Win2K: Primary Domain Fld of Ssn Setup Not Properly Zero Term'd

[Richard Sharpe]

On Mon, 26 Aug 2002, Michael B. Allen wrote:

> On Mon, 26 Aug 2002 10:24:09 +0000
> Luke Kenneth Casson Leighton <lkcl at samba-tng.org> wrote:
> 
> > On Sun, Aug 25, 2002 at 10:02:49PM -0400, Allen, Michael B (RSCH) wrote:
> > 
> > > Clients should not check for *two* zero bytes after the Primary Domain field Unicode string
> > > in SMB_COM_SESSION_SETUP_ANDX. You may only get *one* 0x00 byte. I'm almost
> > > glad this is a bug in Win2K, I thought this was a bug in jCIFS. At least I have two articles of
> > > evidence suggesting the bug is with Win2K. One is inlined here and the other is a PNG of a
> > > pcap.
> > >
> > > Aug 21 06:58:52.472 - bad string
> > > 00000: FF 53 4D 42 73 00 00 00 00 98 01 80 00 00 00 00  |?SMBs...........|
> > > 00010: 00 00 00 00 00 00 00 00 05 88 56 34 01 F8 04 00  |..........V4.?..|
> > > 00020: 03 75 00 81 00 00 00 58 00 7C                    |.u.....X.|
> >  len1 = 0x58; len2=0x7c    ^^^^^ ^^^^^
> > >                                      57 00 69 00 6E 00             W.i.n.|
> > > 00030: 64 00 6F 00 77 00 73 00 20 00 35 00 2E 00 30 00  |d.o.w.s. .5...0.|
> > > 00040: 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00  |..W.i.n.d.o.w.s.|
> > > 00050: 20 00 32 00 30 00 30 00 30 00 20 00 4C 00 41 00  | .2.0.0.0. .L.A.|
> > > 00060: 4E 00 20 00 4D 00 61 00 6E 00 61 00 67 00 65 00  |N. .M.a.n.a.g.e.|
> > > 00070: 72 00 00 00 44 00 49 00 56 00 49 00 4E 00 45 00  |r...D.I.V.I.N.E.|
> > > 00080: 00 30                                            |.0
> > 
> >  0x58 length ends here.
> > 
> >  well, whoopidedoo, that happens to be absolutely spot-on.

Ummm, since SMBs are little endian, 00 58 is a large BCC. Much larger that 
0x58.

As well, ISTM, 00 7C is the first part of the Native OS: It looks like |.
 
Perhaps I am egregiously wrong.

> >  don't know what the 0x7c is about: it's either an incorrectly-specified
> >  "max" length of the Unicode UCS16 string, or it's something else.
> > 
> >  more examples would help isolate that.
> > 
> > 
> >  now.
> > 
> >  who do i send the bill to for my time?

Hmmm, no comment.

> Microsoft Corp.
> PO Box 9876542-1
> Redmond, WA 87654-321
> 
> 

-- 
Regards
-----
Richard Sharpe, rsharpe at ns.aus.com, rsharpe at samba.org, 
sharpe at ethereal.com