epan/dissectors/packet-dcom-sysact.c

   1 /* packet-dcerpc-sysact.c
   2  * Routines for the ISystemActivator interface
   3  * Copyright 2004, Jelmer Vernooij <jelmer@samba.org>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <string.h>
  31
  32 #include <glib.h>
  33 #include <epan/packet.h>
  34 #include "packet-dcerpc.h"
  35 #include "packet-dcom.h"
  36
  37
  38 static int proto_ISystemActivator = -1;
  39
  40 static int hf_opnum = -1;
  41 static int hf_sysact_unknown = -1;
  42
  43 static gint ett_ISystemActivator = -1;
  44
  45 static e_uuid_t uuid_ISystemActivator = { 0x000001a0, 0x0000, 0x0000, { 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 } };
  46 static guint16  ver_ISystemActivator = 0;
  47
  48
  49 static int
  50 dissect_remsysact_remotecreateinstance_rqst(tvbuff_t *tvb, int offset,
  51         packet_info *pinfo, proto_tree *tree, guint8 *drep)
  52 {
  53
  54     offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep);
  55
  56     /* XXX - what is this? */
  57     offset = dissect_dcom_nospec_data(tvb, offset, pinfo, tree, drep,
  58         4);
  59
  60         offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, drep,
  61                                                 hf_sysact_unknown, NULL /* XXX */);
  62
  63         return offset;
  64 }
  65
  66
  67 static int
  68 dissect_remsysact_remotecreateinstance_resp(tvbuff_t *tvb, int offset,
  69         packet_info *pinfo, proto_tree *tree, guint8 *drep)
  70 {
  71
  72     offset = dissect_dcom_that(tvb, offset, pinfo, tree, drep);
  73
  74         offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, drep,
  75                                                 hf_sysact_unknown, NULL /* XXX */);
  76
  77     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep,
  78                                          NULL /* pu32HResult */);
  79
  80         return offset;
  81 }
  82
  83
  84
  85
  86 static dcerpc_sub_dissector ISystemActivator_dissectors[] = {
  87     { 0, "QueryInterfaceIRemoteSCMActivator", NULL, NULL },
  88     { 1, "AddRefIRemoteISCMActivator", NULL, NULL },
  89     { 2, "ReleaseIRemoteISCMActivator", NULL, NULL },
  90     { 3, "RemoteGetClassObject", NULL, NULL },
  91     { 4, "RemoteCreateInstance", dissect_remsysact_remotecreateinstance_rqst, dissect_remsysact_remotecreateinstance_resp },
  92     { 0, NULL, NULL, NULL },
  93 };
  94
  95 void
  96 proto_register_ISystemActivator (void)
  97 {
  98         static hf_register_info hf[] = {
  99                 { &hf_opnum,
 100                   { "Operation", "isystemactivator.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "", HFILL }},
 101                 { &hf_sysact_unknown,
 102                 { "IUnknown", "isystemactivator.unknown", FT_NONE, BASE_HEX, NULL, 0x0, "", HFILL }},
 103         };
 104         static gint *ett[] = {
 105                 &ett_ISystemActivator
 106         };
 107         proto_ISystemActivator = proto_register_protocol ("ISystemActivator ISystemActivator Resolver", "ISystemActivator", "isystemactivator");
 108         proto_register_field_array (proto_ISystemActivator, hf, array_length (hf));
 109         proto_register_subtree_array (ett, array_length (ett));
 110 }
 111
 112 void
 113 proto_reg_handoff_ISystemActivator (void)
 114 {
 115         /* Register the protocol as dcerpc */
 116         dcerpc_init_uuid (proto_ISystemActivator, ett_ISystemActivator, &uuid_ISystemActivator, ver_ISystemActivator, ISystemActivator_dissectors, hf_opnum);
 117 }