none
Array and its size in EcDoRpcExt2 RRS feed

  • Question

  • Hi all,

    I was trying to parse this MSRPC function in Wireshark- 

    long __stdcall EcDoRpcExt2(
    [in, out, ref] CXH * pcxh, [in, out] unsigned long *pulFlags,
    [in, size_is(cbIn)] unsigned char rgbIn[],
    [in] unsigned long cbIn, <br/>
    [out, length_is(*pcbOut), size_is(*pcbOut)] unsigned char rgbOut[],
    [in, out] BIG_RANGE_ULONG *pcbOut, <br/>
    [in, size_is(cbAuxIn)] unsigned char rgbAuxIn[],
    [in] unsigned long cbAuxIn, [out, length_is(*pcbAuxOut), size_is(*pcbAuxOut)] unsigned char rgbAuxOut[],
    [in, out] SMALL_RANGE_ULONG *pcbAuxOut,
    [out] unsigned long *pulTransTime
    );
    
    
    

    I'm stuck trying to parse
    [in, size_is(cbIn)] unsigned char rgbIn[],<br/>
    [in] unsigned long cbIn,
    

    The problem I see is that we first have the array and then the length. I searched the forums and found the following related link-
    http://social.msdn.microsoft.com/Forums/en-US/os_exchangeprotocols/thread/de1da50c-dcaa-4239-9fba-4198afa2ddd8/

    I did a quick read of the relevant part of DCE RPC specs, but in all the cases I saw it always had the size and then the array. In these cases it is trivial to use the size for extracting the array contents.

    I'm sure it is not a typo in the spec, so clearly I'm missing something. Can someone please clarify how to parse the array field ?

    Any pointers/ suggestions/ hints welcome.

    Many thanks,
    Harsha
    • Edited by harshas Saturday, April 25, 2009 2:01 AM
    Saturday, April 25, 2009 1:50 AM

Answers

  • Harsha,

    You're welcome! If you may, could you post your solution to the forum for others to benefit?

    Dominic Salemno
    Senior Support Escalation Engineer
    Wednesday, April 29, 2009 3:23 PM

All replies

  • harshas,

    We have received your request. Someone from our team will be following-up with you in regards to your question.

    Dominic Salemno
    Senior Support Escalation Engineer

    Saturday, April 25, 2009 1:14 PM
  • Please let me know if you want our refernce partner ID.

    Thanks,
    Harsha
    Monday, April 27, 2009 9:36 PM
  • Harsha,

    I am the engineer who has taken ownership of this issue. I am investigating this and will update you as things progress.

    Dominic Salemno
    Senior Support Escalation Engineer
    Tuesday, April 28, 2009 3:11 PM
  • Hi Dominic,

    Please ignore this question, I've figured out a way.

    Many thanks,
    Harsha

    Tuesday, April 28, 2009 10:00 PM
  • Harsha,

    You're welcome! If you may, could you post your solution to the forum for others to benefit?

    Dominic Salemno
    Senior Support Escalation Engineer
    Wednesday, April 29, 2009 3:23 PM