1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
# Conformance file for iwbemservices
MANUAL IWbemServices_dissect_element_GetObject_orpcthis
MANUAL IWbemServices_dissect_element_GetObject_orpcthat_
MANUAL IWbemServices_dissect_element_ExecMethod_orpcthis
MANUAL IWbemServices_dissect_element_ExecMethod_orpcthat_
MANUAL IWbemServices_dissect_element_IWbemClassObject_objects
NOEMIT IWbemServices_dissect_element_IWbemClassObject_objects_
NOEMIT IWbemServices_dissect_element_GetObject_strObjectPath_
ETT_FIELD ett_IWbemServices_GetObject_orpcthis
ETT_FIELD ett_IWbemServices_GetObject_orpcthat
ETT_FIELD ett_IWbemServices_ExecMethod_orpcthis
ETT_FIELD ett_IWbemServices_ExecMethod_orpcthat
CODE START
#include "packet-dcom.h"
static int
IWbemServices_dissect_element_IWbemClassObject_objects_(tvbuff_t *tvb, int offset, int length, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep);
static int
IWbemServices_dissect_element_GetObject_strObjectPath_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep);
extern void register_dcom_wmio (void);
/* GetObject */
static int
IWbemServices_dissect_element_GetObject_orpcthis(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep)
{
proto_item *sub_item;
proto_tree *sub_tree;
sub_item = proto_tree_add_item(tree, hf_IWbemServices_GetObject_orpcthis, tvb, offset, 0, ENC_NA);
sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_GetObject_orpcthis);
return dissect_dcom_this(tvb, offset, pinfo, sub_tree, di, drep);
}
static int
IWbemServices_dissect_element_GetObject_orpcthat_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep)
{
proto_item *sub_item;
proto_tree *sub_tree;
register_dcom_wmio();
sub_item = proto_tree_add_item(tree, hf_IWbemServices_GetObject_orpcthat, tvb, offset, 0, ENC_NA);
sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_GetObject_orpcthat);
return dissect_dcom_that(tvb, offset, pinfo, sub_tree, di, drep);
}
/* ExecMethod */
static int
IWbemServices_dissect_element_ExecMethod_orpcthis(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep)
{
proto_item *sub_item;
proto_tree *sub_tree;
sub_item = proto_tree_add_item(tree, hf_IWbemServices_ExecMethod_orpcthis, tvb, offset, 0, ENC_NA);
sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_ExecMethod_orpcthis);
return dissect_dcom_this(tvb, offset, pinfo, sub_tree, di, drep);
}
static int
IWbemServices_dissect_element_ExecMethod_orpcthat_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep)
{
proto_item *sub_item;
proto_tree *sub_tree;
register_dcom_wmio();
sub_item = proto_tree_add_item(tree, hf_IWbemServices_ExecMethod_orpcthat, tvb, offset, 0, ENC_NA);
sub_tree = proto_item_add_subtree(sub_item, ett_IWbemServices_ExecMethod_orpcthat);
return dissect_dcom_that(tvb, offset, pinfo, sub_tree, di, drep);
}
static int
IWbemServices_dissect_element_IWbemClassObject_objects(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep)
{
return dissect_ndr_ucarray_block(tvb, offset, pinfo, tree, di, drep, &IWbemServices_dissect_element_IWbemClassObject_objects_);
}
static int
IWbemServices_dissect_element_IWbemClassObject_objects_(tvbuff_t *tvb, int offset, int length, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
{
dissect_dcom_OBJREF(tvb, offset, pinfo, tree, di, drep, hf_IWbemServices_IWbemClassObject_objects, NULL);
return offset + length;
}
static int
IWbemServices_dissect_element_GetObject_strObjectPath_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info* di, uint8_t *drep)
{
char *data = NULL;
offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_IWbemServices_GetObject_strObjectPath, false, &data);
if (data){
proto_item_append_text(tree, ": %s", data);
col_append_fstr(pinfo->cinfo, COL_INFO, " Object=%s", data);
}
return offset;
}
CODE END
|
