epan/dissectors/packet-dcom-dispatch.c

   1 /* packet-dcom-dispatch.c
   2  * Routines for DCOM IDispatch
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23  */
  24
  25 /* see packet-dcom.c for details about DCOM */
  26
  27 #include "config.h"
  28
  29
  30 #include <glib.h>
  31 #include <epan/packet.h>
  32 #include "packet-dcerpc.h"
  33 #include "packet-dcom.h"
  34 #include "packet-dcom-dispatch.h"
  35
  36
  37 static int hf_dispatch_opnum = -1;
  38
  39 static int hf_dispatch_riid = -1;
  40 static int hf_dispatch_name = -1;
  41 static int hf_dispatch_names = -1;
  42 static int hf_dispatch_lcid = -1;
  43 static int hf_dispatch_id = -1;
  44
  45 static int hf_dispatch_arg = -1;
  46 static int hf_dispatch_args = -1;
  47 static int hf_dispatch_named_args = -1;
  48 static int hf_dispatch_varref = -1;
  49 static int hf_dispatch_varrefidx = -1;
  50 static int hf_dispatch_varrefarg = -1;
  51
  52 static int hf_dispatch_varresult = -1;
  53 static int hf_dispatch_code = -1;
  54 static int hf_dispatch_reserved16 = -1;
  55 static int hf_dispatch_source = -1;
  56 static int hf_dispatch_description = -1;
  57 static int hf_dispatch_help_file = -1;
  58 static int hf_dispatch_help_context = -1;
  59 static int hf_dispatch_reserved32 = -1;
  60 static int hf_dispatch_deferred_fill_in = -1;
  61 static int hf_dispatch_arg_err = -1;
  62
  63 static int hf_dispatch_tinfo = -1;
  64 static int hf_dispatch_itinfo = -1;
  65 static int hf_dispatch_dispparams = -1;
  66 static int hf_dispatch_excepinfo = -1;
  67 static int hf_dispatch_scode = -1;
  68
  69
  70 static int hf_dispatch_flags = -1;
  71 static int hf_dispatch_flags_method = -1;
  72 static int hf_dispatch_flags_propget = -1;
  73 static int hf_dispatch_flags_propput = -1;
  74 static int hf_dispatch_flags_propputref = -1;
  75
  76 #define DISPATCH_FLAGS_METHOD           1
  77 #define DISPATCH_FLAGS_PROPGET          2
  78 #define DISPATCH_FLAGS_PROPPUT          4
  79 #define DISPATCH_FLAGS_PROPPUTREF       8
  80
  81 static gint ett_dispatch_flags = -1;
  82 static gint ett_dispatch_params = -1;
  83 static gint ett_dispatch_excepinfo = -1;
  84
  85 static e_uuid_t uuid_dispatch = { 0x00020400, 0x0000, 0x0000, { 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 } };
  86 static guint16  ver_dispatch = 0;
  87 static gint ett_dispatch = -1;
  88 static int proto_dispatch = -1;
  89
  90
  91 /* from MSDN "Locale Identifiers" */
  92 /* see: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/intl/nls_8sj7.asp */
  93 /* values from cygwin's winnls.h and: */
  94 /* http://msdn.microsoft.com/library/default.asp?url=/library/en-us/intl/nls_238z.asp */
  95 static const value_string dcom_lcid_vals[] = {
  96     { 0x0000, "Language neutral" },
  97     { 0x0400, "LOCALE_USER_DEFAULT" },
  98     { 0x0409, "English (United States)" },
  99     { 0x0800, "LOCALE_SYSTEM_DEFAULT" },
 100     { 0,    NULL }
 101 };
 102
 103
 104
 105 int
 106 dissect_IDispatch_GetTypeInfoCount_resp(tvbuff_t *tvb, int offset,
 107                                         packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
 108 {
 109     guint32 u32TInfo;
 110     guint32 u32HResult;
 111
 112
 113     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 114
 115     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 116                                 hf_dispatch_tinfo, &u32TInfo);
 117
 118     /* HRESULT of call */
 119     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 120                                   &u32HResult);
 121
 122     col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 123                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 124
 125     return offset;
 126 }
 127
 128 int
 129 dissect_IDispatch_GetTypeInfo_rqst(tvbuff_t *tvb, int offset,
 130                                    packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
 131 {
 132     guint32 u32TInfo;
 133     guint32 u32Lcid;
 134
 135     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
 136
 137     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 138                                 hf_dispatch_tinfo, &u32TInfo);
 139     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 140                                 hf_dispatch_lcid, &u32Lcid);
 141
 142     return offset;
 143 }
 144
 145
 146 int
 147 dissect_IDispatch_GetTypeInfo_resp(tvbuff_t *tvb, int offset,
 148                                    packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
 149 {
 150     guint32 u32HResult;
 151     guint32 u32Pointer;
 152
 153
 154     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 155
 156     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 157                                          &u32Pointer);
 158     if (u32Pointer) {
 159         offset = dissect_dcom_MInterfacePointer(tvb, offset, pinfo, tree, di, drep, hf_dispatch_itinfo, NULL /* XXX */);
 160     }
 161
 162     /* HRESULT of call */
 163     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 164                                   &u32HResult);
 165
 166     col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 167                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 168
 169     return offset;
 170 }
 171
 172
 173 int
 174 dissect_IDispatch_GetIDsOfNames_rqst(tvbuff_t *tvb, int offset,
 175                                      packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
 176 {
 177     e_uuid_t riid;
 178     guint32  u32Lcid;
 179     gchar    szName[1000] = { 0 };
 180     guint32  u32Names;
 181     guint32  u32ArraySize;
 182     guint32  u32Pointer;
 183     guint32  u32Tmp;
 184     guint32  u32VariableOffset;
 185
 186
 187     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
 188
 189     offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
 190                                hf_dispatch_riid, &riid);
 191
 192     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 193                                             &u32ArraySize);
 194
 195     u32VariableOffset = offset + u32ArraySize * 4;
 196
 197     u32Tmp = u32ArraySize;
 198     while(u32Tmp--) {
 199         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 200                                              &u32Pointer);
 201         if (u32Pointer) {
 202             u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, tree, di, drep,
 203                                                     hf_dispatch_name, szName, sizeof(szName));
 204             col_append_fstr(pinfo->cinfo, COL_INFO, " \"%s\"", szName);
 205         }
 206     }
 207
 208     offset = u32VariableOffset;
 209
 210     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 211                                 hf_dispatch_names, &u32Names);
 212
 213     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 214                                 hf_dispatch_lcid, &u32Lcid);
 215
 216     return offset;
 217 }
 218
 219
 220
 221 int
 222 dissect_IDispatch_GetIDsOfNames_resp(tvbuff_t *tvb, int offset,
 223                                      packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
 224 {
 225     guint32 u32DispId;
 226     guint32 u32ArraySize;
 227     guint32 u32Tmp;
 228     guint32 u32HResult;
 229
 230
 231     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 232
 233     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 234                                             &u32ArraySize);
 235
 236     u32Tmp = u32ArraySize;
 237     while (u32Tmp--) {
 238         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 239                                     hf_dispatch_id, &u32DispId);
 240         col_append_fstr(pinfo->cinfo, COL_INFO, " ID=0x%x", u32DispId);
 241     }
 242
 243     /* HRESULT of call */
 244     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 245                                   &u32HResult);
 246
 247     col_append_fstr(pinfo->cinfo, COL_INFO, " -> %s",
 248                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 249
 250     return offset;
 251 }
 252
 253
 254
 255 int
 256 dissect_IDispatch_Invoke_rqst(tvbuff_t *tvb, int offset,
 257                               packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
 258 {
 259     guint32 u32DispIdMember;
 260     e_uuid_t riid;
 261     guint32 u32Lcid;
 262     guint32 u32Flags;
 263     guint32 u32Args;
 264     guint32 u32NamedArgs;
 265     guint32 u32Pointer;
 266     guint32 u32Pointer2;
 267     guint32 u32ArraySize;
 268     guint32 u32VariableOffset;
 269     guint32 u32VarRef;
 270     guint32 u32VarRefIdx;
 271     guint32 u32TmpOffset;
 272     guint32 u32SubStart;
 273
 274     proto_item *feature_item;
 275     proto_tree *feature_tree;
 276     proto_item *dispparams_item;
 277     proto_tree *dispparams_tree;
 278
 279
 280     offset = dissect_dcom_this(tvb, offset, pinfo, tree, di, drep);
 281
 282     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 283                                 hf_dispatch_id, &u32DispIdMember);
 284     col_append_fstr(pinfo->cinfo, COL_INFO, " ID=0x%x", u32DispIdMember);
 285
 286     offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, di, drep,
 287                                hf_dispatch_riid, &riid);
 288     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 289                                 hf_dispatch_lcid, &u32Lcid);
 290
 291     /* dispatch flags */
 292     u32TmpOffset = dissect_dcom_DWORD(tvb, offset, pinfo, NULL, di, drep,
 293                                       hf_dispatch_flags, &u32Flags);
 294     feature_item = proto_tree_add_uint (tree, hf_dispatch_flags, tvb, offset, 4, u32Flags);
 295     feature_tree = proto_item_add_subtree (feature_item, ett_dispatch_flags);
 296     if (feature_tree) {
 297         proto_tree_add_boolean (feature_tree, hf_dispatch_flags_propputref, tvb, offset, 4, u32Flags);
 298         proto_tree_add_boolean (feature_tree, hf_dispatch_flags_propput, tvb, offset, 4, u32Flags);
 299         proto_tree_add_boolean (feature_tree, hf_dispatch_flags_propget, tvb, offset, 4, u32Flags);
 300         proto_tree_add_boolean (feature_tree, hf_dispatch_flags_method, tvb, offset, 4, u32Flags);
 301     }
 302
 303     if (u32Flags & DISPATCH_FLAGS_METHOD) {
 304         proto_item_append_text(feature_item, ", Method");
 305         col_append_str(pinfo->cinfo, COL_INFO, " Method");
 306     }
 307     if (u32Flags & DISPATCH_FLAGS_PROPGET) {
 308         proto_item_append_text(feature_item, ", PropertyGet");
 309         col_append_str(pinfo->cinfo, COL_INFO, " PropertyGet");
 310     }
 311     if (u32Flags & DISPATCH_FLAGS_PROPPUT) {
 312         proto_item_append_text(feature_item, ", PropertyPut");
 313         col_append_str(pinfo->cinfo, COL_INFO, " PropertyPut");
 314     }
 315     if (u32Flags & DISPATCH_FLAGS_PROPPUTREF) {
 316         proto_item_append_text(feature_item, ", PropertyPutRef");
 317         col_append_str(pinfo->cinfo, COL_INFO, " PropertyPutRef");
 318     }
 319
 320     offset = u32TmpOffset;
 321
 322     dispparams_item = proto_tree_add_item(tree, hf_dispatch_dispparams, tvb, offset, 0, ENC_NA);
 323     dispparams_tree = proto_item_add_subtree (dispparams_item, ett_dispatch_params);
 324     u32SubStart = offset;
 325
 326     /* DISPPARAMS */
 327     /* VARIANT rgvarg[u32Args] */
 328     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, di, drep,
 329                                          &u32Pointer);
 330
 331     /* DISPID rgdispidNamedArgs[u32NamedArgs] */
 332     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, di, drep,
 333                                          &u32Pointer2);
 334
 335     offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, di, drep,
 336                                 hf_dispatch_args, &u32Args);
 337     offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, di, drep,
 338                                 hf_dispatch_named_args, &u32NamedArgs);
 339
 340     if (u32Pointer) {
 341         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, dispparams_tree, di, drep,
 342                                                 &u32ArraySize);
 343         u32VariableOffset = offset + u32ArraySize * 4;
 344         while(u32ArraySize--) {
 345             offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, di, drep,
 346                                                  &u32Pointer);
 347             if (u32Pointer) {
 348                 u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, dispparams_tree, di, drep, hf_dispatch_arg);
 349             }
 350         }
 351         offset = u32VariableOffset;
 352     }
 353
 354     /* DISPID rgdispidNamedArgs[u32NamedArgs] */
 355     if (u32Pointer2) {
 356         offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, dispparams_tree, di, drep,
 357                                                 &u32ArraySize);
 358         while(u32ArraySize--) {
 359             offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, di, drep,
 360                                         hf_dispatch_id, &u32DispIdMember);
 361         }
 362     }
 363
 364     proto_item_append_text(dispparams_item, ", Args: %u NamedArgs: %u", u32Args, u32NamedArgs);
 365     proto_item_set_len(dispparams_item, offset - u32SubStart);
 366
 367     /* end of DISPPARAMS */
 368
 369     /* u32VarRef */
 370     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 371                                 hf_dispatch_varref, &u32VarRef);
 372
 373     /* rgVarRefIdx: UINT[u32VarRef] */
 374     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 375                                             &u32ArraySize);
 376     while(u32ArraySize--) {
 377         offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 378                                     hf_dispatch_varrefidx, &u32VarRefIdx);
 379     }
 380
 381     /* rgVarRef: VARIANT[u32VarRef] */
 382     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 383                                             &u32ArraySize);
 384     u32VariableOffset = offset + u32ArraySize * 4;
 385     while(u32ArraySize--) {
 386         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 387                                              &u32Pointer);
 388         if (u32Pointer) {
 389             u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, tree, di, drep, hf_dispatch_varrefarg);
 390         }
 391     }
 392
 393     col_append_fstr(pinfo->cinfo, COL_INFO,
 394                     " Args=%u NamedArgs=%u VarRef=%u", u32Args, u32NamedArgs, u32VarRef);
 395
 396     return u32VariableOffset;
 397 }
 398
 399 int
 400 dissect_IDispatch_Invoke_resp(tvbuff_t *tvb, int offset,
 401                               packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
 402 {
 403     guint32 u32Pointer;
 404     guint32 u32Pointer2;
 405     guint32 u32Pointer3;
 406     guint32 u32VariableOffset;
 407     guint32 u32ArraySize;
 408     guint32 u32SubStart;
 409     guint16 u16Code;
 410     guint16 u16Reserved;
 411     guint32 u32HelpContext;
 412     guint32 u32Reserved;
 413     guint32 u32DeferredFillIn;
 414     guint32 u32ArgErr;
 415     guint32 u32HResult;
 416     guint32 u32SCode;
 417     guint32 u32VarRef;
 418     gchar       szName[1000] = { 0 };
 419     proto_item *excepinfo_item;
 420     proto_tree *excepinfo_tree;
 421
 422
 423     offset = dissect_dcom_that(tvb, offset, pinfo, tree, di, drep);
 424
 425     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 426                                          &u32Pointer);
 427     if (u32Pointer) {
 428         offset = dissect_dcom_VARIANT(tvb, offset, pinfo, tree, di, drep, hf_dispatch_varresult);
 429     }
 430
 431     /* ExcepInfo */
 432     excepinfo_item = proto_tree_add_item(tree, hf_dispatch_excepinfo, tvb, offset, 0, ENC_NA);
 433     excepinfo_tree = proto_item_add_subtree (excepinfo_item, ett_dispatch_excepinfo);
 434     u32SubStart = offset;
 435
 436     offset = dissect_dcom_WORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 437                                hf_dispatch_code, &u16Code);
 438     offset = dissect_dcom_WORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 439                                hf_dispatch_reserved16, &u16Reserved);
 440     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, excepinfo_tree, di, drep,
 441                                          &u32Pointer);
 442     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, excepinfo_tree, di, drep,
 443                                          &u32Pointer2);
 444     offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, excepinfo_tree, di, drep,
 445                                          &u32Pointer3);
 446     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 447                                 hf_dispatch_help_context, &u32HelpContext);
 448     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 449                                 hf_dispatch_reserved32, &u32Reserved);
 450     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 451                                 hf_dispatch_deferred_fill_in, &u32DeferredFillIn);
 452     offset = dissect_dcom_DWORD(tvb, offset, pinfo, excepinfo_tree, di, drep,
 453                                 hf_dispatch_scode, &u32SCode);
 454
 455     if (u32Pointer) {
 456         offset = dissect_dcom_BSTR(tvb, offset, pinfo, excepinfo_tree, di, drep,
 457                                    hf_dispatch_source, szName, sizeof(szName));
 458     }
 459     if (u32Pointer2) {
 460         offset = dissect_dcom_BSTR(tvb, offset, pinfo, excepinfo_tree, di, drep,
 461                                    hf_dispatch_description, szName, sizeof(szName));
 462     }
 463     if (u32Pointer3) {
 464         offset = dissect_dcom_BSTR(tvb, offset, pinfo, excepinfo_tree, di, drep,
 465                                    hf_dispatch_help_file, szName, sizeof(szName));
 466     }
 467
 468     proto_item_append_text(excepinfo_item, ", SCode: %s",
 469                            val_to_str(u32SCode, dcom_hresult_vals, "Unknown (0x%08x)"));
 470     proto_item_set_len(excepinfo_item, offset - u32SubStart);
 471     /* end of ExcepInfo */
 472
 473     offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, di, drep,
 474                                 hf_dispatch_arg_err, &u32ArgErr);
 475
 476     /* rgVarRef: VARIANT[u32VarRef] */
 477     offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, di, drep,
 478                                             &u32ArraySize);
 479     u32VarRef = u32ArraySize;
 480     u32VariableOffset = offset + u32ArraySize * 4;
 481     while(u32ArraySize--) {
 482         offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, di, drep,
 483                                              &u32Pointer);
 484         if (u32Pointer) {
 485             u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, tree, di, drep, hf_dispatch_varrefarg);
 486         }
 487     }
 488     offset = u32VariableOffset;
 489
 490     /* HRESULT of call */
 491     offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, di, drep,
 492                                   &u32HResult);
 493
 494     col_append_fstr(pinfo->cinfo, COL_INFO, " SCode=%s VarRef=%u -> %s",
 495                     val_to_str(u32SCode, dcom_hresult_vals, "Unknown (0x%08x)"),
 496                     u32VarRef,
 497                     val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") );
 498
 499     return offset;
 500 }
 501
 502
 503
 504 /* sub dissector table of IDispatch interface */
 505 static dcerpc_sub_dissector dispatch_dissectors[] = {
 506     { 0, "QueryInterface", NULL, NULL },
 507     { 1, "AddRef", NULL, NULL },
 508     { 2, "Release", NULL, NULL },
 509
 510     { 3, "GetTypeInfoCount", dissect_dcom_simple_rqst, dissect_IDispatch_GetTypeInfoCount_resp },
 511     { 4, "GetTypeInfo", dissect_IDispatch_GetTypeInfo_rqst, dissect_IDispatch_GetTypeInfo_resp },
 512     { 5, "GetIDsOfNames", dissect_IDispatch_GetIDsOfNames_rqst, dissect_IDispatch_GetIDsOfNames_resp },
 513     { 6, "Invoke", dissect_IDispatch_Invoke_rqst, dissect_IDispatch_Invoke_resp },
 514     { 0, NULL, NULL, NULL },
 515 };
 516
 517
 518 void
 519 proto_register_dcom_dispatch(void)
 520 {
 521
 522     static hf_register_info hf_dispatch_array[] = {
 523         { &hf_dispatch_opnum,
 524           { "Operation", "dispatch.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 525
 526         { &hf_dispatch_riid,
 527           { "RIID", "dispatch.riid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 528         { &hf_dispatch_name,
 529           { "Name", "dispatch.name", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 530         { &hf_dispatch_names,
 531           { "Names", "dispatch.names", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 532         { &hf_dispatch_lcid,
 533           { "LCID", "dispatch.lcid", FT_UINT32, BASE_HEX, VALS(dcom_lcid_vals), 0x0, NULL, HFILL }},
 534         { &hf_dispatch_id,
 535           { "DispID", "dispatch.id", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 536         { &hf_dispatch_flags,
 537           { "Flags", "dispatch.flags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 538
 539         { &hf_dispatch_arg,
 540           { "Argument", "dispatch.arg", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 541         { &hf_dispatch_args,
 542           { "Args", "dispatch.args", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 543         { &hf_dispatch_named_args,
 544           { "NamedArgs", "dispatch.named_args", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 545         { &hf_dispatch_varref,
 546           { "VarRef", "dispatch.varref", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 547         { &hf_dispatch_varrefidx,
 548           { "VarRefIdx", "dispatch.varrefidx", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 549         { &hf_dispatch_varrefarg,
 550           { "VarRef", "dispatch.varrefarg", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 551         { &hf_dispatch_varresult,
 552           { "VarResult", "dispatch.varresult", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 553
 554         { &hf_dispatch_flags_method,
 555           { "Method", "dispatch.flags_method", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_METHOD, NULL, HFILL }},
 556         { &hf_dispatch_flags_propget,
 557           { "PropertyGet", "dispatch.flags_propget", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_PROPGET, NULL, HFILL }},
 558         { &hf_dispatch_flags_propput,
 559           { "PropertyPut", "dispatch.flags_propput", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_PROPPUT, NULL, HFILL }},
 560         { &hf_dispatch_flags_propputref,
 561           { "PropertyPutRef", "dispatch.flags_propputref", FT_BOOLEAN, 32, TFS (&tfs_set_notset), DISPATCH_FLAGS_PROPPUTREF, NULL, HFILL }},
 562
 563         { &hf_dispatch_code,
 564           { "Code", "dispatch.code", FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 565         { &hf_dispatch_reserved16,
 566           { "Reserved", "dispatch.reserved16", FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 567         { &hf_dispatch_source,
 568           { "Source", "dispatch.source", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 569         { &hf_dispatch_description,
 570           { "Description", "dispatch.description", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 571         { &hf_dispatch_help_file,
 572           { "HelpFile", "dispatch.help_file", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 573         { &hf_dispatch_help_context,
 574           { "HelpContext", "dispatch.help_context", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 575         { &hf_dispatch_reserved32,
 576           { "Reserved", "dispatch.reserved32", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 577         { &hf_dispatch_deferred_fill_in,
 578           { "DeferredFillIn", "dispatch.deferred_fill_in", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
 579         { &hf_dispatch_arg_err,
 580           { "ArgErr", "dispatch.arg_err", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 581
 582         { &hf_dispatch_tinfo,
 583           { "TInfo", "dispatch.tinfo", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
 584         { &hf_dispatch_itinfo,
 585           { "TInfo", "dispatch.itinfo", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 586         { &hf_dispatch_dispparams,
 587           { "DispParams", "dispatch.dispparams", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 588         { &hf_dispatch_excepinfo,
 589           { "ExcepInfo", "dispatch.excepinfo", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL }},
 590         { &hf_dispatch_scode,
 591           { "SCode", "dispatch.scode", FT_UINT32, BASE_HEX, VALS(dcom_hresult_vals), 0x0, NULL, HFILL }}
 592     };
 593
 594     static gint *ett[] = {
 595         &ett_dispatch,
 596         &ett_dispatch_flags,
 597         &ett_dispatch_params,
 598         &ett_dispatch_excepinfo
 599     };
 600
 601
 602     /* IDispatch currently only partially implemented */
 603     proto_dispatch = proto_register_protocol ("DCOM IDispatch", "IDispatch", "dispatch");
 604     proto_register_field_array (proto_dispatch, hf_dispatch_array, array_length (hf_dispatch_array));
 605     proto_register_subtree_array (ett, array_length (ett));
 606 }
 607
 608
 609 void
 610 proto_reg_handoff_dcom_dispatch(void)
 611 {
 612
 613     dcerpc_init_uuid(proto_dispatch, ett_dispatch,
 614                      &uuid_dispatch, ver_dispatch,
 615                      dispatch_dissectors, hf_dispatch_opnum);
 616 }
 617