epan/dissectors/packet-dcom-dispatch.c

   1 /* packet-dcom-dispatch.c
   2  * Routines for DCOM IDispatch
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 /* see packet-dcom.c for details about DCOM */
  12
  13 #include "config.h"
  14
  15
  16 #include <epan/packet.h>
  17 #include <epan/tfs.h>
  18 #include "packet-dcerpc.h"
  19 #include "packet-dcom.h"
  20 #include "packet-dcom-dispatch.h"
  21
  22 void proto_register_dcom_dispatch(void);
  23 void proto_reg_handoff_dcom_dispatch(void);
  24
  25 static int hf_dispatch_opnum;
  26
  27 static int hf_dispatch_riid;
  28 static int hf_dispatch_name;
  29 static int hf_dispatch_names;
  30 static int hf_dispatch_lcid;
  31 static int hf_dispatch_id;
  32
  33 static int hf_dispatch_arg;
  34 static int hf_dispatch_args;
  35 static int hf_dispatch_named_args;
  36 static int hf_dispatch_varref;
  37 static int hf_dispatch_varrefidx;
  38 static int hf_dispatch_varrefarg;
  39
  40 static int hf_dispatch_varresult;
  41 static int hf_dispatch_code;
  42 static int hf_dispatch_reserved16;
  43 static int hf_dispatch_source;
  44 static int hf_dispatch_description;
  45 static int hf_dispatch_help_file;
  46 static int hf_dispatch_help_context;
  47 static int hf_dispatch_reserved32;
  48 static int hf_dispatch_deferred_fill_in;
  49 static int hf_dispatch_arg_err;
  50
  51 static int hf_dispatch_tinfo;
  52 static int hf_dispatch_itinfo;
  53 static int hf_dispatch_dispparams;
  54 static int hf_dispatch_excepinfo;
  55 static int hf_dispatch_scode;
  56
  57
  58 static int hf_dispatch_flags;
  59 static int hf_dispatch_flags_method;
  60 static int hf_dispatch_flags_propget;
  61 static int hf_dispatch_flags_propput;
  62 static int hf_dispatch_flags_propputref;
  63
  64 #define DISPATCH_FLAGS_METHOD           1
  65 #define DISPATCH_FLAGS_PROPGET          2
  66 #define DISPATCH_FLAGS_PROPPUT          4
  67 #define DISPATCH_FLAGS_PROPPUTREF       8
  68
  69 static int ett_dispatch_flags;
  70 static int ett_dispatch_params;
  71 static int ett_dispatch_excepinfo;
  72
  73 static e_guid_t uuid_dispatch = { 0x00020400, 0x0000, 0x0000, { 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 } };
  74 static uint16_t ver_dispatch;
  75 static int ett_dispatch;
  76 static int proto_dispatch;
  77
  78
  79 /*
  80  * See:
  81  *
  82  *    https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid/a9eac961-e77d-41a6-90a5-ce1a8b0cdb9c
  83  *    https://docs.microsoft.com/en-us/windows/win32/intl/locale-user-default
  84  *    https://docs.microsoft.com/en-us/windows/win32/intl/locale-system-default
  85  *    https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee796949(v%3Dcs.20)
  86  *
  87  * and values from cygwin's winnls.h
  88  */
  89 static const value_string dcom_lcid_vals[] = {
  90     { 0x0000, "Language neutral" },
  91     { 0x0400, "LOCALE_USER_DEFAULT" },
  92     { 0x0409, "English (United States)" },
  93     { 0x0800, "LOCALE_SYSTEM_DEFAULT" },
  94     { 0,    NULL }
  95 };
  96
  97
  98
  99 int
 100 dissect_IDispatch_GetTypeInfoCount_resp(tvbuff_t *tvb, int offset,
 101                                         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 102 {
 103     uint32_t u32TInfo;
 104     uint32_t u32HResult;
 105
 106
 107     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 108
 109     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 110                                 hf_dispatch_tinfo, &u32TInfo);
 111
 112     /* HRESULT of call */
 113     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 114                                   &u32HResult);
 115
 116     col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 117                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 118
 119     return offset;
 120 }
 121
 122 int
 123 dissect_IDispatch_GetTypeInfo_rqst(tvbuff_t *tvb, int offset,
 124                                    packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 125 {
 126     uint32_t u32TInfo;
 127     uint32_t u32Lcid;
 128
 129     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
 130
 131     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 132                                 hf_dispatch_tinfo, &u32TInfo);
 133     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 134                                 hf_dispatch_lcid, &u32Lcid);
 135
 136     return offset;
 137 }
 138
 139
 140 int
 141 dissect_IDispatch_GetTypeInfo_resp(tvbuff_t *tvb, int offset,
 142                                    packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 143 {
 144     uint32_t u32HResult;
 145     uint32_t u32Pointer;
 146
 147
 148     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 149
 150     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 151                                          &u32Pointer);
 152     if (u32Pointer) {
 153         offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep, hf_dispatch_itinfo, NULL /* XXX */);
 154     }
 155
 156     /* HRESULT of call */
 157     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 158                                   &u32HResult);
 159
 160     col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 161                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 162
 163     return offset;
 164 }
 165
 166
 167 int
 168 dissect_IDispatch_GetIDsOfNames_rqst(tvbuff_t *tvb, int offset,
 169                                      packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 170 {
 171     e_guid_t riid;
 172     uint32_t u32Lcid;
 173     char     szName[1000] = { 0 };
 174     uint32_t u32Names;
 175     uint32_t u32ArraySize;
 176     uint32_t u32Pointer;
 177     uint32_t u32Tmp;
 178     uint32_t u32VariableOffset;
 179
 180
 181     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
 182
 183     offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
 184                                hf_dispatch_riid, &riid);
 185
 186     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 187                                             &u32ArraySize);
 188
 189     u32VariableOffset = offset + u32ArraySize * 4;
 190
 191     u32Tmp = u32ArraySize;
 192     while(u32Tmp--) {
 193         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 194                                              &u32Pointer);
 195         if (u32Pointer) {
 196             u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, tree, di, drep,
 197                                                     hf_dispatch_name, szName, sizeof(szName));
 198             col_append_fstr(pinfo->cinfo, COL_INFO, " \"%s\"", szName);
 199         }
 200     }
 201
 202     offset = u32VariableOffset;
 203
 204     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 205                                 hf_dispatch_names, &u32Names);
 206
 207     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 208                                 hf_dispatch_lcid, &u32Lcid);
 209
 210     return offset;
 211 }
 212
 213
 214
 215 int
 216 dissect_IDispatch_GetIDsOfNames_resp(tvbuff_t *tvb, int offset,
 217                                      packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 218 {
 219     uint32_t u32DispId;
 220     uint32_t u32ArraySize;
 221     uint32_t u32Tmp;
 222     uint32_t u32HResult;
 223
 224
 225     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 226
 227     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 228                                             &u32ArraySize);
 229
 230     u32Tmp = u32ArraySize;
 231     while (u32Tmp--) {
 232         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 233                                     hf_dispatch_id, &u32DispId);
 234         col_append_fstr(pinfo->cinfo, COL_INFO, " ID=0x%x", u32DispId);
 235     }
 236
 237     /* HRESULT of call */
 238     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 239                                   &u32HResult);
 240
 241     col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 242                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 243
 244     return offset;
 245 }
 246
 247
 248
 249 int
 250 dissect_IDispatch_Invoke_rqst(tvbuff_t *tvb, int offset,
 251                               packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 252 {
 253     uint32_t u32DispIdMember;
 254     e_guid_t riid;
 255     uint32_t u32Lcid;
 256     uint32_t u32Flags;
 257     uint32_t u32Args;
 258     uint32_t u32NamedArgs;
 259     uint32_t u32Pointer;
 260     uint32_t u32Pointer2;
 261     uint32_t u32ArraySize;
 262     uint32_t u32VariableOffset;
 263     uint32_t u32VarRef;
 264     uint32_t u32VarRefIdx;
 265     uint32_t u32TmpOffset;
 266     uint32_t u32SubStart;
 267
 268     proto_item *dispparams_item;
 269     proto_tree *dispparams_tree;
 270     static int * const flags[] = {
 271         &hf_dispatch_flags_propputref,
 272         &hf_dispatch_flags_propput,
 273         &hf_dispatch_flags_propget,
 274         &hf_dispatch_flags_method,
 275         NULL
 276     };
 277
 278
 279     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
 280
 281     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 282                                 hf_dispatch_id, &u32DispIdMember);
 283     col_append_fstr(pinfo->cinfo, COL_INFO, " ID=0x%x", u32DispIdMember);
 284
 285     offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
 286                                hf_dispatch_riid, &riid);
 287     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 288                                 hf_dispatch_lcid, &u32Lcid);
 289
 290     /* dispatch flags */
 291     u32TmpOffset = dissect_dcom_DWORD(tvb, offset, pinfo, NULL, di, drep, -1, &u32Flags);
 292
 293     proto_tree_add_bitmask_value(tree, tvb, offset, hf_dispatch_flags,
 294                                 ett_dispatch_flags, flags, u32Flags);
 295
 296     if (u32Flags & DISPATCH_FLAGS_METHOD) {
 297         col_append_str(pinfo->cinfo, COL_INFO, " Method");
 298     }
 299     if (u32Flags & DISPATCH_FLAGS_PROPGET) {
 300         col_append_str(pinfo->cinfo, COL_INFO, " PropertyGet");
 301     }
 302     if (u32Flags & DISPATCH_FLAGS_PROPPUT) {
 303         col_append_str(pinfo->cinfo, COL_INFO, " PropertyPut");
 304     }
 305     if (u32Flags & DISPATCH_FLAGS_PROPPUTREF) {
 306         col_append_str(pinfo->cinfo, COL_INFO, " PropertyPutRef");
 307     }
 308
 309     offset = u32TmpOffset;
 310
 311     dispparams_item = proto_tree_add_item(tree, hf_dispatch_dispparams, tvb, offset, 0, ENC_NA);
 312     dispparams_tree = proto_item_add_subtree (dispparams_item, ett_dispatch_params);
 313     u32SubStart = offset;
 314
 315     /* DISPPARAMS */
 316     /* VARIANT rgvarg[u32Args] */
 317     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, di, drep,
 318                                          &u32Pointer);
 319
 320     /* DISPID rgdispidNamedArgs[u32NamedArgs] */
 321     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, di, drep,
 322                                          &u32Pointer2);
 323
 324     offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, di, drep,
 325                                 hf_dispatch_args, &u32Args);
 326     offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, di, drep,
 327                                 hf_dispatch_named_args, &u32NamedArgs);
 328
 329     if (u32Pointer) {
 330         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, dispparams_tree, di, drep,
 331                                                 &u32ArraySize);
 332         u32VariableOffset = offset + u32ArraySize * 4;
 333         while(u32ArraySize--) {
 334             offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, di, drep,
 335                                                  &u32Pointer);
 336             if (u32Pointer) {
 337                 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, dispparams_tree, di, drep, hf_dispatch_arg);
 338             }
 339         }
 340         /*offset = u32VariableOffset;*/
 341     }
 342
 343     /* DISPID rgdispidNamedArgs[u32NamedArgs] */
 344     if (u32Pointer2) {
 345         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, dispparams_tree, di, drep,
 346                                                 &u32ArraySize);
 347         while(u32ArraySize--) {
 348             offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, di, drep,
 349                                         hf_dispatch_id, &u32DispIdMember);
 350         }
 351     }
 352
 353     proto_item_append_text(dispparams_item, ", Args: %u NamedArgs: %u", u32Args, u32NamedArgs);
 354     proto_item_set_len(dispparams_item, offset - u32SubStart);
 355
 356     /* end of DISPPARAMS */
 357
 358     /* u32VarRef */
 359     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 360                                 hf_dispatch_varref, &u32VarRef);
 361
 362     /* rgVarRefIdx: UINT[u32VarRef] */
 363     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 364                                             &u32ArraySize);
 365     while(u32ArraySize--) {
 366         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 367                                     hf_dispatch_varrefidx, &u32VarRefIdx);
 368     }
 369
 370     /* rgVarRef: VARIANT[u32VarRef] */
 371     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 372                                             &u32ArraySize);
 373     u32VariableOffset = offset + u32ArraySize * 4;
 374     while(u32ArraySize--) {
 375         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 376                                              &u32Pointer);
 377         if (u32Pointer) {
 378             u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, tree, di, drep, hf_dispatch_varrefarg);
 379         }
 380     }
 381
 382     col_append_fstr(pinfo->cinfo, COL_INFO,
 383                     " Args=%u NamedArgs=%u VarRef=%u", u32Args, u32NamedArgs, u32VarRef);
 384
 385     return u32VariableOffset;
 386 }
 387
 388 int
 389 dissect_IDispatch_Invoke_resp(tvbuff_t *tvb, int offset,
 390                               packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 391 {
 392     uint32_t u32Pointer;
 393     uint32_t u32Pointer2;
 394     uint32_t u32Pointer3;
 395     uint32_t u32VariableOffset;
 396     uint32_t u32ArraySize;
 397     uint32_t u32SubStart;
 398     uint16_t u16Code;
 399     uint16_t u16Reserved;
 400     uint32_t u32HelpContext;
 401     uint32_t u32Reserved;
 402     uint32_t u32DeferredFillIn;
 403     uint32_t u32ArgErr;
 404     uint32_t u32HResult;
 405     uint32_t u32SCode;
 406     uint32_t u32VarRef;
 407     char        szName[1000] = { 0 };
 408     proto_item *excepinfo_item;
 409     proto_tree *excepinfo_tree;
 410
 411
 412     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 413
 414     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 415                                          &u32Pointer);
 416     if (u32Pointer) {
 417         offset = dissect_dcom_VARIANT(tvb, offset, pinfo, tree, di, drep, hf_dispatch_varresult);
 418     }
 419
 420     /* ExcepInfo */
 421     excepinfo_item = proto_tree_add_item(tree, hf_dispatch_excepinfo, tvb, offset, 0, ENC_NA);
 422     excepinfo_tree = proto_item_add_subtree (excepinfo_item, ett_dispatch_excepinfo);
 423     u32SubStart = offset;
 424
 425     offset = dissect_dcom_WORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 426                                hf_dispatch_code, &u16Code);
 427     offset = dissect_dcom_WORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 428                                hf_dispatch_reserved16, &u16Reserved);
 429     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, excepinfo_tree, di, drep,
 430                                          &u32Pointer);
 431     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, excepinfo_tree, di, drep,
 432                                          &u32Pointer2);
 433     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, excepinfo_tree, di, drep,
 434                                          &u32Pointer3);
 435     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 436                                 hf_dispatch_help_context, &u32HelpContext);
 437     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 438                                 hf_dispatch_reserved32, &u32Reserved);
 439     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 440                                 hf_dispatch_deferred_fill_in, &u32DeferredFillIn);
 441     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 442                                 hf_dispatch_scode, &u32SCode);
 443
 444     if (u32Pointer) {
 445         offset = dissect_dcom_BSTR(tvb, offset, pinfo, excepinfo_tree, di, drep,
 446                                    hf_dispatch_source, szName, sizeof(szName));
 447     }
 448     if (u32Pointer2) {
 449         offset = dissect_dcom_BSTR(tvb, offset, pinfo, excepinfo_tree, di, drep,
 450                                    hf_dispatch_description, szName, sizeof(szName));
 451     }
 452     if (u32Pointer3) {
 453         offset = dissect_dcom_BSTR(tvb, offset, pinfo, excepinfo_tree, di, drep,
 454                                    hf_dispatch_help_file, szName, sizeof(szName));
 455     }
 456
 457     proto_item_append_text(excepinfo_item, ", SCode: %s",
 458                            val_to_str(u32SCode, dcom_hresult_vals, "Unknown (0x%08x)"));
 459     proto_item_set_len(excepinfo_item, offset - u32SubStart);
 460     /* end of ExcepInfo */
 461
 462     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 463                                 hf_dispatch_arg_err, &u32ArgErr);
 464
 465     /* rgVarRef: VARIANT[u32VarRef] */
 466     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 467                                             &u32ArraySize);
 468     u32VarRef = u32ArraySize;
 469     u32VariableOffset = offset + u32ArraySize * 4;
 470     while(u32ArraySize--) {
 471         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 472                                              &u32Pointer);
 473         if (u32Pointer) {
 474             u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, tree, di, drep, hf_dispatch_varrefarg);
 475         }
 476     }
 477     offset = u32VariableOffset;
 478
 479     /* HRESULT of call */
 480     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 481                                   &u32HResult);
 482
 483     col_append_fstr(pinfo->cinfo, COL_INFO, " SCode=%s VarRef=%u -> %s",
 484                     val_to_str(u32SCode, dcom_hresult_vals, "Unknown (0x%08x)"),
 485                     u32VarRef,
 486                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 487
 488     return offset;
 489 }
 490
 491
 492
 493 /* sub dissector table of IDispatch interface */
 494 static const dcerpc_sub_dissector dispatch_dissectors[] = {
 495     { 0, "QueryInterface", NULL, NULL },
 496     { 1, "AddRef", NULL, NULL },
 497     { 2, "Release", NULL, NULL },
 498
 499     { 3, "GetTypeInfoCount", dissect_dcom_simple_rqst, dissect_IDispatch_GetTypeInfoCount_resp },
 500     { 4, "GetTypeInfo", dissect_IDispatch_GetTypeInfo_rqst, dissect_IDispatch_GetTypeInfo_resp },
 501     { 5, "GetIDsOfNames", dissect_IDispatch_GetIDsOfNames_rqst, dissect_IDispatch_GetIDsOfNames_resp },
 502     { 6, "Invoke", dissect_IDispatch_Invoke_rqst, dissect_IDispatch_Invoke_resp },
 503     { 0, NULL, NULL, NULL },
 504 };
 505
 506
 507 void
 508 proto_register_dcom_dispatch(void)
 509 {
 510
 511     static hf_register_info hf_dispatch_array[] = {
 512         { &hf_dispatch_opnum,
 513           { "Operation", "dispatch.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 514
 515         { &hf_dispatch_riid,
 516           { "RIID", "dispatch.riid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 517         { &hf_dispatch_name,
 518           { "Name", "dispatch.name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 519         { &hf_dispatch_names,
 520           { "Names", "dispatch.names", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 521         { &hf_dispatch_lcid,
 522           { "LCID", "dispatch.lcid", FT_UINT32, BASE_HEX, VALS(dcom_lcid_vals), 0x0, NULL, HFILL }},
 523         { &hf_dispatch_id,
 524           { "DispID", "dispatch.id", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 525         { &hf_dispatch_flags,
 526           { "Flags", "dispatch.flags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 527
 528         { &hf_dispatch_arg,
 529           { "Argument", "dispatch.arg", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 530         { &hf_dispatch_args,
 531           { "Args", "dispatch.args", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 532         { &hf_dispatch_named_args,
 533           { "NamedArgs", "dispatch.named_args", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 534         { &hf_dispatch_varref,
 535           { "VarRef", "dispatch.varref", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 536         { &hf_dispatch_varrefidx,
 537           { "VarRefIdx", "dispatch.varrefidx", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 538         { &hf_dispatch_varrefarg,
 539           { "VarRef", "dispatch.varrefarg", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 540         { &hf_dispatch_varresult,
 541           { "VarResult", "dispatch.varresult", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 542
 543         { &hf_dispatch_flags_method,
 544           { "Method", "dispatch.flags_method", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_METHOD, NULL, HFILL }},
 545         { &hf_dispatch_flags_propget,
 546           { "PropertyGet", "dispatch.flags_propget", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_PROPGET, NULL, HFILL }},
 547         { &hf_dispatch_flags_propput,
 548           { "PropertyPut", "dispatch.flags_propput", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_PROPPUT, NULL, HFILL }},
 549         { &hf_dispatch_flags_propputref,
 550           { "PropertyPutRef", "dispatch.flags_propputref", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_PROPPUTREF, NULL, HFILL }},
 551
 552         { &hf_dispatch_code,
 553           { "Code", "dispatch.code", FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 554         { &hf_dispatch_reserved16,
 555           { "Reserved", "dispatch.reserved16", FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 556         { &hf_dispatch_source,
 557           { "Source", "dispatch.source", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 558         { &hf_dispatch_description,
 559           { "Description", "dispatch.description", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 560         { &hf_dispatch_help_file,
 561           { "HelpFile", "dispatch.help_file", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 562         { &hf_dispatch_help_context,
 563           { "HelpContext", "dispatch.help_context", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 564         { &hf_dispatch_reserved32,
 565           { "Reserved", "dispatch.reserved32", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 566         { &hf_dispatch_deferred_fill_in,
 567           { "DeferredFillIn", "dispatch.deferred_fill_in", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 568         { &hf_dispatch_arg_err,
 569           { "ArgErr", "dispatch.arg_err", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 570
 571         { &hf_dispatch_tinfo,
 572           { "TInfo", "dispatch.tinfo", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 573         { &hf_dispatch_itinfo,
 574           { "TInfo", "dispatch.itinfo", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 575         { &hf_dispatch_dispparams,
 576           { "DispParams", "dispatch.dispparams", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 577         { &hf_dispatch_excepinfo,
 578           { "ExcepInfo", "dispatch.excepinfo", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 579         { &hf_dispatch_scode,
 580           { "SCode", "dispatch.scode", FT_UINT32, BASE_HEX, VALS(dcom_hresult_vals), 0x0, NULL, HFILL }}
 581     };
 582
 583     static int *ett[] = {
 584         &ett_dispatch,
 585         &ett_dispatch_flags,
 586         &ett_dispatch_params,
 587         &ett_dispatch_excepinfo
 588     };
 589
 590
 591     /* IDispatch currently only partially implemented */
 592     proto_dispatch = proto_register_protocol ("DCOM IDispatch", "IDispatch", "dispatch");
 593     proto_register_field_array (proto_dispatch, hf_dispatch_array, array_length (hf_dispatch_array));
 594     proto_register_subtree_array (ett, array_length (ett));
 595 }
 596
 597
 598 void
 599 proto_reg_handoff_dcom_dispatch(void)
 600 {
 601
 602     dcerpc_init_uuid(proto_dispatch, ett_dispatch,
 603                      &uuid_dispatch, ver_dispatch,
 604                      dispatch_dissectors, hf_dispatch_opnum);
 605 }
 606
 607 /*
 608  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 609  *
 610  * Local variables:
 611  * c-basic-offset: 4
 612  * tab-width: 8
 613  * indent-tabs-mode: nil
 614  * End:
 615  *
 616  * vi: set shiftwidth=4 tabstop=8 expandtab:
 617  * :indentSize=4:tabSize=8:noTabs=true:
 618  */