#define SAMR_CLOSE_HND 0x01
#define SAMR_OPEN_DOMAIN 0x07
-#define SAMR_UNKNOWN_8 0x08
+#define SAMR_QUERY_DOMAIN_INFO 0x08
#define SAMR_LOOKUP_IDS 0x10
#define SAMR_LOOKUP_NAMES 0x11
#define SAMR_UNKNOWN_3 0x03
/****************************************************************************
-SAMR_Q_UNKNOWN_8 - probably a query on domain group info.
+SAMR_Q_QUERY_DOMAIN_INFO - probably a query on domain group info.
*****************************************************************************/
-/* SAMR_Q_UNKNOWN_8 - */
-typedef struct q_samr_unknown_8_info
+/* SAMR_Q_QUERY_DOMAIN_INFO - */
+typedef struct q_samr_query_domain_info
{
POLICY_HND domain_pol; /* policy handle */
uint16 switch_value; /* 0x0002 */
-} SAMR_Q_UNKNOWN_8;
+} SAMR_Q_QUERY_DOMAIN_INFO;
typedef struct sam_unkown_info_2_info
{
pointer is referring to
*/
- uint32 unknown_4; /* 0x0000 0099 or 0x1000 0000 */
- uint32 unknown_5; /* 0x0000 0000 */
+ uint32 seq_num; /* some sort of incrementing sequence number? */
+ uint32 unknown_3; /* 0x0000 0000 */
- uint32 unknown_6 ; /* 0x0000 0001 */
- uint32 unknown_7 ; /* 0x0000 0003 */
- uint32 unknown_8 ; /* 0x0000 0001 */
- uint32 unknown_9 ; /* 0x0000 0008 */
- uint32 unknown_10; /* 0x0000 0003 */
+ uint32 unknown_4; /* 0x0000 0001 */
+ uint32 unknown_5; /* 0x0000 0003 */
+ uint32 unknown_6; /* 0x0000 0001 */
+ uint32 num_domain_usrs; /* number of users in domain */
+ uint32 num_domain_grps; /* number of domain groups in domain */
+ uint32 num_local_grps; /* number of local groups in domain */
- uint8 padding[16]; /* 16 bytes zeros */
+ uint8 padding[12]; /* 12 bytes zeros */
UNISTR2 uni_domain; /* domain name unicode string */
UNISTR2 uni_server; /* server name unicode string */
} SAM_UNK_CTR;
-/* SAMR_R_UNKNOWN_8 - */
-typedef struct r_samr_unknown_8_info
+/* SAMR_R_QUERY_DOMAIN_INFO - */
+typedef struct r_samr_query_domain_info
{
uint32 ptr_0;
uint16 switch_value; /* same as in query */
uint32 status; /* return status */
-} SAMR_R_UNKNOWN_8;
+} SAMR_R_QUERY_DOMAIN_INFO;
/****************************************************************************
} SAMR_R_LOOKUP_IDS;
-
/****************************************************************************
-SAMR_Q_LOOKUP_NAMES - do a conversion from SID to RID.
-
-the policy handle allocated by an "samr open secret" call is associated
-with a SID. this policy handle is what is queried here, *not* the SID
-itself. the response to the lookup rids is relative to this SID.
+SAMR_Q_LOOKUP_NAMES - do a conversion from Names to RIDs+types.
*****************************************************************************/
/* SAMR_Q_LOOKUP_NAMES */
typedef struct q_samr_lookup_names_info
{
- POLICY_HND pol; /* policy handle */
+ POLICY_HND pol; /* policy handle */
- uint32 num_rids1; /* number of rids being looked up */
- uint32 rid; /* 0x0000 03e8 - RID of the server doing the query? */
+ uint32 num_names1; /* number of names being looked up */
+ uint32 flags; /* 0x0000 03e8 - unknown */
uint32 ptr; /* 0x0000 0000 - 32 bit unknown */
- uint32 num_rids2; /* number of rids being looked up */
+ uint32 num_names2; /* number of names being looked up */
- UNIHDR hdr_user_name[MAX_LOOKUP_SIDS]; /* unicode account name header */
- UNISTR2 uni_user_name[MAX_LOOKUP_SIDS]; /* unicode account name string */
+ UNIHDR hdr_name[MAX_LOOKUP_SIDS]; /* unicode account name header */
+ UNISTR2 uni_name[MAX_LOOKUP_SIDS]; /* unicode account name string */
} SAMR_Q_LOOKUP_NAMES;
-
/* SAMR_R_LOOKUP_NAMES */
typedef struct r_samr_lookup_names_info
{
- uint32 num_entries;
- uint32 undoc_buffer; /* undocumented buffer pointer */
+ uint32 num_rids1; /* number of aliases being looked up */
+ uint32 ptr_rids; /* pointer to aliases */
+ uint32 num_rids2; /* number of aliases being looked up */
- uint32 num_entries2;
- DOM_RID3 dom_rid[MAX_LOOKUP_SIDS]; /* domain RIDs being looked up */
+ uint32 rid[MAX_LOOKUP_SIDS]; /* rids */
+
+ uint32 num_types1; /* number of users in aliases being looked up */
+ uint32 ptr_types; /* pointer to users in aliases */
+ uint32 num_types2; /* number of users in aliases being looked up */
- uint32 num_entries3;
+ uint32 type[MAX_LOOKUP_SIDS]; /* SID_ENUM type */
uint32 status; /* return code */
} SAMR_R_LOOKUP_NAMES;
-
/****************************************************************************
SAMR_Q_UNKNOWN_12 - do a conversion from RID groups to something.
} SAMR_R_UNKNOWN_32;
-
/* SAMR_Q_OPEN_ALIAS - probably an open */
typedef struct q_samr_open_alias_info
{
uint16 unk_1;
uint16 unk_2;
uint16 unk_3;
+ uint32 status; /* return status */
} SAMR_R_UNKNOWN_38;