Hi list. Attached is a new patch for parsing of NDR pointers. Also included is a dissector for a SAMR call which uses a lot of pointers as well as unidimensional conformant arrays.
It looks quite nice on my tests. Dissect_ndr_pointer() uses the NDR format described in DCERPC v 1.1 . By adding dissect_ndr_pointer() it will be much easier to produce a rudimentary idl compiler for NT services. Please looks at the SAMR/DISPINFO dissector and note how simple it is and how simple it maps to the underlying ndr handling. It works well here. please apply.
dcerpc_pointers.patch
Description: Binary data
