packet-dcerpc-reg.c

   1 /* packet-dcerpc-reg.c
   2  * Routines for SMB \PIPE\winreg packet disassembly
   3  * Copyright 2001, 2002 Tim Potter <tpot@samba.org>
   4  *
   5  * $Id: packet-dcerpc-reg.c,v 1.9 2002/07/05 20:41:01 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <glib.h>
  31 #include <epan/packet.h>
  32 #include "packet-dcerpc.h"
  33 #include "packet-dcerpc-nt.h"
  34 #include "packet-dcerpc-reg.h"
  35 #include "smb.h"
  36
  37 /* Global hf index fields */
  38
  39 static int hf_rc = -1;
  40 static int hf_hnd = -1;
  41 static int hf_access_mask = -1;
  42
  43 /* OpenHKLM */
  44
  45 static int hf_openhklm_unknown1 = -1;
  46 static int hf_openhklm_unknown2 = -1;
  47
  48 /* QueryKey */
  49
  50 static int hf_querykey_class = -1;
  51 static int hf_querykey_num_subkeys = -1;
  52 static int hf_querykey_max_subkey_len = -1;
  53 static int hf_querykey_reserved = -1;
  54 static int hf_querykey_num_values = -1;
  55 static int hf_querykey_max_valname_len = -1;
  56 static int hf_querykey_max_valbuf_size = -1;
  57 static int hf_querykey_secdesc = -1;
  58 static int hf_querykey_modtime = -1;
  59
  60 /* Data that is passed to a open call */
  61
  62 static int
  63 dissect_open_data(tvbuff_t *tvb, int offset, packet_info *pinfo,
  64                   proto_tree *tree, char *drep)
  65 {
  66         offset = dissect_ndr_uint16(
  67                 tvb, offset, pinfo, tree, drep,
  68                 hf_openhklm_unknown1, NULL);
  69
  70         offset = dissect_ndr_uint16(
  71                 tvb, offset, pinfo, tree, drep,
  72                 hf_openhklm_unknown1, NULL);
  73
  74         offset = dissect_ndr_uint32(
  75                 tvb, offset, pinfo, tree, drep,
  76                 hf_access_mask, NULL);
  77
  78         return offset;
  79 }
  80
  81 /*
  82  * OpenHKLM
  83  */
  84
  85 static int
  86 RegOpenHKLM_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
  87               proto_tree *tree, char *drep)
  88 {
  89         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
  90         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
  91
  92         if (dcv->rep_frame != 0)
  93                 proto_tree_add_text(tree, tvb, offset, 0,
  94                                     "Reply in frame %u", dcv->rep_frame);
  95
  96         /* Parse packet */
  97
  98         offset = dissect_ndr_pointer(
  99                 tvb, offset, pinfo, tree, drep,
 100                 dissect_open_data,
 101                 NDR_POINTER_UNIQUE, "Unknown", -1, 0);
 102
 103         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 104
 105         return offset;
 106 }
 107
 108 static int
 109 RegOpenHKLM_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
 110               proto_tree *tree, char *drep)
 111 {
 112         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 113         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 114         e_ctx_hnd policy_hnd;
 115
 116         if (dcv->req_frame != 0)
 117                 proto_tree_add_text(tree, tvb, offset, 0,
 118                                     "Request in frame %u", dcv->req_frame);
 119
 120         /* Parse packet */
 121
 122         offset = dissect_nt_policy_hnd(
 123                 tvb, offset, pinfo, tree, drep,
 124                 hf_hnd, &policy_hnd, TRUE, FALSE);
 125
 126         dcerpc_smb_store_pol_name(&policy_hnd, "HKLM handle");
 127
 128         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 129                                   hf_rc, NULL);
 130
 131         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 132
 133         return offset;
 134 }
 135
 136 /*
 137  * OpenHKU
 138  */
 139
 140 static int
 141 RegOpenHKU_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
 142              proto_tree *tree, char *drep)
 143 {
 144         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 145         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 146
 147         if (dcv->rep_frame != 0)
 148                 proto_tree_add_text(tree, tvb, offset, 0,
 149                                     "Reply in frame %u", dcv->rep_frame);
 150
 151         /* Parse packet */
 152
 153         offset = dissect_ndr_pointer(
 154                 tvb, offset, pinfo, tree, drep,
 155                 dissect_open_data,
 156                 NDR_POINTER_UNIQUE, "Unknown", -1, 0);
 157
 158         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 159
 160         return offset;
 161 }
 162
 163 static int
 164 RegOpenHKU_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
 165              proto_tree *tree, char *drep)
 166 {
 167         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 168         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 169         e_ctx_hnd policy_hnd;
 170
 171         if (dcv->req_frame != 0)
 172                 proto_tree_add_text(tree, tvb, offset, 0,
 173                                     "Request in frame %u", dcv->req_frame);
 174
 175         /* Parse packet */
 176
 177         offset = dissect_nt_policy_hnd(
 178                 tvb, offset, pinfo, tree, drep,
 179                 hf_hnd, &policy_hnd, TRUE, FALSE);
 180
 181         dcerpc_smb_store_pol_name(&policy_hnd, "HKU handle");
 182
 183         offset = dissect_ntstatus(
 184                 tvb, offset, pinfo, tree, drep, hf_rc, NULL);
 185
 186         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 187
 188         return offset;
 189 }
 190
 191 /*
 192  * OpenHKCR
 193  */
 194
 195 static int
 196 RegOpenHKCR_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
 197               proto_tree *tree, char *drep)
 198 {
 199         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 200         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 201
 202         if (dcv->rep_frame != 0)
 203                 proto_tree_add_text(tree, tvb, offset, 0,
 204                                     "Reply in frame %u", dcv->rep_frame);
 205
 206         /* Parse packet */
 207
 208         offset = dissect_ndr_pointer(
 209                 tvb, offset, pinfo, tree, drep,
 210                 dissect_open_data,
 211                 NDR_POINTER_UNIQUE, "Unknown", -1, 0);
 212
 213         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 214
 215         return offset;
 216 }
 217
 218 static int
 219 RegOpenHKCR_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
 220               proto_tree *tree, char *drep)
 221 {
 222         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 223         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 224         e_ctx_hnd policy_hnd;
 225
 226         if (dcv->req_frame != 0)
 227                 proto_tree_add_text(tree, tvb, offset, 0,
 228                                     "Request in frame %u", dcv->req_frame);
 229
 230         /* Parse packet */
 231
 232         offset = dissect_nt_policy_hnd(
 233                 tvb, offset, pinfo, tree, drep,
 234                 hf_hnd, &policy_hnd, TRUE, FALSE);
 235
 236         dcerpc_smb_store_pol_name(&policy_hnd, "HKCR handle");
 237
 238         offset = dissect_ntstatus(
 239                 tvb, offset, pinfo, tree, drep, hf_rc, NULL);
 240
 241         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 242
 243         return offset;
 244 }
 245
 246 /*
 247  * RegClose
 248  */
 249
 250 static int
 251 RegClose_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
 252            proto_tree *tree, char *drep)
 253 {
 254         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 255         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 256
 257         if (dcv->rep_frame != 0)
 258                 proto_tree_add_text(tree, tvb, offset, 0,
 259                                     "Reply in frame %u", dcv->rep_frame);
 260
 261         /* Parse packet */
 262
 263         offset = dissect_nt_policy_hnd(
 264                 tvb, offset, pinfo, tree, drep,
 265                 hf_hnd, NULL, FALSE, TRUE);
 266
 267         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 268
 269         return offset;
 270 }
 271
 272 static int
 273 RegClose_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
 274            proto_tree *tree, char *drep)
 275 {
 276         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 277         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 278
 279         if (dcv->req_frame != 0)
 280                 proto_tree_add_text(tree, tvb, offset, 0,
 281                                     "Request in frame %u", dcv->req_frame);
 282
 283         /* Parse packet */
 284
 285         offset = dissect_nt_policy_hnd(
 286                 tvb, offset, pinfo, tree, drep,
 287                 hf_hnd, NULL, FALSE, FALSE);
 288
 289         offset = dissect_ntstatus(
 290                 tvb, offset, pinfo, tree, drep, hf_rc, NULL);
 291
 292         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 293
 294         return offset;
 295 }
 296
 297 /*
 298  * RegQueryKey
 299  */
 300
 301 static int
 302 RegQueryKey_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
 303               proto_tree *tree, char *drep)
 304 {
 305         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 306         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 307
 308         if (dcv->rep_frame != 0)
 309                 proto_tree_add_text(tree, tvb, offset, 0,
 310                                     "Reply in frame %u", dcv->rep_frame);
 311
 312         /* Parse packet */
 313
 314         offset = dissect_nt_policy_hnd(
 315                 tvb, offset, pinfo, tree, drep,
 316                 hf_hnd, NULL, FALSE, FALSE);
 317
 318         offset = dissect_ndr_nt_UNICODE_STRING(
 319                 tvb, offset, pinfo, tree, drep, hf_querykey_class, 0);
 320
 321         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 322
 323         return offset;
 324 }
 325
 326 static int
 327 RegQueryKey_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
 328               proto_tree *tree, char *drep)
 329 {
 330         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 331         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 332
 333         if (dcv->req_frame != 0)
 334                 proto_tree_add_text(tree, tvb, offset, 0,
 335                                     "Request in frame %u", dcv->req_frame);
 336
 337         /* Parse packet */
 338
 339         offset = dissect_ndr_nt_UNICODE_STRING(
 340                 tvb, offset, pinfo, tree, drep, hf_querykey_class, 0);
 341
 342         offset = dissect_ndr_uint32(
 343                 tvb, offset, pinfo, tree, drep,
 344                 hf_querykey_num_subkeys, NULL);
 345
 346         offset = dissect_ndr_uint32(
 347                 tvb, offset, pinfo, tree, drep,
 348                 hf_querykey_max_subkey_len, NULL);
 349
 350         offset = dissect_ndr_uint32(
 351                 tvb, offset, pinfo, tree, drep,
 352                 hf_querykey_reserved, NULL);
 353
 354         offset = dissect_ndr_uint32(
 355                 tvb, offset, pinfo, tree, drep,
 356                 hf_querykey_num_values, NULL);
 357
 358         offset = dissect_ndr_uint32(
 359                 tvb, offset, pinfo, tree, drep,
 360                 hf_querykey_max_valname_len, NULL);
 361
 362         offset = dissect_ndr_uint32(
 363                 tvb, offset, pinfo, tree, drep,
 364                 hf_querykey_max_valbuf_size, NULL);
 365
 366         offset = dissect_ndr_uint32(
 367                 tvb, offset, pinfo, tree, drep,
 368                 hf_querykey_secdesc, NULL);
 369
 370         offset = dissect_ndr_nt_NTTIME(
 371                 tvb, offset, pinfo, tree, drep, hf_querykey_modtime);
 372
 373         offset = dissect_ntstatus(
 374                 tvb, offset, pinfo, tree, drep, hf_rc, NULL);
 375
 376         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 377
 378         return offset;
 379 }
 380
 381 #if 0
 382
 383 /* Templates for new subdissectors */
 384
 385 /*
 386  * FOO
 387  */
 388
 389 static int
 390 RegFoo_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
 391          proto_tree *tree, char *drep)
 392 {
 393         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 394         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 395
 396         if (dcv->rep_frame != 0)
 397                 proto_tree_add_text(tree, tvb, offset, 0,
 398                                     "Reply in frame %u", dcv->rep_frame);
 399
 400         /* Parse packet */
 401
 402         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 403
 404         return offset;
 405 }
 406
 407 static int
 408 RegFoo_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
 409          proto_tree *tree, char *drep)
 410 {
 411         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 412         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 413
 414         if (dcv->req_frame != 0)
 415                 proto_tree_add_text(tree, tvb, offset, 0,
 416                                     "Request in frame %u", dcv->req_frame);
 417
 418         /* Parse packet */
 419
 420         offset = dissect_ntstatus(
 421                 tvb, offset, pinfo, tree, drep, hf_rc, NULL);
 422
 423         dcerpc_smb_check_long_frame(tvb, offset, pinfo, tree);
 424
 425         return offset;
 426 }
 427
 428 #endif
 429
 430 /* Registry data types */
 431
 432 const value_string reg_datatypes[] = {
 433         { REG_NONE, "REG_NONE" },
 434         { REG_SZ, "REG_SZ" },
 435         { REG_EXPAND_SZ, "REG_EXPAND_SZ" },
 436         { REG_BINARY, "REG_BINARY" },
 437         { REG_DWORD, "REG_DWORD" },
 438         { REG_DWORD_LE, "REG_DWORD_LE" },
 439         { REG_DWORD_BE, "REG_DWORD_BE" },
 440         { REG_LINK, "REG_LINK" },
 441         { REG_MULTI_SZ, "REG_MULTI_SZ" },
 442         { REG_RESOURCE_LIST, "REG_RESOURCE_LIST" },
 443         { REG_FULL_RESOURCE_DESCRIPTOR, "REG_FULL_RESOURCE_DESCRIPTOR" },
 444         { REG_RESOURCE_REQUIREMENTS_LIST, "REG_RESOURCE_REQUIREMENTS_LIST" },
 445         {0, NULL }
 446 };
 447
 448 static int proto_dcerpc_reg = -1;
 449 static int hf_reg_opnum = -1;
 450 static gint ett_dcerpc_reg = -1;
 451
 452 static e_uuid_t uuid_dcerpc_reg = {
 453         0x338cd001, 0x2244, 0x31f1,
 454         { 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03 }
 455 };
 456
 457 static guint16 ver_dcerpc_reg = 1;
 458
 459 static dcerpc_sub_dissector dcerpc_reg_dissectors[] = {
 460         { REG_OPEN_HKCR, "OpenHKCR", RegOpenHKCR_q, RegOpenHKCR_r },
 461         { _REG_UNK_01, "Unknown01", NULL, NULL },
 462         { REG_OPEN_HKLM, "OpenHKLM", RegOpenHKLM_q, RegOpenHKLM_r },
 463         { _REG_UNK_03, "Unknown03", NULL, NULL },
 464         { REG_OPEN_HKU, "OpenHKU", RegOpenHKU_q, RegOpenHKU_r },
 465         { REG_CLOSE, "Close", RegClose_q, RegClose_r },
 466         { REG_CREATE_KEY, "CreateKey", NULL, NULL },
 467         { REG_DELETE_KEY, "DeleteKey", NULL, NULL },
 468         { REG_DELETE_VALUE, "DeleteValue", NULL, NULL },
 469         { REG_ENUM_KEY, "EnumKey", NULL, NULL },
 470         { REG_ENUM_VALUE, "EnumValue", NULL, NULL },
 471         { REG_FLUSH_KEY, "FlushKey", NULL, NULL },
 472         { REG_GET_KEY_SEC, "GetKeySecurity", NULL, NULL },
 473         { _REG_UNK_0D, "Unknown0d", NULL, NULL },
 474         { _REG_UNK_0E, "Unknown0e", NULL, NULL },
 475         { REG_OPEN_ENTRY, "OpenEntry", NULL, NULL },
 476         { REG_QUERY_KEY, "QueryKey", RegQueryKey_q, RegQueryKey_r },
 477         { REG_INFO, "Info", NULL, NULL },
 478         { _REG_UNK_12, "Unknown12", NULL, NULL },
 479         { _REG_UNK_13, "Unknown13", NULL, NULL },
 480         { _REG_UNK_14, "Unknown14", NULL, NULL },
 481         { REG_SET_KEY_SEC, "SetKeySecurity", NULL, NULL },
 482         { REG_CREATE_VALUE, "CreateValue", NULL, NULL },
 483         { _REG_UNK_17, "Unknown17", NULL, NULL },
 484         { REG_SHUTDOWN, "Shutdown", NULL, NULL },
 485         { REG_ABORT_SHUTDOWN, "AbortShutdown", NULL, NULL },
 486         { REG_UNK_1A, "Unknown1A", NULL, NULL },
 487
 488         { 0, NULL, NULL,  NULL }
 489 };
 490
 491 static const value_string reg_opnum_vals[] = {
 492         { REG_OPEN_HKCR, "OpenHKCR" },
 493         { _REG_UNK_01, "Unknown01" },
 494         { REG_OPEN_HKLM, "OpenHKLM" },
 495         { _REG_UNK_03, "Unknown03" },
 496         { REG_OPEN_HKU, "OpenHKU" },
 497         { REG_CLOSE, "Close" },
 498         { REG_CREATE_KEY, "CreateKey" },
 499         { REG_DELETE_KEY, "DeleteKey" },
 500         { REG_DELETE_VALUE, "DeleteValue" },
 501         { REG_ENUM_KEY, "EnumKey" },
 502         { REG_ENUM_VALUE, "EnumValue" },
 503         { REG_FLUSH_KEY, "FlushKey" },
 504         { REG_GET_KEY_SEC, "GetKeySecurity" },
 505         { _REG_UNK_0D, "Unknown0d" },
 506         { _REG_UNK_0E, "Unknown0e" },
 507         { REG_OPEN_ENTRY, "OpenEntry" },
 508         { REG_QUERY_KEY, "QueryKey" },
 509         { REG_INFO, "Info" },
 510         { _REG_UNK_12, "Unknown12" },
 511         { _REG_UNK_13, "Unknown13" },
 512         { _REG_UNK_14, "Unknown14" },
 513         { REG_SET_KEY_SEC, "SetKeySecurity" },
 514         { REG_CREATE_VALUE, "CreateValue" },
 515         { _REG_UNK_17, "Unknown17" },
 516         { REG_SHUTDOWN, "Shutdown" },
 517         { REG_ABORT_SHUTDOWN, "AbortShutdown" },
 518         { REG_UNK_1A, "Unknown1A" },
 519         { 0, NULL }
 520 };
 521
 522 void
 523 proto_register_dcerpc_reg(void)
 524 {
 525         static hf_register_info hf[] = {
 526
 527                 /* Global indexes */
 528
 529                 { &hf_hnd,
 530                   { "Context handle", "reg.hnd", FT_BYTES, BASE_NONE,
 531                     NULL, 0x0, "REG policy handle", HFILL }},
 532
 533                 { &hf_rc,
 534                   { "Return code", "reg.rc", FT_UINT32, BASE_HEX,
 535                     VALS(NT_errors), 0x0, "REG return code", HFILL }},
 536
 537                 { &hf_reg_opnum,
 538                   { "Operation", "reg.opnum", FT_UINT16, BASE_DEC,
 539                     VALS(reg_opnum_vals), 0x0, "Operation", HFILL }},
 540
 541                 { &hf_access_mask,
 542                   { "Access mask", "reg.access_mask", FT_UINT32, BASE_HEX,
 543                     NULL, 0x0, "Access mask", HFILL }},
 544
 545                 /* OpenHKLM */
 546
 547                 { &hf_openhklm_unknown1,
 548                   { "Unknown 1", "reg.openhklm.unknown1", FT_UINT16, BASE_DEC,
 549                     NULL, 0x0, "Unknown 1", HFILL }},
 550
 551                 { &hf_openhklm_unknown2,
 552                   { "Unknown 2", "reg.openhklm.unknown2", FT_UINT16, BASE_DEC,
 553                     NULL, 0x0, "Unknown 2", HFILL }},
 554
 555                 /* QueryClass */
 556
 557                 { &hf_querykey_class,
 558                   { "Class", "reg.querykey.class", FT_STRING, BASE_NONE,
 559                     NULL, 0, "Class", HFILL }},
 560
 561                 { &hf_querykey_num_subkeys,
 562                   { "Num subkeys", "reg.querykey.num_subkeys", FT_UINT32, BASE_DEC,
 563                     NULL, 0x0, "Num subkeys", HFILL }},
 564
 565                 { &hf_querykey_max_subkey_len,
 566                   { "Max subkey len", "reg.querykey.max_subkey_len", FT_UINT32, BASE_DEC,
 567                     NULL, 0x0, "Max subkey len", HFILL }},
 568
 569                 { &hf_querykey_reserved,
 570                   { "Reserved", "reg.querykey.reserved", FT_UINT32, BASE_DEC,
 571                     NULL, 0x0, "Reserved", HFILL }},
 572
 573                 { &hf_querykey_num_values,
 574                   { "Num values", "reg.querykey.num_values", FT_UINT32, BASE_DEC,
 575                     NULL, 0x0, "Num values", HFILL }},
 576
 577                 { &hf_querykey_max_valname_len,
 578                   { "Max valnum len", "reg.querykey.max_valname_len", FT_UINT32, BASE_DEC,
 579                     NULL, 0x0, "Max valname len", HFILL }},
 580
 581                 { &hf_querykey_max_valbuf_size,
 582                   { "Max valbuf size", "reg.querykey.max_valbuf_size", FT_UINT32, BASE_DEC,
 583                     NULL, 0x0, "Max valbuf size", HFILL }},
 584
 585                 { &hf_querykey_secdesc,
 586                   { "Secdesc", "reg.querykey.secdesc", FT_UINT32, BASE_DEC,
 587                     NULL, 0x0, "Secdesc", HFILL }},
 588
 589                 { &hf_querykey_modtime,
 590                   { "Mod time", "reg.querykey.modtime", FT_ABSOLUTE_TIME, BASE_NONE,
 591                     NULL, 0x0, "Secdesc", HFILL }},
 592
 593         };
 594
 595         static gint *ett[] = {
 596                 &ett_dcerpc_reg
 597         };
 598
 599         proto_dcerpc_reg = proto_register_protocol(
 600                 "Microsoft Registry", "REG", "reg");
 601
 602         proto_register_field_array(proto_dcerpc_reg, hf, array_length(hf));
 603
 604         proto_register_subtree_array(ett, array_length(ett));
 605 }
 606
 607 void
 608 proto_reg_handoff_dcerpc_reg(void)
 609 {
 610         /* Register protocol as dcerpc */
 611
 612         dcerpc_init_uuid(proto_dcerpc_reg, ett_dcerpc_reg, &uuid_dcerpc_reg,
 613                          ver_dcerpc_reg, dcerpc_reg_dissectors, hf_reg_opnum);
 614 }