At least from one capture, it appears that the mod time field in a QueryKey

reply is probably a FILETIME, so process it as such.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5821 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/packet-dcerpc-reg.c b/packet-dcerpc-reg.c
index 2e1daa0d2325341cfbb552abaf13e2253c8b3b29..2fc7cd3efaf09fec0e7972bd2d75bd6b2d9687e1 100644 (file)
--- a/packet-dcerpc-reg.c
+++ b/packet-dcerpc-reg.c
@@ -2,7 +2,7 @@
  * Routines for SMB \PIPE\winreg packet disassembly
  * Copyright 2001, 2002 Tim Potter <tpot@samba.org>
  *
- * $Id: packet-dcerpc-reg.c,v 1.7 2002/07/05 07:07:34 tpot Exp $
+ * $Id: packet-dcerpc-reg.c,v 1.8 2002/07/05 19:34:12 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -33,6 +33,7 @@
 #include "packet-dcerpc-nt.h"
 #include "packet-dcerpc-reg.h"
 #include "smb.h"
+#include "packet-smb-common.h"
 
 /* Global hf index fields */
 
@@ -55,6 +56,7 @@ static int hf_querykey_num_values = -1;
 static int hf_querykey_max_valname_len = -1;
 static int hf_querykey_max_valbuf_size = -1;
 static int hf_querykey_secdesc = -1;
+static int hf_querykey_modtime = -1;
 
 /* Data that is passed to a open call */
 
@@ -366,10 +368,8 @@ RegQueryKey_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
                tvb, offset, pinfo, tree, drep,
                hf_querykey_secdesc, NULL);
 
-       /* FIXME: do time properly */
-
-       proto_tree_add_text(tree, tvb, offset, 8, "Mod time");
-       offset += 8;
+       offset = dissect_smb_64bit_time(
+               tvb, tree, offset, hf_querykey_modtime);
 
        offset = dissect_ntstatus(
                tvb, offset, pinfo, tree, drep, hf_rc, NULL);
@@ -587,6 +587,10 @@ proto_register_dcerpc_reg(void)
                  { "Secdesc", "reg.querykey.secdesc", FT_UINT32, BASE_DEC,
                    NULL, 0x0, "Secdesc", HFILL }},
 
+               { &hf_querykey_modtime,
+                 { "Mod time", "reg.querykey.modtime", FT_ABSOLUTE_TIME, BASE_NONE,
+                   NULL, 0x0, "Secdesc", HFILL }},
+
        };
 
         static gint *ett[] = {