[jcifs] incorrect SID with negative integer

rush rushkhush at gmail.com
Thu May 28 23:22:55 GMT 2009

I am using the event log patch with jcifs. The events that I get show incorrect
SIDs. i.e. S-1-5-21-479040877--574025713-504305617-500 instead of

I debuggged and found that the double hyphens are a single hyphen with a
negative integer, and there is some problem in calculating the SID for unsigned
integer. Also the event log patch has its own implementation of
encoding/decoding the SID, and it is different from the jcifs implementation in
rpc.java. I am not sure why there are 2 different implementations, and which one
is correct. Has anyone encountered this problem before? And does anyone have a


More information about the jcifs mailing list