On Fri, 24 May 2002, Pia Sahlberg wrote: > Hi, > Richard in your patch to srvsvc_dissect_net_share_get_info_rqst
Hmmm, the problem I have with that claim, even though that is what MSDN suggests is the case with NetShareGetInfo, is that the referent is only 16-bits long in each of the two traces I have. 0x11C9 in one case, and some other value in another. How do you explain that? The trace was of WinNT or Win2K accessing an NT or 2K server ... > the hf_srvsvc_share is actually a top level REF pointer, > > you should probably change/* > > * Construct a label for the string ... > > */ > > item = proto_tree_add_text(tree, tvb, offset, -1, "Share"); > > stree = proto_item_add_subtree(item, ett_srvsvc_share_info); > > di->hf_index = hf_srvsvc_share; > > di->levels = 0; > > > > offset = dissect_ndr_nt_UNICODE_STRING_str(tvb, offset, pinfo, stree, > >drep); > > > into this instead : > > > > offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, > > dissect_ndr_nt_UNICODE_STRING_str, > > NDR_POINTER_REF, "Server", > > hf_srvsvc_share, -1); > > > > > To make the output look nicer, something I have planned to do a long time > would be if you could change dissect_ndr_pointer so it WILL create > a tree also for top level ref pointers. > Then the -1 above should be changed to 0. > This would also need all NDR_POINTER_REF dissect_ndr_pointer calls to be > audited to make sure we specify a string (many "" used i belive) > > It is failry easy to do these changes and the fixes for NDR_POINTER_REF > would be fairly mechanical. (there are not that many places to update). > If you dont want to do this change yourself I can make it sometime during > the weekend. > > > best regards > ronnie s > > > > _________________________________________________________________ > Chat with friends online, try MSN Messenger: http://messenger.msn.com > > > _______________________________________________ > Ethereal-dev mailing list > [EMAIL PROTECTED] > http://www.ethereal.com/mailman/listinfo/ethereal-dev > -- Regards ----- Richard Sharpe, [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED]
