More info on LanMan API

[Todd Sabin]

Richard Sharpe <sharpe at ns.aus.com> writes:

> Hi,
> 
> Ethereal is no able to name the same LanMan API calls that Samba
> understands, and will eventually be able to list out all their parameters
> etc as well.
> 
> However, I need more info on other calls, and was wondering if anyone knew
> of a source of info on other LanMan API calls?
> 

What are you looking for?  If it's just the names of the APIs, this
usually works:  find the binary that implements it on NT, strings the
corresponding .dbg file, grep for the pipe name, e.g.:

[tas at buckaroo sp5chk/symbols/dll]{13} strings lsasrv.dbg | grep _lsarpc_
_lsarpc_LsarClose at 4
_lsarpc_LsarDelete at 4
_lsarpc_LsarEnumeratePrivileges at 4
_lsarpc_LsarQuerySecurityObject at 4
_lsarpc_LsarSetSecurityObject at 4
_lsarpc_LsarChangePassword at 4
_lsarpc_LsarOpenPolicy at 4
_lsarpc_LsarQueryInformationPolicy at 4
_lsarpc_LsarSetInformationPolicy at 4
_lsarpc_LsarClearAuditLog at 4
_lsarpc_LsarCreateAccount at 4
_lsarpc_LsarEnumerateAccounts at 4
_lsarpc_LsarCreateTrustedDomain at 4
_lsarpc_LsarEnumerateTrustedDomains at 4
_lsarpc_LsarLookupNames at 4
_lsarpc_LsarLookupSids at 4
_lsarpc_LsarCreateSecret at 4
_lsarpc_LsarOpenAccount at 4
_lsarpc_LsarEnumeratePrivilegesAccount at 4
_lsarpc_LsarAddPrivilegesToAccount at 4
_lsarpc_LsarRemovePrivilegesFromAccount at 4
_lsarpc_LsarGetQuotasForAccount at 4
_lsarpc_LsarSetQuotasForAccount at 4
_lsarpc_LsarGetSystemAccessAccount at 4
_lsarpc_LsarSetSystemAccessAccount at 4
_lsarpc_LsarOpenTrustedDomain at 4
_lsarpc_LsarQueryInfoTrustedDomain at 4
_lsarpc_LsarSetInformationTrustedDomain at 4
_lsarpc_LsarOpenSecret at 4
_lsarpc_LsarSetSecret at 4
_lsarpc_LsarQuerySecret at 4
_lsarpc_LsarLookupPrivilegeValue at 4
_lsarpc_LsarLookupPrivilegeName at 4
_lsarpc_LsarLookupPrivilegeDisplayName at 4
_lsarpc_LsarDeleteObject at 4
_lsarpc_LsarEnumerateAccountsWithUserRight at 4
_lsarpc_LsarEnumerateAccountRights at 4
_lsarpc_LsarAddAccountRights at 4
_lsarpc_LsarRemoveAccountRights at 4
_lsarpc_LsarQueryTrustedDomainInfo at 4
_lsarpc_LsarSetTrustedDomainInfo at 4
_lsarpc_LsarDeleteTrustedDomain at 4
_lsarpc_LsarStorePrivateData at 4
_lsarpc_LsarRetrievePrivateData at 4
_lsarpc_LsarOpenPolicy2 at 4
_lsarpc_LsarGetUserName at 4
_lsarpc_DispatchTable
_lsarpc_ServerIfHandle
_lsarpc_table$S6675
_lsarpc_StubDesc$S5998
_lsarpc___RpcServerInterface$S5997
_lsarpc__LSAPR_ACLExprEval_0000 at 4
[tas at buckaroo sp5chk/symbols/dll]{14} 

I think the stuff up to _lsarpc_DispatchTable is the RPC function
entry points.


Todd