On Fri, 24 May 2002, Pia Sahlberg wrote:
> Hi,
> Richard in your patch to srvsvc_dissect_net_share_get_info_rqst
Hmmm, the problem I have with that claim, even though that is what MSDN
suggests is the case with NetShareGetInfo, is that the referent is only
16-bits long in each of the two traces I have. 0x11C9 in one case, and
some other value in another.
How do you explain that? The trace was of WinNT or Win2K accessing an NT
or 2K server ...
> the hf_srvsvc_share is actually a top level REF pointer,
>
> you should probably change/*
> > * Construct a label for the string ...
> > */
> > item = proto_tree_add_text(tree, tvb, offset, -1, "Share");
> > stree = proto_item_add_subtree(item, ett_srvsvc_share_info);
> > di->hf_index = hf_srvsvc_share;
> > di->levels = 0;
> >
> > offset = dissect_ndr_nt_UNICODE_STRING_str(tvb, offset, pinfo, stree,
> >drep);
>
>
> into this instead :
>
>
> > offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
> > dissect_ndr_nt_UNICODE_STRING_str,
> > NDR_POINTER_REF, "Server",
> > hf_srvsvc_share, -1);
> >
>
>
> To make the output look nicer, something I have planned to do a long time
> would be if you could change dissect_ndr_pointer so it WILL create
> a tree also for top level ref pointers.
> Then the -1 above should be changed to 0.
> This would also need all NDR_POINTER_REF dissect_ndr_pointer calls to be
> audited to make sure we specify a string (many "" used i belive)
>
> It is failry easy to do these changes and the fixes for NDR_POINTER_REF
> would be fairly mechanical. (there are not that many places to update).
> If you dont want to do this change yourself I can make it sometime during
> the weekend.
>
>
> best regards
> ronnie s
>
>
>
> _________________________________________________________________
> Chat with friends online, try MSN Messenger: http://messenger.msn.com
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
--
Regards
-----
Richard Sharpe, rsharpe@xxxxxxxxxx, rsharpe@xxxxxxxxx,
sharpe@xxxxxxxxxxxx