packet-dcerpc-browser.c

   1 /* packet-dcerpc-browser.c
   2  * Routines for DCERPC Browser packet disassembly
   3  * Copyright 2001, Ronnie Sahlberg
   4  *
   5  * $Id: packet-dcerpc-browser.c,v 1.5 2002/05/31 00:31:12 tpot Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 /* The IDL file for this interface can be extracted by grepping for idl
  27  * in capitals.
  28  */
  29
  30 #ifdef HAVE_CONFIG_H
  31 #include "config.h"
  32 #endif
  33
  34 #include <glib.h>
  35 #include <epan/packet.h>
  36 #include "packet-dcerpc.h"
  37 #include "packet-dcerpc-browser.h"
  38 #include "packet-dcerpc-nt.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_browser = -1;
  42 static int hf_browser_rc = -1;
  43 static int hf_browser_unknown_long = -1;
  44 static int hf_browser_unknown_hyper = -1;
  45 static int hf_browser_unknown_bytes = -1;
  46 static int hf_browser_unknown_string = -1;
  47
  48
  49 static gint ett_dcerpc_browser = -1;
  50
  51
  52 static int
  53 dissect_browser_long_pointer(tvbuff_t *tvb, int offset,
  54                              packet_info *pinfo, proto_tree *tree,
  55                              char *drep)
  56 {
  57         dcerpc_info *di;
  58
  59         di=pinfo->private_data;
  60         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
  61                                      di->hf_index, NULL);
  62         return offset;
  63 }
  64
  65
  66
  67 /*
  68  IDL [ uuid(6bffd098-a112-3610-9833-012892020162),
  69  IDL   version(0.0),
  70  IDL   implicit_handle(handle_t rpc_binding)
  71  IDL ] interface browser
  72  IDL {
  73 */
  74
  75 static e_uuid_t uuid_dcerpc_browser = {
  76         0x6bffd098, 0xa112, 0x3610,
  77         { 0x98, 0x33, 0x01, 0x28, 0x92, 0x02, 0x01, 0x62 }
  78 };
  79
  80 static guint16 ver_dcerpc_browser = 0;
  81
  82
  83 /*
  84   IDL typedef struct {
  85   IDL   long element_7;
  86   IDL   [size_is(element_7)] [unique] byte *element_8;
  87   IDL } TYPE_4;
  88 */
  89 static int
  90 dissect_browser_TYPE_4_data(tvbuff_t *tvb, int offset,
  91                         packet_info *pinfo, proto_tree *tree,
  92                         char *drep)
  93 {
  94         guint32 len;
  95         dcerpc_info *di;
  96
  97         di=pinfo->private_data;
  98         if(di->conformant_run){
  99                 /* this call is to make ethereal eat the array header for the conformant run */
 100                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 101
 102                 return offset;
 103         }
 104         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 105                 hf_browser_unknown_long, &len);
 106
 107         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 108                 FALSE);
 109         offset += len;
 110
 111         return len;
 112 }
 113 static int
 114 dissect_browser_TYPE_4(tvbuff_t *tvb, int offset,
 115                         packet_info *pinfo, proto_tree *tree,
 116                         char *drep)
 117 {
 118         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 119                 hf_browser_unknown_long, NULL);
 120
 121         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 122                 dissect_browser_TYPE_4_data, NDR_POINTER_UNIQUE,
 123                 "unknown TYPE_4", -1, -1);
 124
 125         return offset;
 126 }
 127
 128
 129 /*
 130   IDL typedef struct {
 131   IDL   long element_5;
 132   IDL   [size_is(element_5)] [unique] byte *element_6;
 133   IDL } TYPE_3;
 134 */
 135 static int
 136 dissect_browser_TYPE_3_data(tvbuff_t *tvb, int offset,
 137                         packet_info *pinfo, proto_tree *tree,
 138                         char *drep)
 139 {
 140         guint32 len;
 141         dcerpc_info *di;
 142
 143         di=pinfo->private_data;
 144         if(di->conformant_run){
 145                 /* this call is to make ethereal eat the array header for the conformant run */
 146                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 147
 148                 return offset;
 149         }
 150
 151         /* this is really the length of the encoded data */
 152         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 153                 hf_browser_unknown_long, &len);
 154         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 155                 FALSE);
 156         offset += len;
 157
 158         return len;
 159 }
 160 static int
 161 dissect_browser_TYPE_3(tvbuff_t *tvb, int offset,
 162                         packet_info *pinfo, proto_tree *tree,
 163                         char *drep)
 164 {
 165         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 166                 hf_browser_unknown_long, NULL);
 167
 168         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 169                 dissect_browser_TYPE_3_data, NDR_POINTER_UNIQUE,
 170                 "unknown TYPE_3", -1, -1);
 171
 172         return offset;
 173 }
 174
 175
 176
 177 /*
 178   IDL typedef [switch_type(long)] union {
 179   IDL   [case(100)] [unique] TYPE_3 *element_3;
 180   IDL   [case(101)] [unique] TYPE_4 *element_4;
 181   IDL } TYPE_2;
 182 */
 183 static int
 184 dissect_browser_TYPE_2(tvbuff_t *tvb, int offset,
 185                         packet_info *pinfo, proto_tree *tree,
 186                         char *drep)
 187 {
 188         guint32 level;
 189         dcerpc_info *di;
 190
 191         di=pinfo->private_data;
 192         if(di->conformant_run){
 193                 /* ALING_TO_4_BYTES below might eat bytes otherwise */
 194                 return offset;
 195         }
 196
 197         /* this is really the union switch arm */
 198         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 199                 hf_browser_unknown_long, &level);
 200         ALIGN_TO_4_BYTES;
 201
 202         switch(level){
 203         case 100:
 204                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 205                         dissect_browser_TYPE_3, NDR_POINTER_UNIQUE,
 206                         "unknown TYPE_3", -1, -1);
 207                 break;
 208         case 101:
 209                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 210                         dissect_browser_TYPE_4, NDR_POINTER_UNIQUE,
 211                         "unknown TYPE_4", -1, -1);
 212                 break;
 213         }
 214
 215         return offset;
 216 }
 217
 218
 219 /*
 220   IDL typedef struct {
 221   IDL   long element_1;
 222   IDL   TYPE_2 element_2;
 223   IDL } TYPE_1;
 224 */
 225 static int
 226 dissect_browser_TYPE_1(tvbuff_t *tvb, int offset,
 227                         packet_info *pinfo, proto_tree *tree,
 228                         char *drep)
 229 {
 230         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 231                 hf_browser_unknown_long, NULL);
 232
 233         offset = dissect_browser_TYPE_2(tvb, offset, pinfo, tree, drep);
 234
 235         return offset;
 236 }
 237
 238
 239
 240 /*
 241  IDL  long Function_00(
 242  IDL        [in] [unique] [string] wchar_t *element_9,
 243  IDL        [in] [unique] [string] wchar_t *element_10,
 244  IDL        [in] [unique] [string] wchar_t *element_11,
 245  IDL        [in,out] [ref] TYPE_1 *element_12,
 246  IDL        [in] long element_13,
 247  IDL        [out] long element_14,
 248  IDL        [in] long element_15,
 249  IDL        [in] [unique] [string] wchar_t *element_16,
 250  IDL        [in,out] [unique] long *element_17
 251  IDL  );
 252 */
 253 static int
 254 dissect_browser_UNKNOWN_00_rqst(tvbuff_t *tvb, int offset,
 255                         packet_info *pinfo, proto_tree *tree,
 256                         char *drep)
 257 {
 258         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 259                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 260                         "unknown string", hf_browser_unknown_string, 0);
 261
 262         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 263                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 264                         "unknown string", hf_browser_unknown_string, 0);
 265
 266         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 267                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 268                         "unknown string", hf_browser_unknown_string, 0);
 269
 270         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 271                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 272                         "unknown TYPE_1", -1, 0);
 273
 274         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 275                 hf_browser_unknown_long, NULL);
 276
 277         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 278                 hf_browser_unknown_long, NULL);
 279
 280         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 281                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 282                         "unknown string", hf_browser_unknown_string, 0);
 283
 284         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 285                         dissect_browser_long_pointer, NDR_POINTER_UNIQUE,
 286                         "unknown long", hf_browser_unknown_long, 0);
 287
 288         return offset;
 289 }
 290 static int
 291 dissect_browser_UNKNOWN_00_reply(tvbuff_t *tvb, int offset,
 292                         packet_info *pinfo, proto_tree *tree,
 293                         char *drep)
 294 {
 295         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 296                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 297                         "unknown TYPE_1", -1, 0);
 298
 299         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 300                 hf_browser_unknown_long, NULL);
 301
 302         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 303                         dissect_browser_long_pointer, NDR_POINTER_UNIQUE,
 304                         "unknown long", hf_browser_unknown_long, 0);
 305
 306         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 307                 hf_browser_rc, NULL);
 308
 309         return offset;
 310 }
 311
 312 /*
 313   IDL long Function_01(
 314   IDL       [in] [unique] [string] wchar_t *element_18,
 315   IDL       [in] long element_19,
 316   IDL       [in] long element_20
 317   IDL );
 318 */
 319 static int
 320 dissect_browser_UNKNOWN_01_rqst(tvbuff_t *tvb, int offset,
 321                         packet_info *pinfo, proto_tree *tree,
 322                         char *drep)
 323 {
 324         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 325                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 326                         "unknown string", hf_browser_unknown_string, 0);
 327
 328         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 329                 hf_browser_unknown_long, NULL);
 330
 331         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 332                 hf_browser_unknown_long, NULL);
 333
 334         return offset;
 335 }
 336 static int
 337 dissect_browser_UNKNOWN_01_reply(tvbuff_t *tvb, int offset,
 338                         packet_info *pinfo, proto_tree *tree,
 339                         char *drep)
 340 {
 341         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 342                 hf_browser_rc, NULL);
 343
 344         return offset;
 345 }
 346
 347
 348 /*
 349   IDL long Function_02(
 350   IDL       [in] [unique] [string] wchar_t *element_21,
 351   IDL       [in,out] [ref] TYPE_1 *element_22,
 352   IDL       [out] long element_23
 353   IDL );
 354 */
 355 static int
 356 dissect_browser_UNKNOWN_02_rqst(tvbuff_t *tvb, int offset,
 357                         packet_info *pinfo, proto_tree *tree,
 358                         char *drep)
 359 {
 360         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 361                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 362                         "unknown string", hf_browser_unknown_string, 0);
 363
 364         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 365                         dissect_browser_TYPE_1, NDR_POINTER_REF,
 366                         "unknown TYPE_1", -1, 0);
 367
 368         return offset;
 369 }
 370 static int
 371 dissect_browser_UNKNOWN_02_reply(tvbuff_t *tvb, int offset,
 372                         packet_info *pinfo, proto_tree *tree,
 373                         char *drep)
 374 {
 375         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 376                 hf_browser_unknown_long, NULL);
 377
 378         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 379                 hf_browser_rc, NULL);
 380
 381         return offset;
 382 }
 383
 384
 385 /*
 386   IDL long Function_03(
 387   IDL       [in] [unique] [string] wchar_t *element_24
 388   IDL );
 389 */
 390 static int
 391 dissect_browser_UNKNOWN_03_rqst(tvbuff_t *tvb, int offset,
 392                         packet_info *pinfo, proto_tree *tree,
 393                         char *drep)
 394 {
 395         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 396                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 397                         "unknown string", hf_browser_unknown_string, 0);
 398
 399         return offset;
 400 }
 401 static int
 402 dissect_browser_UNKNOWN_03_reply(tvbuff_t *tvb, int offset,
 403                         packet_info *pinfo, proto_tree *tree,
 404                         char *drep)
 405 {
 406         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 407                 hf_browser_rc, NULL);
 408
 409         return offset;
 410 }
 411
 412
 413 /*
 414   IDL long Function_04(
 415   IDL       [in] [unique] [string] wchar_t *element_25,
 416   IDL       [in] [string] char element_26
 417   IDL );
 418 */
 419 static int
 420 dissect_browser_UNKNOWN_04_rqst(tvbuff_t *tvb, int offset,
 421                         packet_info *pinfo, proto_tree *tree,
 422                         char *drep)
 423 {
 424         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 425                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 426                         "unknown string", hf_browser_unknown_string, 0);
 427
 428         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 429                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
 430                         "unknown string", hf_browser_unknown_string, 0);
 431
 432         return offset;
 433 }
 434 static int
 435 dissect_browser_UNKNOWN_04_reply(tvbuff_t *tvb, int offset,
 436                         packet_info *pinfo, proto_tree *tree,
 437                         char *drep)
 438 {
 439         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 440                 hf_browser_rc, NULL);
 441
 442         return offset;
 443 }
 444
 445
 446
 447 /*
 448   IDL typedef struct {
 449   IDL   TYPE_6 element_27;
 450   IDL   TYPE_6 element_28;
 451   IDL   TYPE_6 element_29;
 452   IDL   long element_30;
 453   IDL   long element_31;
 454   IDL   long element_32;
 455   IDL   long element_33;
 456   IDL   long element_34;
 457   IDL   long element_35;
 458   IDL   long element_36;
 459   IDL   long element_37;
 460   IDL   long element_38;
 461   IDL   long element_39;
 462   IDL   long element_40;
 463   IDL   long element_41;
 464   IDL   long element_42;
 465   IDL   long element_43;
 466   IDL   long element_44;
 467   IDL   TYPE_6 element_45;
 468   IDL } TYPE_5;
 469   IDL
 470   IDL typedef struct {
 471   IDL   hyper element_46;
 472   IDL } TYPE_6;
 473 */
 474 static int
 475 dissect_browser_TYPE_5(tvbuff_t *tvb, int offset,
 476                         packet_info *pinfo, proto_tree *tree,
 477                         char *drep)
 478 {
 479         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 480                 hf_browser_unknown_hyper, NULL);
 481
 482         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 483                 hf_browser_unknown_hyper, NULL);
 484
 485         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 486                 hf_browser_unknown_hyper, NULL);
 487
 488         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 489                 hf_browser_unknown_long, NULL);
 490
 491         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 492                 hf_browser_unknown_long, NULL);
 493
 494         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 495                 hf_browser_unknown_long, NULL);
 496
 497         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 498                 hf_browser_unknown_long, NULL);
 499
 500         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 501                 hf_browser_unknown_long, NULL);
 502
 503         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 504                 hf_browser_unknown_long, NULL);
 505
 506         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 507                 hf_browser_unknown_long, NULL);
 508
 509         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 510                 hf_browser_unknown_long, NULL);
 511
 512         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 513                 hf_browser_unknown_long, NULL);
 514
 515         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 516                 hf_browser_unknown_long, NULL);
 517
 518         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 519                 hf_browser_unknown_long, NULL);
 520
 521         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 522                 hf_browser_unknown_long, NULL);
 523
 524         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 525                 hf_browser_unknown_long, NULL);
 526
 527         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 528                 hf_browser_unknown_long, NULL);
 529
 530         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 531                 hf_browser_unknown_long, NULL);
 532
 533         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 534                 hf_browser_unknown_hyper, NULL);
 535
 536         return offset;
 537 }
 538
 539
 540 /*
 541   IDL long Function_05(
 542   IDL       [in] [unique] [string] wchar_t *element_47,
 543   IDL       [out] [ref] TYPE_5 **element_48
 544   IDL );
 545 */
 546 static int
 547 dissect_browser_UNKNOWN_05_rqst(tvbuff_t *tvb, int offset,
 548                         packet_info *pinfo, proto_tree *tree,
 549                         char *drep)
 550 {
 551         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 552                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 553                         "unknown string", hf_browser_unknown_string, 0);
 554
 555         return offset;
 556 }
 557 static int
 558 dissect_browser_UNKNOWN_05_reply(tvbuff_t *tvb, int offset,
 559                         packet_info *pinfo, proto_tree *tree,
 560                         char *drep)
 561 {
 562         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 563                         dissect_browser_TYPE_5, NDR_POINTER_UNIQUE,
 564                         "unknown TYPE_5", -1, 0);
 565
 566         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 567                 hf_browser_rc, NULL);
 568
 569         return offset;
 570 }
 571
 572
 573 /*
 574   IDL long Function_06(
 575   IDL       [in] [unique] [string] wchar_t *element_49
 576   IDL );
 577 */
 578 static int
 579 dissect_browser_UNKNOWN_06_rqst(tvbuff_t *tvb, int offset,
 580                         packet_info *pinfo, proto_tree *tree,
 581                         char *drep)
 582 {
 583         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 584                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 585                         "unknown string", hf_browser_unknown_string, 0);
 586
 587         return offset;
 588 }
 589 static int
 590 dissect_browser_UNKNOWN_06_reply(tvbuff_t *tvb, int offset,
 591                         packet_info *pinfo, proto_tree *tree,
 592                         char *drep)
 593 {
 594         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 595                 hf_browser_rc, NULL);
 596
 597         return offset;
 598 }
 599
 600
 601 /*
 602   IDL long Function_07(
 603   IDL       [in] [unique] [string] wchar_t *element_49
 604   IDL );
 605 */
 606 static int
 607 dissect_browser_UNKNOWN_07_rqst(tvbuff_t *tvb, int offset,
 608                         packet_info *pinfo, proto_tree *tree,
 609                         char *drep)
 610 {
 611         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 612                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 613                         "unknown string", hf_browser_unknown_string, 0);
 614
 615         return offset;
 616 }
 617 static int
 618 dissect_browser_UNKNOWN_07_reply(tvbuff_t *tvb, int offset,
 619                         packet_info *pinfo, proto_tree *tree,
 620                         char *drep)
 621 {
 622         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 623                 hf_browser_rc, NULL);
 624
 625         return offset;
 626 }
 627
 628
 629 /*
 630   IDL typedef struct {
 631   IDL   TYPE_6 element_59;
 632   IDL   TYPE_6 element_60;
 633   IDL   TYPE_6 element_61;
 634   IDL   long element_62;
 635   IDL   long element_63;
 636   IDL   long element_64;
 637   IDL   TYPE_6 element_65;
 638   IDL   long element_66;
 639   IDL   long element_67;
 640   IDL   long element_68;
 641   IDL   long element_69;
 642   IDL   long element_70;
 643   IDL   long element_71;
 644   IDL   long element_72;
 645   IDL   long element_73;
 646   IDL   long element_74;
 647   IDL } TYPE_11;
 648 */
 649 static int
 650 dissect_browser_TYPE_11(tvbuff_t *tvb, int offset,
 651                         packet_info *pinfo, proto_tree *tree,
 652                         char *drep)
 653 {
 654         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 655                 hf_browser_unknown_hyper, NULL);
 656
 657         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 658                 hf_browser_unknown_hyper, NULL);
 659
 660         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 661                 hf_browser_unknown_hyper, NULL);
 662
 663         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 664                 hf_browser_unknown_long, NULL);
 665
 666         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 667                 hf_browser_unknown_long, NULL);
 668
 669         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 670                 hf_browser_unknown_long, NULL);
 671
 672         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 673                 hf_browser_unknown_hyper, NULL);
 674
 675         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 676                 hf_browser_unknown_long, NULL);
 677
 678         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 679                 hf_browser_unknown_long, NULL);
 680
 681         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 682                 hf_browser_unknown_long, NULL);
 683
 684         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 685                 hf_browser_unknown_long, NULL);
 686
 687         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 688                 hf_browser_unknown_long, NULL);
 689
 690         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 691                 hf_browser_unknown_long, NULL);
 692
 693         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 694                 hf_browser_unknown_long, NULL);
 695
 696         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 697                 hf_browser_unknown_long, NULL);
 698
 699         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 700                 hf_browser_unknown_long, NULL);
 701
 702         return offset;
 703 }
 704
 705 /*
 706   IDL typedef struct {
 707   IDL   long element_57;
 708   IDL   [size_is(element_57)] [unique] TYPE_11 *element_58;
 709   IDL } TYPE_10;
 710 */
 711 static int
 712 dissect_browser_TYPE_11_array(tvbuff_t *tvb, int offset,
 713                         packet_info *pinfo, proto_tree *tree,
 714                         char *drep)
 715 {
 716         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 717                 dissect_browser_TYPE_11);
 718
 719         return offset;
 720 }
 721
 722 static int
 723 dissect_browser_TYPE_10(tvbuff_t *tvb, int offset,
 724                         packet_info *pinfo, proto_tree *tree,
 725                         char *drep)
 726 {
 727         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 728                 hf_browser_unknown_long, NULL);
 729
 730         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 731                 dissect_browser_TYPE_11_array, NDR_POINTER_UNIQUE,
 732                 "unknown TYPE_11_ARRAY", -1, 0);
 733
 734         return offset;
 735 }
 736
 737
 738 /*
 739   IDL typedef struct {
 740   IDL   long element_55;
 741   IDL   [size_is(element_55)] [unique] byte *element_56;
 742   IDL } TYPE_9;
 743 */
 744 static int
 745 dissect_browser_TYPE_9_data(tvbuff_t *tvb, int offset,
 746                         packet_info *pinfo, proto_tree *tree,
 747                         char *drep)
 748 {
 749         guint32 len;
 750         dcerpc_info *di;
 751
 752         di=pinfo->private_data;
 753         if(di->conformant_run){
 754                 /* this call is to make ethereal eat the array header for the conformant run */
 755                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 756
 757                 return offset;
 758         }
 759
 760         /* this is really the length of the encoded data */
 761         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 762                 hf_browser_unknown_long, &len);
 763
 764         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 765                 FALSE);
 766         offset += len;
 767
 768         return len;
 769 }
 770 static int
 771 dissect_browser_TYPE_9(tvbuff_t *tvb, int offset,
 772                         packet_info *pinfo, proto_tree *tree,
 773                         char *drep)
 774 {
 775         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 776                 hf_browser_unknown_long, NULL);
 777
 778         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 779                 dissect_browser_TYPE_9_data, NDR_POINTER_UNIQUE,
 780                 "unknown TYPE_9", -1, -1);
 781
 782         return offset;
 783 }
 784
 785
 786 /*
 787   IDL typedef [switch_type(long)] union {
 788   IDL   [case(100)] [unique] TYPE_9 *element_53;
 789   IDL   [case(101)] [unique] TYPE_10 *element_54;
 790   IDL } TYPE_8;
 791 */
 792 static int
 793 dissect_browser_TYPE_8(tvbuff_t *tvb, int offset,
 794                         packet_info *pinfo, proto_tree *tree,
 795                         char *drep)
 796 {
 797         guint32 level;
 798         dcerpc_info *di;
 799
 800         di=pinfo->private_data;
 801         if(di->conformant_run){
 802                 /* ALING_TO_4_BYTES below might eat bytes otherwise */
 803                 return offset;
 804         }
 805
 806         /* this is really the union switch arm */
 807         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 808                 hf_browser_unknown_long, &level);
 809         ALIGN_TO_4_BYTES;
 810
 811         switch(level){
 812         case 100:
 813                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 814                         dissect_browser_TYPE_9, NDR_POINTER_UNIQUE,
 815                         "unknown TYPE_9", -1, -1);
 816                 break;
 817         case 101:
 818                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 819                         dissect_browser_TYPE_10, NDR_POINTER_UNIQUE,
 820                         "unknown TYPE_10", -1, -1);
 821                 break;
 822         }
 823
 824         return offset;
 825 }
 826
 827
 828 /*
 829   IDL typedef struct {
 830   IDL   long element_51;
 831   IDL   TYPE_8 element_52;
 832   IDL } TYPE_7;
 833 */
 834 static int
 835 dissect_browser_TYPE_7(tvbuff_t *tvb, int offset,
 836                         packet_info *pinfo, proto_tree *tree,
 837                         char *drep)
 838 {
 839         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 840                 hf_browser_unknown_long, NULL);
 841
 842         offset = dissect_browser_TYPE_8(tvb, offset, pinfo, tree, drep);
 843
 844         return offset;
 845 }
 846
 847
 848 /*
 849   IDL long Function_08(
 850   IDL       [in] [unique] [string] wchar_t *element_75,
 851   IDL       [in] long element_76,
 852   IDL   [in,out] [ref] TYPE_7 *element_77
 853   IDL );
 854 */
 855 static int
 856 dissect_browser_UNKNOWN_08_rqst(tvbuff_t *tvb, int offset,
 857                         packet_info *pinfo, proto_tree *tree,
 858                         char *drep)
 859 {
 860         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 861                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 862                         "unknown string", hf_browser_unknown_string, 0);
 863
 864         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 865                 hf_browser_unknown_long, NULL);
 866
 867         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 868                         dissect_browser_TYPE_7, NDR_POINTER_REF,
 869                         "unknown TYPE_7", -1, 0);
 870
 871         return offset;
 872 }
 873 static int
 874 dissect_browser_UNKNOWN_08_reply(tvbuff_t *tvb, int offset,
 875                         packet_info *pinfo, proto_tree *tree,
 876                         char *drep)
 877 {
 878         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 879                         dissect_browser_TYPE_7, NDR_POINTER_REF,
 880                         "unknown TYPE_7", -1, 0);
 881
 882         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 883                 hf_browser_rc, NULL);
 884
 885         return offset;
 886 }
 887
 888
 889 /*
 890   IDL long Function_09(
 891   IDL       [in] [unique] [string] wchar_t *element_78,
 892   IDL       [in] [ref] [string] wchar_t *element_79,
 893   IDL       [in] [unique] [string] wchar_t *element_80,
 894   IDL       [in] long element_81
 895   IDL );
 896 */
 897 static int
 898 dissect_browser_UNKNOWN_09_rqst(tvbuff_t *tvb, int offset,
 899                         packet_info *pinfo, proto_tree *tree,
 900                         char *drep)
 901 {
 902         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 903                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 904                         "unknown string", hf_browser_unknown_string, 0);
 905
 906         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 907                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
 908                         "unknown string", hf_browser_unknown_string, 0);
 909
 910         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 911                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 912                         "unknown string", hf_browser_unknown_string, 0);
 913
 914         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 915                 hf_browser_unknown_long, NULL);
 916
 917         return offset;
 918 }
 919 static int
 920 dissect_browser_UNKNOWN_09_reply(tvbuff_t *tvb, int offset,
 921                         packet_info *pinfo, proto_tree *tree,
 922                         char *drep)
 923 {
 924         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 925                 hf_browser_rc, NULL);
 926
 927         return offset;
 928 }
 929
 930
 931
 932
 933 /*
 934   IDL typedef struct {
 935   IDL   long element_82;
 936   IDL   [size_is(element_82)] [unique] byte *element_83;
 937   IDL } TYPE_12;
 938 */
 939 static int
 940 dissect_browser_TYPE_12_data(tvbuff_t *tvb, int offset,
 941                         packet_info *pinfo, proto_tree *tree,
 942                         char *drep)
 943 {
 944         guint32 len;
 945         dcerpc_info *di;
 946
 947         di=pinfo->private_data;
 948         if(di->conformant_run){
 949                 /* this call is to make ethereal eat the array header for the conformant run */
 950                 offset =dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep, NULL);
 951
 952                 return offset;
 953         }
 954
 955         /* this is really the length of the encoded data */
 956         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 957                 hf_browser_unknown_long, &len);
 958
 959         proto_tree_add_item(tree, hf_browser_unknown_bytes, tvb, offset, len,
 960                 FALSE);
 961         offset += len;
 962
 963         return len;
 964 }
 965 static int
 966 dissect_browser_TYPE_12(tvbuff_t *tvb, int offset,
 967                         packet_info *pinfo, proto_tree *tree,
 968                         char *drep)
 969 {
 970         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 971                 hf_browser_unknown_long, NULL);
 972
 973         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 974                 dissect_browser_TYPE_12_data, NDR_POINTER_UNIQUE,
 975                 "unknown TYPE_12", -1, -1);
 976
 977         return offset;
 978 }
 979
 980
 981 /*
 982   IDL long Function_0a(
 983   IDL       [in] [unique] [string] wchar_t *element_84,
 984   IDL       [in,out] [ref] TYPE_12 *element_85
 985   );
 986 */
 987 static int
 988 dissect_browser_UNKNOWN_0a_rqst(tvbuff_t *tvb, int offset,
 989                         packet_info *pinfo, proto_tree *tree,
 990                         char *drep)
 991 {
 992         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 993                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
 994                         "unknown string", hf_browser_unknown_string, 0);
 995
 996         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 997                         dissect_browser_TYPE_12, NDR_POINTER_REF,
 998                         "unknown TYPE_12", -1, 0);
 999
1000         return offset;
1001 }
1002 static int
1003 dissect_browser_UNKNOWN_0a_reply(tvbuff_t *tvb, int offset,
1004                         packet_info *pinfo, proto_tree *tree,
1005                         char *drep)
1006 {
1007         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1008                         dissect_browser_TYPE_12, NDR_POINTER_REF,
1009                         "unknown TYPE_12", -1, 0);
1010
1011         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1012                 hf_browser_rc, NULL);
1013
1014         return offset;
1015 }
1016
1017
1018 /*
1019   IDL long Function_0b(
1020   IDL       [in] [unique] [string] wchar_t *element_86,
1021   IDL       [in] [unique] [string] wchar_t *element_87,
1022   IDL       [in] [unique] [string] wchar_t *element_88,
1023   IDL       [in,out] [ref] TYPE_1 *element_89,
1024   IDL       [in] long element_90,
1025   IDL       [out] long element_91,
1026   IDL       [in] long element_92,
1027   IDL       [in] [unique] [string] wchar_t *element_93,
1028   IDL       [in] [unique] [string] wchar_t *element_94
1029   IDL );
1030 */
1031 static int
1032 dissect_browser_UNKNOWN_0b_rqst(tvbuff_t *tvb, int offset,
1033                         packet_info *pinfo, proto_tree *tree,
1034                         char *drep)
1035 {
1036         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1037                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1038                         "unknown string", hf_browser_unknown_string, 0);
1039
1040         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1041                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1042                         "unknown string", hf_browser_unknown_string, 0);
1043
1044         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1045                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1046                         "unknown string", hf_browser_unknown_string, 0);
1047
1048         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1049                         dissect_browser_TYPE_1, NDR_POINTER_REF,
1050                         "unknown TYPE_1", -1, 0);
1051
1052         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1053                 hf_browser_unknown_long, NULL);
1054
1055         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1056                 hf_browser_unknown_long, NULL);
1057
1058         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1059                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1060                         "unknown string", hf_browser_unknown_string, 0);
1061
1062         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1063                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
1064                         "unknown string", hf_browser_unknown_string, 0);
1065
1066         return offset;
1067 }
1068 static int
1069 dissect_browser_UNKNOWN_0b_reply(tvbuff_t *tvb, int offset,
1070                         packet_info *pinfo, proto_tree *tree,
1071                         char *drep)
1072 {
1073         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1074                         dissect_browser_TYPE_1, NDR_POINTER_REF,
1075                         "unknown TYPE_1", -1, 0);
1076
1077         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1078                 hf_browser_unknown_long, NULL);
1079
1080         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1081                 hf_browser_rc, NULL);
1082
1083         return offset;
1084 }
1085
1086
1087
1088 /*
1089   IDL }
1090 */
1091 static dcerpc_sub_dissector dcerpc_browser_dissectors[] = {
1092         { BROWSER_UNKNOWN_00, "BROWSER_UNKNOWN_00",
1093                 dissect_browser_UNKNOWN_00_rqst,
1094                 dissect_browser_UNKNOWN_00_reply },
1095         { BROWSER_UNKNOWN_01, "BROWSER_UNKNOWN_01",
1096                 dissect_browser_UNKNOWN_01_rqst,
1097                 dissect_browser_UNKNOWN_01_reply },
1098         { BROWSER_UNKNOWN_02, "BROWSER_UNKNOWN_02",
1099                 dissect_browser_UNKNOWN_02_rqst,
1100                 dissect_browser_UNKNOWN_02_reply },
1101         { BROWSER_UNKNOWN_03, "BROWSER_UNKNOWN_03",
1102                 dissect_browser_UNKNOWN_03_rqst,
1103                 dissect_browser_UNKNOWN_03_reply },
1104         { BROWSER_UNKNOWN_04, "BROWSER_UNKNOWN_04",
1105                 dissect_browser_UNKNOWN_04_rqst,
1106                 dissect_browser_UNKNOWN_04_reply },
1107         { BROWSER_UNKNOWN_05, "BROWSER_UNKNOWN_05",
1108                 dissect_browser_UNKNOWN_05_rqst,
1109                 dissect_browser_UNKNOWN_05_reply },
1110         { BROWSER_UNKNOWN_06, "BROWSER_UNKNOWN_06",
1111                 dissect_browser_UNKNOWN_06_rqst,
1112                 dissect_browser_UNKNOWN_06_reply },
1113         { BROWSER_UNKNOWN_07, "BROWSER_UNKNOWN_07",
1114                 dissect_browser_UNKNOWN_07_rqst,
1115                 dissect_browser_UNKNOWN_07_reply },
1116         { BROWSER_UNKNOWN_08, "BROWSER_UNKNOWN_08",
1117                 dissect_browser_UNKNOWN_08_rqst,
1118                 dissect_browser_UNKNOWN_08_reply },
1119         { BROWSER_UNKNOWN_09, "BROWSER_UNKNOWN_09",
1120                 dissect_browser_UNKNOWN_09_rqst,
1121                 dissect_browser_UNKNOWN_09_reply },
1122         { BROWSER_UNKNOWN_0a, "BROWSER_UNKNOWN_0a",
1123                 dissect_browser_UNKNOWN_0a_rqst,
1124                 dissect_browser_UNKNOWN_0a_reply },
1125         { BROWSER_UNKNOWN_0b, "BROWSER_UNKNOWN_0b",
1126                 dissect_browser_UNKNOWN_0b_rqst,
1127                 dissect_browser_UNKNOWN_0b_reply },
1128
1129         {0, NULL, NULL,  NULL }
1130 };
1131
1132 void
1133 proto_register_dcerpc_browser(void)
1134 {
1135 static hf_register_info hf[] = {
1136         { &hf_browser_rc, {
1137                 "Return code", "rpc_browser.rc", FT_UINT32, BASE_HEX,
1138                 VALS(NT_errors), 0x0, "Browser return code", HFILL }},
1139
1140         { &hf_browser_unknown_long, {
1141                 "Unknown long", "rpc_browser.unknown.long", FT_UINT32, BASE_HEX,
1142                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
1143
1144         { &hf_browser_unknown_hyper, {
1145                 "Unknown hyper", "rpc_browser.unknown.hyper", FT_UINT64, BASE_HEX,
1146                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
1147
1148         { &hf_browser_unknown_bytes, {
1149                 "Unknown bytes", "rpc_browser.unknown.bytes", FT_BYTES, BASE_HEX,
1150                 NULL, 0x0, "Unknown bytes. If you know what this is, contact ethereal developers.", HFILL }},
1151
1152         { &hf_browser_unknown_string, {
1153                 "Unknown string", "rpc_browser.unknown.string", FT_STRING, BASE_HEX,
1154                 NULL, 0x0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }}
1155
1156         };
1157         static gint *ett[] = {
1158                 &ett_dcerpc_browser
1159         };
1160
1161         proto_dcerpc_browser = proto_register_protocol(
1162                 "RPC Browser", "RPC_BROWSER", "rpc_browser");
1163
1164         proto_register_field_array(proto_dcerpc_browser, hf,
1165                                    array_length(hf));
1166         proto_register_subtree_array(ett, array_length(ett));
1167 }
1168
1169 void
1170 proto_reg_handoff_dcerpc_browser(void)
1171 {
1172         /* Register protocol as dcerpc */
1173
1174         dcerpc_init_uuid(proto_dcerpc_browser, ett_dcerpc_browser,
1175                          &uuid_dcerpc_browser, ver_dcerpc_browser,
1176                          dcerpc_browser_dissectors);
1177 }