2 * Routines for SMB \\PIPE\\winreg packet disassembly
3 * Copyright 2001, Tim Potter <tpot@samba.org>
5 * $Id: packet-dcerpc-reg.c,v 1.6 2002/06/24 00:03:17 tpot Exp $
7 * Ethereal - Network traffic analyzer
8 * By Gerald Combs <gerald@ethereal.com>
9 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
31 #include <epan/packet.h>
32 #include "packet-dcerpc.h"
33 #include "packet-dcerpc-reg.h"
35 /* Registry data types */
37 const value_string reg_datatypes[] = {
38 { REG_NONE, "REG_NONE" },
40 { REG_EXPAND_SZ, "REG_EXPAND_SZ" },
41 { REG_BINARY, "REG_BINARY" },
42 { REG_DWORD, "REG_DWORD" },
43 { REG_DWORD_LE, "REG_DWORD_LE" },
44 { REG_DWORD_BE, "REG_DWORD_BE" },
45 { REG_LINK, "REG_LINK" },
46 { REG_MULTI_SZ, "REG_MULTI_SZ" },
47 { REG_RESOURCE_LIST, "REG_RESOURCE_LIST" },
48 { REG_FULL_RESOURCE_DESCRIPTOR, "REG_FULL_RESOURCE_DESCRIPTOR" },
49 { REG_RESOURCE_REQUIREMENTS_LIST, "REG_RESOURCE_REQUIREMENTS_LIST" },
53 static int proto_dcerpc_reg = -1;
54 static int hf_reg_opnum = -1;
55 static gint ett_dcerpc_reg = -1;
57 static e_uuid_t uuid_dcerpc_reg = {
58 0x338cd001, 0x2244, 0x31f1,
59 { 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03 }
62 static guint16 ver_dcerpc_reg = 1;
64 static dcerpc_sub_dissector dcerpc_reg_dissectors[] = {
65 { REG_OPEN_HKCR, "OpenHKCR", NULL, NULL },
66 { _REG_UNK_01, "Unknown01", NULL, NULL },
67 { REG_OPEN_HKLM, "OpenHKLM", NULL, NULL },
68 { _REG_UNK_03, "Unknown03", NULL, NULL },
69 { REG_OPEN_HKU, "OpenHKU", NULL, NULL },
70 { REG_CLOSE, "Close", NULL, NULL },
71 { REG_CREATE_KEY, "CreateKey", NULL, NULL },
72 { REG_DELETE_KEY, "DeleteKey", NULL, NULL },
73 { REG_DELETE_VALUE, "DeleteValue", NULL, NULL },
74 { REG_ENUM_KEY, "EnumKey", NULL, NULL },
75 { REG_ENUM_VALUE, "EnumValue", NULL, NULL },
76 { REG_FLUSH_KEY, "FlushKey", NULL, NULL },
77 { REG_GET_KEY_SEC, "GetKeySecurity", NULL, NULL },
78 { _REG_UNK_0D, "Unknown0d", NULL, NULL },
79 { _REG_UNK_0E, "Unknown0e", NULL, NULL },
80 { REG_OPEN_ENTRY, "OpenEntry", NULL, NULL },
81 { REG_QUERY_KEY, "QueryKey", NULL, NULL },
82 { REG_INFO, "Info", NULL, NULL },
83 { _REG_UNK_12, "Unknown12", NULL, NULL },
84 { _REG_UNK_13, "Unknown13", NULL, NULL },
85 { _REG_UNK_14, "Unknown14", NULL, NULL },
86 { REG_SET_KEY_SEC, "SetKeySecurity", NULL, NULL },
87 { REG_CREATE_VALUE, "CreateValue", NULL, NULL },
88 { _REG_UNK_17, "Unknown17", NULL, NULL },
89 { REG_SHUTDOWN, "Shutdown", NULL, NULL },
90 { REG_ABORT_SHUTDOWN, "AbortShutdown", NULL, NULL },
91 { REG_UNK_1A, "Unknown1A", NULL, NULL },
93 { 0, NULL, NULL, NULL }
96 static const value_string reg_opnum_vals[] = {
97 { REG_OPEN_HKCR, "OpenHKCR" },
98 { _REG_UNK_01, "Unknown01" },
99 { REG_OPEN_HKLM, "OpenHKLM" },
100 { _REG_UNK_03, "Unknown03" },
101 { REG_OPEN_HKU, "OpenHKU" },
102 { REG_CLOSE, "Close" },
103 { REG_CREATE_KEY, "CreateKey" },
104 { REG_DELETE_KEY, "DeleteKey" },
105 { REG_DELETE_VALUE, "DeleteValue" },
106 { REG_ENUM_KEY, "EnumKey" },
107 { REG_ENUM_VALUE, "EnumValue" },
108 { REG_FLUSH_KEY, "FlushKey" },
109 { REG_GET_KEY_SEC, "GetKeySecurity" },
110 { _REG_UNK_0D, "Unknown0d" },
111 { _REG_UNK_0E, "Unknown0e" },
112 { REG_OPEN_ENTRY, "OpenEntry" },
113 { REG_QUERY_KEY, "QueryKey" },
114 { REG_INFO, "Info" },
115 { _REG_UNK_12, "Unknown12" },
116 { _REG_UNK_13, "Unknown13" },
117 { _REG_UNK_14, "Unknown14" },
118 { REG_SET_KEY_SEC, "SetKeySecurity" },
119 { REG_CREATE_VALUE, "CreateValue" },
120 { _REG_UNK_17, "Unknown17" },
121 { REG_SHUTDOWN, "Shutdown" },
122 { REG_ABORT_SHUTDOWN, "AbortShutdown" },
123 { REG_UNK_1A, "Unknown1A" },
128 proto_register_dcerpc_reg(void)
130 static hf_register_info hf[] = {
132 { "Operation", "reg.opnum", FT_UINT16, BASE_DEC,
133 VALS(reg_opnum_vals), 0x0, "Operation", HFILL }},
136 static gint *ett[] = {
140 proto_dcerpc_reg = proto_register_protocol(
141 "Microsoft Registry", "REG", "reg");
143 proto_register_field_array(proto_dcerpc_reg, hf, array_length(hf));
145 proto_register_subtree_array(ett, array_length(ett));
149 proto_reg_handoff_dcerpc_reg(void)
151 /* Register protocol as dcerpc */
153 dcerpc_init_uuid(proto_dcerpc_reg, ett_dcerpc_reg, &uuid_dcerpc_reg,
154 ver_dcerpc_reg, dcerpc_reg_dissectors, -1);