0]=0; switch(hf_info->display){ case BASE_DEC: if(hf_info->strings){ g_snprintf(valstr, 64, "%s(%" G_GINT64_MODIFIER "u)",val_to_str( (guint32) val, hf_info->strings, "Unknown:%u"), val); } else { g_snprintf(valstr, 64, "%" G_GINT64_MODIFIER "u", val); } break; case BASE_HEX: if(hf_info->strings){ g_snprintf(valstr, 64, "%s(0x%" G_GINT64_MODIFIER "x)",val_to_str( (guint32) val, hf_info->strings, "Unknown:%u"), val); } else { g_snprintf(valstr, 64, "0x%" G_GINT64_MODIFIER "x", val); } break; default: REPORT_DISSECTOR_BUG("Invalid hf->display value"); } if (check_col(pinfo->cinfo, COL_INFO)) { col_append_fstr(pinfo->cinfo, COL_INFO," %s:%s", hf_info->name, valstr); } } return offset; }
/* uint64 : hyper a 64 bit integer aligned to proper 8 byte boundaries */ int dissect_ndr_uint64 (tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, guint8 *drep, int hfindex, guint64 *pdata) { dcerpc_info *di; di=pinfo->private_data; if(di->conformant_run){ /* just a run to handle conformant arrays, no scalars to dissect */ return offset; } if (offset % 8) { offset += 8 - (offset % 8); } return dissect_dcerpc_uint64 (tvb, offset, pinfo, tree, drep, hfindex, pdata); }
/* Double uint32 This function dissects the 64bit datatype that is common for ms interfaces and which is 32bit aligned. It is really just 2 uint32's */ int dissect_ndr_duint32(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep, int hfindex, guint64 *pdata) { /* Some callers expect us to initialize pdata, even in error conditions, so * do it right away in case we forget later */ if (pdata) *pdata = 0; if (di->conformant_run) { /* just a run to handle conformant arrays, no scalars to dissect */ return offset; } if (!di->no_align && (offset % 4)) { offset += 4 - (offset % 4); } return dissect_dcerpc_uint64(tvb, offset, pinfo, tree, di, drep, hfindex, pdata); }