Attached is the code necessary to dissect the auth3 message in the NTLMSSP protocol.
Also in the patch is a minor fix to interpret the negotiate_flags fields as 32 bit instead of 16. I'm not sure how to handle UNICODE strings. I ended up with an almost verbatum copy of get_unicode_or_ascii_string() from packet-smb.c. The only thing I changed was I replaced the pinfo argument with a boolean named 'useunicode'. I also duplicated the unicode_to_str function exactly from packet-smb.c (since it is defined static). Do we have an approach for handling unicode strings, so I can eliminate the duplicate code? Thanks, Devin Heitmueller Senior Software Engineer Netilla Networks Inc
ntlmssp_auth3.patch.gz
Description: application/gzip
