epan/dissectors/packet-windows-common.c

   1 /* packet-windows-common.c
   2  * Routines for dissecting various Windows data types
   3  *
   4  * Wireshark - Network traffic analyzer
   5  * By Gerald Combs <gerald@wireshark.org>
   6  * Copyright 1998 Gerald Combs
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 #include "config.h"
  12
  13
  14 #include <epan/packet.h>
  15 #include <epan/expert.h>
  16 #include <epan/exceptions.h>
  17 #include "packet-smb-sidsnooping.h"
  18 #include "packet-windows-common.h"
  19 #include <epan/tfs.h>
  20 #include <wsutil/array.h>
  21 #include "packet-smb.h" /* for "sid_name_snooping" */
  22
  23 /* The types used in [MS-DTYP] v20180912 should be interpreted as
  24  * follows (all multi-byte integer types are little endian):
  25  * typedef uint8_t MS_BYTE;
  26  * typedef uint16_t MS_WORD;
  27  * typedef uint32_t MS_DWORD;
  28  * typedef uint64_t MS_QWORD;
  29  * typedef uint64_t MS_ULONG64;
  30  * typedef uint64_t MS_DWORD64;
  31  * typedef int64_t MS_LONG64;
  32  */
  33
  34 enum cond_ace_token {
  35 #define DEF_COND_ACE_TOKEN(VAL, VAR, STR) COND_ACE_TOKEN_ ## VAR = VAL,
  36 #define DEF_COND_ACE_TOKEN_WITH_DATA DEF_COND_ACE_TOKEN
  37 #include "cond_ace_token_enum.h"
  38         COND_ACE_TOKEN_UNKNOWN = -1
  39 };
  40
  41 static const value_string ace_cond_token_vals[] = {
  42 #define DEF_COND_ACE_TOKEN(VAL, VAR, STR) {VAL, STR},
  43 #define DEF_COND_ACE_TOKEN_WITH_DATA DEF_COND_ACE_TOKEN
  44 #include "cond_ace_token_enum.h"
  45         { 0, NULL }
  46 };
  47
  48 static bool
  49 ace_cond_token_has_data(uint8_t token) {
  50         switch (token) {
  51 #define DEF_COND_ACE_TOKEN(VAL, VAR, STR)
  52 #define DEF_COND_ACE_TOKEN_WITH_DATA(VAL, VAR, STR) case VAL:
  53 #include "cond_ace_token_enum.h"
  54                 return true;
  55         }
  56         return false;
  57 }
  58
  59 static const value_string ace_cond_base_vals[] = {
  60         { 0x01, "OCT" },
  61         { 0x02, "DEC" },
  62         { 0x03, "HEX" },
  63         { 0, NULL }
  64 };
  65
  66 static const value_string ace_cond_sign_vals[] = {
  67         { 0x01, "PLUS" },
  68         { 0x02, "MINUS" },
  69         { 0x03, "NONE" },
  70         { 0, NULL }
  71 };
  72
  73
  74 #define CLAIM_SECURITY_ATTRIBUTE_TYPE_INT64           0x0001
  75 #define CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64          0x0002
  76 #define CLAIM_SECURITY_ATTRIBUTE_TYPE_STRING          0x0003
  77 #define CLAIM_SECURITY_ATTRIBUTE_TYPE_SID             0x0005
  78 #define CLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN         0x0006
  79 #define CLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING    0x0010
  80
  81 static const value_string ace_sra_type_vals[] = {
  82         { CLAIM_SECURITY_ATTRIBUTE_TYPE_INT64, "INT64" },
  83         { CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64, "UINT64" },
  84         { CLAIM_SECURITY_ATTRIBUTE_TYPE_STRING, "STRING" },
  85         { CLAIM_SECURITY_ATTRIBUTE_TYPE_SID, "SID"},
  86         { CLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN, "BOOLEAN" },
  87         { CLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING, "OCTET_STRING" },
  88         { 0, NULL }
  89 };
  90
  91 static int hf_nt_sec_desc_revision;
  92 static int hf_nt_sec_desc_type_owner_defaulted;
  93 static int hf_nt_sec_desc_type_group_defaulted;
  94 static int hf_nt_sec_desc_type_dacl_present;
  95 static int hf_nt_sec_desc_type_dacl_defaulted;
  96 static int hf_nt_sec_desc_type_sacl_present;
  97 static int hf_nt_sec_desc_type_sacl_defaulted;
  98 static int hf_nt_sec_desc_type_dacl_trusted;
  99 static int hf_nt_sec_desc_type_server_security;
 100 static int hf_nt_sec_desc_type_dacl_auto_inherit_req;
 101 static int hf_nt_sec_desc_type_sacl_auto_inherit_req;
 102 static int hf_nt_sec_desc_type_dacl_auto_inherited;
 103 static int hf_nt_sec_desc_type_sacl_auto_inherited;
 104 static int hf_nt_sec_desc_type_dacl_protected;
 105 static int hf_nt_sec_desc_type_sacl_protected;
 106 static int hf_nt_sec_desc_type_rm_control_valid;
 107 static int hf_nt_sec_desc_type_self_relative;
 108 static int hf_nt_sid;
 109 static int hf_nt_sid_revision;
 110 static int hf_nt_sid_num_auth;
 111 static int hf_nt_sid_auth_dec;
 112 static int hf_nt_sid_auth_hex;
 113 static int hf_nt_sid_subauth;
 114 static int hf_nt_sid_rid_dec;
 115 static int hf_nt_sid_rid_hex;
 116 static int hf_nt_sid_wkwn;
 117 static int hf_nt_sid_domain;
 118 static int hf_nt_acl_revision;
 119 static int hf_nt_acl_size;
 120 static int hf_nt_acl_num_aces;
 121 static int hf_nt_ace_flags_object_inherit;
 122 static int hf_nt_ace_flags_container_inherit;
 123 static int hf_nt_ace_flags_non_propagate_inherit;
 124 static int hf_nt_ace_flags_inherit_only;
 125 static int hf_nt_ace_flags_inherited_ace;
 126 static int hf_nt_ace_flags_successful_access;
 127 static int hf_nt_ace_flags_failed_access;
 128 static int hf_nt_ace_type;
 129 static int hf_nt_ace_size;
 130 static int hf_nt_ace_flags_object_type_present;
 131 static int hf_nt_ace_flags_inherited_object_type_present;
 132 static int hf_nt_ace_guid;
 133 static int hf_nt_ace_inherited_guid;
 134
 135 /* Conditional ACE dissect */
 136 static int hf_nt_ace_cond;
 137 static int hf_nt_ace_cond_token;
 138 static int hf_nt_ace_cond_sign;
 139 static int hf_nt_ace_cond_base;
 140 static int hf_nt_ace_cond_value_int8;
 141 static int hf_nt_ace_cond_value_int16;
 142 static int hf_nt_ace_cond_value_int32;
 143 static int hf_nt_ace_cond_value_int64;
 144 static int hf_nt_ace_cond_value_string;
 145 static int hf_nt_ace_cond_value_octet_string;
 146 static int hf_nt_ace_cond_local_attr;
 147 static int hf_nt_ace_cond_user_attr;
 148 static int hf_nt_ace_cond_resource_attr;
 149 static int hf_nt_ace_cond_device_attr;
 150
 151 /* System Resource Attribute ACE dissect */
 152 static int hf_nt_ace_sra;
 153 static int hf_nt_ace_sra_name_offset;
 154 static int hf_nt_ace_sra_name;
 155 static int hf_nt_ace_sra_type;
 156 static int hf_nt_ace_sra_reserved;
 157 static int hf_nt_ace_sra_flags;
 158 static int hf_nt_ace_sra_flags_manual;
 159 static int hf_nt_ace_sra_flags_policy_derived;
 160 static int hf_nt_ace_sra_flags_non_inheritable;
 161 static int hf_nt_ace_sra_flags_case_sensitive;
 162 static int hf_nt_ace_sra_flags_deny_only;
 163 static int hf_nt_ace_sra_flags_disabled_by_default;
 164 static int hf_nt_ace_sra_flags_disabled;
 165 static int hf_nt_ace_sra_flags_mandatory;
 166 static int hf_nt_ace_sra_value_count;
 167 static int hf_nt_ace_sra_value_offset;
 168 static int hf_nt_ace_sra_value_int64;
 169 static int hf_nt_ace_sra_value_uint64;
 170 static int hf_nt_ace_sra_value_string;
 171 static int hf_nt_ace_sra_value_sid;
 172 static int hf_nt_ace_sra_value_boolean;
 173 static int hf_nt_ace_sra_value_octet_string;
 174
 175 static int hf_nt_security_information_sacl;
 176 static int hf_nt_security_information_dacl;
 177 static int hf_nt_security_information_group;
 178 static int hf_nt_security_information_owner;
 179
 180 /* Generated from convert_proto_tree_add_text.pl */
 181 static int hf_nt_security_information;
 182 static int hf_nt_sec_desc_type;
 183 static int hf_nt_offset_to_dacl;
 184 static int hf_nt_offset_to_owner_sid;
 185 static int hf_nt_ace_flags_object;
 186 static int hf_nt_offset_to_group_sid;
 187 static int hf_nt_ace_flags;
 188 static int hf_nt_offset_to_sacl;
 189
 190 static int ett_nt_sec_desc;
 191 static int ett_nt_sec_desc_type;
 192 static int ett_nt_sid;
 193 static int ett_nt_acl;
 194 static int ett_nt_ace;
 195 static int ett_nt_ace_flags;
 196 static int ett_nt_ace_object;
 197 static int ett_nt_ace_object_flags;
 198 static int ett_nt_security_information;
 199 static int ett_nt_ace_cond;
 200 static int ett_nt_ace_cond_data;
 201 static int ett_nt_ace_sra;
 202 static int ett_nt_ace_sra_flags;
 203 static int ett_nt_ace_sra_value_offsets;
 204 static int ett_nt_ace_sra_values;
 205
 206 static expert_field ei_nt_owner_sid_beyond_data;
 207 static expert_field ei_nt_owner_sid_beyond_reassembled_data;
 208 static expert_field ei_nt_ace_extends_beyond_data;
 209 static expert_field ei_nt_ace_extends_beyond_reassembled_data;
 210 static expert_field ei_nt_group_sid_beyond_data;
 211 static expert_field ei_nt_group_sid_beyond_reassembled_data;
 212 static expert_field ei_nt_item_offs_out_of_range;
 213
 214
 215 /* WERR error codes */
 216
 217 VALUE_STRING_ARRAY2(WERR_errors);
 218 value_string_ext WERR_errors_ext = VALUE_STRING_EXT_INIT(WERR_errors);
 219
 220 /*
 221  * HRES error codes.
 222  */
 223
 224 VALUE_STRING_ARRAY2(HRES_errors);
 225 value_string_ext HRES_errors_ext = VALUE_STRING_EXT_INIT(HRES_errors);
 226
 227
 228 /*
 229  * DOS error codes.
 230  */
 231
 232 VALUE_STRING_ARRAY(DOS_errors);
 233 value_string_ext DOS_errors_ext = VALUE_STRING_EXT_INIT(DOS_errors);
 234
 235 /*
 236  * NT error codes.
 237  *
 238  * From
 239  *
 240  *      https://web.archive.org/web/20100503121824/http://www.wildpackets.com/elements/misc/SMB_NT_Status_Codes.txt
 241  *
 242  * See also MS-ERREF section 2.3.1 "NTSTATUS Values":
 243  *
 244  *      https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
 245  */
 246 static const value_string NT_errors[] = {
 247         { 0x00000000, "STATUS_SUCCESS" },
 248         /*{ 0x00000000, "STATUS_WAIT_0" }, */
 249         { 0x00000001, "STATUS_WAIT_1" },
 250         { 0x00000002, "STATUS_WAIT_2" },
 251         { 0x00000003, "STATUS_WAIT_3" },
 252         { 0x0000003F, "STATUS_WAIT_63" },
 253         { 0x00000080, "STATUS_ABANDONED" },
 254         /*{ 0x00000080, "STATUS_ABANDONED_WAIT_0" },*/
 255         { 0x000000BF, "STATUS_ABANDONED_WAIT_63" },
 256         { 0x000000C0, "STATUS_USER_APC" },
 257         { 0x00000100, "STATUS_KERNEL_APC" },
 258         { 0x00000101, "STATUS_ALERTED" },
 259         { 0x00000102, "STATUS_TIMEOUT" },
 260         { 0x00000103, "STATUS_PENDING" },
 261         { 0x00000104, "STATUS_REPARSE" },
 262         { 0x00000105, "STATUS_MORE_ENTRIES" },
 263         { 0x00000106, "STATUS_NOT_ALL_ASSIGNED" },
 264         { 0x00000107, "STATUS_SOME_NOT_MAPPED" },
 265         { 0x00000108, "STATUS_OPLOCK_BREAK_IN_PROGRESS" },
 266         { 0x00000109, "STATUS_VOLUME_MOUNTED" },
 267         { 0x0000010A, "STATUS_RXACT_COMMITTED" },
 268         { 0x0000010B, "STATUS_NOTIFY_CLEANUP" },
 269         { 0x0000010C, "STATUS_NOTIFY_ENUM_DIR" },
 270         { 0x0000010D, "STATUS_NO_QUOTAS_FOR_ACCOUNT" },
 271         { 0x0000010E, "STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED" },
 272         { 0x00000110, "STATUS_PAGE_FAULT_TRANSITION" },
 273         { 0x00000111, "STATUS_PAGE_FAULT_DEMAND_ZERO" },
 274         { 0x00000112, "STATUS_PAGE_FAULT_COPY_ON_WRITE" },
 275         { 0x00000113, "STATUS_PAGE_FAULT_GUARD_PAGE" },
 276         { 0x00000114, "STATUS_PAGE_FAULT_PAGING_FILE" },
 277         { 0x00000115, "STATUS_CACHE_PAGE_LOCKED" },
 278         { 0x00000116, "STATUS_CRASH_DUMP" },
 279         { 0x00000117, "STATUS_BUFFER_ALL_ZEROS" },
 280         { 0x00000118, "STATUS_REPARSE_OBJECT" },
 281         { 0x00000119, "STATUS_RESOURCE_REQUIREMENTS_CHANGED" },
 282         { 0x00000120, "STATUS_TRANSLATION_COMPLETE" },
 283         { 0x00000121, "STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY" },
 284         { 0x00000122, "STATUS_NOTHING_TO_TERMINATE" },
 285         { 0x00000123, "STATUS_PROCESS_NOT_IN_JOB" },
 286         { 0x00000124, "STATUS_PROCESS_IN_JOB" },
 287         { 0x00000125, "STATUS_VOLSNAP_HIBERNATE_READY" },
 288         { 0x00000126, "STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY" },
 289         { 0x00000127, "STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED" },
 290         { 0x00000128, "STATUS_INTERRUPT_STILL_CONNECTED" },
 291         { 0x00000129, "STATUS_PROCESS_CLONED" },
 292         { 0x0000012A, "STATUS_FILE_LOCKED_WITH_ONLY_READERS" },
 293         { 0x0000012B, "STATUS_FILE_LOCKED_WITH_WRITERS" },
 294         { 0x00000202, "STATUS_RESOURCEMANAGER_READ_ONLY" },
 295         { 0x00000367, "STATUS_WAIT_FOR_OPLOCK" },
 296         { 0x0000045C, "STATUS_NO_SHUTDOWN_IN_PROGRESS" },
 297         { 0x00010001, "STATUS_DBG_EXCEPTION_HANDLED" },
 298         { 0x00010002, "STATUS_DBG_CONTINUE" },
 299         { 0x001C0001, "STATUS_FLT_IO_COMPLETE" },
 300         { 0x40000000, "STATUS_OBJECT_NAME_EXISTS" },
 301         { 0x40000001, "STATUS_THREAD_WAS_SUSPENDED" },
 302         { 0x40000002, "STATUS_WORKING_SET_LIMIT_RANGE" },
 303         { 0x40000003, "STATUS_IMAGE_NOT_AT_BASE" },
 304         { 0x40000004, "STATUS_RXACT_STATE_CREATED" },
 305         { 0x40000005, "STATUS_SEGMENT_NOTIFICATION" },
 306         { 0x40000006, "STATUS_LOCAL_USER_SESSION_KEY" },
 307         { 0x40000007, "STATUS_BAD_CURRENT_DIRECTORY" },
 308         { 0x40000008, "STATUS_SERIAL_MORE_WRITES" },
 309         { 0x40000009, "STATUS_REGISTRY_RECOVERED" },
 310         { 0x4000000A, "STATUS_FT_READ_RECOVERY_FROM_BACKUP" },
 311         { 0x4000000B, "STATUS_FT_WRITE_RECOVERY" },
 312         { 0x4000000C, "STATUS_SERIAL_COUNTER_TIMEOUT" },
 313         { 0x4000000D, "STATUS_NULL_LM_PASSWORD" },
 314         { 0x4000000E, "STATUS_IMAGE_MACHINE_TYPE_MISMATCH" },
 315         { 0x4000000F, "STATUS_RECEIVE_PARTIAL" },
 316         { 0x40000010, "STATUS_RECEIVE_EXPEDITED" },
 317         { 0x40000011, "STATUS_RECEIVE_PARTIAL_EXPEDITED" },
 318         { 0x40000012, "STATUS_EVENT_DONE" },
 319         { 0x40000013, "STATUS_EVENT_PENDING" },
 320         { 0x40000014, "STATUS_CHECKING_FILE_SYSTEM" },
 321         { 0x40000015, "STATUS_FATAL_APP_EXIT" },
 322         { 0x40000016, "STATUS_PREDEFINED_HANDLE" },
 323         { 0x40000017, "STATUS_WAS_UNLOCKED" },
 324         { 0x40000018, "STATUS_SERVICE_NOTIFICATION" },
 325         { 0x40000019, "STATUS_WAS_LOCKED" },
 326         { 0x4000001A, "STATUS_LOG_HARD_ERROR" },
 327         { 0x4000001B, "STATUS_ALREADY_WIN32" },
 328         { 0x4000001C, "STATUS_WX86_UNSIMULATE" },
 329         { 0x4000001D, "STATUS_WX86_CONTINUE" },
 330         { 0x4000001E, "STATUS_WX86_SINGLE_STEP" },
 331         { 0x4000001F, "STATUS_WX86_BREAKPOINT" },
 332         { 0x40000020, "STATUS_WX86_EXCEPTION_CONTINUE" },
 333         { 0x40000021, "STATUS_WX86_EXCEPTION_LASTCHANCE" },
 334         { 0x40000022, "STATUS_WX86_EXCEPTION_CHAIN" },
 335         { 0x40000023, "STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE" },
 336         { 0x40000024, "STATUS_NO_YIELD_PERFORMED" },
 337         { 0x40000025, "STATUS_TIMER_RESUME_IGNORED" },
 338         { 0x40000026, "STATUS_ARBITRATION_UNHANDLED" },
 339         { 0x40000027, "STATUS_CARDBUS_NOT_SUPPORTED" },
 340         { 0x40000028, "STATUS_WX86_CREATEWX86TIB" },
 341         { 0x40000029, "STATUS_MP_PROCESSOR_MISMATCH" },
 342         { 0x4000002A, "STATUS_HIBERNATED" },
 343         { 0x4000002B, "STATUS_RESUME_HIBERNATION" },
 344         { 0x4000002C, "STATUS_FIRMWARE_UPDATED" },
 345         { 0x4000002D, "STATUS_DRIVERS_LEAKING_LOCKED_PAGES" },
 346         { 0x4000002E, "STATUS_MESSAGE_RETRIEVED" },
 347         { 0x4000002F, "STATUS_SYSTEM_POWERSTATE_TRANSITION" },
 348         { 0x40000030, "STATUS_ALPC_CHECK_COMPLETION_LIST" },
 349         { 0x40000031, "STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION" },
 350         { 0x40000032, "STATUS_ACCESS_AUDIT_BY_POLICY" },
 351         { 0x40000033, "STATUS_ABANDON_HIBERFILE" },
 352         { 0x40000034, "STATUS_BIZRULES_NOT_ENABLED" },
 353         { 0x40000294, "STATUS_WAKE_SYSTEM" },
 354         { 0x40000370, "STATUS_DS_SHUTTING_DOWN" },
 355         { 0x40010001, "STATUS_DBG_REPLY_LATER" },
 356         { 0x40010002, "STATUS_DBG_UNABLE_TO_PROVIDE_HANDLE" },
 357         { 0x40010003, "STATUS_DBG_TERMINATE_THREAD" },
 358         { 0x40010004, "STATUS_DBG_TERMINATE_PROCESS" },
 359         { 0x40010005, "STATUS_DBG_CONTROL_C" },
 360         { 0x40010006, "STATUS_DBG_PRINTEXCEPTION_C" },
 361         { 0x40010007, "STATUS_DBG_RIPEXCEPTION" },
 362         { 0x40010008, "STATUS_DBG_CONTROL_BREAK" },
 363         { 0x40010009, "STATUS_DBG_COMMAND_EXCEPTION" },
 364         { 0x40020056, "STATUS_RPC_UUID_LOCAL_ONLY" },
 365         { 0x400200AF, "STATUS_RPC_SEND_INCOMPLETE" },
 366         { 0x400A0004, "STATUS_CTX_CDM_CONNECT" },
 367         { 0x400A0005, "STATUS_CTX_CDM_DISCONNECT" },
 368         { 0x4015000D, "STATUS_SXS_RELEASE_ACTIVATION_CONTEXT" },
 369         { 0x40190034, "STATUS_RECOVERY_NOT_NEEDED" },
 370         { 0x40190035, "STATUS_RM_ALREADY_STARTED" },
 371         { 0x401A000C, "STATUS_LOG_NO_RESTART" },
 372         { 0x401B00EC, "STATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST" },
 373         { 0x401E000A, "STATUS_GRAPHICS_PARTIAL_DATA_POPULATED" },
 374         { 0x401E0117, "STATUS_GRAPHICS_DRIVER_MISMATCH" },
 375         { 0x401E0307, "STATUS_GRAPHICS_MODE_NOT_PINNED" },
 376         { 0x401E031E, "STATUS_GRAPHICS_NO_PREFERRED_MODE" },
 377         { 0x401E034B, "STATUS_GRAPHICS_DATASET_IS_EMPTY" },
 378         { 0x401E034C, "STATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET" },
 379         { 0x401E0351, "STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED" },
 380         { 0x401E042F, "STATUS_GRAPHICS_UNKNOWN_CHILD_STATUS" },
 381         { 0x401E0437, "STATUS_GRAPHICS_LEADLINK_START_DEFERRED" },
 382         { 0x401E0439, "STATUS_GRAPHICS_POLLING_TOO_FREQUENTLY" },
 383         { 0x401E043A, "STATUS_GRAPHICS_START_DEFERRED" },
 384         { 0x40230001, "STATUS_NDIS_INDICATION_REQUIRED" },
 385         { 0x80000001, "STATUS_GUARD_PAGE_VIOLATION" },
 386         { 0x80000002, "STATUS_DATATYPE_MISALIGNMENT" },
 387         { 0x80000003, "STATUS_BREAKPOINT" },
 388         { 0x80000004, "STATUS_SINGLE_STEP" },
 389         { 0x80000005, "STATUS_BUFFER_OVERFLOW" },
 390         { 0x80000006, "STATUS_NO_MORE_FILES" },
 391         { 0x80000007, "STATUS_WAKE_SYSTEM_DEBUGGER" },
 392         { 0x8000000A, "STATUS_HANDLES_CLOSED" },
 393         { 0x8000000B, "STATUS_NO_INHERITANCE" },
 394         { 0x8000000C, "STATUS_GUID_SUBSTITUTION_MADE" },
 395         { 0x8000000D, "STATUS_PARTIAL_COPY" },
 396         { 0x8000000E, "STATUS_DEVICE_PAPER_EMPTY" },
 397         { 0x8000000F, "STATUS_DEVICE_POWERED_OFF" },
 398         { 0x80000010, "STATUS_DEVICE_OFF_LINE" },
 399         { 0x80000011, "STATUS_DEVICE_BUSY" },
 400         { 0x80000012, "STATUS_NO_MORE_EAS" },
 401         { 0x80000013, "STATUS_INVALID_EA_NAME" },
 402         { 0x80000014, "STATUS_EA_LIST_INCONSISTENT" },
 403         { 0x80000015, "STATUS_INVALID_EA_FLAG" },
 404         { 0x80000016, "STATUS_VERIFY_REQUIRED" },
 405         { 0x80000017, "STATUS_EXTRANEOUS_INFORMATION" },
 406         { 0x80000018, "STATUS_RXACT_COMMIT_NECESSARY" },
 407         { 0x8000001A, "STATUS_NO_MORE_ENTRIES" },
 408         { 0x8000001B, "STATUS_FILEMARK_DETECTED" },
 409         { 0x8000001C, "STATUS_MEDIA_CHANGED" },
 410         { 0x8000001D, "STATUS_BUS_RESET" },
 411         { 0x8000001E, "STATUS_END_OF_MEDIA" },
 412         { 0x8000001F, "STATUS_BEGINNING_OF_MEDIA" },
 413         { 0x80000020, "STATUS_MEDIA_CHECK" },
 414         { 0x80000021, "STATUS_SETMARK_DETECTED" },
 415         { 0x80000022, "STATUS_NO_DATA_DETECTED" },
 416         { 0x80000023, "STATUS_REDIRECTOR_HAS_OPEN_HANDLES" },
 417         { 0x80000024, "STATUS_SERVER_HAS_OPEN_HANDLES" },
 418         { 0x80000025, "STATUS_ALREADY_DISCONNECTED" },
 419         { 0x80000026, "STATUS_LONGJUMP" },
 420         { 0x80000027, "STATUS_CLEANER_CARTRIDGE_INSTALLED" },
 421         { 0x80000028, "STATUS_PLUGPLAY_QUERY_VETOED" },
 422         { 0x80000029, "STATUS_UNWIND_CONSOLIDATE" },
 423         { 0x8000002A, "STATUS_REGISTRY_HIVE_RECOVERED" },
 424         { 0x8000002B, "STATUS_DLL_MIGHT_BE_INSECURE" },
 425         { 0x8000002C, "STATUS_DLL_MIGHT_BE_INCOMPATIBLE" },
 426         { 0x8000002D, "STATUS_STOPPED_ON_SYMLINK" },
 427         { 0x80000288, "STATUS_DEVICE_REQUIRES_CLEANING" },
 428         { 0x80000289, "STATUS_DEVICE_DOOR_OPEN" },
 429         { 0x80000803, "STATUS_DATA_LOST_REPAIR" },
 430         { 0x80010001, "STATUS_DBG_EXCEPTION_NOT_HANDLED" },
 431         { 0x80040111, "MAPI_E_LOGON_FAILED" },
 432         { 0x80090300, "SEC_E_INSUFFICIENT_MEMORY" },
 433         { 0x80090301, "SEC_E_INVALID_HANDLE" },
 434         { 0x80090302, "SEC_E_UNSUPPORTED_FUNCTION" },
 435         { 0x8009030B, "SEC_E_NO_IMPERSONATION" },
 436         { 0x8009030D, "SEC_E_UNKNOWN_CREDENTIALS" },
 437         { 0x8009030E, "SEC_E_NO_CREDENTIALS" },
 438         { 0x8009030F, "SEC_E_MESSAGE_ALTERED" },
 439         { 0x80090310, "SEC_E_OUT_OF_SEQUENCE" },
 440         { 0x80090311, "SEC_E_NO_AUTHENTICATING_AUTHORITY" },
 441         { 0x80130001, "STATUS_CLUSTER_NODE_ALREADY_UP" },
 442         { 0x80130002, "STATUS_CLUSTER_NODE_ALREADY_DOWN" },
 443         { 0x80130003, "STATUS_CLUSTER_NETWORK_ALREADY_ONLINE" },
 444         { 0x80130004, "STATUS_CLUSTER_NETWORK_ALREADY_OFFLINE" },
 445         { 0x80130005, "STATUS_CLUSTER_NODE_ALREADY_MEMBER" },
 446         { 0x80190009, "STATUS_COULD_NOT_RESIZE_LOG" },
 447         { 0x80190029, "STATUS_NO_TXF_METADATA" },
 448         { 0x80190031, "STATUS_CANT_RECOVER_WITH_HANDLE_OPEN" },
 449         { 0x80190041, "STATUS_TXF_METADATA_ALREADY_PRESENT" },
 450         { 0x80190042, "STATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET" },
 451         { 0x801B00EB, "STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED" },
 452         { 0x801C0001, "STATUS_FLT_BUFFER_TOO_SMALL" },
 453         { 0x80210001, "STATUS_FVE_PARTIAL_METADATA" },
 454         { 0x80210002, "STATUS_FVE_TRANSIENT_STATE" },
 455         { 0xC0000001, "STATUS_UNSUCCESSFUL" },
 456         { 0xC0000002, "STATUS_NOT_IMPLEMENTED" },
 457         { 0xC0000003, "STATUS_INVALID_INFO_CLASS" },
 458         { 0xC0000004, "STATUS_INFO_LENGTH_MISMATCH" },
 459         { 0xC0000005, "STATUS_ACCESS_VIOLATION" },
 460         { 0xC0000006, "STATUS_IN_PAGE_ERROR" },
 461         { 0xC0000007, "STATUS_PAGEFILE_QUOTA" },
 462         { 0xC0000008, "STATUS_INVALID_HANDLE" },
 463         { 0xC0000009, "STATUS_BAD_INITIAL_STACK" },
 464         { 0xC000000A, "STATUS_BAD_INITIAL_PC" },
 465         { 0xC000000B, "STATUS_INVALID_CID" },
 466         { 0xC000000C, "STATUS_TIMER_NOT_CANCELED" },
 467         { 0xC000000D, "STATUS_INVALID_PARAMETER" },
 468         { 0xC000000E, "STATUS_NO_SUCH_DEVICE" },
 469         { 0xC000000F, "STATUS_NO_SUCH_FILE" },
 470         { 0xC0000010, "STATUS_INVALID_DEVICE_REQUEST" },
 471         { 0xC0000011, "STATUS_END_OF_FILE" },
 472         { 0xC0000012, "STATUS_WRONG_VOLUME" },
 473         { 0xC0000013, "STATUS_NO_MEDIA_IN_DEVICE" },
 474         { 0xC0000014, "STATUS_UNRECOGNIZED_MEDIA" },
 475         { 0xC0000015, "STATUS_NONEXISTENT_SECTOR" },
 476         { 0xC0000016, "STATUS_MORE_PROCESSING_REQUIRED" },
 477         { 0xC0000017, "STATUS_NO_MEMORY" },
 478         { 0xC0000018, "STATUS_CONFLICTING_ADDRESSES" },
 479         { 0xC0000019, "STATUS_NOT_MAPPED_VIEW" },
 480         { 0xC000001A, "STATUS_UNABLE_TO_FREE_VM" },
 481         { 0xC000001B, "STATUS_UNABLE_TO_DELETE_SECTION" },
 482         { 0xC000001C, "STATUS_INVALID_SYSTEM_SERVICE" },
 483         { 0xC000001D, "STATUS_ILLEGAL_INSTRUCTION" },
 484         { 0xC000001E, "STATUS_INVALID_LOCK_SEQUENCE" },
 485         { 0xC000001F, "STATUS_INVALID_VIEW_SIZE" },
 486         { 0xC0000020, "STATUS_INVALID_FILE_FOR_SECTION" },
 487         { 0xC0000021, "STATUS_ALREADY_COMMITTED" },
 488         { 0xC0000022, "STATUS_ACCESS_DENIED" },
 489         { 0xC0000023, "STATUS_BUFFER_TOO_SMALL" },
 490         { 0xC0000024, "STATUS_OBJECT_TYPE_MISMATCH" },
 491         { 0xC0000025, "STATUS_NONCONTINUABLE_EXCEPTION" },
 492         { 0xC0000026, "STATUS_INVALID_DISPOSITION" },
 493         { 0xC0000027, "STATUS_UNWIND" },
 494         { 0xC0000028, "STATUS_BAD_STACK" },
 495         { 0xC0000029, "STATUS_INVALID_UNWIND_TARGET" },
 496         { 0xC000002A, "STATUS_NOT_LOCKED" },
 497         { 0xC000002B, "STATUS_PARITY_ERROR" },
 498         { 0xC000002C, "STATUS_UNABLE_TO_DECOMMIT_VM" },
 499         { 0xC000002D, "STATUS_NOT_COMMITTED" },
 500         { 0xC000002E, "STATUS_INVALID_PORT_ATTRIBUTES" },
 501         { 0xC000002F, "STATUS_PORT_MESSAGE_TOO_LONG" },
 502         { 0xC0000030, "STATUS_INVALID_PARAMETER_MIX" },
 503         { 0xC0000031, "STATUS_INVALID_QUOTA_LOWER" },
 504         { 0xC0000032, "STATUS_DISK_CORRUPT_ERROR" },
 505         { 0xC0000033, "STATUS_OBJECT_NAME_INVALID" },
 506         { 0xC0000034, "STATUS_OBJECT_NAME_NOT_FOUND" },
 507         { 0xC0000035, "STATUS_OBJECT_NAME_COLLISION" },
 508         { 0xC0000037, "STATUS_PORT_DISCONNECTED" },
 509         { 0xC0000038, "STATUS_DEVICE_ALREADY_ATTACHED" },
 510         { 0xC0000039, "STATUS_OBJECT_PATH_INVALID" },
 511         { 0xC000003A, "STATUS_OBJECT_PATH_NOT_FOUND" },
 512         { 0xC000003B, "STATUS_OBJECT_PATH_SYNTAX_BAD" },
 513         { 0xC000003C, "STATUS_DATA_OVERRUN" },
 514         { 0xC000003D, "STATUS_DATA_LATE_ERROR" },
 515         { 0xC000003E, "STATUS_DATA_ERROR" },
 516         { 0xC000003F, "STATUS_CRC_ERROR" },
 517         { 0xC0000040, "STATUS_SECTION_TOO_BIG" },
 518         { 0xC0000041, "STATUS_PORT_CONNECTION_REFUSED" },
 519         { 0xC0000042, "STATUS_INVALID_PORT_HANDLE" },
 520         { 0xC0000043, "STATUS_SHARING_VIOLATION" },
 521         { 0xC0000044, "STATUS_QUOTA_EXCEEDED" },
 522         { 0xC0000045, "STATUS_INVALID_PAGE_PROTECTION" },
 523         { 0xC0000046, "STATUS_MUTANT_NOT_OWNED" },
 524         { 0xC0000047, "STATUS_SEMAPHORE_LIMIT_EXCEEDED" },
 525         { 0xC0000048, "STATUS_PORT_ALREADY_SET" },
 526         { 0xC0000049, "STATUS_SECTION_NOT_IMAGE" },
 527         { 0xC000004A, "STATUS_SUSPEND_COUNT_EXCEEDED" },
 528         { 0xC000004B, "STATUS_THREAD_IS_TERMINATING" },
 529         { 0xC000004C, "STATUS_BAD_WORKING_SET_LIMIT" },
 530         { 0xC000004D, "STATUS_INCOMPATIBLE_FILE_MAP" },
 531         { 0xC000004E, "STATUS_SECTION_PROTECTION" },
 532         { 0xC000004F, "STATUS_EAS_NOT_SUPPORTED" },
 533         { 0xC0000050, "STATUS_EA_TOO_LARGE" },
 534         { 0xC0000051, "STATUS_NONEXISTENT_EA_ENTRY" },
 535         { 0xC0000052, "STATUS_NO_EAS_ON_FILE" },
 536         { 0xC0000053, "STATUS_EA_CORRUPT_ERROR" },
 537         { 0xC0000054, "STATUS_FILE_LOCK_CONFLICT" },
 538         { 0xC0000055, "STATUS_LOCK_NOT_GRANTED" },
 539         { 0xC0000056, "STATUS_DELETE_PENDING" },
 540         { 0xC0000057, "STATUS_CTL_FILE_NOT_SUPPORTED" },
 541         { 0xC0000058, "STATUS_UNKNOWN_REVISION" },
 542         { 0xC0000059, "STATUS_REVISION_MISMATCH" },
 543         { 0xC000005A, "STATUS_INVALID_OWNER" },
 544         { 0xC000005B, "STATUS_INVALID_PRIMARY_GROUP" },
 545         { 0xC000005C, "STATUS_NO_IMPERSONATION_TOKEN" },
 546         { 0xC000005D, "STATUS_CANT_DISABLE_MANDATORY" },
 547         { 0xC000005E, "STATUS_NO_LOGON_SERVERS" },
 548         { 0xC000005F, "STATUS_NO_SUCH_LOGON_SESSION" },
 549         { 0xC0000060, "STATUS_NO_SUCH_PRIVILEGE" },
 550         { 0xC0000061, "STATUS_PRIVILEGE_NOT_HELD" },
 551         { 0xC0000062, "STATUS_INVALID_ACCOUNT_NAME" },
 552         { 0xC0000063, "STATUS_USER_EXISTS" },
 553         { 0xC0000064, "STATUS_NO_SUCH_USER" },
 554         { 0xC0000065, "STATUS_GROUP_EXISTS" },
 555         { 0xC0000066, "STATUS_NO_SUCH_GROUP" },
 556         { 0xC0000067, "STATUS_MEMBER_IN_GROUP" },
 557         { 0xC0000068, "STATUS_MEMBER_NOT_IN_GROUP" },
 558         { 0xC0000069, "STATUS_LAST_ADMIN" },
 559         { 0xC000006A, "STATUS_WRONG_PASSWORD" },
 560         { 0xC000006B, "STATUS_ILL_FORMED_PASSWORD" },
 561         { 0xC000006C, "STATUS_PASSWORD_RESTRICTION" },
 562         { 0xC000006D, "STATUS_LOGON_FAILURE" },
 563         { 0xC000006E, "STATUS_ACCOUNT_RESTRICTION" },
 564         { 0xC000006F, "STATUS_INVALID_LOGON_HOURS" },
 565         { 0xC0000070, "STATUS_INVALID_WORKSTATION" },
 566         { 0xC0000071, "STATUS_PASSWORD_EXPIRED" },
 567         { 0xC0000072, "STATUS_ACCOUNT_DISABLED" },
 568         { 0xC0000073, "STATUS_NONE_MAPPED" },
 569         { 0xC0000074, "STATUS_TOO_MANY_LUIDS_REQUESTED" },
 570         { 0xC0000075, "STATUS_LUIDS_EXHAUSTED" },
 571         { 0xC0000076, "STATUS_INVALID_SUB_AUTHORITY" },
 572         { 0xC0000077, "STATUS_INVALID_ACL" },
 573         { 0xC0000078, "STATUS_INVALID_SID" },
 574         { 0xC0000079, "STATUS_INVALID_SECURITY_DESCR" },
 575         { 0xC000007A, "STATUS_PROCEDURE_NOT_FOUND" },
 576         { 0xC000007B, "STATUS_INVALID_IMAGE_FORMAT" },
 577         { 0xC000007C, "STATUS_NO_TOKEN" },
 578         { 0xC000007D, "STATUS_BAD_INHERITANCE_ACL" },
 579         { 0xC000007E, "STATUS_RANGE_NOT_LOCKED" },
 580         { 0xC000007F, "STATUS_DISK_FULL" },
 581         { 0xC0000080, "STATUS_SERVER_DISABLED" },
 582         { 0xC0000081, "STATUS_SERVER_NOT_DISABLED" },
 583         { 0xC0000082, "STATUS_TOO_MANY_GUIDS_REQUESTED" },
 584         { 0xC0000083, "STATUS_GUIDS_EXHAUSTED" },
 585         { 0xC0000084, "STATUS_INVALID_ID_AUTHORITY" },
 586         { 0xC0000085, "STATUS_AGENTS_EXHAUSTED" },
 587         { 0xC0000086, "STATUS_INVALID_VOLUME_LABEL" },
 588         { 0xC0000087, "STATUS_SECTION_NOT_EXTENDED" },
 589         { 0xC0000088, "STATUS_NOT_MAPPED_DATA" },
 590         { 0xC0000089, "STATUS_RESOURCE_DATA_NOT_FOUND" },
 591         { 0xC000008A, "STATUS_RESOURCE_TYPE_NOT_FOUND" },
 592         { 0xC000008B, "STATUS_RESOURCE_NAME_NOT_FOUND" },
 593         { 0xC000008C, "STATUS_ARRAY_BOUNDS_EXCEEDED" },
 594         { 0xC000008D, "STATUS_FLOAT_DENORMAL_OPERAND" },
 595         { 0xC000008E, "STATUS_FLOAT_DIVIDE_BY_ZERO" },
 596         { 0xC000008F, "STATUS_FLOAT_INEXACT_RESULT" },
 597         { 0xC0000090, "STATUS_FLOAT_INVALID_OPERATION" },
 598         { 0xC0000091, "STATUS_FLOAT_OVERFLOW" },
 599         { 0xC0000092, "STATUS_FLOAT_STACK_CHECK" },
 600         { 0xC0000093, "STATUS_FLOAT_UNDERFLOW" },
 601         { 0xC0000094, "STATUS_INTEGER_DIVIDE_BY_ZERO" },
 602         { 0xC0000095, "STATUS_INTEGER_OVERFLOW" },
 603         { 0xC0000096, "STATUS_PRIVILEGED_INSTRUCTION" },
 604         { 0xC0000097, "STATUS_TOO_MANY_PAGING_FILES" },
 605         { 0xC0000098, "STATUS_FILE_INVALID" },
 606         { 0xC0000099, "STATUS_ALLOTTED_SPACE_EXCEEDED" },
 607         { 0xC000009A, "STATUS_INSUFFICIENT_RESOURCES" },
 608         { 0xC000009B, "STATUS_DFS_EXIT_PATH_FOUND" },
 609         { 0xC000009C, "STATUS_DEVICE_DATA_ERROR" },
 610         { 0xC000009D, "STATUS_DEVICE_NOT_CONNECTED" },
 611         { 0xC000009E, "STATUS_DEVICE_POWER_FAILURE" },
 612         { 0xC000009F, "STATUS_FREE_VM_NOT_AT_BASE" },
 613         { 0xC00000A0, "STATUS_MEMORY_NOT_ALLOCATED" },
 614         { 0xC00000A1, "STATUS_WORKING_SET_QUOTA" },
 615         { 0xC00000A2, "STATUS_MEDIA_WRITE_PROTECTED" },
 616         { 0xC00000A3, "STATUS_DEVICE_NOT_READY" },
 617         { 0xC00000A4, "STATUS_INVALID_GROUP_ATTRIBUTES" },
 618         { 0xC00000A5, "STATUS_BAD_IMPERSONATION_LEVEL" },
 619         { 0xC00000A6, "STATUS_CANT_OPEN_ANONYMOUS" },
 620         { 0xC00000A7, "STATUS_BAD_VALIDATION_CLASS" },
 621         { 0xC00000A8, "STATUS_BAD_TOKEN_TYPE" },
 622         { 0xC00000A9, "STATUS_BAD_MASTER_BOOT_RECORD" },
 623         { 0xC00000AA, "STATUS_INSTRUCTION_MISALIGNMENT" },
 624         { 0xC00000AB, "STATUS_INSTANCE_NOT_AVAILABLE" },
 625         { 0xC00000AC, "STATUS_PIPE_NOT_AVAILABLE" },
 626         { 0xC00000AD, "STATUS_INVALID_PIPE_STATE" },
 627         { 0xC00000AE, "STATUS_PIPE_BUSY" },
 628         { 0xC00000AF, "STATUS_ILLEGAL_FUNCTION" },
 629         { 0xC00000B0, "STATUS_PIPE_DISCONNECTED" },
 630         { 0xC00000B1, "STATUS_PIPE_CLOSING" },
 631         { 0xC00000B2, "STATUS_PIPE_CONNECTED" },
 632         { 0xC00000B3, "STATUS_PIPE_LISTENING" },
 633         { 0xC00000B4, "STATUS_INVALID_READ_MODE" },
 634         { 0xC00000B5, "STATUS_IO_TIMEOUT" },
 635         { 0xC00000B6, "STATUS_FILE_FORCED_CLOSED" },
 636         { 0xC00000B7, "STATUS_PROFILING_NOT_STARTED" },
 637         { 0xC00000B8, "STATUS_PROFILING_NOT_STOPPED" },
 638         { 0xC00000B9, "STATUS_COULD_NOT_INTERPRET" },
 639         { 0xC00000BA, "STATUS_FILE_IS_A_DIRECTORY" },
 640         { 0xC00000BB, "STATUS_NOT_SUPPORTED" },
 641         { 0xC00000BC, "STATUS_REMOTE_NOT_LISTENING" },
 642         { 0xC00000BD, "STATUS_DUPLICATE_NAME" },
 643         { 0xC00000BE, "STATUS_BAD_NETWORK_PATH" },
 644         { 0xC00000BF, "STATUS_NETWORK_BUSY" },
 645         { 0xC00000C0, "STATUS_DEVICE_DOES_NOT_EXIST" },
 646         { 0xC00000C1, "STATUS_TOO_MANY_COMMANDS" },
 647         { 0xC00000C2, "STATUS_ADAPTER_HARDWARE_ERROR" },
 648         { 0xC00000C3, "STATUS_INVALID_NETWORK_RESPONSE" },
 649         { 0xC00000C4, "STATUS_UNEXPECTED_NETWORK_ERROR" },
 650         { 0xC00000C5, "STATUS_BAD_REMOTE_ADAPTER" },
 651         { 0xC00000C6, "STATUS_PRINT_QUEUE_FULL" },
 652         { 0xC00000C7, "STATUS_NO_SPOOL_SPACE" },
 653         { 0xC00000C8, "STATUS_PRINT_CANCELLED" },
 654         { 0xC00000C9, "STATUS_NETWORK_NAME_DELETED" },
 655         { 0xC00000CA, "STATUS_NETWORK_ACCESS_DENIED" },
 656         { 0xC00000CB, "STATUS_BAD_DEVICE_TYPE" },
 657         { 0xC00000CC, "STATUS_BAD_NETWORK_NAME" },
 658         { 0xC00000CD, "STATUS_TOO_MANY_NAMES" },
 659         { 0xC00000CE, "STATUS_TOO_MANY_SESSIONS" },
 660         { 0xC00000CF, "STATUS_SHARING_PAUSED" },
 661         { 0xC00000D0, "STATUS_REQUEST_NOT_ACCEPTED" },
 662         { 0xC00000D1, "STATUS_REDIRECTOR_PAUSED" },
 663         { 0xC00000D2, "STATUS_NET_WRITE_FAULT" },
 664         { 0xC00000D3, "STATUS_PROFILING_AT_LIMIT" },
 665         { 0xC00000D4, "STATUS_NOT_SAME_DEVICE" },
 666         { 0xC00000D5, "STATUS_FILE_RENAMED" },
 667         { 0xC00000D6, "STATUS_VIRTUAL_CIRCUIT_CLOSED" },
 668         { 0xC00000D7, "STATUS_NO_SECURITY_ON_OBJECT" },
 669         { 0xC00000D8, "STATUS_CANT_WAIT" },
 670         { 0xC00000D9, "STATUS_PIPE_EMPTY" },
 671         { 0xC00000DA, "STATUS_CANT_ACCESS_DOMAIN_INFO" },
 672         { 0xC00000DB, "STATUS_CANT_TERMINATE_SELF" },
 673         { 0xC00000DC, "STATUS_INVALID_SERVER_STATE" },
 674         { 0xC00000DD, "STATUS_INVALID_DOMAIN_STATE" },
 675         { 0xC00000DE, "STATUS_INVALID_DOMAIN_ROLE" },
 676         { 0xC00000DF, "STATUS_NO_SUCH_DOMAIN" },
 677         { 0xC00000E0, "STATUS_DOMAIN_EXISTS" },
 678         { 0xC00000E1, "STATUS_DOMAIN_LIMIT_EXCEEDED" },
 679         { 0xC00000E2, "STATUS_OPLOCK_NOT_GRANTED" },
 680         { 0xC00000E3, "STATUS_INVALID_OPLOCK_PROTOCOL" },
 681         { 0xC00000E4, "STATUS_INTERNAL_DB_CORRUPTION" },
 682         { 0xC00000E5, "STATUS_INTERNAL_ERROR" },
 683         { 0xC00000E6, "STATUS_GENERIC_NOT_MAPPED" },
 684         { 0xC00000E7, "STATUS_BAD_DESCRIPTOR_FORMAT" },
 685         { 0xC00000E8, "STATUS_INVALID_USER_BUFFER" },
 686         { 0xC00000E9, "STATUS_UNEXPECTED_IO_ERROR" },
 687         { 0xC00000EA, "STATUS_UNEXPECTED_MM_CREATE_ERR" },
 688         { 0xC00000EB, "STATUS_UNEXPECTED_MM_MAP_ERROR" },
 689         { 0xC00000EC, "STATUS_UNEXPECTED_MM_EXTEND_ERR" },
 690         { 0xC00000ED, "STATUS_NOT_LOGON_PROCESS" },
 691         { 0xC00000EE, "STATUS_LOGON_SESSION_EXISTS" },
 692         { 0xC00000EF, "STATUS_INVALID_PARAMETER_1" },
 693         { 0xC00000F0, "STATUS_INVALID_PARAMETER_2" },
 694         { 0xC00000F1, "STATUS_INVALID_PARAMETER_3" },
 695         { 0xC00000F2, "STATUS_INVALID_PARAMETER_4" },
 696         { 0xC00000F3, "STATUS_INVALID_PARAMETER_5" },
 697         { 0xC00000F4, "STATUS_INVALID_PARAMETER_6" },
 698         { 0xC00000F5, "STATUS_INVALID_PARAMETER_7" },
 699         { 0xC00000F6, "STATUS_INVALID_PARAMETER_8" },
 700         { 0xC00000F7, "STATUS_INVALID_PARAMETER_9" },
 701         { 0xC00000F8, "STATUS_INVALID_PARAMETER_10" },
 702         { 0xC00000F9, "STATUS_INVALID_PARAMETER_11" },
 703         { 0xC00000FA, "STATUS_INVALID_PARAMETER_12" },
 704         { 0xC00000FB, "STATUS_REDIRECTOR_NOT_STARTED" },
 705         { 0xC00000FC, "STATUS_REDIRECTOR_STARTED" },
 706         { 0xC00000FD, "STATUS_STACK_OVERFLOW" },
 707         { 0xC00000FE, "STATUS_NO_SUCH_PACKAGE" },
 708         { 0xC00000FF, "STATUS_BAD_FUNCTION_TABLE" },
 709         { 0xC0000100, "STATUS_VARIABLE_NOT_FOUND" },
 710         { 0xC0000101, "STATUS_DIRECTORY_NOT_EMPTY" },
 711         { 0xC0000102, "STATUS_FILE_CORRUPT_ERROR" },
 712         { 0xC0000103, "STATUS_NOT_A_DIRECTORY" },
 713         { 0xC0000104, "STATUS_BAD_LOGON_SESSION_STATE" },
 714         { 0xC0000105, "STATUS_LOGON_SESSION_COLLISION" },
 715         { 0xC0000106, "STATUS_NAME_TOO_LONG" },
 716         { 0xC0000107, "STATUS_FILES_OPEN" },
 717         { 0xC0000108, "STATUS_CONNECTION_IN_USE" },
 718         { 0xC0000109, "STATUS_MESSAGE_NOT_FOUND" },
 719         { 0xC000010A, "STATUS_PROCESS_IS_TERMINATING" },
 720         { 0xC000010B, "STATUS_INVALID_LOGON_TYPE" },
 721         { 0xC000010C, "STATUS_NO_GUID_TRANSLATION" },
 722         { 0xC000010D, "STATUS_CANNOT_IMPERSONATE" },
 723         { 0xC000010E, "STATUS_IMAGE_ALREADY_LOADED" },
 724         { 0xC000010F, "STATUS_ABIOS_NOT_PRESENT" },
 725         { 0xC0000110, "STATUS_ABIOS_LID_NOT_EXIST" },
 726         { 0xC0000111, "STATUS_ABIOS_LID_ALREADY_OWNED" },
 727         { 0xC0000112, "STATUS_ABIOS_NOT_LID_OWNER" },
 728         { 0xC0000113, "STATUS_ABIOS_INVALID_COMMAND" },
 729         { 0xC0000114, "STATUS_ABIOS_INVALID_LID" },
 730         { 0xC0000115, "STATUS_ABIOS_SELECTOR_NOT_AVAILABLE" },
 731         { 0xC0000116, "STATUS_ABIOS_INVALID_SELECTOR" },
 732         { 0xC0000117, "STATUS_NO_LDT" },
 733         { 0xC0000118, "STATUS_INVALID_LDT_SIZE" },
 734         { 0xC0000119, "STATUS_INVALID_LDT_OFFSET" },
 735         { 0xC000011A, "STATUS_INVALID_LDT_DESCRIPTOR" },
 736         { 0xC000011B, "STATUS_INVALID_IMAGE_NE_FORMAT" },
 737         { 0xC000011C, "STATUS_RXACT_INVALID_STATE" },
 738         { 0xC000011D, "STATUS_RXACT_COMMIT_FAILURE" },
 739         { 0xC000011E, "STATUS_MAPPED_FILE_SIZE_ZERO" },
 740         { 0xC000011F, "STATUS_TOO_MANY_OPENED_FILES" },
 741         { 0xC0000120, "STATUS_CANCELLED" },
 742         { 0xC0000121, "STATUS_CANNOT_DELETE" },
 743         { 0xC0000122, "STATUS_INVALID_COMPUTER_NAME" },
 744         { 0xC0000123, "STATUS_FILE_DELETED" },
 745         { 0xC0000124, "STATUS_SPECIAL_ACCOUNT" },
 746         { 0xC0000125, "STATUS_SPECIAL_GROUP" },
 747         { 0xC0000126, "STATUS_SPECIAL_USER" },
 748         { 0xC0000127, "STATUS_MEMBERS_PRIMARY_GROUP" },
 749         { 0xC0000128, "STATUS_FILE_CLOSED" },
 750         { 0xC0000129, "STATUS_TOO_MANY_THREADS" },
 751         { 0xC000012A, "STATUS_THREAD_NOT_IN_PROCESS" },
 752         { 0xC000012B, "STATUS_TOKEN_ALREADY_IN_USE" },
 753         { 0xC000012C, "STATUS_PAGEFILE_QUOTA_EXCEEDED" },
 754         { 0xC000012D, "STATUS_COMMITMENT_LIMIT" },
 755         { 0xC000012E, "STATUS_INVALID_IMAGE_LE_FORMAT" },
 756         { 0xC000012F, "STATUS_INVALID_IMAGE_NOT_MZ" },
 757         { 0xC0000130, "STATUS_INVALID_IMAGE_PROTECT" },
 758         { 0xC0000131, "STATUS_INVALID_IMAGE_WIN_16" },
 759         { 0xC0000132, "STATUS_LOGON_SERVER_CONFLICT" },
 760         { 0xC0000133, "STATUS_TIME_DIFFERENCE_AT_DC" },
 761         { 0xC0000134, "STATUS_SYNCHRONIZATION_REQUIRED" },
 762         { 0xC0000135, "STATUS_DLL_NOT_FOUND" },
 763         { 0xC0000136, "STATUS_OPEN_FAILED" },
 764         { 0xC0000137, "STATUS_IO_PRIVILEGE_FAILED" },
 765         { 0xC0000138, "STATUS_ORDINAL_NOT_FOUND" },
 766         { 0xC0000139, "STATUS_ENTRYPOINT_NOT_FOUND" },
 767         { 0xC000013A, "STATUS_CONTROL_C_EXIT" },
 768         { 0xC000013B, "STATUS_LOCAL_DISCONNECT" },
 769         { 0xC000013C, "STATUS_REMOTE_DISCONNECT" },
 770         { 0xC000013D, "STATUS_REMOTE_RESOURCES" },
 771         { 0xC000013E, "STATUS_LINK_FAILED" },
 772         { 0xC000013F, "STATUS_LINK_TIMEOUT" },
 773         { 0xC0000140, "STATUS_INVALID_CONNECTION" },
 774         { 0xC0000141, "STATUS_INVALID_ADDRESS" },
 775         { 0xC0000142, "STATUS_DLL_INIT_FAILED" },
 776         { 0xC0000143, "STATUS_MISSING_SYSTEMFILE" },
 777         { 0xC0000144, "STATUS_UNHANDLED_EXCEPTION" },
 778         { 0xC0000145, "STATUS_APP_INIT_FAILURE" },
 779         { 0xC0000146, "STATUS_PAGEFILE_CREATE_FAILED" },
 780         { 0xC0000147, "STATUS_NO_PAGEFILE" },
 781         { 0xC0000148, "STATUS_INVALID_LEVEL" },
 782         { 0xC0000149, "STATUS_WRONG_PASSWORD_CORE" },
 783         { 0xC000014A, "STATUS_ILLEGAL_FLOAT_CONTEXT" },
 784         { 0xC000014B, "STATUS_PIPE_BROKEN" },
 785         { 0xC000014C, "STATUS_REGISTRY_CORRUPT" },
 786         { 0xC000014D, "STATUS_REGISTRY_IO_FAILED" },
 787         { 0xC000014E, "STATUS_NO_EVENT_PAIR" },
 788         { 0xC000014F, "STATUS_UNRECOGNIZED_VOLUME" },
 789         { 0xC0000150, "STATUS_SERIAL_NO_DEVICE_INITED" },
 790         { 0xC0000151, "STATUS_NO_SUCH_ALIAS" },
 791         { 0xC0000152, "STATUS_MEMBER_NOT_IN_ALIAS" },
 792         { 0xC0000153, "STATUS_MEMBER_IN_ALIAS" },
 793         { 0xC0000154, "STATUS_ALIAS_EXISTS" },
 794         { 0xC0000155, "STATUS_LOGON_NOT_GRANTED" },
 795         { 0xC0000156, "STATUS_TOO_MANY_SECRETS" },
 796         { 0xC0000157, "STATUS_SECRET_TOO_LONG" },
 797         { 0xC0000158, "STATUS_INTERNAL_DB_ERROR" },
 798         { 0xC0000159, "STATUS_FULLSCREEN_MODE" },
 799         { 0xC000015A, "STATUS_TOO_MANY_CONTEXT_IDS" },
 800         { 0xC000015B, "STATUS_LOGON_TYPE_NOT_GRANTED" },
 801         { 0xC000015C, "STATUS_NOT_REGISTRY_FILE" },
 802         { 0xC000015D, "STATUS_NT_CROSS_ENCRYPTION_REQUIRED" },
 803         { 0xC000015E, "STATUS_DOMAIN_CTRLR_CONFIG_ERROR" },
 804         { 0xC000015F, "STATUS_FT_MISSING_MEMBER" },
 805         { 0xC0000160, "STATUS_ILL_FORMED_SERVICE_ENTRY" },
 806         { 0xC0000161, "STATUS_ILLEGAL_CHARACTER" },
 807         { 0xC0000162, "STATUS_UNMAPPABLE_CHARACTER" },
 808         { 0xC0000163, "STATUS_UNDEFINED_CHARACTER" },
 809         { 0xC0000164, "STATUS_FLOPPY_VOLUME" },
 810         { 0xC0000165, "STATUS_FLOPPY_ID_MARK_NOT_FOUND" },
 811         { 0xC0000166, "STATUS_FLOPPY_WRONG_CYLINDER" },
 812         { 0xC0000167, "STATUS_FLOPPY_UNKNOWN_ERROR" },
 813         { 0xC0000168, "STATUS_FLOPPY_BAD_REGISTERS" },
 814         { 0xC0000169, "STATUS_DISK_RECALIBRATE_FAILED" },
 815         { 0xC000016A, "STATUS_DISK_OPERATION_FAILED" },
 816         { 0xC000016B, "STATUS_DISK_RESET_FAILED" },
 817         { 0xC000016C, "STATUS_SHARED_IRQ_BUSY" },
 818         { 0xC000016D, "STATUS_FT_ORPHANING" },
 819         { 0xC000016E, "STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT" },
 820         { 0xC0000172, "STATUS_PARTITION_FAILURE" },
 821         { 0xC0000173, "STATUS_INVALID_BLOCK_LENGTH" },
 822         { 0xC0000174, "STATUS_DEVICE_NOT_PARTITIONED" },
 823         { 0xC0000175, "STATUS_UNABLE_TO_LOCK_MEDIA" },
 824         { 0xC0000176, "STATUS_UNABLE_TO_UNLOAD_MEDIA" },
 825         { 0xC0000177, "STATUS_EOM_OVERFLOW" },
 826         { 0xC0000178, "STATUS_NO_MEDIA" },
 827         { 0xC000017A, "STATUS_NO_SUCH_MEMBER" },
 828         { 0xC000017B, "STATUS_INVALID_MEMBER" },
 829         { 0xC000017C, "STATUS_KEY_DELETED" },
 830         { 0xC000017D, "STATUS_NO_LOG_SPACE" },
 831         { 0xC000017E, "STATUS_TOO_MANY_SIDS" },
 832         { 0xC000017F, "STATUS_LM_CROSS_ENCRYPTION_REQUIRED" },
 833         { 0xC0000180, "STATUS_KEY_HAS_CHILDREN" },
 834         { 0xC0000181, "STATUS_CHILD_MUST_BE_VOLATILE" },
 835         { 0xC0000182, "STATUS_DEVICE_CONFIGURATION_ERROR" },
 836         { 0xC0000183, "STATUS_DRIVER_INTERNAL_ERROR" },
 837         { 0xC0000184, "STATUS_INVALID_DEVICE_STATE" },
 838         { 0xC0000185, "STATUS_IO_DEVICE_ERROR" },
 839         { 0xC0000186, "STATUS_DEVICE_PROTOCOL_ERROR" },
 840         { 0xC0000187, "STATUS_BACKUP_CONTROLLER" },
 841         { 0xC0000188, "STATUS_LOG_FILE_FULL" },
 842         { 0xC0000189, "STATUS_TOO_LATE" },
 843         { 0xC000018A, "STATUS_NO_TRUST_LSA_SECRET" },
 844         { 0xC000018B, "STATUS_NO_TRUST_SAM_ACCOUNT" },
 845         { 0xC000018C, "STATUS_TRUSTED_DOMAIN_FAILURE" },
 846         { 0xC000018D, "STATUS_TRUSTED_RELATIONSHIP_FAILURE" },
 847         { 0xC000018E, "STATUS_EVENTLOG_FILE_CORRUPT" },
 848         { 0xC000018F, "STATUS_EVENTLOG_CANT_START" },
 849         { 0xC0000190, "STATUS_TRUST_FAILURE" },
 850         { 0xC0000191, "STATUS_MUTANT_LIMIT_EXCEEDED" },
 851         { 0xC0000192, "STATUS_NETLOGON_NOT_STARTED" },
 852         { 0xC0000193, "STATUS_ACCOUNT_EXPIRED" },
 853         { 0xC0000194, "STATUS_POSSIBLE_DEADLOCK" },
 854         { 0xC0000195, "STATUS_NETWORK_CREDENTIAL_CONFLICT" },
 855         { 0xC0000196, "STATUS_REMOTE_SESSION_LIMIT" },
 856         { 0xC0000197, "STATUS_EVENTLOG_FILE_CHANGED" },
 857         { 0xC0000198, "STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT" },
 858         { 0xC0000199, "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT" },
 859         { 0xC000019A, "STATUS_NOLOGON_SERVER_TRUST_ACCOUNT" },
 860         { 0xC000019B, "STATUS_DOMAIN_TRUST_INCONSISTENT" },
 861         { 0xC000019C, "STATUS_FS_DRIVER_REQUIRED" },
 862         { 0xC000019D, "STATUS_IMAGE_ALREADY_LOADED_AS_DLL" },
 863         { 0xC000019E, "STATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING" },
 864         { 0xC000019F, "STATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME" },
 865         { 0xC00001A0, "STATUS_SECURITY_STREAM_IS_INCONSISTENT" },
 866         { 0xC00001A1, "STATUS_INVALID_LOCK_RANGE" },
 867         { 0xC00001A2, "STATUS_INVALID_ACE_CONDITION" },
 868         { 0xC00001A3, "STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT" },
 869         { 0xC00001A4, "STATUS_NOTIFICATION_GUID_ALREADY_DEFINED" },
 870         { 0xC0000201, "STATUS_NETWORK_OPEN_RESTRICTION" },
 871         { 0xC0000202, "STATUS_NO_USER_SESSION_KEY" },
 872         { 0xC0000203, "STATUS_USER_SESSION_DELETED" },
 873         { 0xC0000204, "STATUS_RESOURCE_LANG_NOT_FOUND" },
 874         { 0xC0000205, "STATUS_INSUFF_SERVER_RESOURCES" },
 875         { 0xC0000206, "STATUS_INVALID_BUFFER_SIZE" },
 876         { 0xC0000207, "STATUS_INVALID_ADDRESS_COMPONENT" },
 877         { 0xC0000208, "STATUS_INVALID_ADDRESS_WILDCARD" },
 878         { 0xC0000209, "STATUS_TOO_MANY_ADDRESSES" },
 879         { 0xC000020A, "STATUS_ADDRESS_ALREADY_EXISTS" },
 880         { 0xC000020B, "STATUS_ADDRESS_CLOSED" },
 881         { 0xC000020C, "STATUS_CONNECTION_DISCONNECTED" },
 882         { 0xC000020D, "STATUS_CONNECTION_RESET" },
 883         { 0xC000020E, "STATUS_TOO_MANY_NODES" },
 884         { 0xC000020F, "STATUS_TRANSACTION_ABORTED" },
 885         { 0xC0000210, "STATUS_TRANSACTION_TIMED_OUT" },
 886         { 0xC0000211, "STATUS_TRANSACTION_NO_RELEASE" },
 887         { 0xC0000212, "STATUS_TRANSACTION_NO_MATCH" },
 888         { 0xC0000213, "STATUS_TRANSACTION_RESPONDED" },
 889         { 0xC0000214, "STATUS_TRANSACTION_INVALID_ID" },
 890         { 0xC0000215, "STATUS_TRANSACTION_INVALID_TYPE" },
 891         { 0xC0000216, "STATUS_NOT_SERVER_SESSION" },
 892         { 0xC0000217, "STATUS_NOT_CLIENT_SESSION" },
 893         { 0xC0000218, "STATUS_CANNOT_LOAD_REGISTRY_FILE" },
 894         { 0xC0000219, "STATUS_DEBUG_ATTACH_FAILED" },
 895         { 0xC000021A, "STATUS_SYSTEM_PROCESS_TERMINATED" },
 896         { 0xC000021B, "STATUS_DATA_NOT_ACCEPTED" },
 897         { 0xC000021C, "STATUS_NO_BROWSER_SERVERS_FOUND" },
 898         { 0xC000021D, "STATUS_VDM_HARD_ERROR" },
 899         { 0xC000021E, "STATUS_DRIVER_CANCEL_TIMEOUT" },
 900         { 0xC000021F, "STATUS_REPLY_MESSAGE_MISMATCH" },
 901         { 0xC0000220, "STATUS_MAPPED_ALIGNMENT" },
 902         { 0xC0000221, "STATUS_IMAGE_CHECKSUM_MISMATCH" },
 903         { 0xC0000222, "STATUS_LOST_WRITEBEHIND_DATA" },
 904         { 0xC0000223, "STATUS_CLIENT_SERVER_PARAMETERS_INVALID" },
 905         { 0xC0000224, "STATUS_PASSWORD_MUST_CHANGE" },
 906         { 0xC0000225, "STATUS_NOT_FOUND" },
 907         { 0xC0000226, "STATUS_NOT_TINY_STREAM" },
 908         { 0xC0000227, "STATUS_RECOVERY_FAILURE" },
 909         { 0xC0000228, "STATUS_STACK_OVERFLOW_READ" },
 910         { 0xC0000229, "STATUS_FAIL_CHECK" },
 911         { 0xC000022A, "STATUS_DUPLICATE_OBJECTID" },
 912         { 0xC000022B, "STATUS_OBJECTID_EXISTS" },
 913         { 0xC000022C, "STATUS_CONVERT_TO_LARGE" },
 914         { 0xC000022D, "STATUS_RETRY" },
 915         { 0xC000022E, "STATUS_FOUND_OUT_OF_SCOPE" },
 916         { 0xC000022F, "STATUS_ALLOCATE_BUCKET" },
 917         { 0xC0000230, "STATUS_PROPSET_NOT_FOUND" },
 918         { 0xC0000231, "STATUS_MARSHALL_OVERFLOW" },
 919         { 0xC0000232, "STATUS_INVALID_VARIANT" },
 920         { 0xC0000233, "STATUS_DOMAIN_CONTROLLER_NOT_FOUND" },
 921         { 0xC0000234, "STATUS_ACCOUNT_LOCKED_OUT" },
 922         { 0xC0000235, "STATUS_HANDLE_NOT_CLOSABLE" },
 923         { 0xC0000236, "STATUS_CONNECTION_REFUSED" },
 924         { 0xC0000237, "STATUS_GRACEFUL_DISCONNECT" },
 925         { 0xC0000238, "STATUS_ADDRESS_ALREADY_ASSOCIATED" },
 926         { 0xC0000239, "STATUS_ADDRESS_NOT_ASSOCIATED" },
 927         { 0xC000023A, "STATUS_CONNECTION_INVALID" },
 928         { 0xC000023B, "STATUS_CONNECTION_ACTIVE" },
 929         { 0xC000023C, "STATUS_NETWORK_UNREACHABLE" },
 930         { 0xC000023D, "STATUS_HOST_UNREACHABLE" },
 931         { 0xC000023E, "STATUS_PROTOCOL_UNREACHABLE" },
 932         { 0xC000023F, "STATUS_PORT_UNREACHABLE" },
 933         { 0xC0000240, "STATUS_REQUEST_ABORTED" },
 934         { 0xC0000241, "STATUS_CONNECTION_ABORTED" },
 935         { 0xC0000242, "STATUS_BAD_COMPRESSION_BUFFER" },
 936         { 0xC0000243, "STATUS_USER_MAPPED_FILE" },
 937         { 0xC0000244, "STATUS_AUDIT_FAILED" },
 938         { 0xC0000245, "STATUS_TIMER_RESOLUTION_NOT_SET" },
 939         { 0xC0000246, "STATUS_CONNECTION_COUNT_LIMIT" },
 940         { 0xC0000247, "STATUS_LOGIN_TIME_RESTRICTION" },
 941         { 0xC0000248, "STATUS_LOGIN_WKSTA_RESTRICTION" },
 942         { 0xC0000249, "STATUS_IMAGE_MP_UP_MISMATCH" },
 943         { 0xC0000250, "STATUS_INSUFFICIENT_LOGON_INFO" },
 944         { 0xC0000251, "STATUS_BAD_DLL_ENTRYPOINT" },
 945         { 0xC0000252, "STATUS_BAD_SERVICE_ENTRYPOINT" },
 946         { 0xC0000253, "STATUS_LPC_REPLY_LOST" },
 947         { 0xC0000254, "STATUS_IP_ADDRESS_CONFLICT1" },
 948         { 0xC0000255, "STATUS_IP_ADDRESS_CONFLICT2" },
 949         { 0xC0000256, "STATUS_REGISTRY_QUOTA_LIMIT" },
 950         { 0xC0000257, "STATUS_PATH_NOT_COVERED" },
 951         { 0xC0000258, "STATUS_NO_CALLBACK_ACTIVE" },
 952         { 0xC0000259, "STATUS_LICENSE_QUOTA_EXCEEDED" },
 953         { 0xC000025A, "STATUS_PWD_TOO_SHORT" },
 954         { 0xC000025B, "STATUS_PWD_TOO_RECENT" },
 955         { 0xC000025C, "STATUS_PWD_HISTORY_CONFLICT" },
 956         { 0xC000025E, "STATUS_PLUGPLAY_NO_DEVICE" },
 957         { 0xC000025F, "STATUS_UNSUPPORTED_COMPRESSION" },
 958         { 0xC0000260, "STATUS_INVALID_HW_PROFILE" },
 959         { 0xC0000261, "STATUS_INVALID_PLUGPLAY_DEVICE_PATH" },
 960         { 0xC0000262, "STATUS_DRIVER_ORDINAL_NOT_FOUND" },
 961         { 0xC0000263, "STATUS_DRIVER_ENTRYPOINT_NOT_FOUND" },
 962         { 0xC0000264, "STATUS_RESOURCE_NOT_OWNED" },
 963         { 0xC0000265, "STATUS_TOO_MANY_LINKS" },
 964         { 0xC0000266, "STATUS_QUOTA_LIST_INCONSISTENT" },
 965         { 0xC0000267, "STATUS_FILE_IS_OFFLINE" },
 966         { 0xC0000268, "STATUS_EVALUATION_EXPIRATION" },
 967         { 0xC0000269, "STATUS_ILLEGAL_DLL_RELOCATION" },
 968         { 0xC000026A, "STATUS_LICENSE_VIOLATION" },
 969         { 0xC000026B, "STATUS_DLL_INIT_FAILED_LOGOFF" },
 970         { 0xC000026C, "STATUS_DRIVER_UNABLE_TO_LOAD" },
 971         { 0xC000026D, "STATUS_DFS_UNAVAILABLE" },
 972         { 0xC000026E, "STATUS_VOLUME_DISMOUNTED" },
 973         { 0xC000026F, "STATUS_WX86_INTERNAL_ERROR" },
 974         { 0xC0000270, "STATUS_WX86_FLOAT_STACK_CHECK" },
 975         { 0xC0000271, "STATUS_VALIDATE_CONTINUE" },
 976         { 0xC0000272, "STATUS_NO_MATCH" },
 977         { 0xC0000273, "STATUS_NO_MORE_MATCHES" },
 978         { 0xC0000275, "STATUS_NOT_A_REPARSE_POINT" },
 979         { 0xC0000276, "STATUS_IO_REPARSE_TAG_INVALID" },
 980         { 0xC0000277, "STATUS_IO_REPARSE_TAG_MISMATCH" },
 981         { 0xC0000278, "STATUS_IO_REPARSE_DATA_INVALID" },
 982         { 0xC0000279, "STATUS_IO_REPARSE_TAG_NOT_HANDLED" },
 983         { 0xC0000280, "STATUS_REPARSE_POINT_NOT_RESOLVED" },
 984         { 0xC0000281, "STATUS_DIRECTORY_IS_A_REPARSE_POINT" },
 985         { 0xC0000282, "STATUS_RANGE_LIST_CONFLICT" },
 986         { 0xC0000283, "STATUS_SOURCE_ELEMENT_EMPTY" },
 987         { 0xC0000284, "STATUS_DESTINATION_ELEMENT_FULL" },
 988         { 0xC0000285, "STATUS_ILLEGAL_ELEMENT_ADDRESS" },
 989         { 0xC0000286, "STATUS_MAGAZINE_NOT_PRESENT" },
 990         { 0xC0000287, "STATUS_REINITIALIZATION_NEEDED" },
 991         { 0xC000028A, "STATUS_ENCRYPTION_FAILED" },
 992         { 0xC000028B, "STATUS_DECRYPTION_FAILED" },
 993         { 0xC000028C, "STATUS_RANGE_NOT_FOUND" },
 994         { 0xC000028D, "STATUS_NO_RECOVERY_POLICY" },
 995         { 0xC000028E, "STATUS_NO_EFS" },
 996         { 0xC000028F, "STATUS_WRONG_EFS" },
 997         { 0xC0000290, "STATUS_NO_USER_KEYS" },
 998         { 0xC0000291, "STATUS_FILE_NOT_ENCRYPTED" },
 999         { 0xC0000292, "STATUS_NOT_EXPORT_FORMAT" },
1000         { 0xC0000293, "STATUS_FILE_ENCRYPTED" },
1001         { 0xC0000295, "STATUS_WMI_GUID_NOT_FOUND" },
1002         { 0xC0000296, "STATUS_WMI_INSTANCE_NOT_FOUND" },
1003         { 0xC0000297, "STATUS_WMI_ITEMID_NOT_FOUND" },
1004         { 0xC0000298, "STATUS_WMI_TRY_AGAIN" },
1005         { 0xC0000299, "STATUS_SHARED_POLICY" },
1006         { 0xC000029A, "STATUS_POLICY_OBJECT_NOT_FOUND" },
1007         { 0xC000029B, "STATUS_POLICY_ONLY_IN_DS" },
1008         { 0xC000029C, "STATUS_VOLUME_NOT_UPGRADED" },
1009         { 0xC000029D, "STATUS_REMOTE_STORAGE_NOT_ACTIVE" },
1010         { 0xC000029E, "STATUS_REMOTE_STORAGE_MEDIA_ERROR" },
1011         { 0xC000029F, "STATUS_NO_TRACKING_SERVICE" },
1012         { 0xC00002A0, "STATUS_SERVER_SID_MISMATCH" },
1013         { 0xC00002A1, "STATUS_DS_NO_ATTRIBUTE_OR_VALUE" },
1014         { 0xC00002A2, "STATUS_DS_INVALID_ATTRIBUTE_SYNTAX" },
1015         { 0xC00002A3, "STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED" },
1016         { 0xC00002A4, "STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS" },
1017         { 0xC00002A5, "STATUS_DS_BUSY" },
1018         { 0xC00002A6, "STATUS_DS_UNAVAILABLE" },
1019         { 0xC00002A7, "STATUS_DS_NO_RIDS_ALLOCATED" },
1020         { 0xC00002A8, "STATUS_DS_NO_MORE_RIDS" },
1021         { 0xC00002A9, "STATUS_DS_INCORRECT_ROLE_OWNER" },
1022         { 0xC00002AA, "STATUS_DS_RIDMGR_INIT_ERROR" },
1023         { 0xC00002AB, "STATUS_DS_OBJ_CLASS_VIOLATION" },
1024         { 0xC00002AC, "STATUS_DS_CANT_ON_NON_LEAF" },
1025         { 0xC00002AD, "STATUS_DS_CANT_ON_RDN" },
1026         { 0xC00002AE, "STATUS_DS_CANT_MOD_OBJ_CLASS" },
1027         { 0xC00002AF, "STATUS_DS_CROSS_DOM_MOVE_FAILED" },
1028         { 0xC00002B0, "STATUS_DS_GC_NOT_AVAILABLE" },
1029         { 0xC00002B1, "STATUS_DIRECTORY_SERVICE_REQUIRED" },
1030         { 0xC00002B2, "STATUS_REPARSE_ATTRIBUTE_CONFLICT" },
1031         { 0xC00002B3, "STATUS_CANT_ENABLE_DENY_ONLY" },
1032         { 0xC00002B4, "STATUS_FLOAT_MULTIPLE_FAULTS" },
1033         { 0xC00002B5, "STATUS_FLOAT_MULTIPLE_TRAPS" },
1034         { 0xC00002B6, "STATUS_DEVICE_REMOVED" },
1035         { 0xC00002B7, "STATUS_JOURNAL_DELETE_IN_PROGRESS" },
1036         { 0xC00002B8, "STATUS_JOURNAL_NOT_ACTIVE" },
1037         { 0xC00002B9, "STATUS_NOINTERFACE" },
1038         { 0xC00002C1, "STATUS_DS_ADMIN_LIMIT_EXCEEDED" },
1039         { 0xC00002C2, "STATUS_DRIVER_FAILED_SLEEP" },
1040         { 0xC00002C3, "STATUS_MUTUAL_AUTHENTICATION_FAILED" },
1041         { 0xC00002C4, "STATUS_CORRUPT_SYSTEM_FILE" },
1042         { 0xC00002C5, "STATUS_DATATYPE_MISALIGNMENT_ERROR" },
1043         { 0xC00002C6, "STATUS_WMI_READ_ONLY" },
1044         { 0xC00002C7, "STATUS_WMI_SET_FAILURE" },
1045         { 0xC00002C8, "STATUS_COMMITMENT_MINIMUM" },
1046         { 0xC00002C9, "STATUS_REG_NAT_CONSUMPTION" },
1047         { 0xC00002CA, "STATUS_TRANSPORT_FULL" },
1048         { 0xC00002CB, "STATUS_DS_SAM_INIT_FAILURE" },
1049         { 0xC00002CC, "STATUS_ONLY_IF_CONNECTED" },
1050         { 0xC00002CD, "STATUS_DS_SENSITIVE_GROUP_VIOLATION" },
1051         { 0xC00002CE, "STATUS_PNP_RESTART_ENUMERATION" },
1052         { 0xC00002CF, "STATUS_JOURNAL_ENTRY_DELETED" },
1053         { 0xC00002D0, "STATUS_DS_CANT_MOD_PRIMARYGROUPID" },
1054         { 0xC00002D1, "STATUS_SYSTEM_IMAGE_BAD_SIGNATURE" },
1055         { 0xC00002D2, "STATUS_PNP_REBOOT_REQUIRED" },
1056         { 0xC00002D3, "STATUS_POWER_STATE_INVALID" },
1057         { 0xC00002D4, "STATUS_DS_INVALID_GROUP_TYPE" },
1058         { 0xC00002D5, "STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN" },
1059         { 0xC00002D6, "STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN" },
1060         { 0xC00002D7, "STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER" },
1061         { 0xC00002D8, "STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER" },
1062         { 0xC00002D9, "STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER" },
1063         { 0xC00002DA, "STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER" },
1064         { 0xC00002DB, "STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER" },
1065         { 0xC00002DC, "STATUS_DS_HAVE_PRIMARY_MEMBERS" },
1066         { 0xC00002DD, "STATUS_WMI_NOT_SUPPORTED" },
1067         { 0xC00002DE, "STATUS_INSUFFICIENT_POWER" },
1068         { 0xC00002DF, "STATUS_SAM_NEED_BOOTKEY_PASSWORD" },
1069         { 0xC00002E0, "STATUS_SAM_NEED_BOOTKEY_FLOPPY" },
1070         { 0xC00002E1, "STATUS_DS_CANT_START" },
1071         { 0xC00002E2, "STATUS_DS_INIT_FAILURE" },
1072         { 0xC00002E3, "STATUS_SAM_INIT_FAILURE" },
1073         { 0xC00002E4, "STATUS_DS_GC_REQUIRED" },
1074         { 0xC00002E5, "STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY" },
1075         { 0xC00002E6, "STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS" },
1076         { 0xC00002E7, "STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED" },
1077         { 0xC00002E8, "STATUS_MULTIPLE_FAULT_VIOLATION" },
1078         { 0xC00002E9, "STATUS_CURRENT_DOMAIN_NOT_ALLOWED" },
1079         { 0xC00002EA, "STATUS_CANNOT_MAKE" },
1080         { 0xC00002EB, "STATUS_SYSTEM_SHUTDOWN" },
1081         { 0xC00002EC, "STATUS_DS_INIT_FAILURE_CONSOLE" },
1082         { 0xC00002ED, "STATUS_DS_SAM_INIT_FAILURE_CONSOLE" },
1083         { 0xC00002EE, "STATUS_UNFINISHED_CONTEXT_DELETED" },
1084         { 0xC00002EF, "STATUS_NO_TGT_REPLY" },
1085         { 0xC00002F0, "STATUS_OBJECTID_NOT_FOUND" },
1086         { 0xC00002F1, "STATUS_NO_IP_ADDRESSES" },
1087         { 0xC00002F2, "STATUS_WRONG_CREDENTIAL_HANDLE" },
1088         { 0xC00002F3, "STATUS_CRYPTO_SYSTEM_INVALID" },
1089         { 0xC00002F4, "STATUS_MAX_REFERRALS_EXCEEDED" },
1090         { 0xC00002F5, "STATUS_MUST_BE_KDC" },
1091         { 0xC00002F6, "STATUS_STRONG_CRYPTO_NOT_SUPPORTED" },
1092         { 0xC00002F7, "STATUS_TOO_MANY_PRINCIPALS" },
1093         { 0xC00002F8, "STATUS_NO_PA_DATA" },
1094         { 0xC00002F9, "STATUS_PKINIT_NAME_MISMATCH" },
1095         { 0xC00002FA, "STATUS_SMARTCARD_LOGON_REQUIRED" },
1096         { 0xC00002FB, "STATUS_KDC_INVALID_REQUEST" },
1097         { 0xC00002FC, "STATUS_KDC_UNABLE_TO_REFER" },
1098         { 0xC00002FD, "STATUS_KDC_UNKNOWN_ETYPE" },
1099         { 0xC00002FE, "STATUS_SHUTDOWN_IN_PROGRESS" },
1100         { 0xC00002FF, "STATUS_SERVER_SHUTDOWN_IN_PROGRESS" },
1101         { 0xC0000300, "STATUS_NOT_SUPPORTED_ON_SBS" },
1102         { 0xC0000301, "STATUS_WMI_GUID_DISCONNECTED" },
1103         { 0xC0000302, "STATUS_WMI_ALREADY_DISABLED" },
1104         { 0xC0000303, "STATUS_WMI_ALREADY_ENABLED" },
1105         { 0xC0000304, "STATUS_MFT_TOO_FRAGMENTED" },
1106         { 0xC0000305, "STATUS_COPY_PROTECTION_FAILURE" },
1107         { 0xC0000306, "STATUS_CSS_AUTHENTICATION_FAILURE" },
1108         { 0xC0000307, "STATUS_CSS_KEY_NOT_PRESENT" },
1109         { 0xC0000308, "STATUS_CSS_KEY_NOT_ESTABLISHED" },
1110         { 0xC0000309, "STATUS_CSS_SCRAMBLED_SECTOR" },
1111         { 0xC000030A, "STATUS_CSS_REGION_MISMATCH" },
1112         { 0xC000030B, "STATUS_CSS_RESETS_EXHAUSTED" },
1113         { 0xC0000320, "STATUS_PKINIT_FAILURE" },
1114         { 0xC0000321, "STATUS_SMARTCARD_SUBSYSTEM_FAILURE" },
1115         { 0xC0000322, "STATUS_NO_KERB_KEY" },
1116         { 0xC0000350, "STATUS_HOST_DOWN" },
1117         { 0xC0000351, "STATUS_UNSUPPORTED_PREAUTH" },
1118         { 0xC0000352, "STATUS_EFS_ALG_BLOB_TOO_BIG" },
1119         { 0xC0000353, "STATUS_PORT_NOT_SET" },
1120         { 0xC0000354, "STATUS_DEBUGGER_INACTIVE" },
1121         { 0xC0000355, "STATUS_DS_VERSION_CHECK_FAILURE" },
1122         { 0xC0000356, "STATUS_AUDITING_DISABLED" },
1123         { 0xC0000357, "STATUS_PRENT4_MACHINE_ACCOUNT" },
1124         { 0xC0000358, "STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER" },
1125         { 0xC0000359, "STATUS_INVALID_IMAGE_WIN_32" },
1126         { 0xC000035A, "STATUS_INVALID_IMAGE_WIN_64" },
1127         { 0xC000035B, "STATUS_BAD_BINDINGS" },
1128         { 0xC000035C, "STATUS_NETWORK_SESSION_EXPIRED" },
1129         { 0xC000035D, "STATUS_APPHELP_BLOCK" },
1130         { 0xC000035E, "STATUS_ALL_SIDS_FILTERED" },
1131         { 0xC000035F, "STATUS_NOT_SAFE_MODE_DRIVER" },
1132         { 0xC0000361, "STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT" },
1133         { 0xC0000362, "STATUS_ACCESS_DISABLED_BY_POLICY_PATH" },
1134         { 0xC0000363, "STATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER" },
1135         { 0xC0000364, "STATUS_ACCESS_DISABLED_BY_POLICY_OTHER" },
1136         { 0xC0000365, "STATUS_FAILED_DRIVER_ENTRY" },
1137         { 0xC0000366, "STATUS_DEVICE_ENUMERATION_ERROR" },
1138         { 0xC0000368, "STATUS_MOUNT_POINT_NOT_RESOLVED" },
1139         { 0xC0000369, "STATUS_INVALID_DEVICE_OBJECT_PARAMETER" },
1140         { 0xC000036A, "STATUS_MCA_OCCURED" },
1141         { 0xC000036B, "STATUS_DRIVER_BLOCKED_CRITICAL" },
1142         { 0xC000036C, "STATUS_DRIVER_BLOCKED" },
1143         { 0xC000036D, "STATUS_DRIVER_DATABASE_ERROR" },
1144         { 0xC000036E, "STATUS_SYSTEM_HIVE_TOO_LARGE" },
1145         { 0xC000036F, "STATUS_INVALID_IMPORT_OF_NON_DLL" },
1146         { 0xC0000371, "STATUS_NO_SECRETS" },
1147         { 0xC0000372, "STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY" },
1148         { 0xC0000373, "STATUS_FAILED_STACK_SWITCH" },
1149         { 0xC0000374, "STATUS_HEAP_CORRUPTION" },
1150         { 0xC0000380, "STATUS_SMARTCARD_WRONG_PIN" },
1151         { 0xC0000381, "STATUS_SMARTCARD_CARD_BLOCKED" },
1152         { 0xC0000382, "STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED" },
1153         { 0xC0000383, "STATUS_SMARTCARD_NO_CARD" },
1154         { 0xC0000384, "STATUS_SMARTCARD_NO_KEY_CONTAINER" },
1155         { 0xC0000385, "STATUS_SMARTCARD_NO_CERTIFICATE" },
1156         { 0xC0000386, "STATUS_SMARTCARD_NO_KEYSET" },
1157         { 0xC0000387, "STATUS_SMARTCARD_IO_ERROR" },
1158         { 0xC0000388, "STATUS_DOWNGRADE_DETECTED" },
1159         { 0xC0000389, "STATUS_SMARTCARD_CERT_REVOKED" },
1160         { 0xC000038A, "STATUS_ISSUING_CA_UNTRUSTED" },
1161         { 0xC000038B, "STATUS_REVOCATION_OFFLINE_C" },
1162         { 0xC000038C, "STATUS_PKINIT_CLIENT_FAILURE" },
1163         { 0xC000038D, "STATUS_SMARTCARD_CERT_EXPIRED" },
1164         { 0xC000038E, "STATUS_DRIVER_FAILED_PRIOR_UNLOAD" },
1165         { 0xC000038F, "STATUS_SMARTCARD_SILENT_CONTEXT" },
1166         { 0xC0000401, "STATUS_PER_USER_TRUST_QUOTA_EXCEEDED" },
1167         { 0xC0000402, "STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED" },
1168         { 0xC0000403, "STATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED" },
1169         { 0xC0000404, "STATUS_DS_NAME_NOT_UNIQUE" },
1170         { 0xC0000405, "STATUS_DS_DUPLICATE_ID_FOUND" },
1171         { 0xC0000406, "STATUS_DS_GROUP_CONVERSION_ERROR" },
1172         { 0xC0000407, "STATUS_VOLSNAP_PREPARE_HIBERNATE" },
1173         { 0xC0000408, "STATUS_USER2USER_REQUIRED" },
1174         { 0xC0000409, "STATUS_STACK_BUFFER_OVERRUN" },
1175         { 0xC000040A, "STATUS_NO_S4U_PROT_SUPPORT" },
1176         { 0xC000040B, "STATUS_CROSSREALM_DELEGATION_FAILURE" },
1177         { 0xC000040C, "STATUS_REVOCATION_OFFLINE_KDC" },
1178         { 0xC000040D, "STATUS_ISSUING_CA_UNTRUSTED_KDC" },
1179         { 0xC000040E, "STATUS_KDC_CERT_EXPIRED" },
1180         { 0xC000040F, "STATUS_KDC_CERT_REVOKED" },
1181         { 0xC0000410, "STATUS_PARAMETER_QUOTA_EXCEEDED" },
1182         { 0xC0000411, "STATUS_HIBERNATION_FAILURE" },
1183         { 0xC0000412, "STATUS_DELAY_LOAD_FAILED" },
1184         { 0xC0000413, "STATUS_AUTHENTICATION_FIREWALL_FAILED" },
1185         { 0xC0000414, "STATUS_VDM_DISALLOWED" },
1186         { 0xC0000415, "STATUS_HUNG_DISPLAY_DRIVER_THREAD" },
1187         { 0xC0000416, "STATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE" },
1188         { 0xC0000417, "STATUS_INVALID_CRUNTIME_PARAMETER" },
1189         { 0xC0000418, "STATUS_NTLM_BLOCKED" },
1190         { 0xC0000419, "STATUS_DS_SRC_SID_EXISTS_IN_FOREST" },
1191         { 0xC000041A, "STATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST" },
1192         { 0xC000041B, "STATUS_DS_FLAT_NAME_EXISTS_IN_FOREST" },
1193         { 0xC000041C, "STATUS_INVALID_USER_PRINCIPAL_NAME" },
1194         { 0xC0000420, "STATUS_ASSERTION_FAILURE" },
1195         { 0xC0000421, "STATUS_VERIFIER_STOP" },
1196         { 0xC0000423, "STATUS_CALLBACK_POP_STACK" },
1197         { 0xC0000424, "STATUS_INCOMPATIBLE_DRIVER_BLOCKED" },
1198         { 0xC0000425, "STATUS_HIVE_UNLOADED" },
1199         { 0xC0000426, "STATUS_COMPRESSION_DISABLED" },
1200         { 0xC0000427, "STATUS_FILE_SYSTEM_LIMITATION" },
1201         { 0xC0000428, "STATUS_INVALID_IMAGE_HASH" },
1202         { 0xC0000429, "STATUS_NOT_CAPABLE" },
1203         { 0xC000042A, "STATUS_REQUEST_OUT_OF_SEQUENCE" },
1204         { 0xC000042B, "STATUS_IMPLEMENTATION_LIMIT" },
1205         { 0xC000042C, "STATUS_ELEVATION_REQUIRED" },
1206         { 0xC000042D, "STATUS_NO_SECURITY_CONTEXT" },
1207         { 0xC000042E, "STATUS_PKU2U_CERT_FAILURE" },
1208         { 0xC0000432, "STATUS_BEYOND_VDL" },
1209         { 0xC0000433, "STATUS_ENCOUNTERED_WRITE_IN_PROGRESS" },
1210         { 0xC0000434, "STATUS_PTE_CHANGED" },
1211         { 0xC0000435, "STATUS_PURGE_FAILED" },
1212         { 0xC0000440, "STATUS_CRED_REQUIRES_CONFIRMATION" },
1213         { 0xC0000441, "STATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE" },
1214         { 0xC0000442, "STATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER" },
1215         { 0xC0000443, "STATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE" },
1216         { 0xC0000444, "STATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE" },
1217         { 0xC0000445, "STATUS_CS_ENCRYPTION_FILE_NOT_CSE" },
1218         { 0xC0000446, "STATUS_INVALID_LABEL" },
1219         { 0xC0000450, "STATUS_DRIVER_PROCESS_TERMINATED" },
1220         { 0xC0000451, "STATUS_AMBIGUOUS_SYSTEM_DEVICE" },
1221         { 0xC0000452, "STATUS_SYSTEM_DEVICE_NOT_FOUND" },
1222         { 0xC0000453, "STATUS_RESTART_BOOT_APPLICATION" },
1223         { 0xC0000454, "STATUS_INSUFFICIENT_NVRAM_RESOURCES" },
1224         { 0xC0000460, "STATUS_NO_RANGES_PROCESSED" },
1225         { 0xC0000463, "STATUS_DEVICE_FEATURE_NOT_SUPPORTED" },
1226         { 0xC0000464, "STATUS_DEVICE_UNREACHABLE" },
1227         { 0xC0000465, "STATUS_INVALID_TOKEN" },
1228         { 0xC0000466, "STATUS_SERVER_UNAVAILABLE" },
1229         { 0xC0000500, "STATUS_INVALID_TASK_NAME" },
1230         { 0xC0000501, "STATUS_INVALID_TASK_INDEX" },
1231         { 0xC0000502, "STATUS_THREAD_ALREADY_IN_TASK" },
1232         { 0xC0000503, "STATUS_CALLBACK_BYPASS" },
1233         { 0xC0000602, "STATUS_FAIL_FAST_EXCEPTION" },
1234         { 0xC0000603, "STATUS_IMAGE_CERT_REVOKED" },
1235         { 0xC0000700, "STATUS_PORT_CLOSED" },
1236         { 0xC0000701, "STATUS_MESSAGE_LOST" },
1237         { 0xC0000702, "STATUS_INVALID_MESSAGE" },
1238         { 0xC0000703, "STATUS_REQUEST_CANCELED" },
1239         { 0xC0000704, "STATUS_RECURSIVE_DISPATCH" },
1240         { 0xC0000705, "STATUS_LPC_RECEIVE_BUFFER_EXPECTED" },
1241         { 0xC0000706, "STATUS_LPC_INVALID_CONNECTION_USAGE" },
1242         { 0xC0000707, "STATUS_LPC_REQUESTS_NOT_ALLOWED" },
1243         { 0xC0000708, "STATUS_RESOURCE_IN_USE" },
1244         { 0xC0000709, "STATUS_HARDWARE_MEMORY_ERROR" },
1245         { 0xC000070A, "STATUS_THREADPOOL_HANDLE_EXCEPTION" },
1246         { 0xC000070B, "STATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED" },
1247         { 0xC000070C, "STATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED" },
1248         { 0xC000070D, "STATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED" },
1249         { 0xC000070E, "STATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED" },
1250         { 0xC000070F, "STATUS_THREADPOOL_RELEASED_DURING_OPERATION" },
1251         { 0xC0000710, "STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING" },
1252         { 0xC0000711, "STATUS_APC_RETURNED_WHILE_IMPERSONATING" },
1253         { 0xC0000712, "STATUS_PROCESS_IS_PROTECTED" },
1254         { 0xC0000713, "STATUS_MCA_EXCEPTION" },
1255         { 0xC0000714, "STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE" },
1256         { 0xC0000715, "STATUS_SYMLINK_CLASS_DISABLED" },
1257         { 0xC0000716, "STATUS_INVALID_IDN_NORMALIZATION" },
1258         { 0xC0000717, "STATUS_NO_UNICODE_TRANSLATION" },
1259         { 0xC0000718, "STATUS_ALREADY_REGISTERED" },
1260         { 0xC0000719, "STATUS_CONTEXT_MISMATCH" },
1261         { 0xC000071A, "STATUS_PORT_ALREADY_HAS_COMPLETION_LIST" },
1262         { 0xC000071B, "STATUS_CALLBACK_RETURNED_THREAD_PRIORITY" },
1263         { 0xC000071C, "STATUS_INVALID_THREAD" },
1264         { 0xC000071D, "STATUS_CALLBACK_RETURNED_TRANSACTION" },
1265         { 0xC000071E, "STATUS_CALLBACK_RETURNED_LDR_LOCK" },
1266         { 0xC000071F, "STATUS_CALLBACK_RETURNED_LANG" },
1267         { 0xC0000720, "STATUS_CALLBACK_RETURNED_PRI_BACK" },
1268         { 0xC0000800, "STATUS_DISK_REPAIR_DISABLED" },
1269         { 0xC0000801, "STATUS_DS_DOMAIN_RENAME_IN_PROGRESS" },
1270         { 0xC0000802, "STATUS_DISK_QUOTA_EXCEEDED" },
1271         { 0xC0000804, "STATUS_CONTENT_BLOCKED" },
1272         { 0xC0000805, "STATUS_BAD_CLUSTERS" },
1273         { 0xC0000806, "STATUS_VOLUME_DIRTY" },
1274         { 0xC0000901, "STATUS_FILE_CHECKED_OUT" },
1275         { 0xC0000902, "STATUS_CHECKOUT_REQUIRED" },
1276         { 0xC0000903, "STATUS_BAD_FILE_TYPE" },
1277         { 0xC0000904, "STATUS_FILE_TOO_LARGE" },
1278         { 0xC0000905, "STATUS_FORMS_AUTH_REQUIRED" },
1279         { 0xC0000906, "STATUS_VIRUS_INFECTED" },
1280         { 0xC0000907, "STATUS_VIRUS_DELETED" },
1281         { 0xC0000908, "STATUS_BAD_MCFG_TABLE" },
1282         { 0xC0000909, "STATUS_CANNOT_BREAK_OPLOCK" },
1283         { 0xC0009898, "STATUS_WOW_ASSERTION" },
1284         { 0xC000A000, "STATUS_INVALID_SIGNATURE" },
1285         { 0xC000A001, "STATUS_HMAC_NOT_SUPPORTED" },
1286         { 0xC000A010, "STATUS_IPSEC_QUEUE_OVERFLOW" },
1287         { 0xC000A011, "STATUS_ND_QUEUE_OVERFLOW" },
1288         { 0xC000A012, "STATUS_HOPLIMIT_EXCEEDED" },
1289         { 0xC000A013, "STATUS_PROTOCOL_NOT_SUPPORTED" },
1290         { 0xC000A080, "STATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED" },
1291         { 0xC000A081, "STATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR" },
1292         { 0xC000A082, "STATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR" },
1293         { 0xC000A083, "STATUS_XML_PARSE_ERROR" },
1294         { 0xC000A084, "STATUS_XMLDSIG_ERROR" },
1295         { 0xC000A085, "STATUS_WRONG_COMPARTMENT" },
1296         { 0xC000A086, "STATUS_AUTHIP_FAILURE" },
1297         { 0xC000A087, "STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS" },
1298         { 0xC000A088, "STATUS_DS_OID_NOT_FOUND" },
1299         { 0xC000A100, "STATUS_HASH_NOT_SUPPORTED" },
1300         { 0xC000A101, "STATUS_HASH_NOT_PRESENT" },
1301         { 0xC000A2A1, "STATUS_OFFLOAD_READ_FLT_NOT_SUPPORTED" },
1302         { 0xC000A2A2, "STATUS_OFFLOAD_WRITE_FLT_NOT_SUPPORTED" },
1303         { 0xC000A2A3, "STATUS_OFFLOAD_READ_FILE_NOT_SUPPORTED" },
1304         { 0xC000A2A4, "STATUS_OFFLOAD_WRITE_FILE_NOT_SUPPORTED" },
1305         { 0xC0010001, "STATUS_DBG_NO_STATE_CHANGE" },
1306         { 0xC0010002, "STATUS_DBG_APP_NOT_IDLE" },
1307         { 0xC0020001, "STATUS_RPC_INVALID_STRING_BINDING" },
1308         { 0xC0020002, "STATUS_RPC_WRONG_KIND_OF_BINDING" },
1309         { 0xC0020003, "STATUS_RPC_INVALID_BINDING" },
1310         { 0xC0020004, "STATUS_RPC_PROTSEQ_NOT_SUPPORTED" },
1311         { 0xC0020005, "STATUS_RPC_INVALID_RPC_PROTSEQ" },
1312         { 0xC0020006, "STATUS_RPC_INVALID_STRING_UUID" },
1313         { 0xC0020007, "STATUS_RPC_INVALID_ENDPOINT_FORMAT" },
1314         { 0xC0020008, "STATUS_RPC_INVALID_NET_ADDR" },
1315         { 0xC0020009, "STATUS_RPC_NO_ENDPOINT_FOUND" },
1316         { 0xC002000A, "STATUS_RPC_INVALID_TIMEOUT" },
1317         { 0xC002000B, "STATUS_RPC_OBJECT_NOT_FOUND" },
1318         { 0xC002000C, "STATUS_RPC_ALREADY_REGISTERED" },
1319         { 0xC002000D, "STATUS_RPC_TYPE_ALREADY_REGISTERED" },
1320         { 0xC002000E, "STATUS_RPC_ALREADY_LISTENING" },
1321         { 0xC002000F, "STATUS_RPC_NO_PROTSEQS_REGISTERED" },
1322         { 0xC0020010, "STATUS_RPC_NOT_LISTENING" },
1323         { 0xC0020011, "STATUS_RPC_UNKNOWN_MGR_TYPE" },
1324         { 0xC0020012, "STATUS_RPC_UNKNOWN_IF" },
1325         { 0xC0020013, "STATUS_RPC_NO_BINDINGS" },
1326         { 0xC0020014, "STATUS_RPC_NO_PROTSEQS" },
1327         { 0xC0020015, "STATUS_RPC_CANT_CREATE_ENDPOINT" },
1328         { 0xC0020016, "STATUS_RPC_OUT_OF_RESOURCES" },
1329         { 0xC0020017, "STATUS_RPC_SERVER_UNAVAILABLE" },
1330         { 0xC0020018, "STATUS_RPC_SERVER_TOO_BUSY" },
1331         { 0xC0020019, "STATUS_RPC_INVALID_NETWORK_OPTIONS" },
1332         { 0xC002001A, "STATUS_RPC_NO_CALL_ACTIVE" },
1333         { 0xC002001B, "STATUS_RPC_CALL_FAILED" },
1334         { 0xC002001C, "STATUS_RPC_CALL_FAILED_DNE" },
1335         { 0xC002001D, "STATUS_RPC_PROTOCOL_ERROR" },
1336         { 0xC002001F, "STATUS_RPC_UNSUPPORTED_TRANS_SYN" },
1337         { 0xC0020021, "STATUS_RPC_UNSUPPORTED_TYPE" },
1338         { 0xC0020022, "STATUS_RPC_INVALID_TAG" },
1339         { 0xC0020023, "STATUS_RPC_INVALID_BOUND" },
1340         { 0xC0020024, "STATUS_RPC_NO_ENTRY_NAME" },
1341         { 0xC0020025, "STATUS_RPC_INVALID_NAME_SYNTAX" },
1342         { 0xC0020026, "STATUS_RPC_UNSUPPORTED_NAME_SYNTAX" },
1343         { 0xC0020028, "STATUS_RPC_UUID_NO_ADDRESS" },
1344         { 0xC0020029, "STATUS_RPC_DUPLICATE_ENDPOINT" },
1345         { 0xC002002A, "STATUS_RPC_UNKNOWN_AUTHN_TYPE" },
1346         { 0xC002002B, "STATUS_RPC_MAX_CALLS_TOO_SMALL" },
1347         { 0xC002002C, "STATUS_RPC_STRING_TOO_LONG" },
1348         { 0xC002002D, "STATUS_RPC_PROTSEQ_NOT_FOUND" },
1349         { 0xC002002E, "STATUS_RPC_PROCNUM_OUT_OF_RANGE" },
1350         { 0xC002002F, "STATUS_RPC_BINDING_HAS_NO_AUTH" },
1351         { 0xC0020030, "STATUS_RPC_UNKNOWN_AUTHN_SERVICE" },
1352         { 0xC0020031, "STATUS_RPC_UNKNOWN_AUTHN_LEVEL" },
1353         { 0xC0020032, "STATUS_RPC_INVALID_AUTH_IDENTITY" },
1354         { 0xC0020033, "STATUS_RPC_UNKNOWN_AUTHZ_SERVICE" },
1355         { 0xC0020034, "STATUS_EPT_INVALID_ENTRY" },
1356         { 0xC0020035, "STATUS_EPT_CANT_PERFORM_OP" },
1357         { 0xC0020036, "STATUS_EPT_NOT_REGISTERED" },
1358         { 0xC0020037, "STATUS_RPC_NOTHING_TO_EXPORT" },
1359         { 0xC0020038, "STATUS_RPC_INCOMPLETE_NAME" },
1360         { 0xC0020039, "STATUS_RPC_INVALID_VERS_OPTION" },
1361         { 0xC002003A, "STATUS_RPC_NO_MORE_MEMBERS" },
1362         { 0xC002003B, "STATUS_RPC_NOT_ALL_OBJS_UNEXPORTED" },
1363         { 0xC002003C, "STATUS_RPC_INTERFACE_NOT_FOUND" },
1364         { 0xC002003D, "STATUS_RPC_ENTRY_ALREADY_EXISTS" },
1365         { 0xC002003E, "STATUS_RPC_ENTRY_NOT_FOUND" },
1366         { 0xC002003F, "STATUS_RPC_NAME_SERVICE_UNAVAILABLE" },
1367         { 0xC0020040, "STATUS_RPC_INVALID_NAF_ID" },
1368         { 0xC0020041, "STATUS_RPC_CANNOT_SUPPORT" },
1369         { 0xC0020042, "STATUS_RPC_NO_CONTEXT_AVAILABLE" },
1370         { 0xC0020043, "STATUS_RPC_INTERNAL_ERROR" },
1371         { 0xC0020044, "STATUS_RPC_ZERO_DIVIDE" },
1372         { 0xC0020045, "STATUS_RPC_ADDRESS_ERROR" },
1373         { 0xC0020046, "STATUS_RPC_FP_DIV_ZERO" },
1374         { 0xC0020047, "STATUS_RPC_FP_UNDERFLOW" },
1375         { 0xC0020048, "STATUS_RPC_FP_OVERFLOW" },
1376         { 0xC0020049, "STATUS_RPC_CALL_IN_PROGRESS" },
1377         { 0xC002004A, "STATUS_RPC_NO_MORE_BINDINGS" },
1378         { 0xC002004B, "STATUS_RPC_GROUP_MEMBER_NOT_FOUND" },
1379         { 0xC002004C, "STATUS_EPT_CANT_CREATE" },
1380         { 0xC002004D, "STATUS_RPC_INVALID_OBJECT" },
1381         { 0xC002004F, "STATUS_RPC_NO_INTERFACES" },
1382         { 0xC0020050, "STATUS_RPC_CALL_CANCELLED" },
1383         { 0xC0020051, "STATUS_RPC_BINDING_INCOMPLETE" },
1384         { 0xC0020052, "STATUS_RPC_COMM_FAILURE" },
1385         { 0xC0020053, "STATUS_RPC_UNSUPPORTED_AUTHN_LEVEL" },
1386         { 0xC0020054, "STATUS_RPC_NO_PRINC_NAME" },
1387         { 0xC0020055, "STATUS_RPC_NOT_RPC_ERROR" },
1388         { 0xC0020057, "STATUS_RPC_SEC_PKG_ERROR" },
1389         { 0xC0020058, "STATUS_RPC_NOT_CANCELLED" },
1390         { 0xC0020062, "STATUS_RPC_INVALID_ASYNC_HANDLE" },
1391         { 0xC0020063, "STATUS_RPC_INVALID_ASYNC_CALL" },
1392         { 0xC0020064, "STATUS_RPC_PROXY_ACCESS_DENIED" },
1393         { 0xC0021007, "RPC_P_RECEIVE_ALERTED" },
1394         { 0xC0021008, "RPC_P_CONNECTION_CLOSED" },
1395         { 0xC0021009, "RPC_P_RECEIVE_FAILED" },
1396         { 0xC002100A, "RPC_P_SEND_FAILED" },
1397         { 0xC002100B, "RPC_P_TIMEOUT" },
1398         { 0xC002100C, "RPC_P_SERVER_TRANSPORT_ERROR" },
1399         { 0xC002100E, "RPC_P_EXCEPTION_OCCURRED" },
1400         { 0xC0021012, "RPC_P_CONNECTION_SHUTDOWN" },
1401         { 0xC0021015, "RPC_P_THREAD_LISTENING" },
1402         { 0xC0030001, "STATUS_RPC_NO_MORE_ENTRIES" },
1403         { 0xC0030002, "STATUS_RPC_SS_CHAR_TRANS_OPEN_FAIL" },
1404         { 0xC0030003, "STATUS_RPC_SS_CHAR_TRANS_SHORT_FILE" },
1405         { 0xC0030004, "STATUS_RPC_SS_IN_NULL_CONTEXT" },
1406         { 0xC0030005, "STATUS_RPC_SS_CONTEXT_MISMATCH" },
1407         { 0xC0030006, "STATUS_RPC_SS_CONTEXT_DAMAGED" },
1408         { 0xC0030007, "STATUS_RPC_SS_HANDLES_MISMATCH" },
1409         { 0xC0030008, "STATUS_RPC_SS_CANNOT_GET_CALL_HANDLE" },
1410         { 0xC0030009, "STATUS_RPC_NULL_REF_POINTER" },
1411         { 0xC003000A, "STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE" },
1412         { 0xC003000B, "STATUS_RPC_BYTE_COUNT_TOO_SMALL" },
1413         { 0xC003000C, "STATUS_RPC_BAD_STUB_DATA" },
1414         { 0xC0030059, "STATUS_RPC_INVALID_ES_ACTION" },
1415         { 0xC003005A, "STATUS_RPC_WRONG_ES_VERSION" },
1416         { 0xC003005B, "STATUS_RPC_WRONG_STUB_VERSION" },
1417         { 0xC003005C, "STATUS_RPC_INVALID_PIPE_OBJECT" },
1418         { 0xC003005D, "STATUS_RPC_INVALID_PIPE_OPERATION" },
1419         { 0xC003005E, "STATUS_RPC_WRONG_PIPE_VERSION" },
1420         { 0xC003005F, "STATUS_RPC_PIPE_CLOSED" },
1421         { 0xC0030060, "STATUS_RPC_PIPE_DISCIPLINE_ERROR" },
1422         { 0xC0030061, "STATUS_RPC_PIPE_EMPTY" },
1423         { 0xC0040035, "STATUS_PNP_BAD_MPS_TABLE" },
1424         { 0xC0040036, "STATUS_PNP_TRANSLATION_FAILED" },
1425         { 0xC0040037, "STATUS_PNP_IRQ_TRANSLATION_FAILED" },
1426         { 0xC0040038, "STATUS_PNP_INVALID_ID" },
1427         { 0xC0040039, "STATUS_IO_REISSUE_AS_CACHED" },
1428         { 0xC00A0001, "STATUS_CTX_WINSTATION_NAME_INVALID" },
1429         { 0xC00A0002, "STATUS_CTX_INVALID_PD" },
1430         { 0xC00A0003, "STATUS_CTX_PD_NOT_FOUND" },
1431         { 0xC00A0006, "STATUS_CTX_CLOSE_PENDING" },
1432         { 0xC00A0007, "STATUS_CTX_NO_OUTBUF" },
1433         { 0xC00A0008, "STATUS_CTX_MODEM_INF_NOT_FOUND" },
1434         { 0xC00A0009, "STATUS_CTX_INVALID_MODEMNAME" },
1435         { 0xC00A000A, "STATUS_CTX_RESPONSE_ERROR" },
1436         { 0xC00A000B, "STATUS_CTX_MODEM_RESPONSE_TIMEOUT" },
1437         { 0xC00A000C, "STATUS_CTX_MODEM_RESPONSE_NO_CARRIER" },
1438         { 0xC00A000D, "STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE" },
1439         { 0xC00A000E, "STATUS_CTX_MODEM_RESPONSE_BUSY" },
1440         { 0xC00A000F, "STATUS_CTX_MODEM_RESPONSE_VOICE" },
1441         { 0xC00A0010, "STATUS_CTX_TD_ERROR" },
1442         { 0xC00A0012, "STATUS_CTX_LICENSE_CLIENT_INVALID" },
1443         { 0xC00A0013, "STATUS_CTX_LICENSE_NOT_AVAILABLE" },
1444         { 0xC00A0014, "STATUS_CTX_LICENSE_EXPIRED" },
1445         { 0xC00A0015, "STATUS_CTX_WINSTATION_NOT_FOUND" },
1446         { 0xC00A0016, "STATUS_CTX_WINSTATION_NAME_COLLISION" },
1447         { 0xC00A0017, "STATUS_CTX_WINSTATION_BUSY" },
1448         { 0xC00A0018, "STATUS_CTX_BAD_VIDEO_MODE" },
1449         { 0xC00A0022, "STATUS_CTX_GRAPHICS_INVALID" },
1450         { 0xC00A0024, "STATUS_CTX_NOT_CONSOLE" },
1451         { 0xC00A0026, "STATUS_CTX_CLIENT_QUERY_TIMEOUT" },
1452         { 0xC00A0027, "STATUS_CTX_CONSOLE_DISCONNECT" },
1453         { 0xC00A0028, "STATUS_CTX_CONSOLE_CONNECT" },
1454         { 0xC00A002A, "STATUS_CTX_SHADOW_DENIED" },
1455         { 0xC00A002B, "STATUS_CTX_WINSTATION_ACCESS_DENIED" },
1456         { 0xC00A002E, "STATUS_CTX_INVALID_WD" },
1457         { 0xC00A002F, "STATUS_CTX_WD_NOT_FOUND" },
1458         { 0xC00A0030, "STATUS_CTX_SHADOW_INVALID" },
1459         { 0xC00A0031, "STATUS_CTX_SHADOW_DISABLED" },
1460         { 0xC00A0032, "STATUS_RDP_PROTOCOL_ERROR" },
1461         { 0xC00A0033, "STATUS_CTX_CLIENT_LICENSE_NOT_SET" },
1462         { 0xC00A0034, "STATUS_CTX_CLIENT_LICENSE_IN_USE" },
1463         { 0xC00A0035, "STATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE" },
1464         { 0xC00A0036, "STATUS_CTX_SHADOW_NOT_RUNNING" },
1465         { 0xC00A0037, "STATUS_CTX_LOGON_DISABLED" },
1466         { 0xC00A0038, "STATUS_CTX_SECURITY_LAYER_ERROR" },
1467         { 0xC00A0039, "STATUS_TS_INCOMPATIBLE_SESSIONS" },
1468         { 0xC00B0001, "STATUS_MUI_FILE_NOT_FOUND" },
1469         { 0xC00B0002, "STATUS_MUI_INVALID_FILE" },
1470         { 0xC00B0003, "STATUS_MUI_INVALID_RC_CONFIG" },
1471         { 0xC00B0004, "STATUS_MUI_INVALID_LOCALE_NAME" },
1472         { 0xC00B0005, "STATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME" },
1473         { 0xC00B0006, "STATUS_MUI_FILE_NOT_LOADED" },
1474         { 0xC00B0007, "STATUS_RESOURCE_ENUM_USER_STOP" },
1475         { 0xC0130001, "STATUS_CLUSTER_INVALID_NODE" },
1476         { 0xC0130002, "STATUS_CLUSTER_NODE_EXISTS" },
1477         { 0xC0130003, "STATUS_CLUSTER_JOIN_IN_PROGRESS" },
1478         { 0xC0130004, "STATUS_CLUSTER_NODE_NOT_FOUND" },
1479         { 0xC0130005, "STATUS_CLUSTER_LOCAL_NODE_NOT_FOUND" },
1480         { 0xC0130006, "STATUS_CLUSTER_NETWORK_EXISTS" },
1481         { 0xC0130007, "STATUS_CLUSTER_NETWORK_NOT_FOUND" },
1482         { 0xC0130008, "STATUS_CLUSTER_NETINTERFACE_EXISTS" },
1483         { 0xC0130009, "STATUS_CLUSTER_NETINTERFACE_NOT_FOUND" },
1484         { 0xC013000A, "STATUS_CLUSTER_INVALID_REQUEST" },
1485         { 0xC013000B, "STATUS_CLUSTER_INVALID_NETWORK_PROVIDER" },
1486         { 0xC013000C, "STATUS_CLUSTER_NODE_DOWN" },
1487         { 0xC013000D, "STATUS_CLUSTER_NODE_UNREACHABLE" },
1488         { 0xC013000E, "STATUS_CLUSTER_NODE_NOT_MEMBER" },
1489         { 0xC013000F, "STATUS_CLUSTER_JOIN_NOT_IN_PROGRESS" },
1490         { 0xC0130010, "STATUS_CLUSTER_INVALID_NETWORK" },
1491         { 0xC0130011, "STATUS_CLUSTER_NO_NET_ADAPTERS" },
1492         { 0xC0130012, "STATUS_CLUSTER_NODE_UP" },
1493         { 0xC0130013, "STATUS_CLUSTER_NODE_PAUSED" },
1494         { 0xC0130014, "STATUS_CLUSTER_NODE_NOT_PAUSED" },
1495         { 0xC0130015, "STATUS_CLUSTER_NO_SECURITY_CONTEXT" },
1496         { 0xC0130016, "STATUS_CLUSTER_NETWORK_NOT_INTERNAL" },
1497         { 0xC0130017, "STATUS_CLUSTER_POISONED" },
1498         { 0xC0140001, "STATUS_ACPI_INVALID_OPCODE" },
1499         { 0xC0140002, "STATUS_ACPI_STACK_OVERFLOW" },
1500         { 0xC0140003, "STATUS_ACPI_ASSERT_FAILED" },
1501         { 0xC0140004, "STATUS_ACPI_INVALID_INDEX" },
1502         { 0xC0140005, "STATUS_ACPI_INVALID_ARGUMENT" },
1503         { 0xC0140006, "STATUS_ACPI_FATAL" },
1504         { 0xC0140007, "STATUS_ACPI_INVALID_SUPERNAME" },
1505         { 0xC0140008, "STATUS_ACPI_INVALID_ARGTYPE" },
1506         { 0xC0140009, "STATUS_ACPI_INVALID_OBJTYPE" },
1507         { 0xC014000A, "STATUS_ACPI_INVALID_TARGETTYPE" },
1508         { 0xC014000B, "STATUS_ACPI_INCORRECT_ARGUMENT_COUNT" },
1509         { 0xC014000C, "STATUS_ACPI_ADDRESS_NOT_MAPPED" },
1510         { 0xC014000D, "STATUS_ACPI_INVALID_EVENTTYPE" },
1511         { 0xC014000E, "STATUS_ACPI_HANDLER_COLLISION" },
1512         { 0xC014000F, "STATUS_ACPI_INVALID_DATA" },
1513         { 0xC0140010, "STATUS_ACPI_INVALID_REGION" },
1514         { 0xC0140011, "STATUS_ACPI_INVALID_ACCESS_SIZE" },
1515         { 0xC0140012, "STATUS_ACPI_ACQUIRE_GLOBAL_LOCK" },
1516         { 0xC0140013, "STATUS_ACPI_ALREADY_INITIALIZED" },
1517         { 0xC0140014, "STATUS_ACPI_NOT_INITIALIZED" },
1518         { 0xC0140015, "STATUS_ACPI_INVALID_MUTEX_LEVEL" },
1519         { 0xC0140016, "STATUS_ACPI_MUTEX_NOT_OWNED" },
1520         { 0xC0140017, "STATUS_ACPI_MUTEX_NOT_OWNER" },
1521         { 0xC0140018, "STATUS_ACPI_RS_ACCESS" },
1522         { 0xC0140019, "STATUS_ACPI_INVALID_TABLE" },
1523         { 0xC0140020, "STATUS_ACPI_REG_HANDLER_FAILED" },
1524         { 0xC0140021, "STATUS_ACPI_POWER_REQUEST_FAILED" },
1525         { 0xC0150001, "STATUS_SXS_SECTION_NOT_FOUND" },
1526         { 0xC0150002, "STATUS_SXS_CANT_GEN_ACTCTX" },
1527         { 0xC0150003, "STATUS_SXS_INVALID_ACTCTXDATA_FORMAT" },
1528         { 0xC0150004, "STATUS_SXS_ASSEMBLY_NOT_FOUND" },
1529         { 0xC0150005, "STATUS_SXS_MANIFEST_FORMAT_ERROR" },
1530         { 0xC0150006, "STATUS_SXS_MANIFEST_PARSE_ERROR" },
1531         { 0xC0150007, "STATUS_SXS_ACTIVATION_CONTEXT_DISABLED" },
1532         { 0xC0150008, "STATUS_SXS_KEY_NOT_FOUND" },
1533         { 0xC0150009, "STATUS_SXS_VERSION_CONFLICT" },
1534         { 0xC015000A, "STATUS_SXS_WRONG_SECTION_TYPE" },
1535         { 0xC015000B, "STATUS_SXS_THREAD_QUERIES_DISABLED" },
1536         { 0xC015000C, "STATUS_SXS_ASSEMBLY_MISSING" },
1537         { 0xC015000E, "STATUS_SXS_PROCESS_DEFAULT_ALREADY_SET" },
1538         { 0xC015000F, "STATUS_SXS_EARLY_DEACTIVATION" },
1539         { 0xC0150010, "STATUS_SXS_INVALID_DEACTIVATION" },
1540         { 0xC0150011, "STATUS_SXS_MULTIPLE_DEACTIVATION" },
1541         { 0xC0150012, "STATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY" },
1542         { 0xC0150013, "STATUS_SXS_PROCESS_TERMINATION_REQUESTED" },
1543         { 0xC0150014, "STATUS_SXS_CORRUPT_ACTIVATION_STACK" },
1544         { 0xC0150015, "STATUS_SXS_CORRUPTION" },
1545         { 0xC0150016, "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE" },
1546         { 0xC0150017, "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME" },
1547         { 0xC0150018, "STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE" },
1548         { 0xC0150019, "STATUS_SXS_IDENTITY_PARSE_ERROR" },
1549         { 0xC015001A, "STATUS_SXS_COMPONENT_STORE_CORRUPT" },
1550         { 0xC015001B, "STATUS_SXS_FILE_HASH_MISMATCH" },
1551         { 0xC015001C, "STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT" },
1552         { 0xC015001D, "STATUS_SXS_IDENTITIES_DIFFERENT" },
1553         { 0xC015001E, "STATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT" },
1554         { 0xC015001F, "STATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY" },
1555         { 0xC0150020, "STATUS_ADVANCED_INSTALLER_FAILED" },
1556         { 0xC0150021, "STATUS_XML_ENCODING_MISMATCH" },
1557         { 0xC0150022, "STATUS_SXS_MANIFEST_TOO_BIG" },
1558         { 0xC0150023, "STATUS_SXS_SETTING_NOT_REGISTERED" },
1559         { 0xC0150024, "STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE" },
1560         { 0xC0150025, "STATUS_SMI_PRIMITIVE_INSTALLER_FAILED" },
1561         { 0xC0150026, "STATUS_GENERIC_COMMAND_FAILED" },
1562         { 0xC0150027, "STATUS_SXS_FILE_HASH_MISSING" },
1563         { 0xC0190001, "STATUS_TRANSACTIONAL_CONFLICT" },
1564         { 0xC0190002, "STATUS_INVALID_TRANSACTION" },
1565         { 0xC0190003, "STATUS_TRANSACTION_NOT_ACTIVE" },
1566         { 0xC0190004, "STATUS_TM_INITIALIZATION_FAILED" },
1567         { 0xC0190005, "STATUS_RM_NOT_ACTIVE" },
1568         { 0xC0190006, "STATUS_RM_METADATA_CORRUPT" },
1569         { 0xC0190007, "STATUS_TRANSACTION_NOT_JOINED" },
1570         { 0xC0190008, "STATUS_DIRECTORY_NOT_RM" },
1571         { 0xC019000A, "STATUS_TRANSACTIONS_UNSUPPORTED_REMOTE" },
1572         { 0xC019000B, "STATUS_LOG_RESIZE_INVALID_SIZE" },
1573         { 0xC019000C, "STATUS_REMOTE_FILE_VERSION_MISMATCH" },
1574         { 0xC019000F, "STATUS_CRM_PROTOCOL_ALREADY_EXISTS" },
1575         { 0xC0190010, "STATUS_TRANSACTION_PROPAGATION_FAILED" },
1576         { 0xC0190011, "STATUS_CRM_PROTOCOL_NOT_FOUND" },
1577         { 0xC0190012, "STATUS_TRANSACTION_SUPERIOR_EXISTS" },
1578         { 0xC0190013, "STATUS_TRANSACTION_REQUEST_NOT_VALID" },
1579         { 0xC0190014, "STATUS_TRANSACTION_NOT_REQUESTED" },
1580         { 0xC0190015, "STATUS_TRANSACTION_ALREADY_ABORTED" },
1581         { 0xC0190016, "STATUS_TRANSACTION_ALREADY_COMMITTED" },
1582         { 0xC0190017, "STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER" },
1583         { 0xC0190018, "STATUS_CURRENT_TRANSACTION_NOT_VALID" },
1584         { 0xC0190019, "STATUS_LOG_GROWTH_FAILED" },
1585         { 0xC0190021, "STATUS_OBJECT_NO_LONGER_EXISTS" },
1586         { 0xC0190022, "STATUS_STREAM_MINIVERSION_NOT_FOUND" },
1587         { 0xC0190023, "STATUS_STREAM_MINIVERSION_NOT_VALID" },
1588         { 0xC0190024, "STATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION" },
1589         { 0xC0190025, "STATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT" },
1590         { 0xC0190026, "STATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS" },
1591         { 0xC0190028, "STATUS_HANDLE_NO_LONGER_VALID" },
1592         { 0xC0190030, "STATUS_LOG_CORRUPTION_DETECTED" },
1593         { 0xC0190032, "STATUS_RM_DISCONNECTED" },
1594         { 0xC0190033, "STATUS_ENLISTMENT_NOT_SUPERIOR" },
1595         { 0xC0190036, "STATUS_FILE_IDENTITY_NOT_PERSISTENT" },
1596         { 0xC0190037, "STATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY" },
1597         { 0xC0190038, "STATUS_CANT_CROSS_RM_BOUNDARY" },
1598         { 0xC0190039, "STATUS_TXF_DIR_NOT_EMPTY" },
1599         { 0xC019003A, "STATUS_INDOUBT_TRANSACTIONS_EXIST" },
1600         { 0xC019003B, "STATUS_TM_VOLATILE" },
1601         { 0xC019003C, "STATUS_ROLLBACK_TIMER_EXPIRED" },
1602         { 0xC019003D, "STATUS_TXF_ATTRIBUTE_CORRUPT" },
1603         { 0xC019003E, "STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION" },
1604         { 0xC019003F, "STATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED" },
1605         { 0xC0190040, "STATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE" },
1606         { 0xC0190043, "STATUS_TRANSACTION_REQUIRED_PROMOTION" },
1607         { 0xC0190044, "STATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION" },
1608         { 0xC0190045, "STATUS_TRANSACTIONS_NOT_FROZEN" },
1609         { 0xC0190046, "STATUS_TRANSACTION_FREEZE_IN_PROGRESS" },
1610         { 0xC0190047, "STATUS_NOT_SNAPSHOT_VOLUME" },
1611         { 0xC0190048, "STATUS_NO_SAVEPOINT_WITH_OPEN_FILES" },
1612         { 0xC0190049, "STATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION" },
1613         { 0xC019004A, "STATUS_TM_IDENTITY_MISMATCH" },
1614         { 0xC019004B, "STATUS_FLOATED_SECTION" },
1615         { 0xC019004C, "STATUS_CANNOT_ACCEPT_TRANSACTED_WORK" },
1616         { 0xC019004D, "STATUS_CANNOT_ABORT_TRANSACTIONS" },
1617         { 0xC019004E, "STATUS_TRANSACTION_NOT_FOUND" },
1618         { 0xC019004F, "STATUS_RESOURCEMANAGER_NOT_FOUND" },
1619         { 0xC0190050, "STATUS_ENLISTMENT_NOT_FOUND" },
1620         { 0xC0190051, "STATUS_TRANSACTIONMANAGER_NOT_FOUND" },
1621         { 0xC0190052, "STATUS_TRANSACTIONMANAGER_NOT_ONLINE" },
1622         { 0xC0190053, "STATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION" },
1623         { 0xC0190054, "STATUS_TRANSACTION_NOT_ROOT" },
1624         { 0xC0190055, "STATUS_TRANSACTION_OBJECT_EXPIRED" },
1625         { 0xC0190056, "STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION" },
1626         { 0xC0190057, "STATUS_TRANSACTION_RESPONSE_NOT_ENLISTED" },
1627         { 0xC0190058, "STATUS_TRANSACTION_RECORD_TOO_LONG" },
1628         { 0xC0190059, "STATUS_NO_LINK_TRACKING_IN_TRANSACTION" },
1629         { 0xC019005A, "STATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION" },
1630         { 0xC019005B, "STATUS_TRANSACTION_INTEGRITY_VIOLATED" },
1631         { 0xC0190060, "STATUS_EXPIRED_HANDLE" },
1632         { 0xC0190061, "STATUS_TRANSACTION_NOT_ENLISTED" },
1633         { 0xC01A0001, "STATUS_LOG_SECTOR_INVALID" },
1634         { 0xC01A0002, "STATUS_LOG_SECTOR_PARITY_INVALID" },
1635         { 0xC01A0003, "STATUS_LOG_SECTOR_REMAPPED" },
1636         { 0xC01A0004, "STATUS_LOG_BLOCK_INCOMPLETE" },
1637         { 0xC01A0005, "STATUS_LOG_INVALID_RANGE" },
1638         { 0xC01A0006, "STATUS_LOG_BLOCKS_EXHAUSTED" },
1639         { 0xC01A0007, "STATUS_LOG_READ_CONTEXT_INVALID" },
1640         { 0xC01A0008, "STATUS_LOG_RESTART_INVALID" },
1641         { 0xC01A0009, "STATUS_LOG_BLOCK_VERSION" },
1642         { 0xC01A000A, "STATUS_LOG_BLOCK_INVALID" },
1643         { 0xC01A000B, "STATUS_LOG_READ_MODE_INVALID" },
1644         { 0xC01A000D, "STATUS_LOG_METADATA_CORRUPT" },
1645         { 0xC01A000E, "STATUS_LOG_METADATA_INVALID" },
1646         { 0xC01A000F, "STATUS_LOG_METADATA_INCONSISTENT" },
1647         { 0xC01A0010, "STATUS_LOG_RESERVATION_INVALID" },
1648         { 0xC01A0011, "STATUS_LOG_CANT_DELETE" },
1649         { 0xC01A0012, "STATUS_LOG_CONTAINER_LIMIT_EXCEEDED" },
1650         { 0xC01A0013, "STATUS_LOG_START_OF_LOG" },
1651         { 0xC01A0014, "STATUS_LOG_POLICY_ALREADY_INSTALLED" },
1652         { 0xC01A0015, "STATUS_LOG_POLICY_NOT_INSTALLED" },
1653         { 0xC01A0016, "STATUS_LOG_POLICY_INVALID" },
1654         { 0xC01A0017, "STATUS_LOG_POLICY_CONFLICT" },
1655         { 0xC01A0018, "STATUS_LOG_PINNED_ARCHIVE_TAIL" },
1656         { 0xC01A0019, "STATUS_LOG_RECORD_NONEXISTENT" },
1657         { 0xC01A001A, "STATUS_LOG_RECORDS_RESERVED_INVALID" },
1658         { 0xC01A001B, "STATUS_LOG_SPACE_RESERVED_INVALID" },
1659         { 0xC01A001C, "STATUS_LOG_TAIL_INVALID" },
1660         { 0xC01A001D, "STATUS_LOG_FULL" },
1661         { 0xC01A001E, "STATUS_LOG_MULTIPLEXED" },
1662         { 0xC01A001F, "STATUS_LOG_DEDICATED" },
1663         { 0xC01A0020, "STATUS_LOG_ARCHIVE_NOT_IN_PROGRESS" },
1664         { 0xC01A0021, "STATUS_LOG_ARCHIVE_IN_PROGRESS" },
1665         { 0xC01A0022, "STATUS_LOG_EPHEMERAL" },
1666         { 0xC01A0023, "STATUS_LOG_NOT_ENOUGH_CONTAINERS" },
1667         { 0xC01A0024, "STATUS_LOG_CLIENT_ALREADY_REGISTERED" },
1668         { 0xC01A0025, "STATUS_LOG_CLIENT_NOT_REGISTERED" },
1669         { 0xC01A0026, "STATUS_LOG_FULL_HANDLER_IN_PROGRESS" },
1670         { 0xC01A0027, "STATUS_LOG_CONTAINER_READ_FAILED" },
1671         { 0xC01A0028, "STATUS_LOG_CONTAINER_WRITE_FAILED" },
1672         { 0xC01A0029, "STATUS_LOG_CONTAINER_OPEN_FAILED" },
1673         { 0xC01A002A, "STATUS_LOG_CONTAINER_STATE_INVALID" },
1674         { 0xC01A002B, "STATUS_LOG_STATE_INVALID" },
1675         { 0xC01A002C, "STATUS_LOG_PINNED" },
1676         { 0xC01A002D, "STATUS_LOG_METADATA_FLUSH_FAILED" },
1677         { 0xC01A002E, "STATUS_LOG_INCONSISTENT_SECURITY" },
1678         { 0xC01A002F, "STATUS_LOG_APPENDED_FLUSH_FAILED" },
1679         { 0xC01A0030, "STATUS_LOG_PINNED_RESERVATION" },
1680         { 0xC01B00EA, "STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD" },
1681         { 0xC01C0001, "STATUS_FLT_NO_HANDLER_DEFINED" },
1682         { 0xC01C0002, "STATUS_FLT_CONTEXT_ALREADY_DEFINED" },
1683         { 0xC01C0003, "STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST" },
1684         { 0xC01C0004, "STATUS_FLT_DISALLOW_FAST_IO" },
1685         { 0xC01C0005, "STATUS_FLT_INVALID_NAME_REQUEST" },
1686         { 0xC01C0006, "STATUS_FLT_NOT_SAFE_TO_POST_OPERATION" },
1687         { 0xC01C0007, "STATUS_FLT_NOT_INITIALIZED" },
1688         { 0xC01C0008, "STATUS_FLT_FILTER_NOT_READY" },
1689         { 0xC01C0009, "STATUS_FLT_POST_OPERATION_CLEANUP" },
1690         { 0xC01C000A, "STATUS_FLT_INTERNAL_ERROR" },
1691         { 0xC01C000B, "STATUS_FLT_DELETING_OBJECT" },
1692         { 0xC01C000C, "STATUS_FLT_MUST_BE_NONPAGED_POOL" },
1693         { 0xC01C000D, "STATUS_FLT_DUPLICATE_ENTRY" },
1694         { 0xC01C000E, "STATUS_FLT_CBDQ_DISABLED" },
1695         { 0xC01C000F, "STATUS_FLT_DO_NOT_ATTACH" },
1696         { 0xC01C0010, "STATUS_FLT_DO_NOT_DETACH" },
1697         { 0xC01C0011, "STATUS_FLT_INSTANCE_ALTITUDE_COLLISION" },
1698         { 0xC01C0012, "STATUS_FLT_INSTANCE_NAME_COLLISION" },
1699         { 0xC01C0013, "STATUS_FLT_FILTER_NOT_FOUND" },
1700         { 0xC01C0014, "STATUS_FLT_VOLUME_NOT_FOUND" },
1701         { 0xC01C0015, "STATUS_FLT_INSTANCE_NOT_FOUND" },
1702         { 0xC01C0016, "STATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND" },
1703         { 0xC01C0017, "STATUS_FLT_INVALID_CONTEXT_REGISTRATION" },
1704         { 0xC01C0018, "STATUS_FLT_NAME_CACHE_MISS" },
1705         { 0xC01C0019, "STATUS_FLT_NO_DEVICE_OBJECT" },
1706         { 0xC01C001A, "STATUS_FLT_VOLUME_ALREADY_MOUNTED" },
1707         { 0xC01C001B, "STATUS_FLT_ALREADY_ENLISTED" },
1708         { 0xC01C001C, "STATUS_FLT_CONTEXT_ALREADY_LINKED" },
1709         { 0xC01C0020, "STATUS_FLT_NO_WAITER_FOR_REPLY" },
1710         { 0xC01D0001, "STATUS_MONITOR_NO_DESCRIPTOR" },
1711         { 0xC01D0002, "STATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT" },
1712         { 0xC01D0003, "STATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM" },
1713         { 0xC01D0004, "STATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK" },
1714         { 0xC01D0005, "STATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED" },
1715         { 0xC01D0006, "STATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK" },
1716         { 0xC01D0007, "STATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK" },
1717         { 0xC01D0008, "STATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA" },
1718         { 0xC01D0009, "STATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK" },
1719         { 0xC01D000A, "STATUS_MONITOR_INVALID_MANUFACTURE_DATE" },
1720         { 0xC01E0000, "STATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER" },
1721         { 0xC01E0001, "STATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER" },
1722         { 0xC01E0002, "STATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER" },
1723         { 0xC01E0003, "STATUS_GRAPHICS_ADAPTER_WAS_RESET" },
1724         { 0xC01E0004, "STATUS_GRAPHICS_INVALID_DRIVER_MODEL" },
1725         { 0xC01E0005, "STATUS_GRAPHICS_PRESENT_MODE_CHANGED" },
1726         { 0xC01E0006, "STATUS_GRAPHICS_PRESENT_OCCLUDED" },
1727         { 0xC01E0007, "STATUS_GRAPHICS_PRESENT_DENIED" },
1728         { 0xC01E0008, "STATUS_GRAPHICS_CANNOTCOLORCONVERT" },
1729         { 0xC01E000B, "STATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED" },
1730         { 0xC01E000C, "STATUS_GRAPHICS_PRESENT_UNOCCLUDED" },
1731         { 0xC01E0100, "STATUS_GRAPHICS_NO_VIDEO_MEMORY" },
1732         { 0xC01E0101, "STATUS_GRAPHICS_CANT_LOCK_MEMORY" },
1733         { 0xC01E0102, "STATUS_GRAPHICS_ALLOCATION_BUSY" },
1734         { 0xC01E0103, "STATUS_GRAPHICS_TOO_MANY_REFERENCES" },
1735         { 0xC01E0104, "STATUS_GRAPHICS_TRY_AGAIN_LATER" },
1736         { 0xC01E0105, "STATUS_GRAPHICS_TRY_AGAIN_NOW" },
1737         { 0xC01E0106, "STATUS_GRAPHICS_ALLOCATION_INVALID" },
1738         { 0xC01E0107, "STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE" },
1739         { 0xC01E0108, "STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED" },
1740         { 0xC01E0109, "STATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION" },
1741         { 0xC01E0110, "STATUS_GRAPHICS_INVALID_ALLOCATION_USAGE" },
1742         { 0xC01E0111, "STATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION" },
1743         { 0xC01E0112, "STATUS_GRAPHICS_ALLOCATION_CLOSED" },
1744         { 0xC01E0113, "STATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE" },
1745         { 0xC01E0114, "STATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE" },
1746         { 0xC01E0115, "STATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE" },
1747         { 0xC01E0116, "STATUS_GRAPHICS_ALLOCATION_CONTENT_LOST" },
1748         { 0xC01E0200, "STATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE" },
1749         { 0xC01E0300, "STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY" },
1750         { 0xC01E0301, "STATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED" },
1751         { 0xC01E0302, "STATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED" },
1752         { 0xC01E0303, "STATUS_GRAPHICS_INVALID_VIDPN" },
1753         { 0xC01E0304, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE" },
1754         { 0xC01E0305, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET" },
1755         { 0xC01E0306, "STATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED" },
1756         { 0xC01E0308, "STATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET" },
1757         { 0xC01E0309, "STATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET" },
1758         { 0xC01E030A, "STATUS_GRAPHICS_INVALID_FREQUENCY" },
1759         { 0xC01E030B, "STATUS_GRAPHICS_INVALID_ACTIVE_REGION" },
1760         { 0xC01E030C, "STATUS_GRAPHICS_INVALID_TOTAL_REGION" },
1761         { 0xC01E0310, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE" },
1762         { 0xC01E0311, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE" },
1763         { 0xC01E0312, "STATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET" },
1764         { 0xC01E0313, "STATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY" },
1765         { 0xC01E0314, "STATUS_GRAPHICS_MODE_ALREADY_IN_MODESET" },
1766         { 0xC01E0315, "STATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET" },
1767         { 0xC01E0316, "STATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET" },
1768         { 0xC01E0317, "STATUS_GRAPHICS_SOURCE_ALREADY_IN_SET" },
1769         { 0xC01E0318, "STATUS_GRAPHICS_TARGET_ALREADY_IN_SET" },
1770         { 0xC01E0319, "STATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH" },
1771         { 0xC01E031A, "STATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY" },
1772         { 0xC01E031B, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET" },
1773         { 0xC01E031C, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE" },
1774         { 0xC01E031D, "STATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET" },
1775         { 0xC01E031F, "STATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET" },
1776         { 0xC01E0320, "STATUS_GRAPHICS_STALE_MODESET" },
1777         { 0xC01E0321, "STATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET" },
1778         { 0xC01E0322, "STATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE" },
1779         { 0xC01E0323, "STATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN" },
1780         { 0xC01E0324, "STATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE" },
1781         { 0xC01E0325, "STATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION" },
1782         { 0xC01E0326, "STATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES" },
1783         { 0xC01E0327, "STATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY" },
1784         { 0xC01E0328, "STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE" },
1785         { 0xC01E0329, "STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET" },
1786         { 0xC01E032A, "STATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET" },
1787         { 0xC01E032B, "STATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR" },
1788         { 0xC01E032C, "STATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET" },
1789         { 0xC01E032D, "STATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET" },
1790         { 0xC01E032E, "STATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE" },
1791         { 0xC01E032F, "STATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE" },
1792         { 0xC01E0330, "STATUS_GRAPHICS_RESOURCES_NOT_RELATED" },
1793         { 0xC01E0331, "STATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE" },
1794         { 0xC01E0332, "STATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE" },
1795         { 0xC01E0333, "STATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET" },
1796         { 0xC01E0334, "STATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER" },
1797         { 0xC01E0335, "STATUS_GRAPHICS_NO_VIDPNMGR" },
1798         { 0xC01E0336, "STATUS_GRAPHICS_NO_ACTIVE_VIDPN" },
1799         { 0xC01E0337, "STATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY" },
1800         { 0xC01E0338, "STATUS_GRAPHICS_MONITOR_NOT_CONNECTED" },
1801         { 0xC01E0339, "STATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY" },
1802         { 0xC01E033A, "STATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE" },
1803         { 0xC01E033B, "STATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE" },
1804         { 0xC01E033C, "STATUS_GRAPHICS_INVALID_STRIDE" },
1805         { 0xC01E033D, "STATUS_GRAPHICS_INVALID_PIXELFORMAT" },
1806         { 0xC01E033E, "STATUS_GRAPHICS_INVALID_COLORBASIS" },
1807         { 0xC01E033F, "STATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE" },
1808         { 0xC01E0340, "STATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY" },
1809         { 0xC01E0341, "STATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT" },
1810         { 0xC01E0342, "STATUS_GRAPHICS_VIDPN_SOURCE_IN_USE" },
1811         { 0xC01E0343, "STATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN" },
1812         { 0xC01E0344, "STATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL" },
1813         { 0xC01E0345, "STATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION" },
1814         { 0xC01E0346, "STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED" },
1815         { 0xC01E0347, "STATUS_GRAPHICS_INVALID_GAMMA_RAMP" },
1816         { 0xC01E0348, "STATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED" },
1817         { 0xC01E0349, "STATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED" },
1818         { 0xC01E034A, "STATUS_GRAPHICS_MODE_NOT_IN_MODESET" },
1819         { 0xC01E034D, "STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON" },
1820         { 0xC01E034E, "STATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE" },
1821         { 0xC01E034F, "STATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE" },
1822         { 0xC01E0350, "STATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS" },
1823         { 0xC01E0352, "STATUS_GRAPHICS_INVALID_SCANLINE_ORDERING" },
1824         { 0xC01E0353, "STATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED" },
1825         { 0xC01E0354, "STATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS" },
1826         { 0xC01E0355, "STATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT" },
1827         { 0xC01E0356, "STATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM" },
1828         { 0xC01E0357, "STATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN" },
1829         { 0xC01E0358, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT" },
1830         { 0xC01E0359, "STATUS_GRAPHICS_MAX_NUM_PATHS_REACHED" },
1831         { 0xC01E035A, "STATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION" },
1832         { 0xC01E035B, "STATUS_GRAPHICS_INVALID_CLIENT_TYPE" },
1833         { 0xC01E035C, "STATUS_GRAPHICS_CLIENTVIDPN_NOT_SET" },
1834         { 0xC01E0400, "STATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED" },
1835         { 0xC01E0401, "STATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED" },
1836         { 0xC01E0430, "STATUS_GRAPHICS_NOT_A_LINKED_ADAPTER" },
1837         { 0xC01E0431, "STATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED" },
1838         { 0xC01E0432, "STATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED" },
1839         { 0xC01E0433, "STATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY" },
1840         { 0xC01E0434, "STATUS_GRAPHICS_CHAINLINKS_NOT_STARTED" },
1841         { 0xC01E0435, "STATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON" },
1842         { 0xC01E0436, "STATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE" },
1843         { 0xC01E0438, "STATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER" },
1844         { 0xC01E043B, "STATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED" },
1845         { 0xC01E0500, "STATUS_GRAPHICS_OPM_NOT_SUPPORTED" },
1846         { 0xC01E0501, "STATUS_GRAPHICS_COPP_NOT_SUPPORTED" },
1847         { 0xC01E0502, "STATUS_GRAPHICS_UAB_NOT_SUPPORTED" },
1848         { 0xC01E0503, "STATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS" },
1849         { 0xC01E0504, "STATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL" },
1850         { 0xC01E0505, "STATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST" },
1851         { 0xC01E0506, "STATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME" },
1852         { 0xC01E0507, "STATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP" },
1853         { 0xC01E0508, "STATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED" },
1854         { 0xC01E050A, "STATUS_GRAPHICS_OPM_INVALID_POINTER" },
1855         { 0xC01E050B, "STATUS_GRAPHICS_OPM_INTERNAL_ERROR" },
1856         { 0xC01E050C, "STATUS_GRAPHICS_OPM_INVALID_HANDLE" },
1857         { 0xC01E050D, "STATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE" },
1858         { 0xC01E050E, "STATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH" },
1859         { 0xC01E050F, "STATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED" },
1860         { 0xC01E0510, "STATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED" },
1861         { 0xC01E0511, "STATUS_GRAPHICS_PVP_HFS_FAILED" },
1862         { 0xC01E0512, "STATUS_GRAPHICS_OPM_INVALID_SRM" },
1863         { 0xC01E0513, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP" },
1864         { 0xC01E0514, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP" },
1865         { 0xC01E0515, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA" },
1866         { 0xC01E0516, "STATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET" },
1867         { 0xC01E0517, "STATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH" },
1868         { 0xC01E0518, "STATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE" },
1869         { 0xC01E051A, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS" },
1870         { 0xC01E051B, "STATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS" },
1871         { 0xC01E051C, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS" },
1872         { 0xC01E051D, "STATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST" },
1873         { 0xC01E051E, "STATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR" },
1874         { 0xC01E051F, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS" },
1875         { 0xC01E0520, "STATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED" },
1876         { 0xC01E0521, "STATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST" },
1877         { 0xC01E0580, "STATUS_GRAPHICS_I2C_NOT_SUPPORTED" },
1878         { 0xC01E0581, "STATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST" },
1879         { 0xC01E0582, "STATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA" },
1880         { 0xC01E0583, "STATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA" },
1881         { 0xC01E0584, "STATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED" },
1882         { 0xC01E0585, "STATUS_GRAPHICS_DDCCI_INVALID_DATA" },
1883         { 0xC01E0586, "STATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE" },
1884         { 0xC01E0587, "STATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING" },
1885         { 0xC01E0588, "STATUS_GRAPHICS_MCA_INTERNAL_ERROR" },
1886         { 0xC01E0589, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND" },
1887         { 0xC01E058A, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH" },
1888         { 0xC01E058B, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM" },
1889         { 0xC01E058C, "STATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE" },
1890         { 0xC01E058D, "STATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS" },
1891         { 0xC01E05E0, "STATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED" },
1892         { 0xC01E05E1, "STATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME" },
1893         { 0xC01E05E2, "STATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP" },
1894         { 0xC01E05E3, "STATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED" },
1895         { 0xC01E05E4, "STATUS_GRAPHICS_INVALID_POINTER" },
1896         { 0xC01E05E5, "STATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE" },
1897         { 0xC01E05E6, "STATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL" },
1898         { 0xC01E05E7, "STATUS_GRAPHICS_INTERNAL_ERROR" },
1899         { 0xC01E05E8, "STATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS" },
1900         { 0xC0210000, "STATUS_FVE_LOCKED_VOLUME" },
1901         { 0xC0210001, "STATUS_FVE_NOT_ENCRYPTED" },
1902         { 0xC0210002, "STATUS_FVE_BAD_INFORMATION" },
1903         { 0xC0210003, "STATUS_FVE_TOO_SMALL" },
1904         { 0xC0210004, "STATUS_FVE_FAILED_WRONG_FS" },
1905         { 0xC0210005, "STATUS_FVE_FAILED_BAD_FS" },
1906         { 0xC0210006, "STATUS_FVE_FS_NOT_EXTENDED" },
1907         { 0xC0210007, "STATUS_FVE_FS_MOUNTED" },
1908         { 0xC0210008, "STATUS_FVE_NO_LICENSE" },
1909         { 0xC0210009, "STATUS_FVE_ACTION_NOT_ALLOWED" },
1910         { 0xC021000A, "STATUS_FVE_BAD_DATA" },
1911         { 0xC021000B, "STATUS_FVE_VOLUME_NOT_BOUND" },
1912         { 0xC021000C, "STATUS_FVE_NOT_DATA_VOLUME" },
1913         { 0xC021000D, "STATUS_FVE_CONV_READ_ERROR" },
1914         { 0xC021000E, "STATUS_FVE_CONV_WRITE_ERROR" },
1915         { 0xC021000F, "STATUS_FVE_OVERLAPPED_UPDATE" },
1916         { 0xC0210010, "STATUS_FVE_FAILED_SECTOR_SIZE" },
1917         { 0xC0210011, "STATUS_FVE_FAILED_AUTHENTICATION" },
1918         { 0xC0210012, "STATUS_FVE_NOT_OS_VOLUME" },
1919         { 0xC0210013, "STATUS_FVE_KEYFILE_NOT_FOUND" },
1920         { 0xC0210014, "STATUS_FVE_KEYFILE_INVALID" },
1921         { 0xC0210015, "STATUS_FVE_KEYFILE_NO_VMK" },
1922         { 0xC0210016, "STATUS_FVE_TPM_DISABLED" },
1923         { 0xC0210017, "STATUS_FVE_TPM_SRK_AUTH_NOT_ZERO" },
1924         { 0xC0210018, "STATUS_FVE_TPM_INVALID_PCR" },
1925         { 0xC0210019, "STATUS_FVE_TPM_NO_VMK" },
1926         { 0xC021001A, "STATUS_FVE_PIN_INVALID" },
1927         { 0xC021001B, "STATUS_FVE_AUTH_INVALID_APPLICATION" },
1928         { 0xC021001C, "STATUS_FVE_AUTH_INVALID_CONFIG" },
1929         { 0xC021001D, "STATUS_FVE_DEBUGGER_ENABLED" },
1930         { 0xC021001E, "STATUS_FVE_DRY_RUN_FAILED" },
1931         { 0xC021001F, "STATUS_FVE_BAD_METADATA_POINTER" },
1932         { 0xC0210020, "STATUS_FVE_OLD_METADATA_COPY" },
1933         { 0xC0210021, "STATUS_FVE_REBOOT_REQUIRED" },
1934         { 0xC0210022, "STATUS_FVE_RAW_ACCESS" },
1935         { 0xC0210023, "STATUS_FVE_RAW_BLOCKED" },
1936         { 0xC0210026, "STATUS_FVE_NO_FEATURE_LICENSE" },
1937         { 0xC0210027, "STATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED" },
1938         { 0xC0210028, "STATUS_FVE_CONV_RECOVERY_FAILED" },
1939         { 0xC0210029, "STATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG" },
1940         { 0xC0210030, "STATUS_FVE_VOLUME_TOO_SMALL" },
1941         { 0xC0220001, "STATUS_FWP_CALLOUT_NOT_FOUND" },
1942         { 0xC0220002, "STATUS_FWP_CONDITION_NOT_FOUND" },
1943         { 0xC0220003, "STATUS_FWP_FILTER_NOT_FOUND" },
1944         { 0xC0220004, "STATUS_FWP_LAYER_NOT_FOUND" },
1945         { 0xC0220005, "STATUS_FWP_PROVIDER_NOT_FOUND" },
1946         { 0xC0220006, "STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND" },
1947         { 0xC0220007, "STATUS_FWP_SUBLAYER_NOT_FOUND" },
1948         { 0xC0220008, "STATUS_FWP_NOT_FOUND" },
1949         { 0xC0220009, "STATUS_FWP_ALREADY_EXISTS" },
1950         { 0xC022000A, "STATUS_FWP_IN_USE" },
1951         { 0xC022000B, "STATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS" },
1952         { 0xC022000C, "STATUS_FWP_WRONG_SESSION" },
1953         { 0xC022000D, "STATUS_FWP_NO_TXN_IN_PROGRESS" },
1954         { 0xC022000E, "STATUS_FWP_TXN_IN_PROGRESS" },
1955         { 0xC022000F, "STATUS_FWP_TXN_ABORTED" },
1956         { 0xC0220010, "STATUS_FWP_SESSION_ABORTED" },
1957         { 0xC0220011, "STATUS_FWP_INCOMPATIBLE_TXN" },
1958         { 0xC0220012, "STATUS_FWP_TIMEOUT" },
1959         { 0xC0220013, "STATUS_FWP_NET_EVENTS_DISABLED" },
1960         { 0xC0220014, "STATUS_FWP_INCOMPATIBLE_LAYER" },
1961         { 0xC0220015, "STATUS_FWP_KM_CLIENTS_ONLY" },
1962         { 0xC0220016, "STATUS_FWP_LIFETIME_MISMATCH" },
1963         { 0xC0220017, "STATUS_FWP_BUILTIN_OBJECT" },
1964         { 0xC0220018, "STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS" },
1965         { 0xC0220018, "STATUS_FWP_TOO_MANY_CALLOUTS" },
1966         { 0xC0220019, "STATUS_FWP_NOTIFICATION_DROPPED" },
1967         { 0xC022001A, "STATUS_FWP_TRAFFIC_MISMATCH" },
1968         { 0xC022001B, "STATUS_FWP_INCOMPATIBLE_SA_STATE" },
1969         { 0xC022001C, "STATUS_FWP_NULL_POINTER" },
1970         { 0xC022001D, "STATUS_FWP_INVALID_ENUMERATOR" },
1971         { 0xC022001E, "STATUS_FWP_INVALID_FLAGS" },
1972         { 0xC022001F, "STATUS_FWP_INVALID_NET_MASK" },
1973         { 0xC0220020, "STATUS_FWP_INVALID_RANGE" },
1974         { 0xC0220021, "STATUS_FWP_INVALID_INTERVAL" },
1975         { 0xC0220022, "STATUS_FWP_ZERO_LENGTH_ARRAY" },
1976         { 0xC0220023, "STATUS_FWP_NULL_DISPLAY_NAME" },
1977         { 0xC0220024, "STATUS_FWP_INVALID_ACTION_TYPE" },
1978         { 0xC0220025, "STATUS_FWP_INVALID_WEIGHT" },
1979         { 0xC0220026, "STATUS_FWP_MATCH_TYPE_MISMATCH" },
1980         { 0xC0220027, "STATUS_FWP_TYPE_MISMATCH" },
1981         { 0xC0220028, "STATUS_FWP_OUT_OF_BOUNDS" },
1982         { 0xC0220029, "STATUS_FWP_RESERVED" },
1983         { 0xC022002A, "STATUS_FWP_DUPLICATE_CONDITION" },
1984         { 0xC022002B, "STATUS_FWP_DUPLICATE_KEYMOD" },
1985         { 0xC022002C, "STATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER" },
1986         { 0xC022002D, "STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER" },
1987         { 0xC022002E, "STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER" },
1988         { 0xC022002F, "STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT" },
1989         { 0xC0220030, "STATUS_FWP_INCOMPATIBLE_AUTH_METHOD" },
1990         { 0xC0220031, "STATUS_FWP_INCOMPATIBLE_DH_GROUP" },
1991         { 0xC0220032, "STATUS_FWP_EM_NOT_SUPPORTED" },
1992         { 0xC0220033, "STATUS_FWP_NEVER_MATCH" },
1993         { 0xC0220034, "STATUS_FWP_PROVIDER_CONTEXT_MISMATCH" },
1994         { 0xC0220035, "STATUS_FWP_INVALID_PARAMETER" },
1995         { 0xC0220036, "STATUS_FWP_TOO_MANY_SUBLAYERS" },
1996         { 0xC0220037, "STATUS_FWP_CALLOUT_NOTIFICATION_FAILED" },
1997         { 0xC0220038, "STATUS_FWP_INCOMPATIBLE_AUTH_CONFIG" },
1998         { 0xC0220039, "STATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG" },
1999         { 0xC022003C, "STATUS_FWP_DUPLICATE_AUTH_METHOD" },
2000         { 0xC0220100, "STATUS_FWP_TCPIP_NOT_READY" },
2001         { 0xC0220101, "STATUS_FWP_INJECT_HANDLE_CLOSING" },
2002         { 0xC0220102, "STATUS_FWP_INJECT_HANDLE_STALE" },
2003         { 0xC0220103, "STATUS_FWP_CANNOT_PEND" },
2004         { 0xC0230002, "STATUS_NDIS_CLOSING" },
2005         { 0xC0230004, "STATUS_NDIS_BAD_VERSION" },
2006         { 0xC0230005, "STATUS_NDIS_BAD_CHARACTERISTICS" },
2007         { 0xC0230006, "STATUS_NDIS_ADAPTER_NOT_FOUND" },
2008         { 0xC0230007, "STATUS_NDIS_OPEN_FAILED" },
2009         { 0xC0230008, "STATUS_NDIS_DEVICE_FAILED" },
2010         { 0xC0230009, "STATUS_NDIS_MULTICAST_FULL" },
2011         { 0xC023000A, "STATUS_NDIS_MULTICAST_EXISTS" },
2012         { 0xC023000B, "STATUS_NDIS_MULTICAST_NOT_FOUND" },
2013         { 0xC023000C, "STATUS_NDIS_REQUEST_ABORTED" },
2014         { 0xC023000D, "STATUS_NDIS_RESET_IN_PROGRESS" },
2015         { 0xC023000F, "STATUS_NDIS_INVALID_PACKET" },
2016         { 0xC0230010, "STATUS_NDIS_INVALID_DEVICE_REQUEST" },
2017         { 0xC0230011, "STATUS_NDIS_ADAPTER_NOT_READY" },
2018         { 0xC0230014, "STATUS_NDIS_INVALID_LENGTH" },
2019         { 0xC0230015, "STATUS_NDIS_INVALID_DATA" },
2020         { 0xC0230016, "STATUS_NDIS_BUFFER_TOO_SHORT" },
2021         { 0xC0230017, "STATUS_NDIS_INVALID_OID" },
2022         { 0xC0230018, "STATUS_NDIS_ADAPTER_REMOVED" },
2023         { 0xC0230019, "STATUS_NDIS_UNSUPPORTED_MEDIA" },
2024         { 0xC023001A, "STATUS_NDIS_GROUP_ADDRESS_IN_USE" },
2025         { 0xC023001B, "STATUS_NDIS_FILE_NOT_FOUND" },
2026         { 0xC023001C, "STATUS_NDIS_ERROR_READING_FILE" },
2027         { 0xC023001D, "STATUS_NDIS_ALREADY_MAPPED" },
2028         { 0xC023001E, "STATUS_NDIS_RESOURCE_CONFLICT" },
2029         { 0xC023001F, "STATUS_NDIS_MEDIA_DISCONNECTED" },
2030         { 0xC0230022, "STATUS_NDIS_INVALID_ADDRESS" },
2031         { 0xC023002A, "STATUS_NDIS_PAUSED" },
2032         { 0xC023002B, "STATUS_NDIS_INTERFACE_NOT_FOUND" },
2033         { 0xC023002C, "STATUS_NDIS_UNSUPPORTED_REVISION" },
2034         { 0xC023002D, "STATUS_NDIS_INVALID_PORT" },
2035         { 0xC023002E, "STATUS_NDIS_INVALID_PORT_STATE" },
2036         { 0xC023002F, "STATUS_NDIS_LOW_POWER_STATE" },
2037         { 0xC02300BB, "STATUS_NDIS_NOT_SUPPORTED" },
2038         { 0xC023100F, "STATUS_NDIS_OFFLOAD_POLICY" },
2039         { 0xC0231012, "STATUS_NDIS_OFFLOAD_CONNECTION_REJECTED" },
2040         { 0xC0231013, "STATUS_NDIS_OFFLOAD_PATH_REJECTED" },
2041         { 0xC0232000, "STATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED" },
2042         { 0xC0232001, "STATUS_NDIS_DOT11_MEDIA_IN_USE" },
2043         { 0xC0232002, "STATUS_NDIS_DOT11_POWER_STATE_INVALID" },
2044         { 0xC0232003, "STATUS_NDIS_PM_WOL_PATTERN_LIST_FULL" },
2045         { 0xC0232004, "STATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL" },
2046         { 0xC0360001, "STATUS_IPSEC_BAD_SPI" },
2047         { 0xC0360002, "STATUS_IPSEC_SA_LIFETIME_EXPIRED" },
2048         { 0xC0360003, "STATUS_IPSEC_WRONG_SA" },
2049         { 0xC0360004, "STATUS_IPSEC_REPLAY_CHECK_FAILED" },
2050         { 0xC0360005, "STATUS_IPSEC_INVALID_PACKET" },
2051         { 0xC0360006, "STATUS_IPSEC_INTEGRITY_CHECK_FAILED" },
2052         { 0xC0360007, "STATUS_IPSEC_CLEAR_TEXT_DROP" },
2053         { 0xC0360008, "STATUS_IPSEC_AUTH_FIREWALL_DROP" },
2054         { 0xC0360009, "STATUS_IPSEC_THROTTLE_DROP" },
2055         { 0xC0368000, "STATUS_IPSEC_DOSP_BLOCK" },
2056         { 0xC0368001, "STATUS_IPSEC_DOSP_RECEIVED_MULTICAST" },
2057         { 0xC0368002, "STATUS_IPSEC_DOSP_INVALID_PACKET" },
2058         { 0xC0368003, "STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED" },
2059         { 0xC0368004, "STATUS_IPSEC_DOSP_MAX_ENTRIES" },
2060         { 0xC0368005, "STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED" },
2061         { 0xC0368006, "STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES" },
2062         { 0xC038005B, "STATUS_VOLMGR_MIRROR_NOT_SUPPORTED" },
2063         { 0xC038005C, "STATUS_VOLMGR_RAID5_NOT_SUPPORTED" },
2064         { 0xC03A0014, "STATUS_VIRTDISK_PROVIDER_NOT_FOUND" },
2065         { 0xC03A0015, "STATUS_VIRTDISK_NOT_VIRTUAL_DISK" },
2066         { 0xC03A0016, "STATUS_VHD_PARENT_VHD_ACCESS_DENIED" },
2067         { 0xC03A0017, "STATUS_VHD_CHILD_PARENT_SIZE_MISMATCH" },
2068         { 0xC03A0018, "STATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED" },
2069         { 0xC03A0019, "STATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT" },
2070         { 0xC05C0000, "STATUS_SVHDX_ERROR_STORED" },
2071         { 0xC05CFF00, "STATUS_SVHDX_ERROR_NOT_AVAILABLE" },
2072         { 0xC05CFF01, "STATUS_SVHDX_UNIT_ATTENTION_AVAILABLE" },
2073         { 0xC05CFF02, "STATUS_SVHDX_UNIT_ATTENTION_CAPACITY_DATA_CHANGED" },
2074         { 0xC05CFF03, "STATUS_SVHDX_UNIT_ATTENTION_RESERVATIONS_PREEMPTED" },
2075         { 0xC05CFF04, "STATUS_SVHDX_UNIT_ATTENTION_RESERVATIONS_RELEASED" },
2076         { 0xC05CFF05, "STATUS_SVHDX_UNIT_ATTENTION_REGISTRATIONS_PREEMPTED" },
2077         { 0xC05CFF06, "STATUS_SVHDX_UNIT_ATTENTION_OPERATING_DEFINITION_CHANGED" },
2078         { 0xC05CFF07, "STATUS_SVHDX_RESERVATION_CONFLICT" },
2079         { 0xC05CFF08, "STATUS_SVHDX_WRONG_FILE_TYPE" },
2080         { 0xC05CFF09, "STATUS_SVHDX_VERSION_MISMATCH" },
2081         { 0xC05CFF0A, "STATUS_VHD_SHARED" },
2082         { 0xC05D0000, "STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP" },
2083         { 0xC05D0001, "STATUS_SMB_BAD_CLUSTER_DIALECT" },
2084         { 0,          NULL }
2085 };
2086 value_string_ext NT_errors_ext = VALUE_STRING_EXT_INIT(NT_errors);
2087
2088 /* These are the MS country codes from
2089
2090         https://web.archive.org/web/20081224015707/http://www.unicode.org/unicode/onlinedat/countries.html
2091
2092    For countries that share the same number, I choose to use only the
2093    name of the largest country. Apologies for this. If this offends you,
2094    here is the table to change that.
2095
2096    This also includes the code of 0 for "Default", which isn't in
2097    that list, but is in Microsoft's SDKs and the Cygnus "winnls.h"
2098    header file.  Presumably it means "don't override the setting
2099    on the user's machine".
2100
2101    Future versions of Microsoft's "winnls.h" header file might include
2102    additional codes; the current version matches the Unicode Consortium's
2103    table.
2104 */
2105 static const value_string ms_country_codes[] = {
2106         {  0,   "Default"},
2107         {  1,   "USA"},
2108         {  2,   "Canada"},
2109         {  7,   "Russia"},
2110         { 20,   "Egypt"},
2111         { 27,   "South Africa"},
2112         { 30,   "Greece"},
2113         { 31,   "Netherlands"},
2114         { 32,   "Belgium"},
2115         { 33,   "France"},
2116         { 34,   "Spain"},
2117         { 36,   "Hungary"},
2118         { 39,   "Italy"},
2119         { 40,   "Romania"},
2120         { 41,   "Switzerland"},
2121         { 43,   "Austria"},
2122         { 44,   "United Kingdom"},
2123         { 45,   "Denmark"},
2124         { 46,   "Sweden"},
2125         { 47,   "Norway"},
2126         { 48,   "Poland"},
2127         { 49,   "Germany"},
2128         { 51,   "Peru"},
2129         { 52,   "Mexico"},
2130         { 54,   "Argentina"},
2131         { 55,   "Brazil"},
2132         { 56,   "Chile"},
2133         { 57,   "Colombia"},
2134         { 58,   "Venezuela"},
2135         { 60,   "Malaysia"},
2136         { 61,   "Australia"},
2137         { 62,   "Indonesia"},
2138         { 63,   "Philippines"},
2139         { 64,   "New Zealand"},
2140         { 65,   "Singapore"},
2141         { 66,   "Thailand"},
2142         { 81,   "Japan"},
2143         { 82,   "South Korea"},
2144         { 84,   "Viet Nam"},
2145         { 86,   "China"},
2146         { 90,   "Turkey"},
2147         { 91,   "India"},
2148         { 92,   "Pakistan"},
2149         {212,   "Morocco"},
2150         {213,   "Algeria"},
2151         {216,   "Tunisia"},
2152         {218,   "Libya"},
2153         {254,   "Kenya"},
2154         {263,   "Zimbabwe"},
2155         {298,   "Faroe Islands"},
2156         {351,   "Portugal"},
2157         {352,   "Luxembourg"},
2158         {353,   "Ireland"},
2159         {354,   "Iceland"},
2160         {355,   "Albania"},
2161         {358,   "Finland"},
2162         {359,   "Bulgaria"},
2163         {370,   "Lithuania"},
2164         {371,   "Latvia"},
2165         {372,   "Estonia"},
2166         {374,   "Armenia"},
2167         {375,   "Belarus"},
2168         {380,   "Ukraine"},
2169         {381,   "Serbia"},
2170         {385,   "Croatia"},
2171         {386,   "Slovenia"},
2172         {389,   "Macedonia"},
2173         {420,   "Czech Republic"},
2174         {421,   "Slovak Republic"},
2175         {501,   "Belize"},
2176         {502,   "Guatemala"},
2177         {503,   "El Salvador"},
2178         {504,   "Honduras"},
2179         {505,   "Nicaragua"},
2180         {506,   "Costa Rica"},
2181         {507,   "Panama"},
2182         {591,   "Bolivia"},
2183         {593,   "Ecuador"},
2184         {595,   "Paraguay"},
2185         {598,   "Uruguay"},
2186         {673,   "Brunei Darussalam"},
2187         {852,   "Hong Kong"},
2188         {853,   "Macau"},
2189         {886,   "Taiwan"},
2190         {960,   "Maldives"},
2191         {961,   "Lebanon"},
2192         {962,   "Jordan"},
2193         {963,   "Syria"},
2194         {964,   "Iraq"},
2195         {965,   "Kuwait"},
2196         {966,   "Saudi Arabia"},
2197         {967,   "Yemen"},
2198         {968,   "Oman"},
2199         {971,   "United Arab Emirates"},
2200         {972,   "Israel"},
2201         {973,   "Bahrain"},
2202         {974,   "Qatar"},
2203         {976,   "Mongolia"},
2204         {981,   "Iran"},
2205         {994,   "Azerbaijan"},
2206         {995,   "Georgia"},
2207         {996,   "Kyrgyzstan"},
2208
2209         {0,     NULL}
2210 };
2211 value_string_ext ms_country_codes_ext = VALUE_STRING_EXT_INIT(ms_country_codes);
2212
2213  /*module_t* module;*/
2214  /*pref_t* sid_display_hex;*/
2215
2216 static proto_item *
2217 add_nttime(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date,
2218            uint64_t filetime)
2219 {
2220         proto_item *item;
2221         nstime_t ts;
2222
2223         if (filetime == 0) {
2224                 ts.secs = 0;
2225                 ts.nsecs = 0;
2226                 item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2227                     &ts, "No time specified (0)");
2228         } else if (filetime == UINT64_C(0x8000000000000000)) {
2229                 ts.secs = 0;
2230                 ts.nsecs = 0x80000000;
2231                 item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2232                     &ts, "Infinity (relative time)");
2233         } else if (filetime == UINT64_C(0x7fffffffffffffff)) {
2234                 ts.secs = 0xffffffff;
2235                 ts.nsecs = 0x7fffffff;
2236                 item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2237                     &ts, "Infinity (absolute time)");
2238         } else {
2239                 if (filetime_to_nstime(&ts, filetime)) {
2240                         item = proto_tree_add_time(tree, hf_date, tvb,
2241                             offset, 8, &ts);
2242                 } else {
2243                         item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2244                             &ts, "Time can't be converted");
2245                 }
2246         }
2247         return item;
2248 }
2249
2250 proto_item *
2251 dissect_nttime(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date, const unsigned encoding)
2252 {
2253         if (tree) {
2254                 uint32_t filetime_high, filetime_low;
2255                 uint64_t filetime;
2256
2257                 filetime_low = tvb_get_uint32(tvb, offset, encoding);
2258                 filetime_high = tvb_get_uint32(tvb, offset + 4, encoding);
2259                 filetime =  ((uint64_t)filetime_high << 32) | filetime_low;
2260                 return add_nttime(tvb, tree, offset, hf_date, filetime);
2261         }
2262         return NULL;
2263 }
2264
2265 proto_item *
2266 dissect_nttime_hyper(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date, const unsigned encoding)
2267 {
2268         if (tree) {
2269                 uint64_t filetime;
2270
2271                 filetime = tvb_get_uint64(tvb, offset, encoding);
2272                 return add_nttime(tvb, tree, offset, hf_date, filetime);
2273         }
2274         return NULL;
2275 }
2276
2277 proto_item *
2278 dissect_nttime_hyper_1sec(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date, const unsigned encoding)
2279 {
2280         if (tree) {
2281                 uint64_t ftsecs;
2282                 nstime_t ts;
2283
2284                 ftsecs = tvb_get_uint64(tvb, offset, encoding);
2285                 if (filetime_1sec_to_nstime(&ts, ftsecs)) {
2286                         return proto_tree_add_time(tree, hf_date, tvb,
2287                             offset, 8, &ts);
2288                 } else {
2289                         ts.secs = ftsecs;
2290                         ts.nsecs = 0;
2291                         return proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2292                             &ts, "Time can't be converted");
2293                 }
2294         }
2295         return NULL;
2296 }
2297
2298 /* Well-known SIDs defined in
2299
2300      https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
2301 */
2302 static const sid_strings well_known_sids[] = {
2303         {"S-1-0",          "Null Authority"},
2304         {"S-1-0-0",        "Nobody"},
2305         {"S-1-1",          "World Authority"},
2306         {"S-1-1-0",        "Everyone"},
2307         {"S-1-2",          "Local Authority"},
2308         {"S-1-2-0",        "Local"},
2309         {"S-1-2-1",        "Console Logon"},
2310         {"S-1-3",          "Creator Authority"},
2311         {"S-1-3-0",        "Creator Owner"},
2312         {"S-1-3-1",        "Creator Group"},
2313         {"S-1-3-2",        "Creator Owner Server"},
2314         {"S-1-3-3",        "Creator Group Server"},
2315         {"S-1-3-4",        "Owner Rights"},
2316         {"S-1-4",          "Non-unique Authority"},
2317
2318         {"S-1-5",          "NT Authority"},
2319         {"S-1-5-1",        "Dialup"},
2320         {"S-1-5-2",        "Network"},
2321         {"S-1-5-3",        "Batch"},
2322         {"S-1-5-4",        "Interactive"},
2323         {"S-1-5-5",        "Logon Session"}, /* S-1-5-5-X-Y has 6 fields */
2324         {"S-1-5-6",        "Service"},
2325         {"S-1-5-7",        "Anonymous"},
2326         {"S-1-5-8",        "Proxy"},
2327         {"S-1-5-9",        "Enterprise Domain Controllers"},
2328         {"S-1-5-10",       "Principal Self"},
2329         {"S-1-5-11",       "Authenticated Users"},
2330         {"S-1-5-12",       "Restricted Code"},
2331         {"S-1-5-13",       "Terminal Server Users"},
2332         {"S-1-5-14",       "Remote Interactive Logon"},
2333         {"S-1-5-15",       "All users in this organization"},
2334         {"S-1-5-17",       "Default IIS user account"},
2335         {"S-1-5-18",       "Local System"},
2336         {"S-1-5-19",       "Local Service"},
2337         {"S-1-5-20",       "Network Service"},
2338
2339         {"S-1-5-21-0-0-0-496", "Compounded Authentication"},
2340         {"S-1-5-21-0-0-0-497", "Claims Valid"},
2341
2342         /*
2343          * S-1-5-21-<d1>-<d2>-<d3>-<RID> where "<d1>-<d2>-<d3>" is the NT domain
2344          *          RIDs are defined in 'wkwn_S_1_5_21_rids' */
2345         {"S-1-5-21",       "Domain SID"},
2346
2347         /* S-1-5-32-<RID>: Builtin local group SIDs  */
2348         {"S-1-5-32",       "Local Group"},
2349         {"S-1-5-32-544",   "Administrators"},
2350         {"S-1-5-32-545",   "Users"},
2351         {"S-1-5-32-546",   "Guests"},
2352         {"S-1-5-32-547",   "Power Users"},
2353         {"S-1-5-32-548",   "Account Operators"},
2354         {"S-1-5-32-549",   "Server Operators"},
2355         {"S-1-5-32-550",   "Print Operators"},
2356         {"S-1-5-32-551",   "Backup Operators"},
2357         {"S-1-5-32-552",   "Replicators"},
2358         {"S-1-5-32-554",   "Pre-Windows 2000 Compatible Access"},
2359         {"S-1-5-32-555",   "Remote Desktop Users"},
2360         {"S-1-5-32-556",   "Network Configuration Operators"},
2361         {"S-1-5-32-557",   "Incoming Forest Trust Builders"},
2362         {"S-1-5-32-558",   "Performance Monitor Users"},
2363         {"S-1-5-32-559",   "Performance Log Users"},
2364         {"S-1-5-32-560",   "Windows Authorization Access Group"},
2365         {"S-1-5-32-561",   "Terminal Server License Servers"},
2366         {"S-1-5-32-562",   "Distributed COM Users"},
2367         {"S-1-5-32-568",   "IIS Users"},
2368         {"S-1-5-32-569",   "Cryptographic Operators"},
2369         {"S-1-5-32-573",   "Event Log Readers"},
2370         {"S-1-5-32-574",   "Certificate Service DCOM Access"},
2371         {"S-1-5-32-575",   "RDS Remote Access Servers"},
2372         {"S-1-5-32-576",   "RDS Endpoint Servers"},
2373         {"S-1-5-32-577",   "RDS Management Servers"},
2374         {"S-1-5-32-578",   "Hyper-V Admins"},
2375         {"S-1-5-32-579",   "Access Control Assistance Operators"},
2376         {"S-1-5-32-580",   "Remote Management Users"},
2377
2378         {"S-1-5-33",       "Write Restricted Code"},
2379
2380         {"S-1-5-64",       "Authentication"},
2381         {"S-1-5-64-10",    "NTLM"},
2382         {"S-1-5-64-14",    "SChannel"},
2383         {"S-1-5-64-21",    "Digest"},
2384
2385         {"S-1-5-80",       "NT Service"},
2386
2387         {"S-1-5-84-0-0-0-0-0", "User Mode Drivers"},
2388
2389         {"S-1-5-113",      "Local Account"},
2390         {"S-1-5-114",      "Local Administrator Account"},
2391
2392         {"S-1-5-1000",     "Other Organisation"},
2393
2394         {"S-1-15-2-1",     "All App Packages"},
2395
2396         {"S-1-16",         "Mandatory Level"},
2397         {"S-1-16-0",       "Untrusted"},
2398         {"S-1-16-4096",    "Low"},
2399         {"S-1-16-8192",    "Medium"},
2400         {"S-1-16-8448",    "Medium Plus"},
2401         {"S-1-16-12288",   "High"},
2402         {"S-1-16-16384",   "System"},
2403         {"S-1-16-20480",   "Protected Process"},
2404         {"S-1-16-28672",   "Secure Process"},
2405
2406         {"S-1-18-1",       "Authentication Authority Asserted Identity"},
2407         {"S-1-18-2",       "Service Asserted Identity"},
2408         {"S-1-18-3",       "Fresh Public Key Identity"},
2409         {"S-1-18-4",       "Key Trust Identity"},
2410         {"S-1-18-5",       "Key Property Multifactor Authentication"},
2411         {"S-1-18-6",       "Key Property Attestation"},
2412
2413         {NULL, NULL}
2414 };
2415
2416 static const char*
2417 match_wkwn_sids(const char* sid) {
2418         int i = 0;
2419         while (well_known_sids[i].name) {
2420                 if (strcmp(well_known_sids[i].sid, sid)==0) {
2421                         return well_known_sids[i].name;
2422                 }
2423                 i++;
2424         }
2425         return NULL;
2426 }
2427
2428 /* For SIDs in the form 'S-1-5-21-X-Y-Z-<RID>', '21-X-Y-Z' is referred to
2429    as the "domain SID" (NT domain) or "machine SID" (local machine).
2430    The following are well-known RIDs which are appended to domain/machine SIDs
2431    as defined in
2432
2433      https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
2434 */
2435 static const value_string wkwn_S_1_5_21_rids[] = {
2436         {496,   "Compounded Authentication"},
2437         {497,   "Claims Valid"},
2438         {498,   "Enterprise Read-only Domain Controllers"},
2439         {500,   "Administrator"},
2440         {501,   "Guest"},
2441         {502,   "KRBTGT"},
2442         {512,   "Domain Admins"},
2443         {513,   "Domain Users"},
2444         {514,   "Domain Guests"},
2445         {515,   "Domain Computers"},
2446         {516,   "Domain Controllers"},
2447         {517,   "Cert Publishers"},
2448         {518,   "Schema Administrators"},
2449         {519,   "Enterprise Admins"},
2450         {520,   "Group Policy Creator Owners"},
2451         {521,   "Read-only Domain Controllers"},
2452         {522,   "Cloneable Controllers"},
2453         {525,   "Protected Users"},
2454         {526,   "Key Admins"},
2455         {527,   "Enterprise Key Admins"},
2456         {553,   "RAS and IAS Servers"},
2457         {571,   "Allowed RODC Password Replication Group"},
2458         {572,   "Denied RODC Password Replication Group"},
2459         {0, NULL}
2460 };
2461 static value_string_ext wkwn_S_1_5_21_rids_ext = VALUE_STRING_EXT_INIT(wkwn_S_1_5_21_rids);
2462
2463 /* Dissect an NT SID.  Label it with 'name' and return a string version
2464  * of the SID in the 'sid_str' parameter which has a packet lifetime
2465  * scope and should NOT be freed by the caller. hf_sid can be -1 if
2466  * the caller doesn't care what name is used and then "nt.sid" will be
2467  * the default instead. If the caller wants a more appropriate hf
2468  * field, it will just pass a FT_STRING hf field here
2469  */
2470 int
2471 dissect_nt_sid(tvbuff_t *tvb, int offset, proto_tree *parent_tree,
2472                const char *name, char **sid_str, int hf_sid)
2473 {
2474         int offset_sid_start = offset, sa_offset, rid_offset=0, wkwn_sid1_len=0,
2475                 wkwn_sid2_len = 0, i;
2476         uint8_t revision, num_auth;
2477         uint32_t sa_field, rid=0;
2478         uint64_t authority=0;
2479         wmem_strbuf_t *sa_str = NULL, *sid_in_dec_str = NULL, *sid_in_hex_str = NULL, *label_str = NULL,
2480                                   *domain_str = NULL, *wkwn_sid1_str = NULL, *wkwn_sid2_str = NULL;
2481         const char *mapped_name = NULL, *mapped_rid = NULL;
2482         bool domain_sid = false, s_1_5_32 = false, s_1_5_64 = false, locally_defined = false,
2483                 S_1_16 = false;
2484         proto_item *item = NULL, *hidden_item;
2485         proto_tree *subtree = NULL;
2486
2487         /* Revision of SID */
2488         revision = tvb_get_uint8(tvb, offset);
2489         offset++;
2490
2491         /* Number of subauthority fields */
2492         num_auth = tvb_get_uint8(tvb, offset);
2493         offset++;
2494
2495         if(sid_str)
2496                 *sid_str=NULL;
2497
2498         if(hf_sid <= 0){
2499                 /* if no tree, just return the offset of the end_of_SID+1 */
2500                 if (!parent_tree)
2501                         return offset+(6+(num_auth*4));
2502
2503                 hf_sid=hf_nt_sid;
2504         }
2505
2506         /* Identifier Authority */
2507         for(i=0; i<6; i++){
2508                 authority = (authority << 8) + tvb_get_uint8(tvb, offset);
2509                 offset++;
2510         }
2511
2512         sid_in_dec_str = wmem_strbuf_create(wmem_packet_scope());
2513         wmem_strbuf_append_printf (sid_in_dec_str, "S-%u-%" PRIu64, revision, authority);
2514
2515         /*  If sid_display_hex is set, sid_in_dec_str is still needed for
2516                 looking up well-known SIDs*/
2517         if (sid_display_hex) {
2518                 sid_in_hex_str = wmem_strbuf_create(wmem_packet_scope());
2519                 wmem_strbuf_append_printf (sid_in_hex_str, "S-%x-%" PRIx64, revision, authority);
2520         }
2521
2522         wkwn_sid1_str = wmem_strbuf_create(wmem_packet_scope());
2523         label_str = wmem_strbuf_create(wmem_packet_scope());
2524
2525         if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-16")==0)
2526                 S_1_16 = true;
2527
2528         /* Check for Scoped Policy ID (S-1-17-<subauth1>...) */
2529         if (authority == 17) {
2530                 mapped_name = "Central Access Policy";
2531         }
2532
2533         /* Look for well-known SIDs in format 'S-1-<Identifier Authority>' (i.e., exactly 3 fields) */
2534         if (num_auth==0 || S_1_16 || mapped_name) {
2535                 if (!mapped_name)
2536                         mapped_name = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2537
2538                 if (mapped_name) {
2539                         wmem_strbuf_append(label_str, mapped_name);
2540                         wmem_strbuf_append(wkwn_sid1_str,
2541                                 (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2542                         wkwn_sid1_len = 8;
2543                 }
2544         }
2545
2546
2547         sa_offset = offset;
2548         sa_str = wmem_strbuf_create(wmem_packet_scope());
2549         wkwn_sid2_str = wmem_strbuf_create(wmem_packet_scope());
2550         domain_str = wmem_strbuf_create(wmem_packet_scope());
2551
2552         /* Build the sub-authorities and full SID strings */
2553         for(i=1; i<num_auth+1; i++) {
2554            /*
2555                 * XXX should not be letohl but native byteorder according to
2556                 * Samba header files.
2557                 *
2558                 * However, considering that there were never any NT ports
2559                 * to big-endian platforms (PowerPC and MIPS ran little-endian,
2560                 * and IA-64 runs little-endian, as does x86-64), we can (?)
2561                 * assume that non le byte encodings will be "uncommon"?
2562                 */
2563                 sa_field = tvb_get_letohl(tvb, offset);
2564                 wmem_strbuf_append_printf(sid_in_dec_str, "-%u", sa_field);
2565                 wmem_strbuf_append_printf(sa_str,
2566                         (i==1 ? (sid_display_hex ? "%x" : "%u") : (sid_display_hex ? "-%x" : "-%u")),
2567                         sa_field);
2568                 if (sid_display_hex)
2569                         wmem_strbuf_append_printf(sid_in_hex_str, "-%x", sa_field);
2570
2571                 if (i==1) {
2572                         /* Look for well-known SIDs at level one ("S-1-<authority>-<value>") */
2573                         if (S_1_16) {
2574                                 /* Mandatory Level (S-1-16) */
2575                                 mapped_rid = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2576                                 if (mapped_rid) {
2577                                         /* Get the RID */
2578                                         wmem_strbuf_append_printf(label_str, "%s-%s", mapped_name, mapped_rid);
2579                                         rid = sa_field;
2580                                         rid_offset = offset;
2581                                         wmem_strbuf_append(wkwn_sid2_str,
2582                                                 (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2583                                         wkwn_sid1_len=12;                               }
2584                         } else {
2585                                 mapped_name = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2586                                 if (mapped_name) {
2587                                         wmem_strbuf_append(label_str, mapped_name);
2588                                         wmem_strbuf_append(wkwn_sid1_str,
2589                                                 (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2590                                         wkwn_sid1_len = 12;
2591                                 }
2592                                 /* The following three SID types have (unique) RIDs */
2593                                 if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-5-21")==0) {
2594                                         /* Domain SID */
2595                                         domain_sid = true;
2596                                 } else if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-5-32")==0) {
2597                                         /* Local Group (S-1-5-32) SID */
2598                                         s_1_5_32 = true;
2599                                 } else if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-5-64")==0) {
2600                                         /* Authentication (S-1-5-64) SID */
2601                                         s_1_5_64 = true;
2602                                 }
2603                         }
2604                 } else if (i==2  && !domain_sid) {
2605                         /* The only well-known SIDS with two subauthority fields ("level 2 SIDs") are
2606                            Local Group (S-1-5-32), and Authentication (S-1-5-64). */
2607                         if (s_1_5_32 || s_1_5_64) {
2608                                 mapped_rid = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2609                                 if (mapped_rid) {
2610                                         /* Get the RID */
2611                                         wmem_strbuf_append_printf(label_str, "-%s", mapped_rid);
2612                                         rid = sa_field;
2613                                         rid_offset = offset;
2614                                         wmem_strbuf_append(wkwn_sid2_str,
2615                                                 (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2616                                         wkwn_sid2_len=16;
2617                                 } else {
2618                                         /* The RID not well-known. */
2619                                         locally_defined = true;
2620                                 }
2621                         } else {
2622                                 if (mapped_name) {
2623                                         /* A level 1 well-known SID appended with locally defined value */
2624                                         locally_defined = true;
2625                                 }
2626                         }
2627                 } else {
2628                         /* 3 or more sub-auth fields - NOTE: Except for domain SIDs, there are no wkwn SIDs with 3 or more
2629                            sub-auth fields so we don't lookup SIDs here. Logon Session SIDs have 3 sub-auth fields but the
2630                            last two are locally defined. */
2631                         if (domain_sid) {
2632                                 if (num_auth >= 4) {
2633                                         if (i >= 2 && i <=4 ) {
2634                                                 /* Add the field to the domain string (d1-d2-d3) */
2635                                                 wmem_strbuf_append_printf(domain_str,
2636                                                         (i==2 ? (sid_display_hex ? "%x" : "%u") : (sid_display_hex ? "-%x" : "-%u")), sa_field);
2637
2638                                         } else if (i==5) {
2639                                                 rid = sa_field;
2640                                                 rid_offset = offset;
2641                                                 mapped_rid = val_to_str_ext_const(rid, &wkwn_S_1_5_21_rids_ext, "Domain RID");
2642                                                 wmem_strbuf_append_printf(label_str, "-%s", mapped_rid);
2643
2644                                         } else {
2645                                                 locally_defined = true;
2646                                         }
2647                                 } else {
2648                                         mapped_name = "Corrupt domain SID";
2649                                 }
2650                         } else {
2651                                 if (mapped_name) {
2652                                         /* A locally defined value appended to a level 2 well-known SID*/
2653                                         locally_defined = true;
2654                                 }
2655                         }
2656                 }
2657                 offset+=4;
2658         } /* End of for loop */
2659
2660         if ( !(mapped_name || domain_sid || s_1_5_32 || s_1_5_64) ) {
2661             /* If requested, try to map the NON-well-known SID to an object name discovered in this capture  */
2662                 if (sid_name_snooping) {
2663                         mapped_name = find_sid_name(wmem_strbuf_get_str(sid_in_dec_str));
2664                 } else {
2665                         mapped_name = "<Unknown SID type>";
2666                 }
2667         }
2668
2669         if (locally_defined) {
2670                 wmem_strbuf_append_printf(label_str, "-<locally defined>");
2671         }
2672
2673         /* It's tree time
2674            Display the full SID string in hex or dec */
2675         item = proto_tree_add_string_format(
2676                 parent_tree, hf_sid, tvb, offset_sid_start, (offset - offset_sid_start),
2677                 (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)),
2678                 "%s: %s", name, (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str))
2679         );
2680
2681         if (wmem_strbuf_get_len(label_str) > 0) {
2682                 proto_item_append_text(item, "  (%s)", wmem_strbuf_get_str(label_str));
2683         }
2684
2685         subtree = proto_item_add_subtree(item, ett_nt_sid);
2686
2687         /* Add revision, num_auth, and authority */
2688         proto_tree_add_item(subtree, hf_nt_sid_revision, tvb, offset_sid_start, 1, ENC_LITTLE_ENDIAN);
2689         proto_tree_add_item(subtree, hf_nt_sid_num_auth, tvb, offset_sid_start+1, 1, ENC_LITTLE_ENDIAN);
2690         proto_tree_add_uint64(subtree,
2691                 (sid_display_hex ? hf_nt_sid_auth_hex : hf_nt_sid_auth_dec),
2692                 tvb, offset_sid_start+2, 6, authority);
2693
2694         /* Add subauthorities */
2695         proto_tree_add_string_format_value(subtree, hf_nt_sid_subauth, tvb, sa_offset,
2696                 num_auth*4, wmem_strbuf_get_str(sa_str), "%s", wmem_strbuf_get_str(sa_str));
2697
2698         if (rid) {
2699                 item = proto_tree_add_item (subtree,
2700                         (sid_display_hex ? hf_nt_sid_rid_hex : hf_nt_sid_rid_dec), tvb, rid_offset, 4, ENC_LITTLE_ENDIAN);
2701
2702                 if (mapped_rid)
2703                         proto_item_append_text(item, "  (%s)", mapped_rid);
2704         }
2705
2706         /* Add well-known SID and domain strings if present */
2707         if (wmem_strbuf_get_len(wkwn_sid1_str) > 0) {
2708                 hidden_item = proto_tree_add_string_format_value(
2709                         subtree, hf_nt_sid_wkwn, tvb, offset_sid_start, wkwn_sid1_len,
2710                         wmem_strbuf_get_str(wkwn_sid1_str), "%s", wmem_strbuf_get_str(wkwn_sid1_str));
2711
2712                 if (mapped_name) {
2713                         proto_item_append_text(hidden_item, "  (%s)", mapped_name);
2714                 }
2715                 proto_item_set_hidden(hidden_item);
2716         }
2717         if (wmem_strbuf_get_len(wkwn_sid2_str) > 0) {
2718                 hidden_item = proto_tree_add_string_format_value(
2719                         subtree, hf_nt_sid_wkwn, tvb, offset_sid_start, wkwn_sid2_len,
2720                         wmem_strbuf_get_str(wkwn_sid2_str), "%s", wmem_strbuf_get_str(wkwn_sid2_str));
2721                 if (wmem_strbuf_get_len(label_str) > 0) {
2722                         proto_item_append_text(hidden_item, "  (%s)", wmem_strbuf_get_str(label_str));
2723                 }
2724                 proto_item_set_hidden(hidden_item);
2725         }
2726         if (domain_sid && wmem_strbuf_get_len(domain_str) > 0) {
2727                 hidden_item = proto_tree_add_string_format_value(
2728                         subtree, hf_nt_sid_domain, tvb, offset_sid_start + 12, 12,
2729                         wmem_strbuf_get_str(domain_str), "%s", wmem_strbuf_get_str(domain_str));
2730                 proto_item_set_hidden(hidden_item);
2731         }
2732
2733         /* If requested, return SID string with mapped name */
2734         if(sid_str){
2735                 if(wmem_strbuf_get_len(label_str) > 0){
2736                         *sid_str = wmem_strdup_printf(wmem_packet_scope(), "%s  (%s)",
2737                                 (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)), wmem_strbuf_get_str(label_str));
2738                 } else {
2739                         *sid_str = wmem_strdup(wmem_packet_scope(), sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str));
2740                 }
2741                 if(!(*sid_str)){
2742                         *sid_str=wmem_strdup(wmem_packet_scope(), "corrupted SID");
2743                 }
2744         }
2745         return offset;
2746 }
2747
2748 /* Dissect SYSTEM_RESOURCE_ATTRIBUTE_ACE Value, see [MS-DTYP] v20180912 section 2.4.4.15 */
2749 static int
2750 dissect_nt_ace_system_resource_attribute_value(tvbuff_t *tvb, int value_offset, proto_tree *tree,
2751                                                uint16_t value_type, proto_item *sra_item)
2752 {
2753         unsigned value_len;
2754         uint32_t blob_len;
2755         proto_item *value_item = NULL;
2756         char *value_str = NULL; /* packet scope, do not free */
2757         bool quote = false;
2758         switch (value_type) {
2759             case CLAIM_SECURITY_ATTRIBUTE_TYPE_INT64:
2760                 value_len = sizeof(int64_t);
2761                 value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_int64,
2762                                                  tvb, value_offset, value_len,
2763                                                  ENC_LITTLE_ENDIAN);
2764                 value_offset += value_len;
2765                 break;
2766
2767             case CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64:
2768                 value_len = sizeof(uint64_t);
2769                 value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_uint64,
2770                                                  tvb, value_offset, value_len,
2771                                                  ENC_LITTLE_ENDIAN);
2772                 value_offset += value_len;
2773                 break;
2774
2775             case CLAIM_SECURITY_ATTRIBUTE_TYPE_STRING:
2776                 value_len = tvb_unicode_strsize(tvb, value_offset);
2777                 value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_string,
2778                                                  tvb, value_offset, value_len,
2779                                                  ENC_UTF_16 | ENC_LITTLE_ENDIAN);
2780                 quote = true;
2781                 value_offset += value_len;
2782                 break;
2783
2784             case CLAIM_SECURITY_ATTRIBUTE_TYPE_SID:
2785                 value_offset = dissect_nt_sid(tvb, value_offset, tree,
2786                                               "SID", &value_str, hf_nt_ace_sra_value_sid);
2787                 break;
2788
2789             case CLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN:
2790                 value_len = sizeof(uint64_t);
2791                 value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_boolean,
2792                                                  tvb, value_offset, value_len,
2793                                                  ENC_LITTLE_ENDIAN);
2794                 value_offset += value_len;
2795                 break;
2796
2797             case CLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING:
2798                 blob_len = tvb_get_letohl(tvb, value_offset);
2799                 value_offset += sizeof(blob_len);
2800                 value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_octet_string,
2801                                                  tvb, value_offset, blob_len, ENC_NA);
2802                 /* do not append binary to sra_item */
2803                 value_str = "<bin>";
2804                 value_offset += blob_len;
2805                 break;
2806
2807             default:
2808                 break;
2809         }
2810
2811         if (sra_item) {
2812                 if ((value_str == NULL) && value_item) {
2813                         value_str = proto_item_get_display_repr(wmem_packet_scope(), value_item);
2814                 }
2815
2816                 if (value_str == NULL) {
2817                         /* missing system resource attribute value */
2818                         value_str = "???";
2819                 }
2820
2821                 if (value_str) {
2822                         proto_item_append_text(sra_item,
2823                                                (quote) ? "\"%s\"" : "%s",
2824                                                value_str);
2825                 }
2826         }
2827
2828         return value_offset;
2829 }
2830
2831 /* Dissect SYSTEM_RESOURCE_ATTRIBUTE_ACE, see [MS-DTYP] v20180912 section 2.4.4.15 */
2832 static int
2833 dissect_nt_ace_system_resource_attribute(tvbuff_t *tvb, int offset, uint16_t size, proto_tree *parent_tree)
2834 {
2835         /* The caller has already dissected Header, Mask and Sid. Therefore
2836            this function only dissects Attribute Data. This data takes
2837            the form of a CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1. The
2838            following code dissects the structure piecemeal */
2839         int start_offset = offset;
2840         uint32_t name; /* offset, relative to start_offset */
2841         uint16_t value_type;
2842         uint32_t value_count;
2843
2844         /* Add a subtree to hold the system resource attribute details */
2845         proto_item *sra_item;
2846         proto_tree *sra_tree;
2847         sra_item = proto_tree_add_item(parent_tree, hf_nt_ace_sra, tvb, offset, size, ENC_NA);
2848         sra_tree = proto_item_add_subtree(sra_item, ett_nt_ace_sra);
2849
2850         /* Name offset */
2851         name = tvb_get_letohl(tvb, offset);
2852         proto_tree_add_uint(sra_tree, hf_nt_ace_sra_name_offset,
2853                             tvb, offset, sizeof(name), name);
2854
2855         int name_offset = (start_offset + name);
2856         unsigned name_len = tvb_unicode_strsize(tvb, name_offset);
2857         proto_item *name_item;
2858         name_item = proto_tree_add_item(sra_tree, hf_nt_ace_sra_name,
2859                                         tvb, name_offset, name_len,
2860                                         ENC_UTF_16 | ENC_LITTLE_ENDIAN);
2861         proto_item_append_text(sra_item, ": %s=",
2862                                proto_item_get_display_repr(wmem_packet_scope(), name_item));
2863         offset += sizeof(name);
2864
2865         /* ValueType */
2866         value_type = tvb_get_letohs(tvb, offset);
2867         proto_tree_add_uint(sra_tree, hf_nt_ace_sra_type,
2868                             tvb, offset, sizeof(value_type), value_type);
2869         offset += sizeof(value_type);
2870
2871         /* Reserved */
2872         proto_tree_add_item(sra_tree, hf_nt_ace_sra_reserved,
2873                             tvb, offset, sizeof(uint16_t),
2874                             ENC_LITTLE_ENDIAN);
2875         offset += sizeof(uint16_t);
2876
2877         /* Flags */
2878         static int * const flags[] = {
2879                 &hf_nt_ace_sra_flags_policy_derived,
2880                 &hf_nt_ace_sra_flags_manual,
2881                 &hf_nt_ace_sra_flags_mandatory,
2882                 &hf_nt_ace_sra_flags_disabled,
2883                 &hf_nt_ace_sra_flags_disabled_by_default,
2884                 &hf_nt_ace_sra_flags_deny_only,
2885                 &hf_nt_ace_sra_flags_case_sensitive,
2886                 &hf_nt_ace_sra_flags_non_inheritable,
2887                 NULL
2888         };
2889
2890         proto_tree_add_bitmask(sra_tree, tvb, offset, hf_nt_ace_sra_flags,
2891                                ett_nt_ace_sra_flags, flags, ENC_LITTLE_ENDIAN);
2892         offset += sizeof(uint32_t);
2893
2894         /* ValueCount */
2895         value_count = tvb_get_letohl(tvb, offset);
2896         proto_tree_add_uint(sra_tree, hf_nt_ace_sra_value_count,
2897                             tvb, offset, sizeof(value_count), value_count);
2898         offset += sizeof(value_count);
2899
2900         /* Value Offsets and Values */
2901         uint32_t value_offset;
2902         proto_tree *value_offset_tree = sra_tree;
2903         proto_tree *value_tree = sra_tree;
2904         if (value_count > 1) {
2905                 /* Use independent value offset and value trees when
2906                    there are multiple values. */
2907                 int value_offset_tree_offset = offset;
2908                 int value_offset_tree_len = value_count * sizeof(value_offset);
2909                 value_offset_tree = proto_tree_add_subtree(sra_tree, tvb,
2910                                                            value_offset_tree_offset,
2911                                                            value_offset_tree_len,
2912                                                            ett_nt_ace_sra_value_offsets,
2913                                                            NULL, "Value Offsets");
2914
2915                 /* The range associated with the value tree will
2916                    include some non-value data (but that's fine as the
2917                    value items it contains will have accurate ranges) */
2918                 int value_tree_offset = value_offset_tree_offset + value_offset_tree_len;
2919                 int value_tree_len = (start_offset + size) - value_tree_offset;
2920                 value_tree = proto_tree_add_subtree(sra_tree, tvb,
2921                                                     value_tree_offset,
2922                                                     value_tree_len,
2923                                                     ett_nt_ace_sra_values,
2924                                                     NULL, "Values");
2925         }
2926
2927         proto_item_append_text(sra_item, "{");
2928         for (uint32_t i = 0; i < value_count; ++i) {
2929                 if (i) {
2930                         proto_item_append_text(sra_item, ", ");
2931                 }
2932                 value_offset = tvb_get_letohl(tvb, offset);
2933                 proto_tree_add_uint(value_offset_tree, hf_nt_ace_sra_value_offset,
2934                                     tvb, offset, sizeof(value_offset), value_offset);
2935                 dissect_nt_ace_system_resource_attribute_value(tvb, start_offset + value_offset,
2936                                                                value_tree, value_type, sra_item);
2937                 offset += sizeof(value_offset);
2938         }
2939         proto_item_append_text(sra_item, "}");
2940
2941         return start_offset + size;
2942 }
2943
2944 /* Dissect Condition ACE token, see [MS-DTYP] v20180912 section 2.4.4.17.4 */
2945 static int
2946 // NOLINTNEXTLINE(misc-no-recursion)
2947 dissect_nt_conditional_ace_token(tvbuff_t *tvb, packet_info *pinfo, int offset, uint16_t size, proto_tree *parent_tree)
2948 {
2949         int start_offset = offset;
2950         proto_tree *tree = parent_tree;
2951         proto_item *item = NULL;
2952         uint8_t token = tvb_get_uint8(tvb, offset);
2953         uint32_t len;
2954
2955         item = proto_tree_add_uint(tree, hf_nt_ace_cond_token,
2956                                    tvb, offset, sizeof(token), token);
2957
2958         if (ace_cond_token_has_data(token)) {
2959                 tree = proto_item_add_subtree(item, ett_nt_ace_cond_data);
2960         }
2961         offset += sizeof(token);
2962
2963         switch (token) {
2964             case COND_ACE_TOKEN_INT8:
2965                 proto_tree_add_item(tree, hf_nt_ace_cond_value_int8,
2966                                     tvb, offset, sizeof(uint64_t),
2967                                     ENC_LITTLE_ENDIAN);
2968                 offset += sizeof(uint64_t);
2969
2970                 proto_tree_add_item(tree, hf_nt_ace_cond_sign,
2971                                     tvb, offset, sizeof(uint8_t),
2972                                     ENC_LITTLE_ENDIAN);
2973                 offset += sizeof(uint8_t);
2974
2975                 proto_tree_add_item(tree, hf_nt_ace_cond_base,
2976                                     tvb, offset, sizeof(uint8_t),
2977                                     ENC_LITTLE_ENDIAN);
2978                 offset += sizeof(uint8_t);
2979                 break;
2980
2981             case COND_ACE_TOKEN_INT16:
2982                 proto_tree_add_item(tree, hf_nt_ace_cond_value_int16,
2983                                     tvb, offset, sizeof(uint64_t),
2984                                     ENC_LITTLE_ENDIAN);
2985                 offset += sizeof(uint64_t);
2986
2987                 proto_tree_add_item(tree, hf_nt_ace_cond_sign,
2988                                     tvb, offset, sizeof(uint8_t),
2989                                     ENC_LITTLE_ENDIAN);
2990                 offset += sizeof(uint8_t);
2991
2992                 proto_tree_add_item(tree, hf_nt_ace_cond_base,
2993                                     tvb, offset, sizeof(uint8_t),
2994                                     ENC_LITTLE_ENDIAN);
2995                 offset += sizeof(uint8_t);
2996                 break;
2997
2998             case COND_ACE_TOKEN_INT32:
2999                 proto_tree_add_item(tree, hf_nt_ace_cond_value_int32,
3000                                     tvb, offset, sizeof(uint64_t),
3001                                     ENC_LITTLE_ENDIAN);
3002                 offset += sizeof(uint64_t);
3003
3004                 proto_tree_add_item(tree, hf_nt_ace_cond_sign,
3005                                     tvb, offset, sizeof(uint8_t),
3006                                     ENC_LITTLE_ENDIAN);
3007                 offset += sizeof(uint8_t);
3008
3009                 proto_tree_add_item(tree, hf_nt_ace_cond_base,
3010                                     tvb, offset, sizeof(uint8_t),
3011                                     ENC_LITTLE_ENDIAN);
3012                 offset += sizeof(uint8_t);
3013                 break;
3014
3015             case COND_ACE_TOKEN_INT64:
3016                 proto_tree_add_item(tree, hf_nt_ace_cond_value_int64,
3017                                     tvb, offset, sizeof(uint64_t),
3018                                     ENC_LITTLE_ENDIAN);
3019                 offset += sizeof(uint64_t);
3020
3021                 proto_tree_add_item(tree, hf_nt_ace_cond_sign,
3022                                     tvb, offset, sizeof(uint8_t),
3023                                     ENC_LITTLE_ENDIAN);
3024                 offset += sizeof(uint8_t);
3025
3026                 proto_tree_add_item(tree, hf_nt_ace_cond_base,
3027                                     tvb, offset, sizeof(uint8_t),
3028                                     ENC_LITTLE_ENDIAN);
3029                 offset += sizeof(uint8_t);
3030                 break;
3031
3032             case COND_ACE_TOKEN_UNICODE_STRING:
3033                 len = tvb_get_letohl(tvb, offset); /* in bytes */
3034                 offset += sizeof(len);
3035
3036                 proto_tree_add_item(tree, hf_nt_ace_cond_value_string,
3037                                     tvb, offset, len,
3038                                     ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3039                 offset += len;
3040                 break;
3041
3042             case COND_ACE_TOKEN_OCTET_STRING:
3043                 len = tvb_get_letohl(tvb, offset); /* in bytes */
3044                 offset += sizeof(len);
3045
3046                 proto_tree_add_item(tree, hf_nt_ace_cond_value_octet_string,
3047                                     tvb, offset, len, ENC_NA);
3048                 offset += len;
3049                 break;
3050
3051             case COND_ACE_TOKEN_COMPOSITE:
3052                 /* Create another tree for composite */
3053                 len = tvb_get_letohl(tvb, offset); /* in bytes */
3054                 offset += sizeof(len);
3055                 if (len) {
3056                         int remaining = size - (offset - start_offset);
3057                         if (remaining >= (int)len) {
3058                                 int end_offset = offset + len;
3059                                 increment_dissection_depth(pinfo);
3060                                 while (offset < end_offset) {
3061                                         offset = dissect_nt_conditional_ace_token(tvb, pinfo, offset, remaining, tree);
3062                                 }
3063                                 decrement_dissection_depth(pinfo);
3064                         } else {
3065                                 /* malformed: composite len is longer
3066                                  * than the remaining data in the ace
3067                                  */
3068                                 offset += remaining;
3069                         }
3070                 }
3071                 break;
3072
3073             case COND_ACE_TOKEN_SID:
3074                 offset += sizeof(len);
3075
3076                 offset = dissect_nt_sid(tvb, offset, tree, "SID", NULL, -1);
3077                 break;
3078
3079             case COND_ACE_TOKEN_LOCAL_ATTRIBUTE:
3080                 len = tvb_get_letohl(tvb, offset); /* in bytes */
3081                 offset += sizeof(len);
3082
3083                 proto_tree_add_item(tree, hf_nt_ace_cond_local_attr,
3084                                     tvb, offset, len,
3085                                     ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3086                 offset += len;
3087                 break;
3088
3089             case COND_ACE_TOKEN_USER_ATTRIBUTE:
3090                 len = tvb_get_letohl(tvb, offset); /* in bytes */
3091                 offset += sizeof(len);
3092
3093                 proto_tree_add_item(tree, hf_nt_ace_cond_user_attr,
3094                                     tvb, offset, len,
3095                                     ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3096                 offset += len;
3097                 break;
3098
3099             case COND_ACE_TOKEN_RESOURCE_ATTRIBUTE:
3100                 len = tvb_get_letohl(tvb, offset); /* in bytes */
3101                 offset += sizeof(len);
3102
3103                 proto_tree_add_item(tree, hf_nt_ace_cond_resource_attr,
3104                                     tvb, offset, len,
3105                                     ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3106                 offset += len;
3107                 break;
3108
3109             case COND_ACE_TOKEN_DEVICE_ATTRIBUTE:
3110                 len = tvb_get_letohl(tvb, offset); /* in bytes */
3111                 offset += sizeof(len);
3112
3113                 proto_tree_add_item(tree, hf_nt_ace_cond_device_attr,
3114                                     tvb, offset, len,
3115                                     ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3116                 offset += len;
3117                 break;
3118
3119             default:
3120                 DISSECTOR_ASSERT(!ace_cond_token_has_data(token));
3121                 break;
3122         }
3123
3124         proto_item_set_len(item, offset - start_offset);
3125         return offset;
3126 }
3127
3128
3129 /* Dissect Conditional ACE (if present), see [MS-DTYP] v20180912 section 2.4.4.17.4 */
3130 static int
3131 dissect_nt_conditional_ace(tvbuff_t *tvb, packet_info *pinfo, int offset, uint16_t size, proto_tree *parent_tree)
3132 {
3133         int start_offset = offset;
3134
3135         /* Conditional ACE Application Data starts with "artx" */
3136         if (size >= 4) {
3137                 const uint32_t artx = 0x78747261; /* "xtra" (LE) */
3138                 uint32_t prefix = tvb_get_letohl(tvb, offset);
3139                 offset += sizeof(prefix);
3140
3141                 if (prefix == artx) {
3142                         /* Add a subtree to hold the condition expression tokens */
3143                         proto_item *item = NULL;
3144                         item = proto_tree_add_item(parent_tree, hf_nt_ace_cond, tvb, start_offset, size, ENC_NA);
3145                         parent_tree = proto_item_add_subtree(item, ett_nt_ace_cond);
3146
3147                         /* Add the tokens to the subtree */
3148                         int remaining;
3149                         while (true) {
3150                                 remaining = size - (offset - start_offset);
3151                                 if (remaining <= 0)
3152                                         break;
3153                                 offset = dissect_nt_conditional_ace_token(tvb, pinfo, offset, remaining, parent_tree);
3154                         }
3155                 }
3156         }
3157         return start_offset + size;
3158 }
3159
3160 /* Dissect an access mask.  All this stuff is kind of explained at
3161
3162      https://docs.microsoft.com/en-us/windows/win32/secauthz/access-mask-format
3163
3164 */
3165 static int ett_nt_access_mask;
3166 static int ett_nt_access_mask_generic;
3167 static int ett_nt_access_mask_standard;
3168 static int ett_nt_access_mask_specific;
3169
3170 static int hf_access_sacl;
3171 static int hf_access_maximum_allowed;
3172 static int hf_access_generic_read;
3173 static int hf_access_generic_write;
3174 static int hf_access_generic_execute;
3175 static int hf_access_generic_all;
3176 static int hf_access_standard_delete;
3177 static int hf_access_standard_read_control;
3178 static int hf_access_standard_synchronise;
3179 static int hf_access_standard_write_dac;
3180 static int hf_access_standard_write_owner;
3181 static int hf_access_specific_15;
3182 static int hf_access_specific_14;
3183 static int hf_access_specific_13;
3184 static int hf_access_specific_12;
3185 static int hf_access_specific_11;
3186 static int hf_access_specific_10;
3187 static int hf_access_specific_9;
3188 static int hf_access_specific_8;
3189 static int hf_access_specific_7;
3190 static int hf_access_specific_6;
3191 static int hf_access_specific_5;
3192 static int hf_access_specific_4;
3193 static int hf_access_specific_3;
3194 static int hf_access_specific_2;
3195 static int hf_access_specific_1;
3196 static int hf_access_specific_0;
3197
3198 /* Map generic permissions to specific permissions */
3199
3200 static void map_generic_access(uint32_t *access_mask,
3201                                struct generic_mapping *mapping)
3202 {
3203         if (*access_mask & GENERIC_READ_ACCESS) {
3204                 *access_mask &= ~GENERIC_READ_ACCESS;
3205                 *access_mask |= mapping->generic_read;
3206         }
3207
3208         if (*access_mask & GENERIC_WRITE_ACCESS) {
3209                 *access_mask &= ~GENERIC_WRITE_ACCESS;
3210                 *access_mask |= mapping->generic_write;
3211         }
3212
3213         if (*access_mask & GENERIC_EXECUTE_ACCESS) {
3214                 *access_mask &= ~GENERIC_EXECUTE_ACCESS;
3215                 *access_mask |= mapping->generic_execute;
3216         }
3217
3218         if (*access_mask & GENERIC_ALL_ACCESS) {
3219                 *access_mask &= ~GENERIC_ALL_ACCESS;
3220                 *access_mask |= mapping->generic_all;
3221         }
3222 }
3223
3224 /* Map standard permissions to specific permissions */
3225
3226 static void map_standard_access(uint32_t *access_mask,
3227                                 struct standard_mapping *mapping)
3228 {
3229         if (*access_mask & READ_CONTROL_ACCESS) {
3230                 *access_mask &= ~READ_CONTROL_ACCESS;
3231                 *access_mask |= mapping->std_read;
3232         }
3233
3234         if (*access_mask & (DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|
3235                             SYNCHRONIZE_ACCESS)) {
3236                 *access_mask &= ~(DELETE_ACCESS|WRITE_DAC_ACCESS|
3237                                   WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS);
3238                 *access_mask |= mapping->std_all;
3239         }
3240
3241 }
3242
3243 int
3244 dissect_nt_access_mask(tvbuff_t *tvb, int offset, packet_info *pinfo,
3245                        proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
3246                        struct access_mask_info *ami, uint32_t *perms)
3247 {
3248         proto_item *item;
3249         proto_tree *subtree, *generic_tree, *standard_tree, *specific_tree;
3250         uint32_t access;
3251
3252         static int * const generic_access_flags[] = {
3253                 &hf_access_generic_read,
3254                 &hf_access_generic_write,
3255                 &hf_access_generic_execute,
3256                 &hf_access_generic_all,
3257                 &hf_access_maximum_allowed,
3258                 &hf_access_sacl,
3259                 NULL
3260         };
3261
3262         static int * const standard_access_flags[] = {
3263                 &hf_access_standard_synchronise,
3264                 &hf_access_standard_write_owner,
3265                 &hf_access_standard_write_dac,
3266                 &hf_access_standard_read_control,
3267                 &hf_access_standard_delete,
3268                 NULL
3269         };
3270
3271         static int * const access_specific_flags[] = {
3272                 &hf_access_specific_15,
3273                 &hf_access_specific_14,
3274                 &hf_access_specific_13,
3275                 &hf_access_specific_12,
3276                 &hf_access_specific_11,
3277                 &hf_access_specific_10,
3278                 &hf_access_specific_9,
3279                 &hf_access_specific_8,
3280                 &hf_access_specific_7,
3281                 &hf_access_specific_6,
3282                 &hf_access_specific_5,
3283                 &hf_access_specific_4,
3284                 &hf_access_specific_3,
3285                 &hf_access_specific_2,
3286                 &hf_access_specific_1,
3287                 &hf_access_specific_0,
3288                 NULL
3289         };
3290
3291         if (drep != NULL) {
3292                 /*
3293                  * Called from a DCE RPC protocol dissector, for a
3294                  * protocol where a 32-bit NDR integer contains
3295                  * an NT access mask; extract the access mask
3296                  * with an NDR call.
3297                  */
3298                 offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep,
3299                                             hfindex, &access);
3300         } else {
3301                 /*
3302                  * Called from SMB, where the access mask is just a
3303                  * 4-byte little-endian quantity with no special
3304                  * NDR alignment requirement; extract it with
3305                  * "tvb_get_letohl()".
3306                  */
3307                 access = tvb_get_letohl(tvb, offset);
3308                 offset += 4;
3309         }
3310
3311         if (perms) {
3312           *perms = access;
3313         }
3314
3315         item = proto_tree_add_uint(tree, hfindex, tvb, offset - 4, 4, access);
3316
3317         subtree = proto_item_add_subtree(item, ett_nt_access_mask);
3318
3319         /* Generic access rights */
3320
3321         generic_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3322                                    ett_nt_access_mask_generic, NULL, "Generic rights: 0x%08x",
3323                                    access & GENERIC_RIGHTS_MASK);
3324
3325         proto_tree_add_bitmask_list_value(generic_tree, tvb, offset - 4, 4, generic_access_flags, access);
3326
3327         /* Standard access rights */
3328
3329         standard_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3330                                    ett_nt_access_mask_standard, NULL, "Standard rights: 0x%08x",
3331                                    access & STANDARD_RIGHTS_MASK);
3332
3333         proto_tree_add_bitmask_list_value(standard_tree, tvb, offset - 4, 4, standard_access_flags, access);
3334
3335         /* Specific access rights.  Call the specific_rights_fn
3336            pointer if we have one, otherwise just display bits 0-15 in
3337            boring fashion. */
3338
3339         if (ami && ami->specific_rights_name)
3340                 specific_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3341                                            ett_nt_access_mask_specific, &item, "%s specific rights: 0x%08x",
3342                                            ami->specific_rights_name,
3343                                            access & SPECIFIC_RIGHTS_MASK);
3344         else
3345                 specific_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3346                                            ett_nt_access_mask_specific, &item, "Specific rights: 0x%08x",
3347                                            access & SPECIFIC_RIGHTS_MASK);
3348
3349         if (ami && ami->specific_rights_fn) {
3350                 uint32_t mapped_access = access;
3351                 proto_tree *specific_mapped;
3352
3353                 specific_mapped = proto_item_add_subtree(
3354                         item, ett_nt_access_mask_specific);
3355
3356                 ami->specific_rights_fn(
3357                         tvb, offset - 4, specific_tree, access);
3358
3359                 if (ami->generic_mapping)
3360                         map_generic_access(&access, ami->generic_mapping);
3361
3362                 if (ami->standard_mapping)
3363                         map_standard_access(&access, ami->standard_mapping);
3364
3365                 if (access != mapped_access) {
3366                         ami->specific_rights_fn(
3367                                 tvb, offset - 4, specific_mapped,
3368                                 mapped_access);
3369                 }
3370
3371                 return offset;
3372         }
3373
3374         proto_tree_add_bitmask_list_value(specific_tree, tvb, offset - 4, 4, access_specific_flags, access);
3375
3376         return offset;
3377 }
3378
3379 static int hf_nt_access_mask;
3380
3381 #define ACL_REVISION_NT4                2
3382 #define ACL_REVISION_ADS                4
3383 static const value_string acl_revision_vals[] = {
3384         { ACL_REVISION_NT4,     "NT4"},
3385         { ACL_REVISION_ADS,     "AD"},
3386         {0,NULL}
3387 };
3388
3389 #define ACE_TYPE_ACCESS_ALLOWED         0
3390 #define ACE_TYPE_ACCESS_DENIED          1
3391 #define ACE_TYPE_SYSTEM_AUDIT           2
3392 #define ACE_TYPE_SYSTEM_ALARM           3
3393 #define ACE_TYPE_ALLOWED_COMPOUND       4
3394 #define ACE_TYPE_ACCESS_ALLOWED_OBJECT  5
3395 #define ACE_TYPE_ACCESS_DENIED_OBJECT   6
3396 #define ACE_TYPE_SYSTEM_AUDIT_OBJECT    7
3397 #define ACE_TYPE_SYSTEM_ALARM_OBJECT    8
3398 #define ACE_TYPE_ACCESS_ALLOWED_CALLBACK         9
3399 #define ACE_TYPE_ACCESS_DENIED_CALLBACK         10
3400 #define ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT 11
3401 #define ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT  12
3402 #define ACE_TYPE_SYSTEM_AUDIT_CALLBACK          13
3403 #define ACE_TYPE_SYSTEM_ALARM_CALLBACK          14
3404 #define ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT   15
3405 #define ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT   16
3406 #define ACE_TYPE_SYSTEM_MANDATORY_LABEL         17
3407 #define ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE      18
3408 #define ACE_TYPE_SYSTEM_SCOPED_POLICY_ID        19
3409
3410 static const value_string ace_type_vals[] = {
3411         { ACE_TYPE_ACCESS_ALLOWED,                 "Access Allowed"},
3412         { ACE_TYPE_ACCESS_DENIED,                  "Access Denied"},
3413         { ACE_TYPE_SYSTEM_AUDIT,                   "System Audit"},
3414         { ACE_TYPE_SYSTEM_ALARM,                   "System Alarm"},
3415         { ACE_TYPE_ALLOWED_COMPOUND,               "Allowed Compound"},
3416         { ACE_TYPE_ACCESS_ALLOWED_OBJECT,          "Allowed Object"},
3417         { ACE_TYPE_ACCESS_DENIED_OBJECT,           "Denied Object"},
3418         { ACE_TYPE_SYSTEM_AUDIT_OBJECT,            "Audit Object"},
3419         { ACE_TYPE_SYSTEM_ALARM_OBJECT,            "Alarm Object"},
3420         { ACE_TYPE_ACCESS_ALLOWED_CALLBACK,        "Allowed Callback"},
3421         { ACE_TYPE_ACCESS_DENIED_CALLBACK,         "Denied Callback"},
3422         { ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT, "Allowed Callback Object"},
3423         { ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT,  "Denied Callback Object"},
3424         { ACE_TYPE_SYSTEM_AUDIT_CALLBACK,          "Audit Callback"},
3425         { ACE_TYPE_SYSTEM_ALARM_CALLBACK,          "Alarm Callback"},
3426         { ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT,   "Audit Callback Object"},
3427         { ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT,   "Alarm Callback Object"},
3428         { ACE_TYPE_SYSTEM_MANDATORY_LABEL,         "Mandatory label"},
3429         { ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE,      "Resource Attribute"},
3430         { ACE_TYPE_SYSTEM_SCOPED_POLICY_ID,        "Scoped Policy ID" },
3431         { 0, NULL}
3432 };
3433 static const true_false_string tfs_ace_flags_object_inherit = {
3434         "Subordinate files will inherit this ACE",
3435         "Subordinate files will not inherit this ACE"
3436 };
3437 static const true_false_string tfs_ace_flags_container_inherit = {
3438         "Subordinate containers will inherit this ACE",
3439         "Subordinate containers will not inherit this ACE"
3440 };
3441 static const true_false_string tfs_ace_flags_non_propagate_inherit = {
3442         "Subordinate object will not propagate the inherited ACE further",
3443         "Subordinate object will propagate the inherited ACE further"
3444 };
3445 static const true_false_string tfs_ace_flags_inherit_only = {
3446         "This ACE does not apply to the current object",
3447         "This ACE applies to the current object"
3448 };
3449 static const true_false_string tfs_ace_flags_inherited_ace = {
3450         "This ACE was inherited from its parent object",
3451         "This ACE was not inherited from its parent object"
3452 };
3453 static const true_false_string tfs_ace_flags_successful_access = {
3454         "Successful accesses will be audited",
3455         "Successful accesses will not be audited"
3456 };
3457 static const true_false_string tfs_ace_flags_failed_access = {
3458         "Failed accesses will be audited",
3459         "Failed accesses will not be audited"
3460 };
3461
3462 static const true_false_string flags_sec_info_sacl = {
3463         "Request SACL",
3464         "Do NOT request SACL"
3465 };
3466 static const true_false_string flags_sec_info_dacl = {
3467         "Request DACL",
3468         "Do NOT request DACL"
3469 };
3470 static const true_false_string flags_sec_info_group = {
3471         "Request GROUP",
3472         "Do NOT request group"
3473 };
3474 static const true_false_string flags_sec_info_owner = {
3475         "Request OWNER",
3476         "Do NOT request owner"
3477 };
3478
3479 static const true_false_string flags_ace_sra_info_manual = {
3480         "Manually Assigned",
3481         "NOT Manually Assigned"
3482 };
3483
3484
3485 static const true_false_string flags_ace_sra_info_policy_derived = {
3486         "Policy Derived",
3487         "NOT Policy Derived"
3488 };
3489
3490 static const true_false_string flags_ace_sra_info_non_inheritable = {
3491         "Non-Inheritable",
3492         "Inheritable"
3493 };
3494
3495 static const true_false_string flags_ace_sra_info_case_sensitive = {
3496         "Case Sensitive",
3497         "NOT Case Sensitive"
3498 };
3499
3500 static const true_false_string flags_ace_sra_info_deny_only = {
3501         "Deny Only",
3502         "NOT Deny Only"
3503 };
3504
3505 static const true_false_string flags_ace_sra_info_disabled_by_default = {
3506         "Disabled By Default",
3507         "NOT Disabled By Default"
3508 };
3509
3510 static const true_false_string flags_ace_sra_info_disabled = {
3511         "Disabled",
3512         "NOT Disabled"
3513 };
3514
3515 static const true_false_string flags_ace_sra_info_mandatory = {
3516         "Mandatory",
3517         "NOT Mandatory"
3518 };
3519
3520 #define APPEND_ACE_TEXT(flag, item, string) \
3521         if(flag){                                                       \
3522                 if(item)                                                \
3523                         proto_item_append_text(item, string, sep);      \
3524                 sep = ", ";                                             \
3525         }
3526
3527
3528 static int
3529 dissect_nt_ace_object(tvbuff_t *tvb, int offset, proto_tree *parent_tree)
3530 {
3531         proto_item *item;
3532         proto_tree *tree;
3533         proto_item *flags_item;
3534         uint32_t flags;
3535         int old_offset=offset;
3536         const char *sep = " ";
3537         static int * const ace_flags[] = {
3538                 &hf_nt_ace_flags_object_type_present,
3539                 &hf_nt_ace_flags_inherited_object_type_present,
3540                 NULL
3541         };
3542
3543         tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
3544                                            ett_nt_ace_object, &item, "ACE Object");
3545
3546         /* flags */
3547         flags=tvb_get_letohl(tvb, offset);
3548         flags_item = proto_tree_add_bitmask(tree, tvb, offset, hf_nt_ace_flags_object,
3549                                            ett_nt_ace_object_flags, ace_flags, ENC_LITTLE_ENDIAN);
3550
3551         APPEND_ACE_TEXT(flags&0x00000001, flags_item, "%sObject Type Present");
3552         APPEND_ACE_TEXT(flags&0x00000002, flags_item, "%sInherited Object Type Present");
3553         offset+=4;
3554
3555
3556         /* is there a GUID ? */
3557         if(flags&0x00000001){
3558                 proto_tree_add_item(tree, hf_nt_ace_guid, tvb, offset, 16, ENC_LITTLE_ENDIAN);
3559                 offset+=16;
3560         }
3561
3562         /* is there an inherited GUID ? */
3563         if(flags&0x00000002){
3564                 proto_tree_add_item(tree, hf_nt_ace_inherited_guid, tvb, offset, 16, ENC_LITTLE_ENDIAN);
3565                 offset+=16;
3566         }
3567
3568         proto_item_set_len(item, offset-old_offset);
3569         return offset;
3570 }
3571
3572 static int
3573 dissect_nt_v2_ace_flags(tvbuff_t *tvb, int offset, proto_tree *parent_tree,
3574                         uint8_t *data)
3575 {
3576         proto_item *item = NULL;
3577         uint8_t mask;
3578         const char *sep = " ";
3579         static int * const ace_flags[] = {
3580                 &hf_nt_ace_flags_failed_access,
3581                 &hf_nt_ace_flags_successful_access,
3582                 &hf_nt_ace_flags_inherited_ace,
3583                 &hf_nt_ace_flags_inherit_only,
3584                 &hf_nt_ace_flags_non_propagate_inherit,
3585                 &hf_nt_ace_flags_container_inherit,
3586                 &hf_nt_ace_flags_object_inherit,
3587                 NULL
3588         };
3589
3590         mask = tvb_get_uint8(tvb, offset);
3591
3592         if (data)
3593                 *data = mask;
3594
3595         item = proto_tree_add_bitmask(parent_tree, tvb, offset, hf_nt_ace_flags,
3596                                            ett_nt_ace_flags, ace_flags, ENC_NA);
3597
3598         APPEND_ACE_TEXT(mask&0x80, item, "%sFailed Access");
3599         APPEND_ACE_TEXT(mask&0x40, item, "%sSuccessful Access");
3600         APPEND_ACE_TEXT(mask&0x10, item, "%sInherited ACE");
3601         APPEND_ACE_TEXT(mask&0x08, item, "%sInherit Only");
3602         APPEND_ACE_TEXT(mask&0x04, item, "%sNo Propagate Inherit");
3603         APPEND_ACE_TEXT(mask&0x02, item, "%sContainer Inherit");
3604         APPEND_ACE_TEXT(mask&0x01, item, "%sObject Inherit");
3605
3606
3607         offset += 1;
3608         return offset;
3609 }
3610
3611 static int
3612 dissect_nt_v2_ace(tvbuff_t *tvb, int offset, packet_info *pinfo,
3613                   proto_tree *parent_tree, uint8_t *drep,
3614                   struct access_mask_info *ami)
3615 {
3616         proto_item *item;
3617         proto_tree *tree;
3618         int old_offset = offset;
3619         char *sid_str = NULL;
3620         uint16_t size;
3621         uint16_t data_size;
3622         uint8_t type;
3623         uint8_t flags;
3624         uint32_t perms = 0;
3625
3626         tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
3627                                            ett_nt_ace, &item, "NT ACE: ");
3628
3629         /* type */
3630         type = tvb_get_uint8(tvb, offset);
3631         proto_tree_add_uint(tree, hf_nt_ace_type, tvb, offset, 1, type);
3632         offset += 1;
3633
3634         /* flags */
3635         offset = dissect_nt_v2_ace_flags(tvb, offset, tree, &flags);
3636
3637         /* size */
3638         size = tvb_get_letohs(tvb, offset);
3639         if (size < 4) {
3640                 /*
3641                  * BOGUS - the size includes the ACE header length,
3642                  * which is 4.
3643                  */
3644                 proto_tree_add_uint_format_value(tree, hf_nt_ace_size, tvb, offset, 2,
3645                     size, "%u (bogus, must be >= 4)", size);
3646                 return old_offset;      /* our caller quits in this case */
3647         }
3648         proto_tree_add_uint(tree, hf_nt_ace_size, tvb, offset, 2, size);
3649         offset += 2;
3650
3651         /* some ACE types we not yet handle store other things than access mask
3652          * and SID in here.
3653          * sometimes things that are not related at all to access control.
3654          *    naughty naughty.    -- ronnie
3655          */
3656         switch(type){
3657         case ACE_TYPE_ACCESS_ALLOWED:
3658         case ACE_TYPE_ACCESS_DENIED:
3659         case ACE_TYPE_SYSTEM_AUDIT:
3660         case ACE_TYPE_SYSTEM_ALARM:
3661         case ACE_TYPE_ALLOWED_COMPOUND:
3662         case ACE_TYPE_ACCESS_ALLOWED_OBJECT:
3663         case ACE_TYPE_ACCESS_DENIED_OBJECT:
3664         case ACE_TYPE_SYSTEM_AUDIT_OBJECT:
3665         case ACE_TYPE_SYSTEM_ALARM_OBJECT:
3666         case ACE_TYPE_ACCESS_ALLOWED_CALLBACK:
3667         case ACE_TYPE_ACCESS_DENIED_CALLBACK:
3668         case ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
3669         case ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
3670         case ACE_TYPE_SYSTEM_AUDIT_CALLBACK:
3671         case ACE_TYPE_SYSTEM_ALARM_CALLBACK:
3672         case ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
3673         case ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT:
3674         case ACE_TYPE_SYSTEM_MANDATORY_LABEL:
3675         case ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE:
3676         case ACE_TYPE_SYSTEM_SCOPED_POLICY_ID:
3677                 /* access mask */
3678                 offset = dissect_nt_access_mask(
3679                         tvb, offset, pinfo, tree, NULL, drep,
3680                         hf_nt_access_mask, ami, &perms);
3681
3682                 /* these aces contain an extra object */
3683                 switch(type){
3684                 case ACE_TYPE_ACCESS_ALLOWED_OBJECT:
3685                 case ACE_TYPE_ACCESS_DENIED_OBJECT:
3686                 case ACE_TYPE_SYSTEM_AUDIT_OBJECT:
3687                 case ACE_TYPE_SYSTEM_ALARM_OBJECT:
3688                 case ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
3689                 case ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
3690                 case ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
3691                 case ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT:
3692                         offset=dissect_nt_ace_object(tvb, offset, tree);
3693                 }
3694
3695                 /* SID */
3696                 offset = dissect_nt_sid(tvb, offset, tree, "SID", &sid_str, -1);
3697
3698                 if (item)
3699                         proto_item_append_text(
3700                                 item, "%s, flags 0x%02x, %s, mask 0x%08x", sid_str, flags,
3701                                 val_to_str(type, ace_type_vals, "Unknown ACE type (0x%02x)"),
3702                                 perms);
3703
3704                 data_size = size - (offset - old_offset);
3705
3706                 /* Dissect Dynamic Access Control related ACE types
3707                    (if present). That is, Conditional ACE and Resource
3708                    Attributes. See [MS-DTYP] v20180912 section 2.4.4.17 */
3709                 switch (type) {
3710                     case ACE_TYPE_ACCESS_ALLOWED_CALLBACK:
3711                     case ACE_TYPE_ACCESS_DENIED_CALLBACK:
3712                     case ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
3713                     case ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
3714                     case ACE_TYPE_SYSTEM_AUDIT_CALLBACK:
3715                     case ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
3716                         dissect_nt_conditional_ace(tvb, pinfo, offset, data_size, tree);
3717                         break;
3718
3719                     case ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE:
3720                         dissect_nt_ace_system_resource_attribute(tvb, offset, data_size, tree);
3721                         break;
3722                 }
3723                 break;
3724         };
3725
3726         proto_item_set_len(item, offset-old_offset);
3727
3728         /* Sometimes there is some spare space at the end of the ACE so use
3729            the size field to work out where the end is. */
3730
3731         return old_offset + size;
3732 }
3733
3734 static int
3735 dissect_nt_acl(tvbuff_t *tvb, int offset_a, packet_info *pinfo,
3736                proto_tree *parent_tree, uint8_t *drep, const char *name,
3737                struct access_mask_info *ami)
3738 {
3739         proto_item *item;
3740         proto_tree *tree;
3741         int old_offset = offset_a;
3742         int pre_ace_offset;
3743         uint16_t revision;
3744         uint32_t num_aces;
3745         volatile int offset_v = offset_a;
3746         volatile bool missing_data = false;
3747         volatile bool bad_ace = false;
3748
3749         tree = proto_tree_add_subtree_format(parent_tree, tvb, offset_v, -1,
3750                                            ett_nt_acl, &item, "NT %s ACL", name);
3751
3752         /* revision */
3753         /*
3754          * XXX - is this *really* 2 bytes?  The page at
3755          *
3756          *      https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-_acl
3757          *
3758          * indicates that it's one byte of revision and one byte of
3759          * zero padding, which means the code that used to be here
3760          * was correct - and this code would give the same results
3761          * as long as the padding is zero, so if this dissects it
3762          * correctly when the padding is zero, and the padding is
3763          * always zero, the old code would dissect it correctly
3764          * also.
3765          */
3766         revision = tvb_get_letohs(tvb, offset_v);
3767         proto_tree_add_uint(tree, hf_nt_acl_revision,
3768                 tvb, offset_v, 2, revision);
3769         offset_v += 2;
3770
3771         switch(revision){
3772         case ACL_REVISION_NT4:
3773         case ACL_REVISION_ADS:
3774         case 3:  /* weirdo type */
3775           /* size */
3776           proto_tree_add_item(tree, hf_nt_acl_size, tvb, offset_v, 2, ENC_LITTLE_ENDIAN);
3777           offset_v += 2;
3778
3779           /* number of ace structures */
3780           /*
3781            * XXX - is this *really* 4 bytes?  The page referred to above
3782            * says it's 2 bytes of count followed by two bytes of
3783            * zero padding.
3784            */
3785           num_aces = tvb_get_letohl(tvb, offset_v);
3786           proto_tree_add_uint(tree, hf_nt_acl_num_aces,
3787                               tvb, offset_v, 4, num_aces);
3788           offset_v += 4;
3789
3790           while(num_aces-- && !missing_data && !bad_ace) {
3791                 pre_ace_offset = offset_v;
3792
3793                 /*
3794                  * These are at an offset_v later in the packet; don't
3795                  * fail if we can't fetch them, just note the problem
3796                  * and dissect the stuff before it.
3797                  */
3798                 TRY {
3799                   offset_v = dissect_nt_v2_ace(tvb, offset_v, pinfo, tree, drep, ami);
3800                   if (pre_ace_offset == offset_v) {
3801                         /*
3802                          * Bogus ACE, with a length < 4.
3803                          */
3804                         bad_ace = true;
3805                   }
3806                 }
3807
3808                 CATCH(ContainedBoundsError) {
3809                         proto_tree_add_expert(tree, pinfo, &ei_nt_ace_extends_beyond_data, tvb, offset_v, 0);
3810                         missing_data = true;
3811                 }
3812
3813                 CATCH(ReportedBoundsError) {
3814                         proto_tree_add_expert(tree, pinfo, &ei_nt_ace_extends_beyond_reassembled_data, tvb, offset_v, 0);
3815                         missing_data = true;
3816                 }
3817
3818                 ENDTRY;
3819           }
3820         }
3821
3822         proto_item_set_len(item, offset_v-old_offset);
3823         return offset_v;
3824 }
3825
3826 static const true_false_string tfs_sec_desc_type_owner_defaulted = {
3827         "OWNER is DEFAULTED",
3828         "Owner is NOT defaulted"
3829 };
3830 static const true_false_string tfs_sec_desc_type_group_defaulted = {
3831         "GROUP is DEFAULTED",
3832         "Group is NOT defaulted"
3833 };
3834 static const true_false_string tfs_sec_desc_type_dacl_present = {
3835         "DACL is PRESENT",
3836         "DACL is NOT present"
3837 };
3838 static const true_false_string tfs_sec_desc_type_dacl_defaulted = {
3839         "DACL is DEFAULTED",
3840         "DACL is NOT defaulted"
3841 };
3842 static const true_false_string tfs_sec_desc_type_sacl_present = {
3843         "SACL is PRESENT",
3844         "SACL is NOT present"
3845 };
3846 static const true_false_string tfs_sec_desc_type_sacl_defaulted = {
3847         "SACL is DEFAULTED",
3848         "SACL is NOT defaulted"
3849 };
3850 static const true_false_string tfs_sec_desc_type_dacl_trusted = {
3851         "DACL TRUSTED is TRUE",
3852         "Dacl trusted is FALSE"
3853 };
3854 static const true_false_string tfs_sec_desc_type_server_security = {
3855         "SERVER SECURITY is TRUE",
3856         "Server security is FALSE"
3857 };
3858 static const true_false_string tfs_sec_desc_type_dacl_auto_inherit_req = {
3859         "DACL has AUTO INHERIT REQUIRED",
3860         "DACL does NOT require auto inherit"
3861 };
3862 static const true_false_string tfs_sec_desc_type_sacl_auto_inherit_req = {
3863         "SACL has AUTO INHERIT REQUIRED",
3864         "SACL does NOT require auto inherit"
3865 };
3866 static const true_false_string tfs_sec_desc_type_dacl_auto_inherited = {
3867         "DACL is AUTO INHERITED",
3868         "DACL is NOT auto inherited"
3869 };
3870 static const true_false_string tfs_sec_desc_type_sacl_auto_inherited = {
3871         "SACL is AUTO INHERITED",
3872         "SACL is NOT auto inherited"
3873 };
3874 static const true_false_string tfs_sec_desc_type_dacl_protected = {
3875         "The DACL is PROTECTED",
3876         "The DACL is NOT protected"
3877 };
3878 static const true_false_string tfs_sec_desc_type_sacl_protected = {
3879         "The SACL is PROTECTED",
3880         "The SACL is NOT protected"
3881 };
3882 static const true_false_string tfs_sec_desc_type_rm_control_valid = {
3883         "Rm control valid is TRUE",
3884         "Rm control valid is FALSE"
3885 };
3886 static const true_false_string tfs_sec_desc_type_self_relative = {
3887         "This SecDesc is SELF RELATIVE",
3888         "This SecDesc is NOT self relative"
3889 };
3890
3891
3892 static int
3893 dissect_nt_sec_desc_type(tvbuff_t *tvb, int offset, proto_tree *parent_tree)
3894 {
3895         static int * const flags[] = {
3896                 &hf_nt_sec_desc_type_self_relative,
3897                 &hf_nt_sec_desc_type_rm_control_valid,
3898                 &hf_nt_sec_desc_type_sacl_protected,
3899                 &hf_nt_sec_desc_type_dacl_protected,
3900                 &hf_nt_sec_desc_type_sacl_auto_inherited,
3901                 &hf_nt_sec_desc_type_dacl_auto_inherited,
3902                 &hf_nt_sec_desc_type_sacl_auto_inherit_req,
3903                 &hf_nt_sec_desc_type_dacl_auto_inherit_req,
3904                 &hf_nt_sec_desc_type_server_security,
3905                 &hf_nt_sec_desc_type_dacl_trusted,
3906                 &hf_nt_sec_desc_type_sacl_defaulted,
3907                 &hf_nt_sec_desc_type_sacl_present,
3908                 &hf_nt_sec_desc_type_dacl_defaulted,
3909                 &hf_nt_sec_desc_type_dacl_present,
3910                 &hf_nt_sec_desc_type_group_defaulted,
3911                 &hf_nt_sec_desc_type_owner_defaulted,
3912                 NULL
3913         };
3914
3915         proto_tree_add_bitmask(parent_tree, tvb, offset, hf_nt_sec_desc_type,
3916                                            ett_nt_sec_desc_type, flags, ENC_LITTLE_ENDIAN);
3917
3918         offset += 2;
3919         return offset;
3920 }
3921
3922 int
3923 dissect_nt_security_information(tvbuff_t *tvb, int offset, proto_tree *parent_tree)
3924 {
3925         proto_item *item = NULL;
3926         uint32_t mask;
3927         static int * const flags[] = {
3928                 &hf_nt_security_information_sacl,
3929                 &hf_nt_security_information_dacl,
3930                 &hf_nt_security_information_group,
3931                 &hf_nt_security_information_owner,
3932                 NULL
3933         };
3934
3935         mask = tvb_get_letohl(tvb, offset);
3936         item = proto_tree_add_bitmask(parent_tree, tvb, offset, hf_nt_security_information,
3937                                            ett_nt_security_information, flags, ENC_LITTLE_ENDIAN);
3938
3939         if (mask & 0x00000008) {
3940                 proto_item_append_text(item, " SACL");
3941         }
3942         if (mask & 0x00000004) {
3943                 proto_item_append_text(item, " DACL");
3944         }
3945         if (mask & 0x00000002) {
3946                 proto_item_append_text(item, " GROUP");
3947         }
3948         if (mask & 0x00000001) {
3949                 proto_item_append_text(item, " OWNER");
3950         }
3951
3952         offset += 4;
3953
3954         return offset;
3955 }
3956
3957 int
3958 dissect_nt_sec_desc(tvbuff_t *tvb, int offset_a, packet_info *pinfo,
3959                     proto_tree *parent_tree, uint8_t *drep,
3960                     bool len_supplied _U_, int len,
3961                     struct access_mask_info *ami)
3962 {
3963         proto_item *item = NULL;
3964         proto_tree * volatile tree = NULL;
3965         uint16_t revision;
3966         int start_offset = offset_a;
3967         volatile int offset_v=offset_a;
3968         volatile int end_offset;
3969         volatile int item_offset;
3970         uint32_t owner_sid_offset;
3971         proto_item *it_owner_sid_offs = NULL;
3972         volatile uint32_t group_sid_offset;
3973         proto_item * volatile it_gr_sid_offs = NULL;
3974         volatile uint32_t sacl_offset;
3975         proto_item * volatile it_sacl_offs = NULL;
3976         volatile uint32_t dacl_offset;
3977         proto_item * volatile it_dacl_offs = NULL;
3978
3979         tree = proto_tree_add_subtree(parent_tree, tvb, offset_v, -1,
3980                                    ett_nt_sec_desc, &item, "NT Security Descriptor");
3981
3982         /* revision */
3983         revision = tvb_get_letohs(tvb, offset_v);
3984         proto_tree_add_uint(tree, hf_nt_sec_desc_revision,
3985                 tvb, offset_v, 2, revision);
3986         offset_v += 2;
3987
3988         switch(revision){
3989         case 1:  /* only version we will ever see of this structure?*/
3990           /* type */
3991           offset_v = dissect_nt_sec_desc_type(tvb, offset_v, tree);
3992
3993           /* offset_v to owner sid */
3994           owner_sid_offset = tvb_get_letohl(tvb, offset_v);
3995           if(owner_sid_offset != 0 && owner_sid_offset < 20){
3996             /* Bogus value - points into fixed portion of descriptor */
3997             proto_tree_add_uint_format_value(tree, hf_nt_offset_to_owner_sid, tvb, offset_v, 4, owner_sid_offset, "%u (bogus, must be >= 20)", owner_sid_offset);
3998             owner_sid_offset = 0;
3999           } else
4000             it_owner_sid_offs = proto_tree_add_item(tree, hf_nt_offset_to_owner_sid, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4001           offset_v += 4;
4002
4003           /* offset to group sid */
4004           group_sid_offset = tvb_get_letohl(tvb, offset_v);
4005           if(group_sid_offset != 0 && group_sid_offset < 20){
4006             /* Bogus value - points into fixed portion of descriptor */
4007             proto_tree_add_uint_format_value(tree, hf_nt_offset_to_group_sid, tvb, offset_v, 4, group_sid_offset, "%u (bogus, must be >= 20)", group_sid_offset);
4008             group_sid_offset = 0;
4009           } else
4010             it_gr_sid_offs = proto_tree_add_item(tree, hf_nt_offset_to_group_sid, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4011           offset_v += 4;
4012
4013           /* offset to sacl */
4014           sacl_offset = tvb_get_letohl(tvb, offset_v);
4015           if(sacl_offset != 0 && sacl_offset < 20){
4016             /* Bogus value - points into fixed portion of descriptor */
4017             proto_tree_add_uint_format_value(tree, hf_nt_offset_to_sacl, tvb, offset_v, 4, sacl_offset, "%u (bogus, must be >= 20)", sacl_offset);
4018             sacl_offset = 0;
4019           } else
4020             it_sacl_offs = proto_tree_add_item(tree, hf_nt_offset_to_sacl, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4021           offset_v += 4;
4022
4023           /* offset to dacl */
4024           dacl_offset = tvb_get_letohl(tvb, offset_v);
4025           if(dacl_offset != 0 && dacl_offset < 20){
4026             /* Bogus value - points into fixed portion of descriptor */
4027             proto_tree_add_uint_format_value(tree, hf_nt_offset_to_dacl, tvb, offset_v, 4, dacl_offset, "%u (bogus, must be >= 20)", dacl_offset);
4028             dacl_offset = 0;
4029           } else
4030             it_dacl_offs = proto_tree_add_item(tree, hf_nt_offset_to_dacl, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4031           offset_v += 4;
4032
4033           end_offset = offset_v;
4034
4035           /*owner SID*/
4036           if(owner_sid_offset){
4037             item_offset = start_offset+owner_sid_offset;
4038             if (item_offset < start_offset) {
4039                     expert_add_info(pinfo, it_owner_sid_offs,
4040                                     &ei_nt_item_offs_out_of_range);
4041                     break;
4042             }
4043             TRY{
4044               offset_v = dissect_nt_sid(tvb, item_offset, tree, "Owner", NULL, -1);
4045               if (offset_v > end_offset)
4046                 end_offset = offset_v;
4047             }
4048
4049             CATCH(ContainedBoundsError) {
4050               proto_tree_add_expert(tree, pinfo, &ei_nt_owner_sid_beyond_data, tvb, item_offset, 0);
4051             }
4052
4053             CATCH(ReportedBoundsError) {
4054               proto_tree_add_expert(tree, pinfo, &ei_nt_owner_sid_beyond_reassembled_data, tvb, item_offset, 0);
4055             }
4056
4057             ENDTRY;
4058           }
4059
4060           /*group SID*/
4061           if(group_sid_offset){
4062             item_offset = start_offset+group_sid_offset;
4063             if (item_offset < start_offset) {
4064                     expert_add_info(pinfo, it_gr_sid_offs,
4065                                     &ei_nt_item_offs_out_of_range);
4066                     break;
4067             }
4068             TRY {
4069               offset_v = dissect_nt_sid(tvb, item_offset, tree, "Group", NULL, -1);
4070               if (offset_v > end_offset)
4071                 end_offset = offset_v;
4072             }
4073
4074             CATCH(ContainedBoundsError) {
4075               proto_tree_add_expert(tree, pinfo, &ei_nt_group_sid_beyond_data, tvb, item_offset, 0);
4076             }
4077
4078             CATCH(ReportedBoundsError) {
4079               proto_tree_add_expert(tree, pinfo, &ei_nt_group_sid_beyond_reassembled_data, tvb, item_offset, 0);
4080             }
4081
4082             ENDTRY;
4083           }
4084
4085           /* sacl */
4086           if(sacl_offset){
4087             item_offset = start_offset+sacl_offset;
4088             if (item_offset < start_offset) {
4089                     expert_add_info(pinfo, it_sacl_offs,
4090                                     &ei_nt_item_offs_out_of_range);
4091                     break;
4092             }
4093             offset_v = dissect_nt_acl(tvb, item_offset, pinfo, tree,
4094                                     drep, "System (SACL)", ami);
4095             if (offset_v > end_offset)
4096               end_offset = offset_v;
4097           }
4098
4099           /* dacl */
4100           if(dacl_offset){
4101             item_offset = start_offset+dacl_offset;
4102             if (item_offset < start_offset) {
4103                     expert_add_info(pinfo, it_dacl_offs,
4104                                     &ei_nt_item_offs_out_of_range);
4105                     break;
4106             }
4107             offset_v = dissect_nt_acl(tvb, item_offset, pinfo, tree,
4108                                     drep, "User (DACL)", ami);
4109             if (offset_v > end_offset)
4110               end_offset = offset_v;
4111           }
4112
4113           break;
4114
4115         default:
4116           end_offset = offset_v;
4117           break;
4118         }
4119
4120         len = end_offset - start_offset;
4121         proto_item_set_len(item, len);
4122
4123         return offset_v;
4124 }
4125
4126 /*
4127  * XXX - we should have a way to register fields not associated with a
4128  * protocol.
4129  *
4130  * XXX - make-reg-dotc.py doesn't check for an argument list of "(void)",
4131  * so we have to give this a name other than "proto_register_..." so that
4132  * it doesn't end up being called from "register.c".
4133  */
4134 void
4135 proto_do_register_windows_common(int proto_smb)
4136 {
4137         static hf_register_info hf[] = {
4138                 /* Security descriptors */
4139
4140                 { &hf_nt_sec_desc_revision,
4141                   { "Revision", "nt.sec_desc.revision", FT_UINT16, BASE_DEC,
4142                     NULL, 0, "Version of NT Security Descriptor structure", HFILL }},
4143
4144                 { &hf_nt_sec_desc_type_owner_defaulted,
4145                   { "Owner Defaulted", "nt.sec_desc.type.owner_defaulted", FT_BOOLEAN, 16,
4146                     TFS(&tfs_sec_desc_type_owner_defaulted), 0x0001, "Is Owner Defaulted set?", HFILL }},
4147
4148                 { &hf_nt_sec_desc_type_group_defaulted,
4149                   { "Group Defaulted", "nt.sec_desc.type.group_defaulted", FT_BOOLEAN, 16,
4150                     TFS(&tfs_sec_desc_type_group_defaulted), 0x0002, "Is Group Defaulted?", HFILL }},
4151
4152                 { &hf_nt_sec_desc_type_dacl_present,
4153                   { "DACL Present", "nt.sec_desc.type.dacl_present", FT_BOOLEAN, 16,
4154                     TFS(&tfs_sec_desc_type_dacl_present), 0x0004, "Does this SecDesc have DACL present?", HFILL }},
4155
4156                 { &hf_nt_sec_desc_type_dacl_defaulted,
4157                   { "DACL Defaulted", "nt.sec_desc.type.dacl_defaulted", FT_BOOLEAN, 16,
4158                     TFS(&tfs_sec_desc_type_dacl_defaulted), 0x0008, "Does this SecDesc have DACL Defaulted?", HFILL }},
4159
4160                 { &hf_nt_sec_desc_type_sacl_present,
4161                   { "SACL Present", "nt.sec_desc.type.sacl_present", FT_BOOLEAN, 16,
4162                     TFS(&tfs_sec_desc_type_sacl_present), 0x0010, "Is the SACL present?", HFILL }},
4163
4164                 { &hf_nt_sec_desc_type_sacl_defaulted,
4165                   { "SACL Defaulted", "nt.sec_desc.type.sacl_defaulted", FT_BOOLEAN, 16,
4166                     TFS(&tfs_sec_desc_type_sacl_defaulted), 0x0020, "Does this SecDesc have SACL Defaulted?", HFILL }},
4167
4168                 { &hf_nt_sec_desc_type_dacl_auto_inherit_req,
4169                   { "DACL Auto Inherit Required", "nt.sec_desc.type.dacl_auto_inherit_req", FT_BOOLEAN, 16,
4170                     TFS(&tfs_sec_desc_type_dacl_auto_inherit_req), 0x0100, "Does this SecDesc have DACL Auto Inherit Required set?", HFILL }},
4171
4172                 { &hf_nt_sec_desc_type_dacl_trusted,
4173                   { "DACL Trusted", "nt.sec_desc.type.dacl_trusted", FT_BOOLEAN, 16,
4174                     TFS(&tfs_sec_desc_type_dacl_trusted), 0x0040, "Does this SecDesc have DACL TRUSTED set?", HFILL }},
4175
4176                 { &hf_nt_sec_desc_type_server_security,
4177                   { "Server Security", "nt.sec_desc.type.server_security", FT_BOOLEAN, 16,
4178                     TFS(&tfs_sec_desc_type_server_security), 0x0080, "Does this SecDesc have SERVER SECURITY set?", HFILL }},
4179
4180                 { &hf_nt_sec_desc_type_sacl_auto_inherit_req,
4181                   { "SACL Auto Inherit Required", "nt.sec_desc.type.sacl_auto_inherit_req", FT_BOOLEAN, 16,
4182                     TFS(&tfs_sec_desc_type_sacl_auto_inherit_req), 0x0200, "Does this SecDesc have SACL Auto Inherit Required set?", HFILL }},
4183
4184                 { &hf_nt_sec_desc_type_dacl_auto_inherited,
4185                   { "DACL Auto Inherited", "nt.sec_desc.type.dacl_auto_inherited", FT_BOOLEAN, 16,
4186                     TFS(&tfs_sec_desc_type_dacl_auto_inherited), 0x0400, "Is this DACL auto inherited", HFILL }},
4187
4188                 { &hf_nt_sec_desc_type_sacl_auto_inherited,
4189                   { "SACL Auto Inherited", "nt.sec_desc.type.sacl_auto_inherited", FT_BOOLEAN, 16,
4190                     TFS(&tfs_sec_desc_type_sacl_auto_inherited), 0x0800, "Is this SACL auto inherited", HFILL }},
4191
4192                 { &hf_nt_sec_desc_type_dacl_protected,
4193                   { "DACL Protected", "nt.sec_desc.type.dacl_protected", FT_BOOLEAN, 16,
4194                     TFS(&tfs_sec_desc_type_dacl_protected), 0x1000, "Is the DACL structure protected?", HFILL }},
4195
4196                 { &hf_nt_sec_desc_type_sacl_protected,
4197                   { "SACL Protected", "nt.sec_desc.type.sacl_protected", FT_BOOLEAN, 16,
4198                     TFS(&tfs_sec_desc_type_sacl_protected), 0x2000, "Is the SACL structure protected?", HFILL }},
4199
4200                 { &hf_nt_sec_desc_type_self_relative,
4201                   { "Self Relative", "nt.sec_desc.type.self_relative", FT_BOOLEAN, 16,
4202                     TFS(&tfs_sec_desc_type_self_relative), 0x8000, "Is this SecDesc self relative?", HFILL }},
4203
4204                 { &hf_nt_sec_desc_type_rm_control_valid,
4205                   { "RM Control Valid", "nt.sec_desc.type.rm_control_valid", FT_BOOLEAN, 16,
4206                     TFS(&tfs_sec_desc_type_rm_control_valid), 0x4000, "Is RM Control Valid set?", HFILL }},
4207
4208                 /* SIDs */
4209
4210                 { &hf_nt_sid,
4211                   { "SID", "nt.sid", FT_STRING, BASE_NONE,
4212                     NULL, 0, "SID: Security Identifier", HFILL }},
4213
4214                 { &hf_nt_sid_revision,
4215                   { "Revision", "nt.sid.revision", FT_UINT8, BASE_DEC,
4216                     NULL, 0, "Version of SID structure", HFILL }},
4217
4218                 { &hf_nt_sid_num_auth,
4219                   { "Num Auth", "nt.sid.num_auth", FT_UINT8, BASE_DEC,
4220                     NULL, 0, "Number of authorities for this SID", HFILL }},
4221
4222                 { &hf_nt_sid_auth_dec,
4223                   { "Authority", "nt.sid.auth", FT_UINT64, BASE_DEC,
4224                     NULL, 0, "Identifier Authority", HFILL }},
4225
4226                 { &hf_nt_sid_auth_hex,
4227                   { "Authority", "nt.sid.auth", FT_UINT64, BASE_HEX,
4228                     NULL, 0, "Identifier Authority", HFILL }},
4229
4230                 { &hf_nt_sid_subauth,
4231                   { "Subauthorities", "nt.sid.subauth", FT_STRING, BASE_NONE,
4232                   NULL, 0, "Subauthorities fields", HFILL }},
4233
4234                 { &hf_nt_sid_rid_dec,
4235                   { "RID", "nt.sid.rid", FT_UINT32, BASE_DEC,
4236                   NULL, 0, "Relative IDentifier: identifies a user or group", HFILL }},
4237
4238                 { &hf_nt_sid_rid_hex,
4239                   { "RID", "nt.sid.rid", FT_UINT32, BASE_HEX,
4240                   NULL, 0, "Relative IDentifier: identifies a user or group", HFILL }},
4241
4242                 { &hf_nt_sid_wkwn,
4243                   { "Well-known SID", "nt.sid.wkwn", FT_STRING, BASE_NONE,
4244                   NULL, 0, NULL, HFILL }},
4245
4246                 { &hf_nt_sid_domain,
4247                   { "Domain", "nt.sid.domain", FT_STRING, BASE_NONE,
4248                   NULL, 0, NULL, HFILL }},
4249
4250                 /* ACLs */
4251
4252                 { &hf_nt_acl_revision,
4253                   { "Revision", "nt.acl.revision", FT_UINT16, BASE_DEC,
4254                     VALS(acl_revision_vals), 0, "Version of NT ACL structure", HFILL }},
4255
4256                 { &hf_nt_acl_size,
4257                   { "Size", "nt.acl.size", FT_UINT16, BASE_DEC,
4258                     NULL, 0, "Size of NT ACL structure", HFILL }},
4259
4260                 { &hf_nt_acl_num_aces,
4261                   { "Num ACEs", "nt.acl.num_aces", FT_UINT32, BASE_DEC,
4262                     NULL, 0, "Number of ACE structures for this ACL", HFILL }},
4263
4264                 /* ACEs */
4265
4266                 { &hf_nt_ace_type,
4267                   { "Type", "nt.ace.type",
4268                     FT_UINT8, BASE_DEC, VALS(ace_type_vals), 0, "Type of ACE",
4269                     HFILL }},
4270
4271                 { &hf_nt_ace_size,
4272                   { "Size", "nt.ace.size", FT_UINT16, BASE_DEC, NULL, 0,
4273                     "Size of this ACE", HFILL }},
4274
4275                 { &hf_nt_ace_flags_object_inherit,
4276                   { "Object Inherit", "nt.ace.flags.object_inherit", FT_BOOLEAN, 8,
4277                     TFS(&tfs_ace_flags_object_inherit), 0x01, "Will subordinate files inherit this ACE?", HFILL }},
4278
4279                 { &hf_nt_ace_flags_container_inherit,
4280                   { "Container Inherit", "nt.ace.flags.container_inherit", FT_BOOLEAN, 8,
4281                     TFS(&tfs_ace_flags_container_inherit), 0x02, "Will subordinate containers inherit this ACE?", HFILL }},
4282
4283                 { &hf_nt_ace_flags_non_propagate_inherit,
4284                   { "Non-Propagate Inherit", "nt.ace.flags.non_propagate_inherit", FT_BOOLEAN, 8,
4285                     TFS(&tfs_ace_flags_non_propagate_inherit), 0x04, "Will subordinate object propagate this ACE further?", HFILL }},
4286
4287                 { &hf_nt_ace_flags_inherit_only,
4288                   { "Inherit Only", "nt.ace.flags.inherit_only", FT_BOOLEAN, 8,
4289                     TFS(&tfs_ace_flags_inherit_only), 0x08, "Does this ACE apply to the current object?", HFILL }},
4290
4291                 { &hf_nt_ace_flags_inherited_ace,
4292                   { "Inherited ACE", "nt.ace.flags.inherited_ace", FT_BOOLEAN, 8,
4293                     TFS(&tfs_ace_flags_inherited_ace), 0x10, "Was this ACE inherited from its parent object?", HFILL }},
4294
4295                 { &hf_nt_ace_flags_successful_access,
4296                   { "Audit Successful Accesses", "nt.ace.flags.successful_access", FT_BOOLEAN, 8,
4297                     TFS(&tfs_ace_flags_successful_access), 0x40, "Should successful accesses be audited?", HFILL }},
4298
4299                 { &hf_nt_ace_flags_failed_access,
4300                   { "Audit Failed Accesses", "nt.ace.flags.failed_access", FT_BOOLEAN, 8,
4301                     TFS(&tfs_ace_flags_failed_access), 0x80, "Should failed accesses be audited?", HFILL }},
4302
4303                 /* Access masks */
4304
4305                 { &hf_nt_access_mask,
4306                   { "Access required", "nt.access_mask",
4307                     FT_UINT32, BASE_HEX, NULL, 0x0, "Access mask",
4308                     HFILL }},
4309
4310                 { &hf_access_generic_read,
4311                   { "Generic read", "nt.access_mask.generic_read",
4312                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4313                     GENERIC_READ_ACCESS, NULL, HFILL }},
4314
4315                 { &hf_access_generic_write,
4316                   { "Generic write", "nt.access_mask.generic_write",
4317                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4318                     GENERIC_WRITE_ACCESS, NULL, HFILL }},
4319
4320                 { &hf_access_generic_execute,
4321                   { "Generic execute", "nt.access_mask.generic_execute",
4322                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4323                     GENERIC_EXECUTE_ACCESS, NULL, HFILL }},
4324
4325                 { &hf_access_generic_all,
4326                   { "Generic all", "nt.access_mask.generic_all",
4327                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4328                     GENERIC_ALL_ACCESS, NULL, HFILL }},
4329
4330                 { &hf_access_maximum_allowed,
4331                   { "Maximum allowed", "nt.access_mask.maximum_allowed",
4332                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4333                     MAXIMUM_ALLOWED_ACCESS, NULL, HFILL }},
4334
4335                 { &hf_access_sacl,
4336                   { "Access SACL", "nt.access_mask.access_sacl",
4337                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4338                     ACCESS_SACL_ACCESS, NULL, HFILL }},
4339
4340                 { &hf_access_standard_read_control,
4341                   { "Read control", "nt.access_mask.read_control",
4342                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4343                     READ_CONTROL_ACCESS, NULL, HFILL }},
4344
4345                 { &hf_access_standard_delete,
4346                   { "Delete", "nt.access_mask.delete",
4347                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4348                     DELETE_ACCESS, NULL, HFILL }},
4349
4350                 { &hf_access_standard_synchronise,
4351                   { "Synchronise", "nt.access_mask.synchronise",
4352                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4353                     SYNCHRONIZE_ACCESS, NULL, HFILL }},
4354
4355                 { &hf_access_standard_write_dac,
4356                   { "Write DAC", "nt.access_mask.write_dac",
4357                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4358                     WRITE_DAC_ACCESS, NULL, HFILL }},
4359
4360                 { &hf_access_standard_write_owner,
4361                   { "Write owner", "nt.access_mask.write_owner",
4362                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4363                     WRITE_OWNER_ACCESS, NULL, HFILL }},
4364
4365                 { &hf_access_specific_15,
4366                   { "Specific access, bit 15", "nt.access_mask.specific_15",
4367                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4368                     0x00008000, NULL, HFILL }},
4369
4370                 { &hf_access_specific_14,
4371                   { "Specific access, bit 14", "nt.access_mask.specific_14",
4372                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4373                     0x00004000, NULL, HFILL }},
4374
4375                 { &hf_access_specific_13,
4376                   { "Specific access, bit 13", "nt.access_mask.specific_13",
4377                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4378                     0x00002000, NULL, HFILL }},
4379
4380                 { &hf_access_specific_12,
4381                   { "Specific access, bit 12", "nt.access_mask.specific_12",
4382                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4383                     0x00001000, NULL, HFILL }},
4384
4385                 { &hf_access_specific_11,
4386                   { "Specific access, bit 11", "nt.access_mask.specific_11",
4387                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4388                     0x00000800, NULL, HFILL }},
4389
4390                 { &hf_access_specific_10,
4391                   { "Specific access, bit 10", "nt.access_mask.specific_10",
4392                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4393                     0x00000400, NULL, HFILL }},
4394
4395                 { &hf_access_specific_9,
4396                   { "Specific access, bit 9", "nt.access_mask.specific_9",
4397                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4398                     0x00000200, NULL, HFILL }},
4399
4400                 { &hf_access_specific_8,
4401                   { "Specific access, bit 8", "nt.access_mask.specific_8",
4402                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4403                     0x00000100, NULL, HFILL }},
4404
4405                 { &hf_access_specific_7,
4406                   { "Specific access, bit 7", "nt.access_mask.specific_7",
4407                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4408                     0x00000080, NULL, HFILL }},
4409
4410                 { &hf_access_specific_6,
4411                   { "Specific access, bit 6", "nt.access_mask.specific_6",
4412                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4413                         0x00000040, NULL, HFILL }},
4414
4415                 { &hf_access_specific_5,
4416                   { "Specific access, bit 5", "nt.access_mask.specific_5",
4417                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4418                     0x00000020, NULL, HFILL }},
4419
4420                 { &hf_access_specific_4,
4421                   { "Specific access, bit 4", "nt.access_mask.specific_4",
4422                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4423                     0x00000010, NULL, HFILL }},
4424
4425                 { &hf_access_specific_3,
4426                   { "Specific access, bit 3", "nt.access_mask.specific_3",
4427                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4428                     0x00000008, NULL, HFILL }},
4429
4430                 { &hf_access_specific_2,
4431                   { "Specific access, bit 2", "nt.access_mask.specific_2",
4432                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4433                     0x00000004, NULL, HFILL }},
4434
4435                 { &hf_access_specific_1,
4436                   { "Specific access, bit 1", "nt.access_mask.specific_1",
4437                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4438                     0x00000002, NULL, HFILL }},
4439
4440                 { &hf_access_specific_0,
4441                   { "Specific access, bit 0", "nt.access_mask.specific_0",
4442                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4443                     0x00000001, NULL, HFILL }},
4444
4445                 { &hf_nt_ace_flags_object_type_present,
4446                   { "Object Type Present", "nt.ace.object.flags.object_type_present",
4447                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4448                     0x00000001, NULL, HFILL }},
4449
4450                 { &hf_nt_ace_flags_inherited_object_type_present,
4451                   { "Inherited Object Type Present", "nt.ace.object.flags.inherited_object_type_present",
4452                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4453                     0x00000002, NULL, HFILL }},
4454
4455                 { &hf_nt_ace_guid,
4456                   { "GUID", "nt.ace.object.guid", FT_GUID, BASE_NONE,
4457                     NULL, 0, NULL, HFILL }},
4458
4459                 { &hf_nt_ace_inherited_guid,
4460                   { "Inherited GUID", "nt.ace.object.inherited_guid", FT_GUID, BASE_NONE,
4461                     NULL, 0, NULL, HFILL }},
4462
4463                 { &hf_nt_ace_cond,
4464                   { "Conditional Expression", "nt.ace.cond", FT_NONE, BASE_NONE,
4465                     NULL, 0, NULL, HFILL }},
4466
4467                 { &hf_nt_ace_cond_token,
4468                   { "Token", "nt.ace.cond.token",
4469                     FT_UINT8, BASE_HEX, VALS(ace_cond_token_vals), 0, "Type of Token",
4470                     HFILL }},
4471
4472                 { &hf_nt_ace_cond_sign,
4473                   { "SIGN", "nt.ace.cond.sign",
4474                     FT_UINT8, BASE_HEX, VALS(ace_cond_sign_vals), 0,
4475                     NULL, HFILL }},
4476
4477                 { &hf_nt_ace_cond_base,
4478                   { "BASE", "nt.ace.cond.base",
4479                     FT_UINT8, BASE_HEX, VALS(ace_cond_base_vals), 0,
4480                     NULL, HFILL }},
4481
4482                 { &hf_nt_ace_cond_value_int8,
4483                   { "INT8", "nt.ace.cond.value_int8", FT_INT8, BASE_DEC,
4484                     NULL, 0, NULL, HFILL }},
4485
4486                 { &hf_nt_ace_cond_value_int16,
4487                   { "INT16", "nt.ace.cond.value_int16", FT_INT16, BASE_DEC,
4488                     NULL, 0, NULL, HFILL }},
4489
4490                 { &hf_nt_ace_cond_value_int32,
4491                   { "INT32", "nt.ace.cond.value_int32", FT_INT32, BASE_DEC,
4492                     NULL, 0, NULL, HFILL }},
4493
4494                 { &hf_nt_ace_cond_value_int64,
4495                   { "INT64", "nt.ace.cond.value_int64", FT_INT64, BASE_DEC,
4496                     NULL, 0, NULL, HFILL }},
4497
4498                 { &hf_nt_ace_cond_value_string,
4499                   { "UNICODE_STRING", "nt.ace.cond.value_string", FT_STRING, BASE_NONE,
4500                     NULL, 0, NULL, HFILL }},
4501
4502                 { &hf_nt_ace_cond_value_octet_string,
4503                   { "OCTET_STRING", "nt.ace.cond.value_octet_string", FT_BYTES, BASE_NONE,
4504                     NULL, 0x0, NULL, HFILL }},
4505
4506                 { &hf_nt_ace_cond_local_attr,
4507                   { "LOCAL_ATTRIBUTE", "nt.ace.cond.local_attr", FT_STRING, BASE_NONE,
4508                     NULL, 0, NULL, HFILL }},
4509
4510                 { &hf_nt_ace_cond_user_attr,
4511                   { "USER_ATTRIBUTE", "nt.ace.cond.user_attr", FT_STRING, BASE_NONE,
4512                     NULL, 0, NULL, HFILL }},
4513
4514                 { &hf_nt_ace_cond_resource_attr,
4515                   { "RESOURCE_ATTRIBUTE", "nt.ace.cond.resource_attr", FT_STRING, BASE_NONE,
4516                     NULL, 0, NULL, HFILL }},
4517
4518                 { &hf_nt_ace_cond_device_attr,
4519                   { "DEVICE_ATTRIBUTE", "nt.ace.cond.device_attr", FT_STRING, BASE_NONE,
4520                     NULL, 0, NULL, HFILL }},
4521
4522                 { &hf_nt_ace_sra,
4523                   { "Resource Attribute", "nt.ace.sra", FT_NONE, BASE_NONE,
4524                     NULL, 0, NULL, HFILL }},
4525
4526                 { &hf_nt_ace_sra_name_offset,
4527                   { "Name Offset", "nt.ace.sra.name_offset", FT_UINT32, BASE_DEC, NULL, 0,
4528                     "Offset to Name of Resource Attribute", HFILL }},
4529
4530                 { &hf_nt_ace_sra_name,
4531                   { "Name", "nt.ace.sra.name", FT_STRING, BASE_NONE, NULL, 0,
4532                     "Name of Resource Attribute", HFILL }},
4533
4534                 { &hf_nt_ace_sra_type,
4535                   { "Type", "nt.ace.sra.type",
4536                     FT_UINT16, BASE_DEC, VALS(ace_sra_type_vals), 0,
4537                     "Type of Resource Attribute", HFILL }},
4538
4539                 { &hf_nt_ace_sra_reserved,
4540                   { "Reserved", "nt.ace.sra.reserved", FT_UINT16, BASE_HEX, NULL, 0,
4541                     "Reserved of Resource Attribute", HFILL }},
4542
4543                 { &hf_nt_ace_sra_flags,
4544                   { "Flags", "nt.ace.sra.flags", FT_UINT32, BASE_HEX, NULL, 0,
4545                     "Flags of Resource Attribute", HFILL }},
4546
4547                 { &hf_nt_ace_sra_flags_manual,
4548                   { "Manual", "nt.ace.sra.flags.manual", FT_BOOLEAN, 32,
4549                     TFS(&flags_ace_sra_info_manual), 0x00010000, NULL, HFILL }},
4550
4551                 { &hf_nt_ace_sra_flags_policy_derived,
4552                   { "Policy Derived", "nt.ace.sra.flags.policy_derived", FT_BOOLEAN, 32,
4553                     TFS(&flags_ace_sra_info_policy_derived), 0x00020000, NULL, HFILL }},
4554
4555                 { &hf_nt_ace_sra_flags_non_inheritable,
4556                   { "Non-Inheritable", "nt.ace.sra.flags.non_inheritable", FT_BOOLEAN, 32,
4557                     TFS(&flags_ace_sra_info_non_inheritable), 0x00000001, NULL, HFILL }},
4558
4559                 { &hf_nt_ace_sra_flags_case_sensitive,
4560                   { "Case Sensitive", "nt.ace.sra.flags.case_sensitive", FT_BOOLEAN, 32,
4561                     TFS(&flags_ace_sra_info_case_sensitive), 0x00000002, NULL, HFILL }},
4562
4563                 { &hf_nt_ace_sra_flags_deny_only,
4564                   { "Deny Only", "nt.ace.sra.flags.deny_only", FT_BOOLEAN, 32,
4565                     TFS(&flags_ace_sra_info_deny_only), 0x00000004, NULL, HFILL }},
4566
4567                 { &hf_nt_ace_sra_flags_disabled_by_default,
4568                   { "Disabled By Default", "nt.ace.sra.flags.disabled_by_default", FT_BOOLEAN, 32,
4569                     TFS(&flags_ace_sra_info_disabled_by_default), 0x00000008, NULL, HFILL }},
4570
4571                 { &hf_nt_ace_sra_flags_disabled,
4572                   { "Disabled", "nt.ace.sra.flags.disabled", FT_BOOLEAN, 32,
4573                     TFS(&flags_ace_sra_info_disabled), 0x00000010, NULL, HFILL }},
4574
4575                 { &hf_nt_ace_sra_flags_mandatory,
4576                   { "Mandatory", "nt.ace.sra.flags.mandatory", FT_BOOLEAN, 32,
4577                     TFS(&flags_ace_sra_info_mandatory), 0x00000020, NULL, HFILL }},
4578
4579                 { &hf_nt_ace_sra_value_count,
4580                   { "Value Count", "nt.ace.sra.value_count", FT_UINT32, BASE_DEC, NULL, 0,
4581                     "Value Count of Resource Attribute", HFILL }},
4582
4583                 { &hf_nt_ace_sra_value_offset,
4584                   { "Value Offset", "nt.ace.sra.name_offset", FT_UINT32, BASE_DEC, NULL, 0,
4585                     "Offset to a Resource Attribute Value", HFILL }},
4586
4587                 { &hf_nt_ace_sra_value_int64,
4588                   { "INT64", "nt.ace.sra.value_int64", FT_INT64, BASE_DEC, NULL, 0,
4589                     NULL, HFILL }},
4590
4591                 { &hf_nt_ace_sra_value_uint64,
4592                   { "UINT64", "nt.ace.sra.value_uint64", FT_UINT64, BASE_DEC, NULL, 0,
4593                     NULL, HFILL }},
4594
4595                 { &hf_nt_ace_sra_value_string,
4596                   { "STRING", "nt.ace.sra.value_string", FT_STRING, BASE_NONE,
4597                     NULL, 0, NULL, HFILL }},
4598
4599                 { &hf_nt_ace_sra_value_sid,
4600                   { "SID", "nt.ace.sra.value_sid", FT_STRING, BASE_NONE,
4601                     NULL, 0, NULL, HFILL }},
4602
4603                 { &hf_nt_ace_sra_value_boolean,
4604                   { "BOOLEAN", "nt.ace.sra.value_boolean", FT_UINT64, BASE_DEC,
4605                     NULL, 0, NULL, HFILL }},
4606
4607                 { &hf_nt_ace_sra_value_octet_string,
4608                   { "OCTET_STRING", "nt.ace.sra.value_octet_string", FT_BYTES, BASE_NONE,
4609                     NULL, 0x0, NULL, HFILL }},
4610
4611                 { &hf_nt_security_information_sacl,
4612                   { "SACL", "nt.sec_info.sacl", FT_BOOLEAN, 32,
4613                     TFS(&flags_sec_info_sacl), 0x00000008, NULL, HFILL }},
4614
4615                 { &hf_nt_security_information_dacl,
4616                   { "DACL", "nt.sec_info.dacl", FT_BOOLEAN, 32,
4617                     TFS(&flags_sec_info_dacl), 0x00000004, NULL, HFILL }},
4618
4619                 { &hf_nt_security_information_group,
4620                   { "Group", "nt.sec_info.group", FT_BOOLEAN, 32,
4621                     TFS(&flags_sec_info_group), 0x00000002, NULL, HFILL }},
4622
4623                 { &hf_nt_security_information_owner,
4624                   { "Owner", "nt.sec_info.owner", FT_BOOLEAN, 32,
4625                     TFS(&flags_sec_info_owner), 0x00000001, NULL, HFILL }},
4626
4627                 /* Generated from convert_proto_tree_add_text.pl */
4628                 { &hf_nt_ace_flags_object, { "ACE Object Flags", "nt.ace.object.flags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4629                 { &hf_nt_ace_flags, { "NT ACE Flags", "nt.ace.flags", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4630                 { &hf_nt_sec_desc_type, { "Type", "nt.sec_desc.type", FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4631                 { &hf_nt_security_information, { "SEC INFO", "nt.sec_info", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4632                 { &hf_nt_offset_to_owner_sid, { "Offset to owner SID", "nt.offset_to_owner_sid", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4633                 { &hf_nt_offset_to_group_sid, { "Offset to group SID", "nt.offset_to_group_sid", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4634                 { &hf_nt_offset_to_sacl, { "Offset to SACL", "nt.offset_to_sacl", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4635                 { &hf_nt_offset_to_dacl, { "Offset to DACL", "nt.offset_to_dacl", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4636         };
4637
4638         static int *ett[] = {
4639                 &ett_nt_sec_desc,
4640                 &ett_nt_sec_desc_type,
4641                 &ett_nt_sid,
4642                 &ett_nt_acl,
4643                 &ett_nt_ace,
4644                 &ett_nt_ace_flags,
4645                 &ett_nt_ace_object,
4646                 &ett_nt_ace_object_flags,
4647                 &ett_nt_access_mask,
4648                 &ett_nt_access_mask_generic,
4649                 &ett_nt_access_mask_standard,
4650                 &ett_nt_access_mask_specific,
4651                 &ett_nt_security_information,
4652                 &ett_nt_ace_cond,
4653                 &ett_nt_ace_cond_data,
4654                 &ett_nt_ace_sra,
4655                 &ett_nt_ace_sra_flags,
4656                 &ett_nt_ace_sra_value_offsets,
4657                 &ett_nt_ace_sra_values,
4658         };
4659
4660         static ei_register_info ei[] = {
4661                 { &ei_nt_ace_extends_beyond_data, { "nt.ace_extends_beyond_data", PI_MALFORMED, PI_ERROR, "ACE Extends beyond end of data", EXPFILL }},
4662                 { &ei_nt_ace_extends_beyond_reassembled_data, { "nt.ace_extends_beyond_reassembled_data", PI_MALFORMED, PI_ERROR, "ACE Extends beyond end of reassembled data", EXPFILL }},
4663                 { &ei_nt_owner_sid_beyond_data, { "nt.owner_sid.beyond_data", PI_MALFORMED, PI_ERROR, "Owner SID beyond end of data", EXPFILL }},
4664                 { &ei_nt_owner_sid_beyond_reassembled_data, { "nt.owner_sid.beyond_reassembled_data", PI_MALFORMED, PI_ERROR, "Owner SID beyond end of reassembled data", EXPFILL }},
4665                 { &ei_nt_group_sid_beyond_data, { "nt.group_sid.beyond_data", PI_MALFORMED, PI_ERROR, "Group SID beyond end of data", EXPFILL }},
4666                 { &ei_nt_group_sid_beyond_reassembled_data, { "nt.group_sid.beyond_reassembled_data", PI_MALFORMED, PI_ERROR, "Group SID beyond end of reassembled data", EXPFILL }},
4667                 { &ei_nt_item_offs_out_of_range, { "nt.item_offset.out_of_range", PI_MALFORMED, PI_ERROR, "Item offset is out of range", EXPFILL }},
4668         };
4669
4670         expert_module_t* expert_nt;
4671
4672         proto_register_subtree_array(ett, array_length(ett));
4673         proto_register_field_array(proto_smb, hf, array_length(hf));
4674         expert_nt = expert_register_protocol(proto_smb);
4675         expert_register_field_array(expert_nt, ei, array_length(ei));
4676 }
4677
4678 /*
4679  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
4680  *
4681  * Local variables:
4682  * c-basic-offset: 8
4683  * tab-width: 8
4684  * indent-tabs-mode: t
4685  * End:
4686  *
4687  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
4688  * :indentSize=8:tabSize=8:noTabs=false:
4689  */