[Samba] Can't get user list in Win98se
Ubirata Muniz da Silva
ubiratamuniz at gmail.com
Thu Dec 14 20:40:49 GMT 2006
Hello all,
I've already searched the old topics about this subject on the
newsgroup, and haven't found so far an alternative to solve the problem.
I have a Samba PDC (domain JMU) with Mandriva 2006, samba 3.0.13-2 and
OpenLDAP 2.2.23 (nss_ldap 220) .
Packages installed on the server related to samba and ldap:
samba-swat-3.0.13-2.1.102mdk
samba-server-3.0.13-2.1.102mdk
samba-common-3.0.13-2.1.102mdk
samba-client-3.0.13-2.1.102mdk
nss_ldap-220-5.3.102mdk
openldap-2.2.23-5.2.102mdk
perl-ldap-0.31-2mdk
libldap2.2_7-2.2.23-5.2.102mdk
pam_ldap-170-5.3.102mdk
openldap-clients-2.2.23-5.2.102mdk
libldap2.3_0-2.3.6-4.1.20060mdk
openldap-servers-2.2.23-5.2.102mdk
libsmbclient0-3.0.13-2.1.102mdk
pam_smb-1.1.7-1mdk
Windows XP Pro clients work flawlessly, like a charm. Everything works
fine, such as adding workstations to the domain, sharing, logging,
roaming profiles, etc.
However, I am not having the same luck with W98 computers. They log on
to the network ok, roaming profiles ok, logon script ok. However, they
can't access folders shared in XP workstations (printers as well), and
they also can't share with user-based permissions. I believe both
problems are related.
When trying to share a folder in w98, it returns an error message like
"Impossible to show the user list right now. Try again later"
(translated from portuguese brazilian error message).
I have another domain (which is in the process of being fully migrated
to the new one) with an older version of Samba (3.0.4) which works OK
with w98 machines (domain STM). However, checking the smb.conf,
ldap.conf and slapd.conf, I see no difference which could explain the
different behaviour with w98 machines.
Below, the smb.conf of the domain JMU (except the shares), and later,
the level 10 log for the w98 station "antenorw98" with my user account
"bira" when trying to list users attempting to share.
Thanks in advance,
Best wishes,
Ubirata Muniz da Silva
%%%%%%%%%%%%%%%%%%%%%%%begin smb.conf%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
[global]
workgroup = JMU
netbios name = TribunalMilitar
server string = Servidor da Justica Militar
interfaces = lo, eth0
bind interfaces only = Yes
log level = 3
log file = /var/log/samba/%m.log
max log size = 1000000
debug level = 3
syslog = 2
security = user
domain logons = yes
local master = yes
preferred master = yes
domain master = yes
os level = 65
encrypt passwords = yes
==>> username map = *
==>> this line is being mentioned on the log level 10
logon path =
logon home =
profiles acls=No
logon script = geral.bat
passdb backend = ldapsam:ldaps://127.0.0.1
ldap passwd sync = yes
ldap delete dn = Yes
ldap admin dn = cn=Manager,dc=tribunal,dc=militar
ldap suffix = dc=tribunal,dc=militar
ldap machine suffix = ou=Computadores
ldap user suffix = ou=People
ldap group suffix = ou=Grupos
ldap idmap suffix = sambaDomainName=JMU
idmap backend = ldap:ldaps://127.0.0.1
idmap uid = 10000-20000
idmap gid = 10000-20000
enable privileges = yes
add user script = /usr/local/sbin/smbldap-useradd -m "%u"
delete user script = /usr/local/sbin/smbldap-userdel "%u"
add group script = /usr/local/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/local/sbin/smbldap-groupdel "%g"
add user to group script = /usr/local/sbin/smbldap-groupmod -m
"%u" "%g"
delete user from group script = /usr/local/sbin/smbldap-groupmod
-x "%u" "%g"
set primary group script = /usr/local/sbin/smbldap-usermod -g
"%g" "%u"
add machine script = /usr/local/sbin/smbldap-useradd -w "%u"
admin users = administrator
smb ports = 139 445
name resolve order = wins bcast hosts
utmp = Yes
time server = Yes
template shell = /bin/false
winbind use default domain = no
map acl inherit = Yes
strict locking = Yes
announce as = NT Worstation
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
wins support = Yes
dos charset = CP850
unix charset = ISO8859-1
veto files = /*.eml/*.nws/*.{*}/
veto oplock files = /*.doc/*.xls/*.mdb/
hidedotfiles = yes
recycle:repository = .lixeira
recycle:keeptree = True
recycle:touch = True
recycle:versions = True
recycle:exclude = *.tmp|*.temp|*.o|*.obj|~$*|*.$$$
recycle:excludedir = /tmp|/temp|/trash
recycle:noversions = .doc|.xls|.ppt|.dbf|.nsx|.idx|.dbt
recycle:maxsize = 0
allow trusted domains = yes
%%%%%%%%%%%%%%%%%%%%%%%end smb.conf%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
$$$$$$$$$$$$$$$$$$$$$$begin antenorw98.log$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$ just an excerpt as the whole log for this single $$$$$$$$$
$$$$$$$$ transaction is more than 4 megs $$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
<...blah...blah...blah...>
[2006/12/14 17:46:08, 0] lib/username.c:map_username(128)
can't open username map *. Error No such file or directory
<...etc...whatsoever...>
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [modifyTimestamp] = [<does not exist>]
[2006/12/14 17:46:09, 10] rpc_server/srv_samr_nt.c:load_sampwd_entries(367)
load_sampwd_entries: allocating more memory
[2006/12/14 17:46:09, 10] rpc_server/srv_samr_nt.c:load_sampwd_entries(380)
load_sampwd_entries: entry: 0
[2006/12/14 17:46:09, 2] passdb/pdb_ldap.c:init_sam_from_ldap(499)
init_sam_from_ldap: Entry found for user: nobody
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_username(617)
pdb_set_username: setting username nobody, was
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_domain(644)
pdb_set_domain: setting domain JMU, was
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671)
pdb_set_nt_username: setting nt username nobody, was
[2006/12/14 17:46:09, 10]
passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557)
pdb_set_user_sid_from_string: setting user sid
S-1-5-21-1216785039-3915473977-2098946654-2998
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544)
pdb_set_user_sid: setting user sid
S-1-5-21-1216785039-3915473977-2098946654-2998
[2006/12/14 17:46:09, 10]
passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592)
pdb_set_group_sid_from_string: setting group sid
S-1-5-21-1216785039-3915473977-2098946654-514
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580)
pdb_set_group_sid: setting group sid
S-1-5-21-1216785039-3915473977-2098946654-514
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [displayName] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_fullname(698)
pdb_set_full_name: setting full name nobody, was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaHomeDrive] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779)
pdb_set_dir_drive: setting dir drive , was NULL
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaHomePath] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_homedir(806)
pdb_set_homedir: setting home dir , was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725)
pdb_set_logon_script: setting logon script geral.bat, was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaProfilePath] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752)
pdb_set_profile_path: setting profile path , was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [description] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/account_pol.c:account_policy_get(210)
account_policy_get: password history:0
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [modifyTimestamp] = [<does not exist>]
[2006/12/14 17:46:09, 10] rpc_server/srv_samr_nt.c:load_sampwd_entries(380)
load_sampwd_entries: entry: 1
[2006/12/14 17:46:09, 2] passdb/pdb_ldap.c:init_sam_from_ldap(499)
init_sam_from_ldap: Entry found for user: microxp
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_username(617)
pdb_set_username: setting username microxp, was
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_domain(644)
pdb_set_domain: setting domain JMU, was
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671)
pdb_set_nt_username: setting nt username microxp, was
[2006/12/14 17:46:09, 10]
passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557)
pdb_set_user_sid_from_string: setting user sid
S-1-5-21-1216785039-3915473977-2098946654-3012
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544)
pdb_set_user_sid: setting user sid
S-1-5-21-1216785039-3915473977-2098946654-3012
[2006/12/14 17:46:09, 10]
passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592)
pdb_set_group_sid_from_string: setting group sid
S-1-5-21-1216785039-3915473977-2098946654-513
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580)
pdb_set_group_sid: setting group sid
S-1-5-21-1216785039-3915473977-2098946654-513
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_fullname(698)
pdb_set_full_name: setting full name Insere maquinas no dominio, was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaHomeDrive] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779)
pdb_set_dir_drive: setting dir drive , was NULL
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaHomePath] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_homedir(806)
pdb_set_homedir: setting home dir , was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725)
pdb_set_logon_script: setting logon script geral.bat, was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaProfilePath] = [<does not exist>]
[2006/12/14 17:46:09, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752)
pdb_set_profile_path: setting profile path , was
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/account_pol.c:account_policy_get(210)
account_policy_get: password history:0
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>]
[2006/12/14 17:46:09, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
smbldap_get_single_attribute: [modifyTimestamp] = [<does not exist>]
[2006/12/14 17:46:09, 10] rpc_server/srv_samr_nt.c:load_sampwd_entries(380)
load_sampwd_entries: entry: 2
<... loading all 1258 users...>
[2006/12/14 17:46:10, 10] rpc_server/srv_samr_nt.c:load_sampwd_entries(380)
load_sampwd_entries: entry: 1258
[2006/12/14 17:46:10, 10] rpc_server/srv_samr_nt.c:load_sampwd_entries(393)
load_sampwd_entries: done
[2006/12/14 17:46:10, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
pop_sec_ctx (2202, 513) - sec_ctx_stack_ndx = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_samr_nt.c:load_group_domain_entries(407)
load_group_domain_entries
[2006/12/14 17:46:10, 3] smbd/sec_ctx.c:push_sec_ctx(256)
push_sec_ctx(2202, 513) : sec_ctx_stack_ndx = 1
[2006/12/14 17:46:10, 3] smbd/uid.c:push_conn_ctx(365)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/12/14 17:46:10, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/12/14 17:46:10, 5] auth/auth_util.c:debug_nt_user_token(485)
NT user token: (NULL)
[2006/12/14 17:46:10, 5] auth/auth_util.c:debug_unix_user_token(506)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2006/12/14 17:46:10, 5] lib/smbldap.c:smbldap_search(1038)
smbldap_search: base => [ou=Grupos,dc=tribunal,dc=militar], filter =>
[(objectclass=sambaGroupMapping)], scope => [2]
[2006/12/14 17:46:10, 2] passdb/pdb_ldap.c:ldapsam_setsamgrent(2772)
ldapsam_setsamgrent: 101 entries in the base!
[2006/12/14 17:46:10, 2] passdb/pdb_ldap.c:init_group_from_ldap(2000)
init_group_from_ldap: Entry found for group: 512
<<...loading all 101 groups...>
[2006/12/14 17:46:10, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
pop_sec_ctx (2202, 513) - sec_ctx_stack_ndx = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_samr_nt.c:load_group_domain_entries(457)
load_group_domain_entries: done
[2006/12/14 17:46:10, 10] lib/account_pol.c:account_policy_get(210)
account_policy_get: disconnect time:-1
[2006/12/14 17:46:10, 5]
rpc_parse/parse_samr.c:init_samr_r_query_dom_info(834)
init_samr_r_query_dom_info
[2006/12/14 17:46:10, 5] rpc_server/srv_samr_nt.c:_samr_query_dom_info(2209)
_samr_query_dom_info: 2209
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_query_dom_info
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 ptr_0 : 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 switch_value: 0002
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000008 sam_io_unk_info2 unk_inf2
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000008 smb_io_time logout
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0008 low : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c high: 80000000
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_unihdr hdr_comment
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0010 uni_str_len: 0036
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0012 uni_max_len: 0036
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0014 buffer : 00000001
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000018 smb_io_unihdr hdr_domain
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0018 uni_str_len: 0006
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001a uni_max_len: 0006
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
001c buffer : 00000001
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000020 smb_io_unihdr hdr_server
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0020 uni_str_len: 001e
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0022 uni_max_len: 001e
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0024 buffer : 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0028 seq_num : 4581aa02
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
002c seq_num : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0030 unknown_4 : 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0034 server_role : 00000003
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0038 unknown_6 : 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
003c num_domain_usrs : 000004eb
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0040 num_domain_grps: 00000060
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0044 num_local_grps: 00000000
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000048 smb_io_unistr2 uni_comment
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0048 uni_max_len: 0000001b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
004c offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0050 uni_str_len: 0000001b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
0054 buffer : S.e.r.v.i.d.o.r. .d.a. .J.u.s.t.i.c.a.
.M.i.l.i.t.a.r.
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
00008a smb_io_unistr2 uni_domain
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
008c uni_max_len: 00000003
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0090 offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0094 uni_str_len: 00000003
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
0098 buffer : J.M.U.
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
00009e smb_io_unistr2 uni_server
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
00a0 uni_max_len: 0000000f
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
00a4 offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
00a8 uni_str_len: 0000000f
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
00ac buffer : T.R.I.B.U.N.A.L.M.I.L.I.T.A.R.
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
00cc status: NT_STATUS_OK
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called samr successfully
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 220
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 30
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7364 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: samr: fault_state = 0 : data_sent_length = 0,
prs_offset(&p->out_data.rdata) = 208.
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 00e8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000034
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 000000d0
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..232]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=288
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43393
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 232 (0xE8)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 232 (0xE8)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=233
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 02 03 10 00 00 00 E8 00 00 00 34 00 00 ........ .....4..
[010] 00 D0 00 00 00 00 00 00 00 01 00 00 00 02 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 80 36 00 36 00 01 00 00 ........ .6.6....
[030] 00 06 00 06 00 01 00 00 00 1E 00 1E 00 01 00 00 ........ ........
[040] 00 02 AA 81 45 00 00 00 00 01 00 00 00 03 00 00 ....E... ........
[050] 00 01 00 00 00 EB 04 00 00 60 00 00 00 00 00 00 ........ .`......
[060] 00 1B 00 00 00 00 00 00 00 1B 00 00 00 53 00 65 ........ .....S.e
[070] 00 72 00 76 00 69 00 64 00 6F 00 72 00 20 00 64 .r.v.i.d .o.r. .d
[080] 00 61 00 20 00 4A 00 75 00 73 00 74 00 69 00 63 .a. .J.u .s.t.i.c
[090] 00 61 00 20 00 4D 00 69 00 6C 00 69 00 74 00 61 .a. .M.i .l.i.t.a
[0A0] 00 72 00 00 00 03 00 00 00 00 00 00 00 03 00 00 .r...... ........
[0B0] 00 4A 00 4D 00 55 00 00 00 0F 00 00 00 00 00 00 .J.M.U.. ........
[0C0] 00 0F 00 00 00 54 00 52 00 49 00 42 00 55 00 4E .....T.R .I.B.U.N
[0D0] 00 41 00 4C 00 4D 00 49 00 4C 00 49 00 54 00 41 .A.L.M.I .L.I.T.A
[0E0] 00 52 00 00 00 00 00 00 00 .R...... .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,292)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,292) wrote 292
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 132
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x84
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 15 of length 136
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=132
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43521
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 52 (0x34)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 512 (0x200)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 52 (0x34)
smb_vwv[12]= 80 (0x50)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29540 (0x7364)
smb_bcc=65
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 05 00 00 .\.P.I.P .E......
[010] 03 10 00 00 00 34 00 00 00 35 00 00 00 1C 00 00 .....4.. .5......
[020] 00 00 00 0B 00 00 00 00 00 02 00 00 00 00 00 00 ........ ........
[030] 00 00 AA 81 45 64 59 00 00 00 00 00 00 00 FA 00 ....EdY. ........
[040] 00 .
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=52 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7364
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7364 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x26 on pipe "samr" (pnum 7364)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83c3e70 max_trans_reply: 512
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 7364 name: samr open: Yes len: 52
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 52
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
0, incoming data = 52
[2006/12/14 17:46:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 52, len_needed_to_complete_hdr = 16,
receive_len = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 36
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len =
0, incoming data = 36
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0034
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000035
[2006/12/14 17:46:10, 5]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 36
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
36, incoming data = 36
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 0000001c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 000b
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0xb - api_rpcTNP: rpc command: SAMR_ENUM_DOM_GROUPS
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[5].fn == 0x8142c6f
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_enum_dom_groups
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000002
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 aa 81 45 64 59 00 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0014 start_idx: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0018 max_size : 0000fa00
[2006/12/14 17:46:10, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 00 AA
81 45 ........ .......E
[010] 64 59 00 00 dY..
[2006/12/14 17:46:10, 5]
rpc_server/srv_samr_nt.c:access_check_samr_function(201)
_samr_enum_dom_groups: access check ((granted: 0x000f07ff; required:
0x00000100)
[2006/12/14 17:46:10, 5] rpc_server/srv_samr_nt.c:_samr_enum_dom_groups(973)
samr_reply_enum_dom_groups: 973
[2006/12/14 17:46:10, 3] smbd/sec_ctx.c:push_sec_ctx(256)
push_sec_ctx(2202, 513) : sec_ctx_stack_ndx = 1
[2006/12/14 17:46:10, 3] smbd/uid.c:push_conn_ctx(365)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/12/14 17:46:10, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/12/14 17:46:10, 5] auth/auth_util.c:debug_nt_user_token(485)
NT user token: (NULL)
[2006/12/14 17:46:10, 5] auth/auth_util.c:debug_unix_user_token(506)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2006/12/14 17:46:10, 5] lib/smbldap.c:smbldap_search(1038)
smbldap_search: base => [ou=Grupos,dc=tribunal,dc=militar], filter =>
[(objectclass=sambaGroupMapping)], scope => [2]
[2006/12/14 17:46:10, 2] passdb/pdb_ldap.c:ldapsam_setsamgrent(2772)
ldapsam_setsamgrent: 101 entries in the base!
[2006/12/14 17:46:10, 2] passdb/pdb_ldap.c:init_group_from_ldap(2000)
init_group_from_ldap: Entry found for group: 512
<<... etc for the other groups ... >>
[2006/12/14 17:46:10, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
pop_sec_ctx (2202, 513) - sec_ctx_stack_ndx = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_samr_nt.c:get_group_domain_entries(907)
get_group_domain_entries: returning 96 entries
[2006/12/14 17:46:10, 10] rpc_parse/parse_samr.c:init_sam_entry(1291)
init_sam_entry: 512
[2006/12/14 17:46:10, 10] rpc_parse/parse_samr.c:init_sam_entry(1291)
init_sam_entry: 513
[2006/12/14 17:46:10, 10] rpc_parse/parse_samr.c:init_sam_entry(1291)
init_sam_entry: 514
<<... etc for the other groups ... >>
[2006/12/14 17:46:10, 5]
rpc_parse/parse_samr.c:init_samr_r_enum_dom_groups(3297)
init_samr_r_enum_dom_groups
[2006/12/14 17:46:10, 5] rpc_server/srv_samr_nt.c:_samr_enum_dom_groups(984)
samr_enum_dom_groups: 984
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_enum_dom_groups
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 next_idx : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 ptr_entries1: 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0008 num_entries2: 00000060
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c ptr_entries2: 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 num_entries3: 00000060
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000014 sam_io_sam_entry
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0014 rid: 00000200
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000018 smb_io_unihdr unihdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0018 uni_str_len: 0036
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001a uni_max_len: 0036
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
001c buffer : 00000001
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000020 sam_io_sam_entry
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 rid: 00000201
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000024 smb_io_unihdr unihdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0024 uni_str_len: 0030
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0026 uni_max_len: 0030
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0028 buffer : 00000001
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
00002c sam_io_sam_entry
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
002c rid: 00000202
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000030 smb_io_unihdr unihdr
<< ... blah blah blah ... >>
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
048c uni_str_len: 0020
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
048e uni_max_len: 0020
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0490 buffer : 00000001
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000494 smb_io_unistr2
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0494 uni_max_len: 0000001b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0498 offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
049c uni_str_len: 0000001b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
04a0 buffer : A.d.m.i.n.i.s.t.r.a.d.o.r.e.s. .d.o.
.D.o.m.i.n.i.o...
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
0004d6 smb_io_unistr2
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
04d8 uni_max_len: 00000018
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
04dc offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
04e0 uni_str_len: 00000018
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
04e4 buffer : U.s.u.a.r.i.o.s. .d.o. .D.o.m.i.n.i.o. .J.M.U...
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000514 smb_io_unistr2
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0514 uni_max_len: 00000017
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0518 offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
051c uni_str_len: 00000017
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
0520 buffer : C.o.n.v.i.d.a.d.o.s. .d.o. .D.o.m.i.n.i.o.s...
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
00054e smb_io_unistr2
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0550 uni_max_len: 00000018
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0554 offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0558 uni_str_len: 00000018
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
055c buffer : C.o.m.p.u.t.a.d.o.r.e.s. .d.o. .D.o.m.i.n.i.o...
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
00058c smb_io_unistr2
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
058c uni_max_len: 0000000d
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0590 offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0594 uni_str_len: 0000000d
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
0598 buffer : s.i.s._.i.n.t.r.a.n.e.t...
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
0005b2 smb_io_unistr2
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
05b4 uni_max_len: 00000009
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
05b8 offset : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
05bc uni_str_len: 00000009
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
<< ... keep loading info from the groups ... >>
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
1130 num_entries4: 00000060
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
1134 status: NT_STATUS_OK
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
api_rpcTNP: called samr successfully
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 54608
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 36
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7364 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
read_from_pipe: samr: fault_state = 0 : data_sent_length = 0,
prs_offset(&p->out_data.rdata) = 4408.
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 02
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 01
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 10b8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000035
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00001138
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2006/12/14 17:46:10, 5] smbd/ipc.c:send_trans_reply(89)
send_trans_reply: buffer 512 too large
[2006/12/14 17:46:10, 3] smbd/error.c:error_packet(145)
error packet at smbd/ipc.c(97) cmd=37 (SMBtrans) eclass=1 ecode=234
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..512]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=568
smb_com=0x25
smb_rcls=1
smb_reh=0
smb_err=234
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43521
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 512 (0x200)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 512 (0x200)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=513
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 02 01 10 00 00 00 B8 10 00 00 35 00 00 ........ .....5..
[010] 00 38 11 00 00 00 00 00 00 00 00 00 00 01 00 00 .8...... ........
[020] 00 60 00 00 00 01 00 00 00 60 00 00 00 00 02 00 .`...... .`......
[030] 00 36 00 36 00 01 00 00 00 01 02 00 00 30 00 30 .6.6.... .....0.0
[040] 00 01 00 00 00 02 02 00 00 2E 00 2E 00 01 00 00 ........ ........
[050] 00 03 02 00 00 30 00 30 00 01 00 00 00 BB 0B 00 .....0.0 ........
[060] 00 1A 00 1A 00 01 00 00 00 BF 0B 00 00 12 00 12 ........ ........
[070] 00 01 00 00 00 C1 0B 00 00 14 00 14 00 01 00 00 ........ ........
[080] 00 C3 0B 00 00 10 00 10 00 01 00 00 00 C5 0B 00 ........ ........
[090] 00 0C 00 0C 00 01 00 00 00 C7 0B 00 00 12 00 12 ........ ........
[0A0] 00 01 00 00 00 C9 0B 00 00 20 00 20 00 01 00 00 ........ . . ....
[0B0] 00 CB 0B 00 00 0C 00 0C 00 01 00 00 00 CD 0B 00 ........ ........
[0C0] 00 06 00 06 00 01 00 00 00 CF 0B 00 00 16 00 16 ........ ........
[0D0] 00 01 00 00 00 D1 0B 00 00 24 00 24 00 01 00 00 ........ .$.$....
[0E0] 00 D3 0B 00 00 28 00 28 00 01 00 00 00 D5 0B 00 .....(.( ........
[0F0] 00 1A 00 1A 00 01 00 00 00 D7 0B 00 00 1E 00 1E ........ ........
[100] 00 01 00 00 00 D9 0B 00 00 20 00 20 00 01 00 00 ........ . . ....
[110] 00 DB 0B 00 00 1A 00 1A 00 01 00 00 00 DD 0B 00 ........ ........
[120] 00 1E 00 1E 00 01 00 00 00 DF 0B 00 00 16 00 16 ........ ........
[130] 00 01 00 00 00 E1 0B 00 00 1A 00 1A 00 01 00 00 ........ ........
[140] 00 E3 0B 00 00 14 00 14 00 01 00 00 00 E5 0B 00 ........ ........
[150] 00 1E 00 1E 00 01 00 00 00 E7 0B 00 00 1C 00 1C ........ ........
[160] 00 01 00 00 00 E9 0B 00 00 1C 00 1C 00 01 00 00 ........ ........
[170] 00 EB 0B 00 00 1E 00 1E 00 01 00 00 00 ED 0B 00 ........ ........
[180] 00 14 00 14 00 01 00 00 00 EF 0B 00 00 16 00 16 ........ ........
[190] 00 01 00 00 00 F1 0B 00 00 16 00 16 00 01 00 00 ........ ........
[1A0] 00 F3 0B 00 00 12 00 12 00 01 00 00 00 F5 0B 00 ........ ........
[1B0] 00 10 00 10 00 01 00 00 00 F7 0B 00 00 10 00 10 ........ ........
[1C0] 00 01 00 00 00 F9 0B 00 00 0C 00 0C 00 01 00 00 ........ ........
[1D0] 00 FB 0B 00 00 12 00 12 00 01 00 00 00 FD 0B 00 ........ ........
[1E0] 00 10 00 10 00 01 00 00 00 FF 0B 00 00 0C 00 0C ........ ........
[1F0] 00 01 00 00 00 01 0C 00 00 0C 00 0C 00 01 00 00 ........ ........
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,572)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,572) wrote 572
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 55
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x37
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 16 of length 59
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=55
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43649
smt_wct=10
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=29540 (0x7364)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 2860 (0xB2C)
smb_vwv[ 6]= 2860 (0xB2C)
smb_vwv[ 7]=65535 (0xFFFF)
smb_vwv[ 8]=65535 (0xFFFF)
smb_vwv[ 9]= 3768 (0xEB8)
smb_bcc=0
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBreadX (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7364
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7364 (pipes_open=1)
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7364 name: samr len: 2860
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 4280, current_pdu_sent = 512
returning 2860 bytes.
[2006/12/14 17:46:10, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
readX-IPC pnum=7364 min=2860 max=2860 nread=2860
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=2919
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43649
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 2860 (0xB2C)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=2860
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 03 0C 00 00 0C 00 0C 00 01 00 00 00 05 0C 00 00 ........ ........
[010] 1A 00 1A 00 01 00 00 00 07 0C 00 00 10 00 10 00 ........ ........
[020] 01 00 00 00 09 0C 00 00 10 00 10 00 01 00 00 00 ........ ........
[030] 0B 0C 00 00 10 00 10 00 01 00 00 00 0D 0C 00 00 ........ ........
[040] 18 00 18 00 01 00 00 00 0F 0C 00 00 1C 00 1C 00 ........ ........
[050] 01 00 00 00 11 0C 00 00 1A 00 1A 00 01 00 00 00 ........ ........
[060] 13 0C 00 00 18 00 18 00 01 00 00 00 15 0C 00 00 ........ ........
[070] 14 00 14 00 01 00 00 00 17 0C 00 00 12 00 12 00 ........ ........
[080] 01 00 00 00 19 0C 00 00 10 00 10 00 01 00 00 00 ........ ........
[090] 1B 0C 00 00 14 00 14 00 01 00 00 00 1D 0C 00 00 ........ ........
[0A0] 14 00 14 00 01 00 00 00 1F 0C 00 00 14 00 14 00 ........ ........
[0B0] 01 00 00 00 21 0C 00 00 10 00 10 00 01 00 00 00 ....!... ........
[0C0] 23 0C 00 00 10 00 10 00 01 00 00 00 25 0C 00 00 #....... ....%...
[0D0] 10 00 10 00 01 00 00 00 27 0C 00 00 16 00 16 00 ........ '.......
[0E0] 01 00 00 00 29 0C 00 00 16 00 16 00 01 00 00 00 ....)... ........
[0F0] 33 0C 00 00 10 00 10 00 01 00 00 00 35 0C 00 00 3....... ....5...
[100] 16 00 16 00 01 00 00 00 37 0C 00 00 0C 00 0C 00 ........ 7.......
[110] 01 00 00 00 39 0C 00 00 20 00 20 00 01 00 00 00 ....9... . .....
[120] 3B 0C 00 00 1E 00 1E 00 01 00 00 00 3D 0C 00 00 ;....... ....=...
[130] 0C 00 0C 00 01 00 00 00 3F 0C 00 00 12 00 12 00 ........ ?.......
[140] 01 00 00 00 41 0C 00 00 20 00 20 00 01 00 00 00 ....A... . .....
[150] 43 0C 00 00 0C 00 0C 00 01 00 00 00 45 0C 00 00 C....... ....E...
[160] 1A 00 1A 00 01 00 00 00 47 0C 00 00 1A 00 1A 00 ........ G.......
[170] 01 00 00 00 49 0C 00 00 1E 00 1E 00 01 00 00 00 ....I... ........
[180] 4B 0C 00 00 2C 00 2C 00 01 00 00 00 4D 0C 00 00 K...,.,. ....M...
[190] 22 00 22 00 01 00 00 00 4F 0C 00 00 16 00 16 00 "."..... O.......
[1A0] 01 00 00 00 51 0C 00 00 0C 00 0C 00 01 00 00 00 ....Q... ........
[1B0] 53 0C 00 00 0C 00 0C 00 01 00 00 00 55 0C 00 00 S....... ....U...
[1C0] 0C 00 0C 00 01 00 00 00 57 0C 00 00 0C 00 0C 00 ........ W.......
[1D0] 01 00 00 00 59 0C 00 00 0C 00 0C 00 01 00 00 00 ....Y... ........
[1E0] 5B 0C 00 00 0C 00 0C 00 01 00 00 00 5D 0C 00 00 [....... ....]...
[1F0] 0C 00 0C 00 01 00 00 00 5F 0C 00 00 0C 00 0C 00 ........ _.......
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,2923)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,2923) wrote 2923
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 55
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x37
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 17 of length 59
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=55
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43777
smt_wct=10
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=29540 (0x7364)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 2860 (0xB2C)
smb_vwv[ 6]= 2860 (0xB2C)
smb_vwv[ 7]=65535 (0xFFFF)
smb_vwv[ 8]=65535 (0xFFFF)
smb_vwv[ 9]= 3372 (0xD2C)
smb_bcc=0
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBreadX (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7364
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7364 (pipes_open=1)
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7364 name: samr len: 2860
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 4280, current_pdu_sent = 3372
returning 908 bytes.
[2006/12/14 17:46:10, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
readX-IPC pnum=7364 min=2860 max=2860 nread=908
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=967
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43777
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 908 (0x38C)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=908
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 00 00 00 06 00 00 00 00 00 00 00 06 00 00 00 ........ ........
[010] 73 00 65 00 62 00 69 00 62 00 00 00 10 00 00 00 s.e.b.i. b.......
[020] 00 00 00 00 10 00 00 00 67 00 61 00 62 00 6D 00 ........ g.a.b.m.
[030] 69 00 6E 00 6C 00 65 00 6E 00 63 00 61 00 73 00 i.n.l.e. n.c.a.s.
[040] 74 00 72 00 65 00 00 00 0F 00 00 00 00 00 00 00 t.r.e... ........
[050] 0F 00 00 00 67 00 61 00 62 00 6D 00 69 00 6E 00 ....g.a. b.m.i.n.
[060] 6C 00 6F 00 75 00 72 00 65 00 6E 00 63 00 6F 00 l.o.u.r. e.n.c.o.
[070] 00 00 00 00 06 00 00 00 00 00 00 00 06 00 00 00 ........ ........
[080] 73 00 65 00 73 00 65 00 6C 00 00 00 09 00 00 00 s.e.s.e. l.......
[090] 00 00 00 00 09 00 00 00 61 00 72 00 6D 00 61 00 ........ a.r.m.a.
[0A0] 7A 00 65 00 6E 00 61 00 00 00 00 00 10 00 00 00 z.e.n.a. ........
[0B0] 00 00 00 00 10 00 00 00 67 00 61 00 62 00 6D 00 ........ g.a.b.m.
[0C0] 69 00 6E 00 61 00 70 00 70 00 61 00 72 00 69 00 i.n.a.p. p.a.r.i.
[0D0] 63 00 69 00 6F 00 00 00 06 00 00 00 00 00 00 00 c.i.o... ........
[0E0] 06 00 00 00 73 00 65 00 69 00 6E 00 61 00 00 00 ....s.e. i.n.a...
[0F0] 0D 00 00 00 00 00 00 00 0D 00 00 00 67 00 61 00 ........ ....g.a.
[100] 62 00 6D 00 69 00 6E 00 68 00 65 00 72 00 6D 00 b.m.i.n. h.e.r.m.
[110] 65 00 73 00 00 00 00 00 0D 00 00 00 00 00 00 00 e.s..... ........
[120] 0D 00 00 00 67 00 61 00 62 00 6D 00 69 00 6E 00 ....g.a. b.m.i.n.
[130] 72 00 61 00 79 00 64 00 65 00 72 00 00 00 00 00 r.a.y.d. e.r.....
[140] 0F 00 00 00 00 00 00 00 0F 00 00 00 67 00 61 00 ........ ....g.a.
[150] 62 00 6D 00 69 00 6E 00 63 00 6F 00 6E 00 66 00 b.m.i.n. c.o.n.f.
[160] 6F 00 72 00 74 00 6F 00 00 00 00 00 16 00 00 00 o.r.t.o. ........
[170] 00 00 00 00 16 00 00 00 64 00 69 00 72 00 65 00 ........ d.i.r.e.
[180] 74 00 6F 00 72 00 65 00 73 00 65 00 73 00 65 00 t.o.r.e. s.e.s.e.
[190] 63 00 72 00 65 00 74 00 61 00 72 00 69 00 6F 00 c.r.e.t. a.r.i.o.
[1A0] 73 00 00 00 11 00 00 00 00 00 00 00 11 00 00 00 s....... ........
[1B0] 63 00 68 00 65 00 66 00 65 00 73 00 64 00 65 00 c.h.e.f. e.s.d.e.
[1C0] 67 00 61 00 62 00 69 00 6E 00 65 00 74 00 65 00 g.a.b.i. n.e.t.e.
[1D0] 00 00 00 00 0B 00 00 00 00 00 00 00 0B 00 00 00 ........ ........
[1E0] 61 00 73 00 73 00 65 00 73 00 73 00 6F 00 72 00 a.s.s.e. s.s.o.r.
[1F0] 65 00 73 00 00 00 00 00 06 00 00 00 00 00 00 00 e.s..... ........
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,971)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,971) wrote 971
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 18 of length 45
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43905
smt_wct=3
smb_vwv[ 0]=29540 (0x7364)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7364
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7364 (pipes_open=1)
[2006/12/14 17:46:10, 5] smbd/pipes.c:reply_pipe_close(260)
reply_pipe_close: pnum:7364
[2006/12/14 17:46:10, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 00 AA
81 45 ........ .......E
[010] 64 59 00 00 dY..
[2006/12/14 17:46:10, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2006/12/14 17:46:10, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 00 AA
81 45 ........ .......E
[010] 64 59 00 00 dY..
[2006/12/14 17:46:10, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
Closed policy
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
close_policy_by_pipe: deleted handle list for pipe samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name samr pnum=7364 (pipes_open=0)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=43905
smt_wct=0
smb_bcc=0
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,39)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,39) wrote 39
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 90
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x5a
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 19 of length 94
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=90
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44033
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 90 (0x5A)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 83 (0x53)
smb_vwv[15]= 0 (0x0)
smb_bcc=23
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 53 00 41 .\.P.I.P .E.\.S.A
[010] 00 4D 00 52 00 00 00 .M.R...
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE\SAMR> data=0 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <SAMR> name
[2006/12/14 17:46:10, 4] smbd/ipc.c:named_pipe(345)
named pipe command from Win95 (wow!)
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=0
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(285)
Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..0]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=56
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44033
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=1
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,60)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,60) wrote 60
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 88
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x58
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 20 of length 92
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=88
smb_com=0x2d
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44161
smt_wct=15
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 1 (0x1)
smb_vwv[ 3]= 194 (0xC2)
smb_vwv[ 4]= 22 (0x16)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]=36322 (0x8DE2)
smb_vwv[ 7]=17793 (0x4581)
smb_vwv[ 8]= 1 (0x1)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 0 (0x0)
smb_vwv[14]= 0 (0x0)
smb_bcc=23
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 17 5C 00 50 00 49 00 50 00 45 00 5C 00 73 00 61 .\.P.I.P .E.\.s.a
[010] 00 6D 00 72 00 00 00 .m.r...
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBopenX (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] smbd/pipes.c:reply_open_pipe_and_X(61)
Opening pipe \PIPE\samr.
[2006/12/14 17:46:10, 3] smbd/pipes.c:reply_open_pipe_and_X(85)
Known pipe samr opening.
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
Open pipe requested samr (pipes_open=0)
[2006/12/14 17:46:10, 4]
rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
Create pipe requested samr
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
init_pipe_handles: created handle list for pipe samr
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
init_pipe_handles: pipe_handles ref count = 1 for pipe samr
[2006/12/14 17:46:10, 4]
rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
Created internal pipe samr (pipes_open=0)
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
Opened pipe samr with handle 7365 (pipes_open=1)
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
open pipes: name samr pnum=7365
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=65
smb_com=0x2d
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44161
smt_wct=15
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=29541 (0x7365)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 2 (0x2)
smb_vwv[10]=50944 (0xC700)
smb_vwv[11]= 1 (0x1)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 0 (0x0)
smb_vwv[14]= 0 (0x0)
smb_bcc=0
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,69)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,69) wrote 69
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 82
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x52
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 21 of length 86
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=82
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44289
smt_wct=16
smb_vwv[ 0]= 2 (0x2)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 2 (0x2)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 1 (0x1)
smb_vwv[15]=29541 (0x7365)
smb_bcc=15
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 00 01 .\.P.I.P .E.....
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=0 params=2 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7365
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7365 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x1 on pipe "samr" (pnum 7365)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83e2df8 max_trans_reply: 0
[2006/12/14 17:46:10, 4] smbd/ipc.c:api_SNPHS(221)
SetNamedPipeHandleState to code 100
[2006/12/14 17:46:10, 3]
rpc_server/srv_pipe_hnd.c:set_rpc_pipe_hnd_state(1050)
set_rpc_pipe_hnd_state: Setting pipe device state=100 on pipe (name=samr)
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..0]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=56
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44289
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=1
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,60)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,60) wrote 60
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 152
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x98
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 22 of length 156
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=152
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44417
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 72 (0x48)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 512 (0x200)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 72 (0x48)
smb_vwv[12]= 80 (0x50)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29541 (0x7365)
smb_bcc=85
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 05 00 0B .\.P.I.P .E......
[010] 00 10 00 00 00 48 00 00 00 EF EF EF EF 30 16 30 .....H.. .....0.0
[020] 16 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 ........ .....xW4
[030] 12 34 12 CD AB EF 00 01 23 45 67 89 AC 01 00 00 .4...... #Eg.....
[040] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[050] 60 02 00 00 00 `....
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=72 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7365
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7365 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x26 on pipe "samr" (pnum 7365)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83e2df8 max_trans_reply: 512
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 7365 name: samr open: Yes len: 72
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 72
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
0, incoming data = 72
[2006/12/14 17:46:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16,
receive_len = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len =
0, incoming data = 56
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 0b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0048
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : efefefef
[2006/12/14 17:46:10, 5]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 11, flags = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
56, incoming data = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 11
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
api_pipe_bind_req: decode request. 876
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_rb
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_bba
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0000 max_tsize: 1630
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0002 max_rsize: 1630
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 assoc_gid: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0008 num_elements: 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000c context_id : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
000e num_syntaxes: 01
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
00000f smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 data : 12345778
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 data : 1234
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0016 data : abcd
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
0018 data : ef 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
001a data : 01 23 45 67 89 ac
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 version: 00000001
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000024 smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000024 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0024 data : 8a885d04
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0028 data : 1ceb
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
002a data : 11c9
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002c data : 9f e8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002e data : 08 00 2b 10 48 60
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0034 version: 00000002
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
api_pipe_bind_req: make response. 1017
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
check_bind_req for \PIPE\samr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_ba
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_bba
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0000 max_tsize: 10b8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0002 max_rsize: 10b8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 assoc_gid: 000053f0
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000008 smb_io_rpc_addr_str
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 len: 000c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000a str: \PIPE\lsass.
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000016 smb_io_rpc_results
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0018 num_results: 01
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001c result : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001e reason : 0000
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000020 smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000020 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 data : 8a885d04
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0024 data : 1ceb
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0026 data : 11c9
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
0028 data : 9f e8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002a data : 08 00 2b 10 48 60
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0030 version: 00000002
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 0c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0044
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : efefefef
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 56
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7365 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 68, current_pdu_sent = 0
returning 68 bytes.
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..68]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44417
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 68 (0x44)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 68 (0x44)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=69
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 EF EF EF ........ .D......
[010] EF B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE
[020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........
[030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[040] 60 02 00 00 00 `....
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,128)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,128) wrote 128
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 140
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x8c
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 23 of length 144
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=140
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44545
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 60 (0x3C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 512 (0x200)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 60 (0x3C)
smb_vwv[12]= 80 (0x50)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29541 (0x7365)
smb_bcc=73
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 05 00 00 .\.P.I.P .E......
[010] 03 10 00 00 00 3C 00 00 00 36 00 00 00 24 00 00 .....<.. .6...$..
[020] 00 00 00 33 00 00 00 00 00 02 00 00 00 00 00 00 ...3.... ........
[030] 00 00 AA 81 45 64 59 00 00 04 00 89 AC 00 00 00 ....EdY. ........
[040] 00 30 75 00 00 00 E8 03 00 .0u..... .
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=60 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7365
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7365 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x26 on pipe "samr" (pnum 7365)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83e2df8 max_trans_reply: 512
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 7365 name: samr open: Yes len: 60
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 60
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
0, incoming data = 60
[2006/12/14 17:46:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16,
receive_len = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len =
0, incoming data = 44
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 003c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000036
[2006/12/14 17:46:10, 5]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
44, incoming data = 44
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000024
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0033
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0x33 - api_rpcTNP: rpc command: SAMR_QUERY_DISPINFO4
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[28].fn == 0x8142f2b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_query_dispinfo
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd domain_pol
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000002
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 aa 81 45 64 59 00 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 switch_level: 0004
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0018 start_idx : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
001c max_entries : 00007530
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 max_size : 0003e800
[2006/12/14 17:46:10, 5] rpc_server/srv_samr_nt.c:_samr_query_dispinfo(1052)
samr_reply_query_dispinfo: 1052
[2006/12/14 17:46:10, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(170)
Policy not found: [000] 00 00 00 00 02 00 00 00 00 00 00 00 00 AA 81
45 ........ .......E
[010] 64 59 00 00 dY..
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_query_dispinfo
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 total_size : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data_size : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 switch_level: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c num_entries : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 ptr_entries : 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_INVALID_HANDLE
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1566)
api_rpcTNP: bad handle fault return.
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 23
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0020
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000036
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000018 smb_io_rpc_hdr_fault fault
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0018 status : NT code 0x1c00001a
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
001c reserved: 00000000
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 44
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7365 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 32, current_pdu_sent = 0
returning 32 bytes.
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..32]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=88
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44545
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 32 (0x20)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 32 (0x20)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=33
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 03 23 10 00 00 00 20 00 00 00 36 00 00 ....#... . ...6..
[010] 00 00 00 00 00 00 00 00 00 1A 00 00 1C 00 00 00 ........ ........
[020] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,92)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,92) wrote 92
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 24 of length 45
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44673
smt_wct=3
smb_vwv[ 0]=29541 (0x7365)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7365
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7365 (pipes_open=1)
[2006/12/14 17:46:10, 5] smbd/pipes.c:reply_pipe_close(260)
reply_pipe_close: pnum:7365
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
close_policy_by_pipe: deleted handle list for pipe samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name samr pnum=7365 (pipes_open=0)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44673
smt_wct=0
smb_bcc=0
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,39)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,39) wrote 39
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 90
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x5a
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 25 of length 94
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=90
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44801
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 90 (0x5A)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 83 (0x53)
smb_vwv[15]= 0 (0x0)
smb_bcc=23
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 53 00 41 .\.P.I.P .E.\.S.A
[010] 00 4D 00 52 00 00 00 .M.R...
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE\SAMR> data=0 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <SAMR> name
[2006/12/14 17:46:10, 4] smbd/ipc.c:named_pipe(345)
named pipe command from Win95 (wow!)
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=0
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(285)
Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..0]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=56
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44801
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=1
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,60)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,60) wrote 60
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 88
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x58
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 26 of length 92
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=88
smb_com=0x2d
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44929
smt_wct=15
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 1 (0x1)
smb_vwv[ 3]= 194 (0xC2)
smb_vwv[ 4]= 22 (0x16)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]=36322 (0x8DE2)
smb_vwv[ 7]=17793 (0x4581)
smb_vwv[ 8]= 1 (0x1)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 0 (0x0)
smb_vwv[14]= 0 (0x0)
smb_bcc=23
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 17 5C 00 50 00 49 00 50 00 45 00 5C 00 73 00 61 .\.P.I.P .E.\.s.a
[010] 00 6D 00 72 00 00 00 .m.r...
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBopenX (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] smbd/pipes.c:reply_open_pipe_and_X(61)
Opening pipe \PIPE\samr.
[2006/12/14 17:46:10, 3] smbd/pipes.c:reply_open_pipe_and_X(85)
Known pipe samr opening.
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
Open pipe requested samr (pipes_open=0)
[2006/12/14 17:46:10, 4]
rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
Create pipe requested samr
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
init_pipe_handles: created handle list for pipe samr
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
init_pipe_handles: pipe_handles ref count = 1 for pipe samr
[2006/12/14 17:46:10, 4]
rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
Created internal pipe samr (pipes_open=0)
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
Opened pipe samr with handle 7366 (pipes_open=1)
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
open pipes: name samr pnum=7366
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=65
smb_com=0x2d
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=44929
smt_wct=15
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=29542 (0x7366)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 2 (0x2)
smb_vwv[10]=50944 (0xC700)
smb_vwv[11]= 1 (0x1)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 0 (0x0)
smb_vwv[14]= 0 (0x0)
smb_bcc=0
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,69)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,69) wrote 69
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 82
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x52
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 27 of length 86
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=82
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45057
smt_wct=16
smb_vwv[ 0]= 2 (0x2)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 2 (0x2)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 1 (0x1)
smb_vwv[15]=29542 (0x7366)
smb_bcc=15
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 00 01 .\.P.I.P .E.....
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=0 params=2 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7366
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7366 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x1 on pipe "samr" (pnum 7366)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83e2df8 max_trans_reply: 0
[2006/12/14 17:46:10, 4] smbd/ipc.c:api_SNPHS(221)
SetNamedPipeHandleState to code 100
[2006/12/14 17:46:10, 3]
rpc_server/srv_pipe_hnd.c:set_rpc_pipe_hnd_state(1050)
set_rpc_pipe_hnd_state: Setting pipe device state=100 on pipe (name=samr)
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..0]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=56
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45057
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=1
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,60)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,60) wrote 60
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 152
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x98
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 28 of length 156
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=152
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45185
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 72 (0x48)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 512 (0x200)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 72 (0x48)
smb_vwv[12]= 80 (0x50)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29542 (0x7366)
smb_bcc=85
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 05 00 0B .\.P.I.P .E......
[010] 00 10 00 00 00 48 00 00 00 EF EF EF EF 30 16 30 .....H.. .....0.0
[020] 16 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 ........ .....xW4
[030] 12 34 12 CD AB EF 00 01 23 45 67 89 AC 01 00 00 .4...... #Eg.....
[040] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[050] 60 02 00 00 00 `....
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=72 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7366
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7366 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x26 on pipe "samr" (pnum 7366)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83e2df8 max_trans_reply: 512
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 7366 name: samr open: Yes len: 72
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 72
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
0, incoming data = 72
[2006/12/14 17:46:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16,
receive_len = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len =
0, incoming data = 56
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 0b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0048
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : efefefef
[2006/12/14 17:46:10, 5]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 11, flags = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
56, incoming data = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 11
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
api_pipe_bind_req: decode request. 876
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_rb
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_bba
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0000 max_tsize: 1630
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0002 max_rsize: 1630
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 assoc_gid: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0008 num_elements: 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000c context_id : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
000e num_syntaxes: 01
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
00000f smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 data : 12345778
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 data : 1234
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0016 data : abcd
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
0018 data : ef 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
001a data : 01 23 45 67 89 ac
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 version: 00000001
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000024 smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000024 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0024 data : 8a885d04
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0028 data : 1ceb
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
002a data : 11c9
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002c data : 9f e8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002e data : 08 00 2b 10 48 60
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0034 version: 00000002
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
api_pipe_bind_req: make response. 1017
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
check_bind_req for \PIPE\samr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_ba
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_bba
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0000 max_tsize: 10b8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0002 max_rsize: 10b8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 assoc_gid: 000053f0
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000008 smb_io_rpc_addr_str
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 len: 000c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000a str: \PIPE\lsass.
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000016 smb_io_rpc_results
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0018 num_results: 01
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001c result : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001e reason : 0000
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000020 smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000020 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 data : 8a885d04
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0024 data : 1ceb
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0026 data : 11c9
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
0028 data : 9f e8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002a data : 08 00 2b 10 48 60
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0030 version: 00000002
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 0c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0044
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : efefefef
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 56
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7366 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 68, current_pdu_sent = 0
returning 68 bytes.
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..68]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45185
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 68 (0x44)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 68 (0x44)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=69
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 EF EF EF ........ .D......
[010] EF B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE
[020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........
[030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[040] 60 02 00 00 00 `....
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,128)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,128) wrote 128
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 124
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x7c
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 29 of length 128
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45313
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 512 (0x200)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 80 (0x50)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29542 (0x7366)
smb_bcc=57
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 05 00 00 .\.P.I.P .E......
[010] 03 10 00 00 00 2C 00 00 00 37 00 00 00 14 00 00 .....,.. .7......
[020] 00 00 00 01 00 00 00 00 00 02 00 00 00 00 00 00 ........ ........
[030] 00 00 AA 81 45 64 59 00 00 ....EdY. .
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=44 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7366
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7366 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x26 on pipe "samr" (pnum 7366)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83e2df8 max_trans_reply: 512
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 7366 name: samr open: Yes len: 44
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
0, incoming data = 44
[2006/12/14 17:46:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16,
receive_len = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len =
0, incoming data = 28
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000037
[2006/12/14 17:46:10, 5]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
28, incoming data = 28
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0001
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[0].fn == 0x8142410
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_close_hnd
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000002
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 aa 81 45 64 59 00 00
[2006/12/14 17:46:10, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(170)
Policy not found: [000] 00 00 00 00 02 00 00 00 00 00 00 00 00 AA 81
45 ........ .......E
[010] 64 59 00 00 dY..
[2006/12/14 17:46:10, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(196)
Error closing policy
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_close_hnd
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OBJECT_NAME_INVALID
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1566)
api_rpcTNP: bad handle fault return.
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 23
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0020
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000037
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000018 smb_io_rpc_hdr_fault fault
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0018 status : NT code 0x1c00001a
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
001c reserved: 00000000
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7366 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 32, current_pdu_sent = 0
returning 32 bytes.
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..32]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=88
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45313
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 32 (0x20)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 32 (0x20)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=33
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 03 23 10 00 00 00 20 00 00 00 37 00 00 ....#... . ...7..
[010] 00 00 00 00 00 00 00 00 00 1A 00 00 1C 00 00 00 ........ ........
[020] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,92)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,92) wrote 92
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 30 of length 45
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45441
smt_wct=3
smb_vwv[ 0]=29542 (0x7366)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7366
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7366 (pipes_open=1)
[2006/12/14 17:46:10, 5] smbd/pipes.c:reply_pipe_close(260)
reply_pipe_close: pnum:7366
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
close_policy_by_pipe: deleted handle list for pipe samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name samr pnum=7366 (pipes_open=0)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45441
smt_wct=0
smb_bcc=0
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,39)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,39) wrote 39
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 90
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x5a
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 31 of length 94
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=90
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45569
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 90 (0x5A)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 83 (0x53)
smb_vwv[15]= 0 (0x0)
smb_bcc=23
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 53 00 41 .\.P.I.P .E.\.S.A
[010] 00 4D 00 52 00 00 00 .M.R...
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE\SAMR> data=0 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <SAMR> name
[2006/12/14 17:46:10, 4] smbd/ipc.c:named_pipe(345)
named pipe command from Win95 (wow!)
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=0
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(285)
Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..0]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=56
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45569
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=1
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,60)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,60) wrote 60
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 88
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x58
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 32 of length 92
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=88
smb_com=0x2d
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45697
smt_wct=15
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 1 (0x1)
smb_vwv[ 3]= 194 (0xC2)
smb_vwv[ 4]= 22 (0x16)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]=36322 (0x8DE2)
smb_vwv[ 7]=17793 (0x4581)
smb_vwv[ 8]= 1 (0x1)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 0 (0x0)
smb_vwv[14]= 0 (0x0)
smb_bcc=23
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 17 5C 00 50 00 49 00 50 00 45 00 5C 00 73 00 61 .\.P.I.P .E.\.s.a
[010] 00 6D 00 72 00 00 00 .m.r...
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBopenX (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] smbd/pipes.c:reply_open_pipe_and_X(61)
Opening pipe \PIPE\samr.
[2006/12/14 17:46:10, 3] smbd/pipes.c:reply_open_pipe_and_X(85)
Known pipe samr opening.
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
Open pipe requested samr (pipes_open=0)
[2006/12/14 17:46:10, 4]
rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
Create pipe requested samr
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
init_pipe_handles: created handle list for pipe samr
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
init_pipe_handles: pipe_handles ref count = 1 for pipe samr
[2006/12/14 17:46:10, 4]
rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
Created internal pipe samr (pipes_open=0)
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
Opened pipe samr with handle 7367 (pipes_open=1)
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
open pipes: name samr pnum=7367
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=65
smb_com=0x2d
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45697
smt_wct=15
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=29543 (0x7367)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 2 (0x2)
smb_vwv[10]=50944 (0xC700)
smb_vwv[11]= 1 (0x1)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 0 (0x0)
smb_vwv[14]= 0 (0x0)
smb_bcc=0
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,69)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,69) wrote 69
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 82
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x52
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 33 of length 86
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=82
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45825
smt_wct=16
smb_vwv[ 0]= 2 (0x2)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 2 (0x2)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 0 (0x0)
smb_vwv[12]= 0 (0x0)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 1 (0x1)
smb_vwv[15]=29543 (0x7367)
smb_bcc=15
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 00 01 .\.P.I.P .E.....
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=0 params=2 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7367
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7367 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x1 on pipe "samr" (pnum 7367)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83c3e70 max_trans_reply: 0
[2006/12/14 17:46:10, 4] smbd/ipc.c:api_SNPHS(221)
SetNamedPipeHandleState to code 100
[2006/12/14 17:46:10, 3]
rpc_server/srv_pipe_hnd.c:set_rpc_pipe_hnd_state(1050)
set_rpc_pipe_hnd_state: Setting pipe device state=100 on pipe (name=samr)
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..0]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=56
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45825
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=1
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,60)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,60) wrote 60
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 152
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x98
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 34 of length 156
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=152
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45953
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 72 (0x48)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 512 (0x200)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 72 (0x48)
smb_vwv[12]= 80 (0x50)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29543 (0x7367)
smb_bcc=85
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 05 00 0B .\.P.I.P .E......
[010] 00 10 00 00 00 48 00 00 00 EF EF EF EF 30 16 30 .....H.. .....0.0
[020] 16 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 ........ .....xW4
[030] 12 34 12 CD AB EF 00 01 23 45 67 89 AC 01 00 00 .4...... #Eg.....
[040] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[050] 60 02 00 00 00 `....
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=72 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7367
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7367 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x26 on pipe "samr" (pnum 7367)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83c3e70 max_trans_reply: 512
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 7367 name: samr open: Yes len: 72
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 72
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
0, incoming data = 72
[2006/12/14 17:46:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16,
receive_len = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len =
0, incoming data = 56
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 0b
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0048
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : efefefef
[2006/12/14 17:46:10, 5]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 11, flags = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
56, incoming data = 56
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 11
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
api_pipe_bind_req: decode request. 876
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_rb
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_bba
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0000 max_tsize: 1630
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0002 max_rsize: 1630
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 assoc_gid: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0008 num_elements: 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000c context_id : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
000e num_syntaxes: 01
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
00000f smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 data : 12345778
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 data : 1234
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0016 data : abcd
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
0018 data : ef 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
001a data : 01 23 45 67 89 ac
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 version: 00000001
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000024 smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000024 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0024 data : 8a885d04
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0028 data : 1ceb
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
002a data : 11c9
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002c data : 9f e8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002e data : 08 00 2b 10 48 60
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0034 version: 00000002
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
api_pipe_bind_req: make response. 1017
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
check_bind_req for \PIPE\samr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_ba
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_bba
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0000 max_tsize: 10b8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0002 max_rsize: 10b8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 assoc_gid: 000053f0
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000008 smb_io_rpc_addr_str
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 len: 000c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000a str: \PIPE\lsass.
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000016 smb_io_rpc_results
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0018 num_results: 01
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001c result : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
001e reason : 0000
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000020 smb_io_rpc_iface
[2006/12/14 17:46:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
000020 smb_io_uuid uuid
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0020 data : 8a885d04
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0024 data : 1ceb
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0026 data : 11c9
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
0028 data : 9f e8
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
002a data : 08 00 2b 10 48 60
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0030 version: 00000002
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 0c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0044
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : efefefef
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 56
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7367 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 68, current_pdu_sent = 0
returning 68 bytes.
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..68]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=45953
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 68 (0x44)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 68 (0x44)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=69
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 EF EF EF ........ .D......
[010] EF B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE
[020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........
[030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[040] 60 02 00 00 00 `....
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,128)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,128) wrote 128
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 124
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x7c
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 35 of length 128
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32768
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=46081
smt_wct=16
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 44 (0x2C)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 512 (0x200)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 80 (0x50)
smb_vwv[11]= 44 (0x2C)
smb_vwv[12]= 80 (0x50)
smb_vwv[13]= 2 (0x2)
smb_vwv[14]= 38 (0x26)
smb_vwv[15]=29543 (0x7367)
smb_bcc=57
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 5C 00 50 00 49 00 50 00 45 00 00 00 05 00 00 .\.P.I.P .E......
[010] 03 10 00 00 00 2C 00 00 00 38 00 00 00 14 00 00 .....,.. .8......
[020] 00 00 00 01 00 00 00 00 00 01 00 00 00 00 00 00 ........ ........
[030] 00 00 AA 81 45 64 59 00 00 ....EdY. .
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBtrans (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 3] smbd/ipc.c:reply_trans(539)
trans <\PIPE> data=44 params=0 setup=2
[2006/12/14 17:46:10, 5] smbd/ipc.c:reply_trans(560)
calling named_pipe
[2006/12/14 17:46:10, 3] smbd/ipc.c:named_pipe(334)
named pipe command on <> name
[2006/12/14 17:46:10, 5] smbd/ipc.c:api_fd_reply(265)
api_fd_reply
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7367
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7367 (pipes_open=1)
[2006/12/14 17:46:10, 3] smbd/ipc.c:api_fd_reply(294)
Got API command 0x26 on pipe "samr" (pnum 7367)
[2006/12/14 17:46:10, 10] smbd/ipc.c:api_fd_reply(299)
api_fd_reply: p:0x83c3e70 max_trans_reply: 512
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
write_to_pipe: 7367 name: samr open: Yes len: 44
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 44
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
0, incoming data = 44
[2006/12/14 17:46:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16,
receive_len = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 16
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len =
0, incoming data = 28
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 002c
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000038
[2006/12/14 17:46:10, 5]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
unmarshall_rpc_header: using little-endian RPC
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
unmarshall_rpc_header: type = 0, flags = 3
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
write_to_pipe: data_left = 28
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len =
28, incoming data = 28
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
process_complete_pdu: processing packet type 0
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr_req req
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 alloc_hint: 00000014
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0004 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0006 opnum : 0001
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
Requested \PIPE\samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
api_rpc_cmds[0].fn == 0x8142410
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_q_close_hnd
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000001
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 aa 81 45 64 59 00 00
[2006/12/14 17:46:10, 4]
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(170)
Policy not found: [000] 00 00 00 00 01 00 00 00 00 00 00 00 00 AA 81
45 ........ .......E
[010] 64 59 00 00 dY..
[2006/12/14 17:46:10, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(196)
Error closing policy
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 samr_io_r_close_hnd
[2006/12/14 17:46:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_pol_hnd pol
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0000 data1: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0004 data2: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 data3: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a data4: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
000c data5: 00 00 00 00 00 00 00 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0014 status: NT_STATUS_OBJECT_NAME_INVALID
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1566)
api_rpcTNP: bad handle fault return.
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000000 smb_io_rpc_hdr
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0000 major : 05
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0001 minor : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0002 pkt_type : 03
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0003 flags : 23
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0004 pack_type0: 10
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0005 pack_type1: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0006 pack_type2: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0007 pack_type3: 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0008 frag_len : 0020
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
000a auth_len : 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
000c call_id : 00000038
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000010 smb_io_rpc_hdr_resp resp
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
0010 alloc_hint: 00000000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
0014 context_id: 0000
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0016 cancel_ct : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
0017 reserved : 00
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
000018 smb_io_rpc_hdr_fault fault
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
0018 status : NT code 0x1c00001a
[2006/12/14 17:46:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
001c reserved: 00000000
[2006/12/14 17:46:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
free_pipe_context: destroying talloc pool of size 0
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
write_to_pipe: data_used = 28
[2006/12/14 17:46:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
read_from_pipe: 7367 name: samr len: 512
[2006/12/14 17:46:10, 10]
rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
read_from_pipe: samr: current_pdu_len = 32, current_pdu_sent = 0
returning 32 bytes.
[2006/12/14 17:46:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
copy_trans_params_and_data: params[0..0] data[0..32]
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=88
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=46081
smt_wct=10
smb_vwv[ 0]= 0 (0x0)
smb_vwv[ 1]= 32 (0x20)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 56 (0x38)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 32 (0x20)
smb_vwv[ 7]= 56 (0x38)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_bcc=33
[2006/12/14 17:46:10, 10] lib/util.c:dump_data(1995)
[000] 00 05 00 03 23 10 00 00 00 20 00 00 00 38 00 00 ....#... . ...8..
[010] 00 00 00 00 00 00 00 00 00 1A 00 00 1C 00 00 00 ........ ........
[020] 00 .
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,92)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,92) wrote 92
[2006/12/14 17:46:10, 10]
lib/util_sock.c:read_smb_length_return_keepalive(505)
got smb length of 41
[2006/12/14 17:46:10, 6] smbd/process.c:process_smb(1090)
got message type 0x0 of len 0x29
[2006/12/14 17:46:10, 3] smbd/process.c:process_smb(1091)
Transaction 36 of length 45
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=41
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=46209
smt_wct=3
smb_vwv[ 0]=29543 (0x7367)
smb_vwv[ 1]=65535 (0xFFFF)
smb_vwv[ 2]=65535 (0xFFFF)
smb_bcc=0
[2006/12/14 17:46:10, 3] smbd/process.c:switch_message(886)
switch message SMBclose (pid 22884) conn 0x83e1ff8
[2006/12/14 17:46:10, 4] smbd/uid.c:change_to_user(194)
change_to_user: Skipping user change - already user
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
search for pipe pnum=7367
[2006/12/14 17:46:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
pipe name samr pnum=7367 (pipes_open=1)
[2006/12/14 17:46:10, 5] smbd/pipes.c:reply_pipe_close(260)
reply_pipe_close: pnum:7367
[2006/12/14 17:46:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
close_policy_by_pipe: deleted handle list for pipe samr
[2006/12/14 17:46:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
closed pipe name samr pnum=7367 (pipes_open=0)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(464)
[2006/12/14 17:46:10, 5] lib/util.c:show_msg(474)
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=128
smb_flg2=32769
smb_tid=1
smb_pid=7923
smb_uid=101
smb_mid=46209
smt_wct=0
smb_bcc=0
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(449)
write_socket(28,39)
[2006/12/14 17:46:10, 6] lib/util_sock.c:write_socket(452)
write_socket(28,39) wrote 39
$$$$$$$$$$$$$$$$$$$$$$end antenorw98.log$$$$$$$$$$$$$$$$$$$$$$$$$$
More information about the samba
mailing list