epan/dissectors/packet-dcom-sysact.c

   1 /* packet-dcom-sysact.c
   2  * Routines for the ISystemActivator interface
   3  * Copyright 2004, Jelmer Vernooij <jelmer@samba.org>
   4  * Copyright 2012, Litao Gao <ltgao@juniper.net>
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13 #include "config.h"
  14
  15 #include <epan/packet.h>
  16 #include "packet-dcerpc.h"
  17 #include "packet-dcom.h"
  18
  19 void proto_register_ISystemActivator(void);
  20 void proto_reg_handoff_ISystemActivator(void);
  21
  22 static int proto_ISystemActivator;
  23
  24 static int ett_isystemactivator;
  25 static int hf_opnum;
  26 static int hf_sysact_actproperties;
  27 /* static int hf_sysact_unknown; */
  28
  29 static int ett_actproperties;
  30 static int hf_sysact_totalsize;
  31 static int hf_sysact_res;
  32
  33 static int ett_commonheader;
  34 static int ett_propguids;
  35 static int ett_properties;
  36 static int hf_sysact_customhdrsize;
  37 static int hf_sysact_dstctx;
  38 static int hf_sysact_actpropnumber;
  39 static int hf_sysact_actpropclsinfoid;
  40 /* static int hf_sysact_actpropclsids; */
  41 static int hf_sysact_actpropclsid;
  42 /* static int hf_sysact_actpropsizes; */
  43 static int hf_sysact_actpropsize;
  44
  45
  46 static int ett_dcom_spclsysprop;
  47 static int ett_dcom_reserved;
  48 static int hf_sysact_spsysprop_sid;
  49 static int hf_sysact_spsysprop_remotethissid;
  50 static int hf_sysact_spsysprop_cltimpersonating;
  51 static int hf_sysact_spsysprop_partitionid;
  52 static int hf_sysact_spsysprop_defauthlvl;
  53 static int hf_sysact_spsysprop_partition;
  54 static int hf_sysact_spsysprop_procrqstflgs;
  55 static int hf_sysact_spsysprop_origclsctx;
  56 static int hf_sysact_spsysprop_flags;
  57 /* static int hf_sysact_spsysprop_procid; */
  58 /* static int hf_sysact_spsysprop_hwnd; */
  59
  60 static int ett_dcom_instantianinfo;
  61 static int hf_sysact_instninfo_clsid;
  62 static int hf_sysact_instninfo_clsctx;
  63 static int hf_sysact_instninfo_actflags;
  64 static int hf_sysact_instninfo_issurrogate;
  65 static int hf_sysact_instninfo_iidcount;
  66 static int hf_sysact_instninfo_instflags;
  67 static int hf_sysact_instninfo_entiresize;
  68 static int hf_sysact_instninfo_iid;
  69
  70 static int ett_dcom_actctxinfo;
  71 static int hf_sysact_actctxinfo_cltok;
  72 static int hf_sysact_context;
  73
  74 static int ett_dcom_instanceinfo;
  75 static int hf_sysact_instinfo_mode;
  76 static int hf_sysact_instinfo_stg;
  77
  78 static int ett_dcom_istorage;
  79 static int hf_sysact_istg;
  80
  81 static int ett_dcom_context;
  82 static int hf_sysact_ctx_id;
  83 static int hf_sysact_ctx_flags;
  84 static int hf_sysact_ctx_res;
  85 static int hf_sysact_ctx_numextents;
  86 static int hf_sysact_ctx_extentscnt;
  87 static int hf_sysact_ctx_mashflags;
  88 static int hf_sysact_ctx_count;
  89 static int hf_sysact_ctx_frozen;
  90
  91 static int ett_dcom_securityinfo;
  92 static int hf_sysact_si_authflalgs;
  93 static int hf_sysact_si_ci_res;
  94 static int hf_sysact_si_ci_string;
  95 static int hf_sysact_si_serverinfo;
  96
  97 static int ett_dcom_locationinfo;
  98 static int hf_sysact_li_string;
  99 static int hf_sysact_li_procid;
 100 static int hf_sysact_li_apartid;
 101 static int hf_sysact_li_ctxid;
 102
 103 static int ett_dcom_scmrqstinfo;
 104 static int ett_dcom_rmtrqst;
 105
 106 static int hf_sysact_sri_cltimplvl;
 107 static int hf_sysact_sri_protseqnum;
 108 static int hf_sysact_sri_protseq;
 109
 110 static int ett_dcom_propsoutput;
 111 static int hf_sysact_pi_ifnum;
 112 static int hf_sysact_pi_retval;
 113 static int hf_sysact_pi_interf;
 114 static int hf_sysact_pi_iid;
 115
 116 static int ett_dcom_scmrespinfo;
 117 static int ett_dcom_rmtresp;
 118 static int ett_dcom_oxidbinding;
 119 static int hf_sysact_scmri_rmtunknid;
 120 static int hf_sysact_scmri_authhint;
 121 static int hf_sysact_scmri_binding;
 122 static int hf_sysact_scmri_oxid;
 123 static int hf_sysact_unused_buffer;
 124
 125 static int ett_typeszcommhdr;
 126 static int ett_typeszprivhdr;
 127 static int hf_typeszch;
 128 static int hf_typeszph;
 129 static int hf_typesz_ver;
 130 static int hf_typesz_endianness;
 131 static int hf_typesz_commhdrlen;
 132 static int hf_typesz_filler;
 133 static int hf_typesz_buflen;
 134
 135 static e_guid_t uuid_ISystemActivator = { 0x000001a0, 0x0000, 0x0000, { 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 } };
 136 static uint16_t ver_ISystemActivator;
 137
 138 /*static e_guid_t clsid_ActivationPropertiesIn = { 0x00000338, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
 139 /*static e_guid_t clsid_ActivationPropertiesOut = { 0x00000339, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };*/
 140 static e_guid_t iid_ActivationPropertiesIn = { 0x000001a2, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 141 static e_guid_t iid_ActivationPropertiesOut = { 0x000001a3, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 142
 143 static e_guid_t clsid_SpecialSystemProperties = { 0x000001b9, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 144 static e_guid_t clsid_InstantiationInfo = { 0x000001ab, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 145 static e_guid_t clsid_ActivationContextInfo = { 0x000001a5, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 146 //static e_guid_t clsid_ContextMarshaler = { 0x0000033b, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 147 static e_guid_t iid_IContext = { 0x000001c0, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 148 static e_guid_t clsid_SecurityInfo = { 0x000001a6, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 149 static e_guid_t clsid_ServerLocationInfo = { 0x000001a4, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 150 static e_guid_t clsid_ScmRequestInfo = { 0x000001aa, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 151 static e_guid_t clsid_PropsOutInfo = { 0x00000339, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 152 static e_guid_t clsid_ScmReplyInfo = { 0x000001b6, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 153 static e_guid_t clsid_InstanceInfo = { 0x000001ad, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 154 static e_guid_t iid_IStorage = { 0x0000000B, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46} };
 155
 156
 157 static const value_string instninfo_actflags[] = {
 158     { 0x00000002, "ACTVFLAGS_DISABLE_AAA" },
 159     { 0x00000004, "ACTVFLAGS_ACTIVATE_32_BIT_SERVER" },
 160     { 0x00000008, "ACTVFLAGS_ACTIVATE_64_BIT_SERVER" },
 161     { 0x00000020, "ACTVFLAGS_NO_FAILURE_LOG" },
 162     { 0,  NULL }
 163 };
 164
 165 static const value_string boolean_flag_vals[] = {
 166     { 0x00000001, "TRUE" },
 167     { 0x00000000, "FALSE" },
 168     { 0,  NULL }
 169 };
 170
 171 static const value_string dcom_context_flag_vals[] = {
 172     { 0x00000002, "MarshalByValue" },
 173     { 0,  NULL }
 174 };
 175
 176 static const value_string ts_endian_vals[] = {
 177     { 0x10, "Little-endian" },
 178     { 0x00, "Big-endian" },
 179     { 0,  NULL }
 180 };
 181
 182 /* MS-DCOM 2.2.28.1 */
 183 #define MIN_ACTPROP_LIMIT 1
 184 #define MAX_ACTPROP_LIMIT 10
 185
 186 typedef struct property_guids {
 187     e_guid_t guid[MAX_ACTPROP_LIMIT];
 188     uint32_t size[MAX_ACTPROP_LIMIT];
 189     uint32_t id_idx;
 190     uint32_t size_idx;
 191 } property_guids_t;
 192
 193 /* Type Serialization Version 1 */
 194 static int
 195 dissect_TypeSzCommPrivHdr(tvbuff_t *tvb, int offset, packet_info *pinfo,
 196                        proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 197 {
 198     proto_item *sub_item;
 199     proto_tree *sub_tree;
 200     uint8_t drep_tmp;
 201     uint8_t endian = 0x10;
 202     int    old_offset;
 203
 204     /* Common Header use little endian */
 205     sub_item = proto_tree_add_item(tree, hf_typeszch, tvb, offset, 0, ENC_NA);
 206     sub_tree = proto_item_add_subtree(sub_item, ett_typeszcommhdr);
 207
 208     old_offset = offset;
 209     offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, di, drep,
 210             hf_typesz_ver, NULL);
 211
 212     offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, di, drep,
 213             hf_typesz_endianness, &endian);
 214     if (endian == 0x10)
 215         *drep = DREP_LITTLE_ENDIAN;
 216     else
 217         *drep &= ~DREP_LITTLE_ENDIAN;
 218
 219     drep_tmp = DREP_LITTLE_ENDIAN;
 220     offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, &drep_tmp,
 221             hf_typesz_commhdrlen, NULL);
 222     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, &drep_tmp,
 223             hf_typesz_filler, NULL);
 224     proto_item_set_len(sub_item, offset - old_offset);
 225
 226     /* Private Header */
 227     old_offset = offset;
 228     sub_item = proto_tree_add_item(tree, hf_typeszph, tvb, offset, 0, ENC_NA);
 229     sub_tree = proto_item_add_subtree(sub_item, ett_typeszprivhdr);
 230     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 231             hf_typesz_buflen, NULL);
 232     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 233             hf_typesz_filler, NULL);
 234     proto_item_set_len(sub_item, offset - old_offset);
 235
 236     return offset;
 237 }
 238
 239
 240
 241 static int
 242 dissect_dcom_Property_Guid(tvbuff_t *tvb, int offset, packet_info *pinfo,
 243                             proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 244 {
 245     property_guids_t *pg;
 246
 247     pg = (property_guids_t*)di->private_data;
 248
 249     if (pg->id_idx < MAX_ACTPROP_LIMIT) {
 250         offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
 251                 hf_sysact_actpropclsid, &pg->guid[pg->id_idx++]);
 252     }
 253     else {
 254         /* TODO: expert info */
 255         tvb_ensure_bytes_exist(tvb, offset, 16);
 256         offset += 16;
 257     }
 258
 259     return offset;
 260 }
 261
 262 static int
 263 dissect_dcom_ActivationPropertiesCustomerHdr_PropertyGuids(tvbuff_t *tvb, int offset,
 264         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 265 {
 266     offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, dissect_dcom_Property_Guid);
 267     return offset;
 268 }
 269
 270 static int
 271 dissect_dcom_Property_Size(tvbuff_t *tvb, int offset, packet_info *pinfo,
 272                             proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 273 {
 274     property_guids_t *pg;
 275
 276     pg = (property_guids_t*)di->private_data;
 277
 278     if (pg->size_idx < MAX_ACTPROP_LIMIT) {
 279         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 280                 hf_sysact_actpropsize, &pg->size[pg->size_idx++]);
 281     }
 282     else {
 283         /* TODO: expert info */
 284         tvb_ensure_bytes_exist(tvb, offset, 4);
 285         offset += 4;
 286     }
 287
 288     return offset;
 289 }
 290
 291 static int
 292 dissect_dcom_ActivationPropertiesCustomerHdr_PropertySizes(tvbuff_t *tvb, int offset,
 293         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 294 {
 295     offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, dissect_dcom_Property_Size);
 296     return offset;
 297 }
 298
 299 static int
 300 dissect_dcom_ActivationPropertiesCustomerHdr(tvbuff_t *tvb, int offset, packet_info *pinfo,
 301                        proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 302 {
 303     uint32_t  u32TotalSize;
 304     uint32_t  u32CustomHdrSize;
 305     uint32_t  u32ActPropNumber;
 306     int       old_offset;
 307
 308     proto_item *sub_item;
 309     proto_tree *sub_tree;
 310
 311     sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_commonheader, &sub_item, "CustomHeader");
 312
 313     old_offset = offset;
 314     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
 315
 316     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 317             hf_sysact_totalsize, &u32TotalSize);
 318     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 319             hf_sysact_customhdrsize, &u32CustomHdrSize);
 320     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 321             hf_sysact_res, NULL);
 322     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 323             hf_sysact_dstctx, NULL);
 324     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 325             hf_sysact_actpropnumber, &u32ActPropNumber);
 326     offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
 327             hf_sysact_actpropclsinfoid, NULL);
 328
 329     /* ClsIdPtr, SizesPtr */
 330     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 331             dissect_dcom_ActivationPropertiesCustomerHdr_PropertyGuids, NDR_POINTER_UNIQUE,
 332             "ClsIdPtr",hf_sysact_actpropclsid);
 333     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 334             dissect_dcom_ActivationPropertiesCustomerHdr_PropertySizes, NDR_POINTER_UNIQUE,
 335             "ClsSizesPtr",hf_sysact_actpropclsid);
 336     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 337             NULL, NDR_POINTER_UNIQUE, "OpaqueDataPtr: Pointer To NULL", 0);
 338
 339     dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 340     proto_item_set_len(sub_item, u32CustomHdrSize);
 341
 342     return old_offset + u32CustomHdrSize;
 343 }
 344
 345
 346 static int
 347 dissect_dcom_ActivationProperty(tvbuff_t *tvb, int offset, packet_info *pinfo,
 348                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, e_guid_t *clsid, int size)
 349 {
 350     dcom_dissect_fn_t routine = NULL;
 351
 352     /* the following data depends on the clsid, get the routine by clsid */
 353     routine = dcom_get_routine_by_uuid(clsid);
 354     if (routine){
 355         routine(tvb, offset, pinfo, tree, di, drep, size);
 356     }
 357
 358     return offset+size;
 359 }
 360
 361
 362
 363 static int
 364 dissect_dcom_ActivationPropertiesBody(tvbuff_t *tvb, int offset, packet_info *pinfo,
 365                        proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 366 {
 367     int       old_offset;
 368
 369     proto_item *sub_item;
 370     proto_tree *sub_tree;
 371     property_guids_t *pg;
 372     uint32_t i;
 373     uint32_t min_idx;
 374
 375     pg = (property_guids_t*)di->private_data;
 376
 377     if (pg->id_idx == pg->size_idx) {
 378         min_idx = pg->id_idx;
 379     }
 380     else {
 381         /* TODO: expert info */
 382         min_idx = MIN(pg->id_idx, pg->size_idx);
 383     }
 384
 385     sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_properties, &sub_item, "Properties");
 386
 387     old_offset = offset;
 388     for (i = 0; i < min_idx; i++) {
 389         offset = dissect_dcom_ActivationProperty(tvb, offset, pinfo, sub_tree, di, drep,
 390                                                     &pg->guid[i], pg->size[i]);
 391     }
 392     proto_item_set_len(sub_item, offset - old_offset);
 393
 394     return offset;
 395 }
 396
 397 static int
 398 dissect_dcom_ActivationProperties(tvbuff_t *tvb, int offset, packet_info *pinfo,
 399         proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size _U_)
 400 {
 401     proto_item *sub_item;
 402     proto_tree *sub_tree;
 403     property_guids_t *old_pg = NULL;
 404
 405     uint32_t   u32TotalSize;
 406     uint32_t   u32Res;
 407
 408     sub_item = proto_tree_add_item(tree, hf_sysact_actproperties, tvb, offset, 0, ENC_NA);
 409     sub_tree = proto_item_add_subtree(sub_item, ett_actproperties);
 410
 411     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 412             hf_sysact_totalsize, &u32TotalSize);
 413     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 414             hf_sysact_res, &u32Res);
 415
 416     old_pg = (property_guids_t*)di->private_data;
 417     di->private_data = wmem_new0(pinfo->pool, property_guids_t);
 418
 419     offset = dissect_dcom_ActivationPropertiesCustomerHdr(tvb, offset, pinfo, sub_tree, di, drep);
 420     offset = dissect_dcom_ActivationPropertiesBody(tvb, offset, pinfo, sub_tree, di, drep);
 421
 422     di->private_data = old_pg;
 423
 424     return offset;
 425 }
 426
 427
 428
 429 static int
 430 dissect_dcom_IStorage(tvbuff_t *tvb, int offset, packet_info *pinfo,
 431                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size _U_)
 432 {
 433     proto_item  *sub_item;
 434     proto_tree  *sub_tree;
 435     int         old_offset;
 436
 437     old_offset = offset;
 438     sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_istorage, &sub_item, "IStorage");
 439
 440     offset = dissect_dcom_OBJREF(tvb, offset, pinfo, sub_tree, di, drep, hf_sysact_istg, NULL);
 441
 442     proto_item_set_len(sub_item, offset - old_offset);
 443
 444     return offset;
 445 }
 446
 447 static int
 448 dissect_dcom_IContext(tvbuff_t *tvb, int offset, packet_info *pinfo,
 449                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size _U_)
 450 {
 451     proto_item  *sub_item;
 452     proto_tree  *sub_tree;
 453     int         old_offset;
 454
 455     uint32_t   u32Count;
 456
 457     old_offset = offset;
 458     sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_context, &sub_item, "Context");
 459
 460     offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, di, drep,
 461                 NULL, NULL);
 462     offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
 463             hf_sysact_ctx_id, NULL);
 464     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 465             hf_sysact_ctx_flags, NULL);
 466     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 467             hf_sysact_ctx_res, NULL);
 468     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 469             hf_sysact_ctx_numextents, NULL);
 470     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 471             hf_sysact_ctx_extentscnt, NULL);
 472     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 473             hf_sysact_ctx_mashflags, NULL);
 474     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 475             hf_sysact_ctx_count, &u32Count);
 476     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 477             hf_sysact_ctx_frozen, NULL);
 478
 479     if (u32Count) {
 480         /*PropMarshalHeader array*/
 481         /*TBD*/
 482     }
 483
 484     proto_item_set_len(sub_item, offset - old_offset);
 485
 486     return offset;
 487 }
 488
 489 static int
 490 dissect_dcom_SpecialSystemProperties(tvbuff_t *tvb, int offset, packet_info *pinfo,
 491                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
 492 {
 493     proto_tree *sub_tree, *tr;
 494     int old_offset, len, i;
 495
 496     old_offset = offset;
 497
 498     if (size <= 0) {
 499         /* TODO: expert info */
 500         size = -1;
 501     }
 502
 503     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_spclsysprop, NULL, "SpecialSystemProperties");
 504
 505     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
 506
 507     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 508             hf_sysact_spsysprop_sid, NULL);
 509     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 510             hf_sysact_spsysprop_remotethissid, NULL);
 511     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 512             hf_sysact_spsysprop_cltimpersonating, NULL);
 513     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 514             hf_sysact_spsysprop_partitionid, NULL);
 515     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 516             hf_sysact_spsysprop_defauthlvl, NULL);
 517     offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
 518             hf_sysact_spsysprop_partition, NULL);
 519     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 520             hf_sysact_spsysprop_procrqstflgs, NULL);
 521     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 522             hf_sysact_spsysprop_origclsctx, NULL);
 523     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 524             hf_sysact_spsysprop_flags, NULL);
 525 /*
 526  *
 527  *    offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 528  *            hf_sysact_spsysprop_procid, NULL);
 529  *    offset = dissect_dcom_I8(tvb, offset, pinfo, sub_tree, drep,
 530  *            hf_sysact_spsysprop_hwnd, NULL);
 531  *
 532  */
 533     tr = proto_tree_add_subtree(sub_tree, tvb, offset, sizeof(uint32_t)*8,
 534                              ett_dcom_reserved, NULL, "Reserved: 8 DWORDs");
 535     for (i = 0; i < 8; i++) {
 536         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tr, di, drep,
 537                 hf_sysact_res, NULL);
 538     }
 539
 540     len = offset - old_offset;
 541     if (size < len) {
 542         /* TODO expert info */
 543         size = len;
 544     }
 545     else if (size > len) {
 546         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
 547     }
 548
 549     offset = old_offset + size;
 550     return offset;
 551 }
 552
 553 static int
 554 dissect_dcom_InterfaceId(tvbuff_t *tvb, int offset, packet_info *pinfo,
 555                             proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 556 {
 557     offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
 558                         hf_sysact_instninfo_iid, NULL);
 559     return offset;
 560 }
 561
 562 static int
 563 dissect_InstantiationInfoIids(tvbuff_t *tvb, int offset,
 564         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 565 {
 566     offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
 567             dissect_dcom_InterfaceId);
 568
 569     return offset;
 570 }
 571
 572 static int
 573 dissect_dcom_InstantiationInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
 574                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
 575 {
 576     proto_tree *sub_tree;
 577     int old_offset, len;
 578
 579     old_offset = offset;
 580
 581     if (size <= 0) {
 582         /* TODO: expert info */
 583         size = -1;
 584     }
 585
 586     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_instantianinfo, NULL, "InstantiationInfo");
 587
 588     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
 589
 590     offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
 591             hf_sysact_instninfo_clsid, NULL);
 592     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 593             hf_sysact_instninfo_clsctx, NULL);
 594     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 595             hf_sysact_instninfo_actflags, NULL);
 596     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 597             hf_sysact_instninfo_issurrogate, NULL);
 598     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 599             hf_sysact_instninfo_iidcount, NULL);
 600     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 601             hf_sysact_instninfo_instflags, NULL);
 602
 603     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 604             dissect_InstantiationInfoIids, NDR_POINTER_UNIQUE,
 605             "InterfaceIdsPtr", -1);
 606
 607     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 608             hf_sysact_instninfo_entiresize, NULL);
 609     offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, di, drep,
 610             NULL, NULL);
 611
 612     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 613
 614     len = offset - old_offset;
 615     if (size < len) {
 616         /* TODO expert info */
 617         size = len;
 618     }
 619     else if (size > len) {
 620         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
 621     }
 622
 623     offset = old_offset + size;
 624     return offset;
 625 }
 626
 627 static int
 628 dissect_ActCtxInfo_PropCtx(tvbuff_t *tvb _U_, int offset,
 629         packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info *di _U_, uint8_t *drep _U_)
 630 {
 631     /*TBD*/
 632     return offset;
 633 }
 634
 635
 636 static int
 637 dissect_ActCtxInfo_CltCtx(tvbuff_t *tvb, int offset,
 638         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 639 {
 640     if (di->conformant_run) {
 641         return offset;
 642     }
 643
 644     offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep,
 645             hf_sysact_context, NULL);
 646     return offset;
 647 }
 648
 649 static int
 650 dissect_dcom_ActivationContextInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
 651                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
 652 {
 653     proto_tree *sub_tree;
 654     int old_offset, len;
 655
 656     old_offset = offset;
 657
 658     if (size <= 0) {
 659         /* TODO: expert info */
 660         size = -1;
 661     }
 662
 663     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_actctxinfo, NULL, "ActivationContextInfo");
 664
 665     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
 666
 667     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 668             hf_sysact_actctxinfo_cltok, NULL);
 669     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 670             hf_sysact_res, NULL);
 671     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 672             hf_sysact_res, NULL);
 673     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 674             hf_sysact_res, NULL);
 675
 676     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 677             dissect_ActCtxInfo_CltCtx, NDR_POINTER_UNIQUE,
 678             "ClientPtr", -1);
 679     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 680             dissect_ActCtxInfo_PropCtx, NDR_POINTER_UNIQUE,
 681             "PrototypePtr", -1);
 682     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 683
 684     len = offset - old_offset;
 685     if (size < len) {
 686         /* TODO expert info */
 687         size = len;
 688     }
 689     else if (size > len) {
 690         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
 691     }
 692
 693     offset = old_offset + size;
 694     return offset;
 695 }
 696
 697
 698 static int
 699 dissect_InstInfo_IfdROT(tvbuff_t *tvb _U_, int offset,
 700         packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info *di _U_, uint8_t *drep _U_)
 701 {
 702     /*TBD*/
 703     return offset;
 704 }
 705
 706
 707 static int
 708 dissect_InstInfo_IfdStg(tvbuff_t *tvb, int offset,
 709         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 710 {
 711     if (di->conformant_run) {
 712         return offset;
 713     }
 714
 715     offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep,
 716             hf_sysact_instinfo_stg, NULL);
 717     return offset;
 718 }
 719
 720
 721 static int
 722 dissect_dcom_InstanceInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
 723               proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
 724 {
 725     proto_tree *sub_tree;
 726     int old_offset, len;
 727
 728     old_offset = offset;
 729
 730     if (size <= 0) {
 731         /* TODO: expert info */
 732         size = -1;
 733     }
 734
 735     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_instanceinfo, NULL, "InstanceInfo");
 736
 737     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
 738
 739     /*
 740     typedef struct tagInstanceInfoData {
 741         [string] wchar_t* fileName;
 742         DWORD mode;
 743         MInterfacePointer* ifdROT;
 744         MInterfacePointer* ifdStg;
 745     } InstanceInfoData;
 746     */
 747
 748     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 749             dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "FileNamePtr",
 750             hf_sysact_li_string);
 751
 752     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 753             hf_sysact_instinfo_mode, NULL);
 754
 755     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 756             dissect_InstInfo_IfdROT, NDR_POINTER_UNIQUE,
 757             "ifdROTPtr", -1);
 758     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 759             dissect_InstInfo_IfdStg, NDR_POINTER_UNIQUE,
 760             "ifdStgPtr", -1);
 761     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 762
 763     len = offset - old_offset;
 764     if (size < len) {
 765         /* TODO expert info */
 766         size = len;
 767     }
 768     else if (size > len) {
 769         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
 770     }
 771
 772     offset = old_offset + size;
 773     return offset;
 774 }
 775
 776
 777 static int
 778 dissect_dcom_COSERVERINFO(tvbuff_t *tvb, int offset,
 779         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex)
 780 {
 781     proto_item *sub_item;
 782     proto_tree *sub_tree;
 783     int old_offset;
 784
 785     if (di->conformant_run) {
 786         return offset;
 787     }
 788
 789     sub_item = proto_tree_add_item(tree, hfindex, tvb, offset, 0, ENC_NA);
 790     sub_tree = proto_item_add_subtree(sub_item, ett_dcom_securityinfo);
 791
 792     old_offset = offset;
 793     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 794             hf_sysact_si_ci_res, NULL);
 795     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 796             dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Name(wstring)",
 797             hf_sysact_si_ci_string);
 798     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 799             NULL, NDR_POINTER_UNIQUE, "AuthInfoPtr", -1);
 800     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 801             hf_sysact_si_ci_res, NULL);
 802
 803     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 804
 805     proto_item_set_len(sub_item, offset - old_offset);
 806
 807     return offset;
 808 }
 809
 810 static int
 811 dissect_dcom_SI_ServerInfo(tvbuff_t *tvb, int offset,
 812         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 813 {
 814     offset = dissect_dcom_COSERVERINFO(tvb, offset, pinfo, tree, di, drep,
 815             hf_sysact_si_serverinfo);
 816     return offset;
 817 }
 818
 819 static int
 820 dissect_dcom_SecurtiyInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
 821                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
 822 {
 823     proto_tree *sub_tree;
 824     int old_offset, len;
 825
 826     old_offset = offset;
 827
 828     if (size <= 0) {
 829         /* TODO: expert info */
 830         size = -1;
 831     }
 832
 833     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_securityinfo, NULL, "SecurityInfo");
 834
 835     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di ,drep);
 836
 837     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 838             hf_sysact_si_authflalgs, NULL);
 839     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 840             dissect_dcom_SI_ServerInfo, NDR_POINTER_UNIQUE, "ServerInfoPtr", -1);
 841     /*This SHOULD be NULL and MUST be ignored on receipt*/
 842     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 843             NULL, NDR_POINTER_UNIQUE, "ReservedPtr", -1);
 844     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 845
 846     len = offset - old_offset;
 847     if (size < len) {
 848         /* TODO expert info */
 849         size = len;
 850     }
 851     else if (size > len) {
 852         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
 853     }
 854
 855     offset = old_offset + size;
 856     return offset;
 857 }
 858
 859 static int
 860 dissect_dcom_LocationInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
 861                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
 862 {
 863     proto_tree *sub_tree;
 864     int old_offset, len;
 865
 866     old_offset = offset;
 867
 868     if (size <= 0) {
 869         /* TODO: expert info */
 870         size = -1;
 871     }
 872
 873     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_locationinfo, NULL, "LocationInfo");
 874
 875     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
 876
 877     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 878             dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "MachineNamePtr",
 879             hf_sysact_li_string);
 880
 881     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 882             hf_sysact_li_procid, NULL);
 883     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 884             hf_sysact_li_apartid, NULL);
 885     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 886             hf_sysact_li_ctxid, NULL);
 887
 888     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 889
 890     len = offset - old_offset;
 891     if (size < len) {
 892         /* TODO expert info */
 893         size = len;
 894     }
 895     else if (size > len) {
 896         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
 897     }
 898
 899     offset = old_offset + size;
 900
 901     return offset;
 902 }
 903
 904 static int
 905 dissect_dcom_ProtoSeq(tvbuff_t *tvb, int offset, packet_info *pinfo,
 906                         proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 907 {
 908     offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, di, drep,
 909                         hf_sysact_sri_protseq, NULL);
 910
 911     return offset;
 912 }
 913
 914 static int
 915 dissect_dcom_ProtoSeqArray(tvbuff_t *tvb, int offset,
 916                     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 917 {
 918     offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
 919             dissect_dcom_ProtoSeq);
 920     return offset;
 921 }
 922
 923 static int
 924 dissect_dcom_customREMOTE_REQUEST_SCM_INFO(tvbuff_t *tvb, int offset,
 925         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 926 {
 927     proto_item *sub_item;
 928     proto_tree *sub_tree;
 929     int old_offset;
 930
 931     if (di->conformant_run) {
 932         return offset;
 933     }
 934
 935     sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_rmtrqst, &sub_item, "RemoteRequest");
 936
 937     old_offset = offset;
 938     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
 939             hf_sysact_sri_cltimplvl, NULL);
 940     offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, di, drep,
 941             hf_sysact_sri_protseqnum, NULL);
 942     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 943             dissect_dcom_ProtoSeqArray, NDR_POINTER_UNIQUE, "ProtocolSeqsArrayPtr", -1);
 944     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 945
 946     proto_item_set_len(sub_item, offset - old_offset);
 947
 948     return offset;
 949 }
 950
 951 static int
 952 dissect_dcom_ScmRqstInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
 953                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
 954 {
 955     proto_tree *sub_tree;
 956     int old_offset, len;
 957
 958     old_offset = offset;
 959
 960     if (size <= 0) {
 961         /* TODO: expert info */
 962         size = -1;
 963     }
 964
 965     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_scmrqstinfo, NULL, "ScmRequestInfo");
 966
 967     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
 968
 969     /*This MUST be set to NULL and MUST be ignored on receipt*/
 970     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 971             NULL, NDR_POINTER_UNIQUE, "Ptr", -1);
 972     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
 973             dissect_dcom_customREMOTE_REQUEST_SCM_INFO, NDR_POINTER_UNIQUE,
 974             "RemoteRequestPtr", -1);
 975     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 976
 977     len = offset - old_offset;
 978     if (size < len) {
 979         /* TODO expert info */
 980         size = len;
 981     }
 982     else if (size > len) {
 983         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
 984     }
 985
 986     offset = old_offset + size;
 987
 988     return offset;
 989 }
 990
 991 static int
 992 dissect_dcom_IfId(tvbuff_t *tvb, int offset, packet_info *pinfo,
 993                         proto_tree *tree, dcerpc_info *di, uint8_t *drep)
 994 {
 995     offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
 996             hf_sysact_pi_iid, NULL);
 997     return offset;
 998 }
 999
1000 static int
1001 dissect_dcom_IfIds(tvbuff_t *tvb, int offset,
1002                     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1003 {
1004     offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
1005             dissect_dcom_IfId);
1006     return offset;
1007 }
1008
1009 static int
1010 dissect_dcom_ReturnVal(tvbuff_t *tvb, int offset, packet_info *pinfo,
1011                             proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1012 {
1013     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
1014                         hf_sysact_pi_retval, NULL);
1015     return offset;
1016 }
1017
1018 static int
1019 dissect_dcom_ReturnVals(tvbuff_t *tvb, int offset,
1020         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1021 {
1022     offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
1023             dissect_dcom_ReturnVal);
1024     return offset;
1025 }
1026
1027 static int
1028 dissect_OneInterfData(tvbuff_t *tvb, int offset,
1029         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1030 {
1031     offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep,
1032             hf_sysact_pi_interf, NULL);
1033     return offset;
1034 }
1035
1036 static int
1037 dissect_dcom_OneInterfDataPtr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1038                             proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1039 {
1040     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep,
1041             dissect_OneInterfData, NDR_POINTER_UNIQUE, "InterfacePtr", -1);
1042     return offset;
1043 }
1044
1045 /*
1046  * This MUST be an array of MInterfacePointer pointers containing the OBJREFs for
1047  * the interfaces returned by the server.
1048  */
1049 static int
1050 dissect_dcom_InterfData(tvbuff_t *tvb, int offset,
1051         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1052 {
1053     offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
1054             dissect_dcom_OneInterfDataPtr);
1055     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1056     return offset;
1057 }
1058
1059 static int
1060 dissect_dcom_PropsOutInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
1061                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
1062 {
1063     proto_tree *sub_tree;
1064     int old_offset, len;
1065
1066     old_offset = offset;
1067
1068     if (size <= 0) {
1069         /* TODO: expert info */
1070         size = -1;
1071     }
1072
1073     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_propsoutput, NULL, "PropertiesOutput");
1074
1075     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
1076
1077     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
1078             hf_sysact_pi_ifnum, NULL);
1079
1080     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1081             dissect_dcom_IfIds, NDR_POINTER_UNIQUE, "InterfaceIdsPtr", -1);
1082     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1083             dissect_dcom_ReturnVals, NDR_POINTER_UNIQUE, "ReturnValuesPtr", -1);
1084     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1085             dissect_dcom_InterfData, NDR_POINTER_UNIQUE, "InterfacePtrsPtr", -1);
1086     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1087
1088     len = offset - old_offset;
1089     if (size < len) {
1090         /* TODO expert info */
1091         size = len;
1092     }
1093     else if (size > len) {
1094         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
1095     }
1096
1097     offset = old_offset + size;
1098
1099     return offset;
1100 }
1101
1102
1103 /*
1104  *typedef struct tagDUALSTRINGARRAY {
1105  *  unsigned short wNumEntries;
1106  *  unsigned short wSecurityOffset;
1107  *  [size_is(wNumEntries)] unsigned short aStringArray[];
1108  *} DUALSTRINGARRAY;
1109  */
1110 static int
1111 dissect_dcom_OxidBindings(tvbuff_t *tvb, int offset,
1112                     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1113 {
1114     proto_item *sub_item;
1115     proto_tree *sub_tree;
1116     int old_offset;
1117
1118     if (di->conformant_run) {
1119         return offset;
1120     }
1121
1122     old_offset = offset;
1123     sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_oxidbinding, &sub_item, "OxidBindings");
1124
1125     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, sub_tree, di, drep, NULL);
1126     offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, sub_tree, di, drep,
1127             hf_sysact_scmri_binding, NULL);
1128
1129     proto_item_set_len(sub_item, offset - old_offset);
1130     return offset;
1131 }
1132
1133
1134 static int
1135 dissect_dcom_customREMOTE_REPLY_SCM_INFO(tvbuff_t *tvb, int offset,
1136         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1137 {
1138     proto_item *sub_item;
1139     proto_tree *sub_tree;
1140     int old_offset;
1141
1142     if (di->conformant_run) {
1143         return offset;
1144     }
1145
1146     sub_tree = proto_tree_add_subtree(tree, tvb, offset, 0, ett_dcom_rmtresp, &sub_item, "RemoteReply");
1147
1148     old_offset = offset;
1149     offset = dissect_dcom_ID(tvb, offset, pinfo, sub_tree, di, drep,
1150             hf_sysact_scmri_oxid, NULL);
1151     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1152             dissect_dcom_OxidBindings, NDR_POINTER_UNIQUE, "OxidBindingsPtr", -1);
1153     offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, di, drep,
1154             hf_sysact_scmri_rmtunknid, NULL);
1155     offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, di, drep,
1156             hf_sysact_scmri_authhint, NULL);
1157     offset = dissect_dcom_COMVERSION(tvb, offset, pinfo, sub_tree, di, drep,
1158                 NULL, NULL);
1159     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1160
1161     proto_item_set_len(sub_item, offset - old_offset);
1162
1163     return offset;
1164 }
1165
1166
1167 static int
1168 dissect_dcom_ScmReplyInfo(tvbuff_t *tvb, int offset, packet_info *pinfo,
1169                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int size)
1170 {
1171     proto_tree *sub_tree;
1172     int old_offset, len;
1173
1174     old_offset = offset;
1175
1176     if (size <= 0) {
1177         /* TODO: expert info */
1178         size = -1;
1179     }
1180
1181     sub_tree = proto_tree_add_subtree(tree, tvb, offset, size, ett_dcom_scmrespinfo, NULL, "ScmReplyInfo");
1182
1183     offset = dissect_TypeSzCommPrivHdr(tvb, offset, pinfo, sub_tree, di, drep);
1184
1185     /*This MUST be set to NULL and MUST be ignored on receipt*/
1186     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1187             NULL, NDR_POINTER_UNIQUE, "Ptr", -1);
1188     offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, sub_tree, di, drep,
1189             dissect_dcom_customREMOTE_REPLY_SCM_INFO, NDR_POINTER_UNIQUE,
1190             "RemoteRequestPtr", -1);
1191     offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1192
1193     len = offset - old_offset;
1194     if (size < len) {
1195         /* TODO expert info */
1196         size = len;
1197     }
1198     else if (size > len) {
1199         proto_tree_add_item(sub_tree, hf_sysact_unused_buffer, tvb, offset, size - len, ENC_NA);
1200     }
1201
1202     offset = old_offset + size;
1203
1204     return offset;
1205 }
1206
1207 static void
1208 sysact_register_routines(void)
1209 {
1210     dcom_register_routine(dissect_dcom_ActivationProperties, &iid_ActivationPropertiesIn);
1211     dcom_register_routine(dissect_dcom_ActivationProperties, &iid_ActivationPropertiesOut);
1212     dcom_register_routine(dissect_dcom_SpecialSystemProperties, &clsid_SpecialSystemProperties);
1213     dcom_register_routine(dissect_dcom_InstantiationInfo, &clsid_InstantiationInfo);
1214     dcom_register_routine(dissect_dcom_ActivationContextInfo, &clsid_ActivationContextInfo);
1215     dcom_register_routine(dissect_dcom_IContext, &iid_IContext);
1216     dcom_register_routine(dissect_dcom_SecurtiyInfo, &clsid_SecurityInfo);
1217     dcom_register_routine(dissect_dcom_LocationInfo, &clsid_ServerLocationInfo);
1218     dcom_register_routine(dissect_dcom_ScmRqstInfo, &clsid_ScmRequestInfo);
1219     dcom_register_routine(dissect_dcom_PropsOutInfo, &clsid_PropsOutInfo);
1220     dcom_register_routine(dissect_dcom_ScmReplyInfo, &clsid_ScmReplyInfo);
1221     dcom_register_routine(dissect_dcom_InstanceInfo, &clsid_InstanceInfo);
1222     dcom_register_routine(dissect_dcom_IStorage, &iid_IStorage);
1223
1224     return;
1225 }
1226
1227 static int
1228 dissect_remsysact_remotecreateinstance_rqst(tvbuff_t *tvb, int offset,
1229     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1230 {
1231
1232     sysact_register_routines();
1233
1234     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1235
1236     /* XXX - what is this? */
1237     offset = dissect_dcom_nospec_data(tvb, offset, pinfo, tree, drep, 4);
1238     offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
1239                         hf_sysact_actproperties, NULL /* XXX */);
1240     return offset;
1241 }
1242
1243 static int
1244 dissect_remsysact_remotecreateinstance_resp(tvbuff_t *tvb, int offset,
1245     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1246 {
1247     sysact_register_routines();
1248
1249     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1250
1251     offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
1252                         hf_sysact_actproperties, NULL /* XXX */);
1253
1254     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1255                      NULL /* pu32HResult */);
1256
1257     return offset;
1258 }
1259
1260 static int
1261 dissect_remsysact_remotegetclassobject_rqst(tvbuff_t *tvb, int offset,
1262     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1263 {
1264     sysact_register_routines();
1265
1266     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
1267     offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
1268                         hf_sysact_actproperties, NULL);
1269
1270     return offset;
1271 }
1272
1273 static int
1274 dissect_remsysact_remotegetclassobject_resp(tvbuff_t *tvb, int offset,
1275     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep)
1276 {
1277     sysact_register_routines();
1278
1279     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
1280
1281     offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, di, drep,
1282                         hf_sysact_actproperties, NULL);
1283
1284     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
1285                      NULL /* pu32HResult */);
1286
1287     return offset;
1288 }
1289
1290 static const dcerpc_sub_dissector ISystemActivator_dissectors[] = {
1291     { 0, "QueryInterfaceIRemoteSCMActivator", NULL, NULL },
1292     { 1, "AddRefIRemoteISCMActivator", NULL, NULL },
1293     { 2, "ReleaseIRemoteISCMActivator", NULL, NULL },
1294     { 3, "RemoteGetClassObject", dissect_remsysact_remotegetclassobject_rqst, dissect_remsysact_remotegetclassobject_resp },
1295     { 4, "RemoteCreateInstance", dissect_remsysact_remotecreateinstance_rqst, dissect_remsysact_remotecreateinstance_resp },
1296     { 0, NULL, NULL, NULL },
1297 };
1298
1299 void
1300 proto_register_ISystemActivator (void)
1301 {
1302     /* fields */
1303     static hf_register_info hf[] = {
1304         { &hf_opnum,
1305           { "Operation", "isystemactivator.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1306         { &hf_sysact_actproperties,
1307         { "IActProperties", "isystemactivator.actproperties", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1308 #if 0
1309         { &hf_sysact_unknown,
1310         { "IUnknown", "isystemactivator.unknown", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1311 #endif
1312     };
1313
1314     static hf_register_info hf_actproperties[] = {
1315         { &hf_sysact_totalsize,
1316         { "Totalsize", "isystemactivator.actproperties.size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1317         { &hf_sysact_res,
1318         { "Reserved", "isystemactivator.actproperties.resv", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1319
1320         { &hf_sysact_customhdrsize,
1321         { "CustomHeaderSize", "isystemactivator.customhdr.size", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1322         { &hf_sysact_dstctx,
1323         { "DestinationContext", "isystemactivator.customhdr.dc", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1324         { &hf_sysact_actpropnumber,
1325         { "NumActivationPropertyStructs", "isystemactivator.customhdr.actpropnumber", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1326         { &hf_sysact_actpropclsinfoid,
1327         { "ClassInfoClsid", "isystemactivator.customhdr.clsinfoid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1328 #if 0
1329         { &hf_sysact_actpropclsids,
1330         { "PropertyGuids", "isystemactivator.customhdr.clsids", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1331 #endif
1332         { &hf_sysact_actpropclsid,
1333         { "PropertyStructGuid", "isystemactivator.customhdr.clsid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1334 #if 0
1335         { &hf_sysact_actpropsizes,
1336         { "PropertyDataSizes", "isystemactivator.customhdr.datasizes", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1337 #endif
1338         { &hf_sysact_actpropsize,
1339         { "PropertyDataSize", "isystemactivator.customhdr.datasize", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1340
1341         /*SpecialSystemProperties*/
1342         { &hf_sysact_spsysprop_sid,
1343         { "SessionID", "isystemactivator.properties.spcl.sid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, "A value that uniquely identifies a logon session on the server", HFILL }},
1344         { &hf_sysact_spsysprop_remotethissid,
1345         { "RemoteThisSessionID", "isystemactivator.properties.spcl.remotesid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1346         { &hf_sysact_spsysprop_cltimpersonating,
1347         { "ClientImpersonating", "isystemactivator.properties.spcl.cltimp", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1348         { &hf_sysact_spsysprop_partitionid,
1349         { "PartitionIDPresent", "isystemactivator.properties.spcl.partitionid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1350         { &hf_sysact_spsysprop_defauthlvl,
1351         { "DefaultAuthnLevel", "isystemactivator.properties.spcl.defauthlvl", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1352         { &hf_sysact_spsysprop_partition,
1353         { "PartitionGuid", "isystemactivator.properties.spcl.partition", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1354         { &hf_sysact_spsysprop_procrqstflgs,
1355         { "ProcessRequestFlags", "isystemactivator.properties.spcl.procreqstflgs", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1356         { &hf_sysact_spsysprop_origclsctx,
1357         { "OriginalClassContext", "isystemactivator.properties.spcl.origclsctx", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1358         { &hf_sysact_spsysprop_flags,
1359         { "Flags", "isystemactivator.properties.spcl.flags", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1360 #if 0
1361         { &hf_sysact_spsysprop_procid,
1362         { "ProcessID", "isystemactivator.properties.spcl.procid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1363 #endif
1364 #if 0
1365         { &hf_sysact_spsysprop_hwnd,
1366         { "hWnd", "isystemactivator.properties.spcl.hwnd", FT_UINT64, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1367 #endif
1368
1369         /*InstantiationInfo*/
1370         { &hf_sysact_instninfo_clsid,
1371         { "InstantiatedObjectClsId", "isystemactivator.properties.instninfo.clsid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1372         { &hf_sysact_instninfo_clsctx,
1373         { "ClassContext", "isystemactivator.properties.instninfo.clsctx", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1374         { &hf_sysact_instninfo_actflags,
1375         { "ActivationFlags", "isystemactivator.properties.instninfo.actflags", FT_UINT32, BASE_DEC_HEX, VALS(instninfo_actflags), 0x0, NULL, HFILL }},
1376         { &hf_sysact_instninfo_issurrogate,
1377         { "FlagsSurrogate", "isystemactivator.properties.instninfo.issurogate", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1378         { &hf_sysact_instninfo_iidcount,
1379         { "InterfaceIdCount", "isystemactivator.properties.instninfo.iidcount", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1380         { &hf_sysact_instninfo_instflags,
1381         { "InstantiationFlag", "isystemactivator.properties.instninfo.instflags", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1382         { &hf_sysact_instninfo_entiresize,
1383         { "EntirePropertySize", "isystemactivator.properties.instninfo.entiresize", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1384         { &hf_sysact_instninfo_iid,
1385         { "InterfaceIds", "isystemactivator.properties.instninfo.iid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1386
1387         /*ActivationContextInfo*/
1388         { &hf_sysact_actctxinfo_cltok,
1389         { "ClientOk", "isystemactivator.properties.actctxinfo.cltok", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1390         { &hf_sysact_context,
1391         { "ClientContext", "isystemactivator.properties.context", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1392
1393         /*InstanceInfo*/
1394         { &hf_sysact_instinfo_mode,
1395         { "Mode", "isystemactivator.properties.instinfo.mode", FT_INT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1396         { &hf_sysact_instinfo_stg,
1397         { "IfdStg", "isystemactivator.properties.instinfo.ifdstg", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1398
1399         /*IStorage*/
1400         { &hf_sysact_istg,
1401         { "IStorage", "isystemactivator.properties.istg", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1402
1403         /*dcom Context*/
1404         { &hf_sysact_ctx_id,
1405         { "ContextID", "isystemactivator.properties.context.id", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1406         { &hf_sysact_ctx_flags,
1407         { "Flags", "isystemactivator.properties.context.flags", FT_UINT32, BASE_HEX, VALS(dcom_context_flag_vals), 0x0, NULL, HFILL }},
1408         { &hf_sysact_ctx_res,
1409         { "Reserved", "isystemactivator.properties.context.res", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1410         { &hf_sysact_ctx_numextents,
1411         { "NumExtents", "isystemactivator.properties.context.numext", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1412         { &hf_sysact_ctx_extentscnt,
1413         { "ExtentCount", "isystemactivator.properties.context.extcnt", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1414         { &hf_sysact_ctx_mashflags,
1415         { "MarshalFlags", "isystemactivator.properties.context.mashflags", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1416         { &hf_sysact_ctx_count,
1417         { "ContextPropertyCount", "isystemactivator.properties.context.cnt", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1418         { &hf_sysact_ctx_frozen,
1419         { "Frozen", "isystemactivator.properties.context.frz", FT_UINT32, BASE_HEX, VALS(boolean_flag_vals), 0x0, NULL, HFILL }},
1420
1421         /*Security Info*/
1422         { &hf_sysact_si_authflalgs,
1423         { "AuthenticationFlags", "isystemactivator.properties.si.authflags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1424         { &hf_sysact_si_serverinfo,
1425         { "ServerInfo", "isystemactivator.properties.si.ci", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1426         { &hf_sysact_si_ci_res,
1427         { "Reserved", "isystemactivator.properties.si.ci.res", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1428         { &hf_sysact_si_ci_string,
1429         { "String", "isystemactivator.properties.si.ci.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1430
1431         /*Location info*/
1432         { &hf_sysact_li_string,
1433         { "String", "isystemactivator.properties.li.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1434         { &hf_sysact_li_procid,
1435         { "ProcessId", "isystemactivator.properties.li.procid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1436         { &hf_sysact_li_apartid,
1437         { "ApartmentId", "isystemactivator.properties.li.apartid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1438         { &hf_sysact_li_ctxid,
1439         { "ContextId", "isystemactivator.properties.li.ctxid", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL }},
1440
1441         /*ScmRequst info*/
1442         { &hf_sysact_sri_cltimplvl,
1443         { "ClientImpersonationLevel", "isystemactivator.properties.sri.cltimplvl", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1444         { &hf_sysact_sri_protseqnum,
1445         { "NumProtocolSequences", "isystemactivator.properties.sri.protseqnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1446         { &hf_sysact_sri_protseq,
1447         { "ProtocolSeq", "isystemactivator.properties.sri.protseq", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1448
1449         /*PropsOutInfo*/
1450         { &hf_sysact_pi_ifnum,
1451         { "NumInterfaces", "isystemactivator.properties.pi.ifnum", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1452         { &hf_sysact_pi_retval,
1453         { "ReturnValue", "isystemactivator.properties.retval", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1454         { &hf_sysact_pi_interf,
1455         { "Interface", "isystemactivator.properties.interf", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1456         { &hf_sysact_pi_iid,
1457         { "IID", "isystemactivator.properties.iid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1458
1459         /*ScmReply info*/
1460         { &hf_sysact_scmri_rmtunknid,
1461         { "IRemUnknownInterfacePointerId", "isystemactivator.properties.scmresp.rmtunknid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1462         { &hf_sysact_scmri_authhint,
1463         { "AuthenticationHint", "isystemactivator.properties.scmresp.authhint", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1464         { &hf_sysact_scmri_binding,
1465         { "Bindings", "isystemactivator.properties.scmresp.binding", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1466         { &hf_sysact_scmri_oxid,
1467         { "OXID", "isystemactivator.properties.scmresp.oxid", FT_UINT64, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1468         { &hf_sysact_unused_buffer,
1469         { "Unused buffer", "isystemactivator.unused_buffer", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1470     };
1471
1472     static hf_register_info hf_tshdr[] = {
1473         { &hf_typeszch,
1474         { "CommonHeader", "isystemactivator.actproperties.ts.hdr", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1475         { &hf_typeszph,
1476         { "PrivateHeader", "isystemactivator.actproperties.ts.hdr", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
1477         { &hf_typesz_ver,
1478         { "Version", "isystemactivator.actproperties.ts.ver", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1479         { &hf_typesz_endianness,
1480         { "Endianness", "isystemactivator.actproperties.ts.end", FT_UINT8, BASE_HEX, VALS(ts_endian_vals), 0x0, NULL, HFILL }},
1481         { &hf_typesz_commhdrlen,
1482         { "CommonHeaderLength", "isystemactivator.actproperties.ts.chl", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1483         { &hf_typesz_filler,
1484         { "Filler", "isystemactivator.actproperties.ts.fil", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
1485         { &hf_typesz_buflen,
1486         { "ObjectBufferLength", "isystemactivator.actproperties.ts.buflen", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
1487     };
1488
1489
1490     /* Tree */
1491     static int *ett[] = {
1492         &ett_isystemactivator,
1493         &ett_actproperties,
1494         &ett_properties,
1495         &ett_commonheader,
1496         &ett_propguids,
1497         &ett_typeszcommhdr,
1498         &ett_typeszprivhdr,
1499         &ett_dcom_spclsysprop,
1500         &ett_dcom_reserved,
1501         &ett_dcom_instantianinfo,
1502         &ett_dcom_actctxinfo,
1503         &ett_dcom_instanceinfo,
1504         &ett_dcom_istorage,
1505         &ett_dcom_context,
1506         &ett_dcom_securityinfo,
1507         &ett_dcom_locationinfo,
1508         &ett_dcom_scmrqstinfo,
1509         &ett_dcom_rmtrqst,
1510
1511         &ett_dcom_propsoutput,
1512         &ett_dcom_scmrespinfo,
1513         &ett_dcom_rmtresp,
1514         &ett_dcom_oxidbinding,
1515
1516     };
1517
1518     proto_ISystemActivator = proto_register_protocol ("ISystemActivator ISystemActivator Resolver", "ISystemActivator", "isystemactivator");
1519     proto_register_field_array (proto_ISystemActivator, hf, array_length (hf));
1520     proto_register_field_array (proto_ISystemActivator, hf_actproperties, array_length (hf_actproperties));
1521     proto_register_field_array(proto_ISystemActivator, hf_tshdr, array_length(hf_tshdr));
1522     proto_register_subtree_array (ett, array_length (ett));
1523 }
1524
1525 void
1526 proto_reg_handoff_ISystemActivator (void)
1527 {
1528     /* Register the protocol as dcerpc */
1529     dcerpc_init_uuid (proto_ISystemActivator, ett_isystemactivator, &uuid_ISystemActivator,
1530             ver_ISystemActivator, ISystemActivator_dissectors, hf_opnum);
1531 }
1532
1533 /*
1534  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
1535  *
1536  * Local variables:
1537  * c-basic-offset: 4
1538  * tab-width: 8
1539  * indent-tabs-mode: nil
1540  * End:
1541  *
1542  * vi: set shiftwidth=4 tabstop=8 expandtab:
1543  * :indentSize=4:tabSize=8:noTabs=true:
1544  */