smb_tid=5 smb_pid=65279 smb_uid=126 smb_mid=25028 smt_wct=0 smb_bcc=0 [2005/08/10 14:40:52, 6] lib/util_sock.c:write_socket(449) write_socket(30,39) [2005/08/10 14:40:52, 6] lib/util_sock.c:write_socket(452) write_socket(30,39) wrote 39 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0xfa [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150626 of length 254 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=250 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25092 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 166 (0xA6) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 166 (0xA6) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=183 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/08/10 14:41:08, 5] auth/auth_util.c:debug_nt_user_token(490) NT user token of user S-1-5-21-2835518385-1596783884-3863852789-2996 contains 6 SIDs SID[ 0]: S-1-5-21-2835518385-1596783884-3863852789-2996 SID[ 1]: S-1-5-21-2835518385-1596783884-3863852789-512 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SID[ 5]: S-1-5-21-2835518385-1596783884-3863852789-1001 SE_PRIV 0x0 0x0 0x0 0x0 [2005/08/10 14:41:08, 5] auth/auth_util.c:debug_unix_user_token(506) UNIX token of user 0 Primary group is 0 and contains 1 supplementary groups Group[ 0]: 0 [2005/08/10 14:41:08, 5] smbd/uid.c:change_to_user(304) change_to_user uid=(0,0) gid=(0,0) [2005/08/10 14:41:08, 4] smbd/vfs.c:vfs_ChDir(660) vfs_ChDir to /var/tmp [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=166 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 166 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 00a6 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537c [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 0000008e [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 0045 [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[1].fn == 0x8143160 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_open_printer_ex [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 printername_ptr: 010dfb40 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 00001c spoolss_io_printer_default [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c datatype_ptr: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 size: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 devmode_ptr: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 access_required: 00020002 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 002c user_switch: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000030 spool_io_user_level [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0030 level: 00000001 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0034 ptr: 014cf548 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0038 size: 0000001c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 003c client_name_ptr: 003ecbb0 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0040 user_name_ptr: 014cf5a4 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0044 build: 00000a28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0048 major: 00000003 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c minor: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 processor: 00610000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 uni_max_len: 0000000c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0058 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 005c uni_str_len: 0000000c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0060 buffer : \.\.B.E.R.Y.L.L.I.U.M... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0078 uni_max_len: 00000005 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 007c offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0080 uni_str_len: 00000005 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0084 buffer : r.o.o.t... checking name: \\pcb [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[5] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469) Setting printer type=\\pcb Printer is a print server [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505) Setting printer name=\\pcb (len=5) [2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642) 5 printer handles active [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734) Setting print server access = SERVER_ACCESS_ENUMERATE [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_open_printer_ex [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000561 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0014 status code: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 46 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0030 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000018 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25092 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,108) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,108) wrote 108 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0xa4 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150627 of length 168 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=164 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25156 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 80 (0x50) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 80 (0x50) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=97 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=80 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 80 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0050 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537d [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000038 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 001a [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[2].fn == 0x8142fb0 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdata [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000561 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000014 smb_io_unistr2 valuename [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0014 uni_max_len: 0000000a [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0018 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c uni_str_len: 0000000a [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0020 buffer : O.S.V.e.r.s.i.o.n... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0034 size: 00000114 [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503) _spoolss_getprinterdata [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdata [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 type: 00000003 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000114 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 0008 data: 14 01 00 00 05 00 00 00 00 00 00 00 93 08 00 00 70 6f 6c 61 72 6d 65 64 69 61 2e 6e 6f 2f 63 67 69 2d 62 69 6e 2f 67 65 74 2d 63 65 72 74 2e 70 79 2f 52 6f 6f 74 2f 63 61 2e 63 72 74 00 00 00 00 00 00 00 d9 00 00 00 c8 cd 32 08 48 1e 36 08 10 00 00 00 20 00 00 00 f8 37 36 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 61 00 00 00 70 2a 36 08 e8 37 36 08 00 00 00 00 51 00 00 00 38 27 34 08 90 47 34 08 72 20 74 6f 6b 65 6e 20 6f 66 20 75 73 65 72 20 53 2d 31 2d 35 2d 32 31 2d 32 38 33 35 35 31 38 33 38 35 2d 31 35 39 36 37 38 33 38 38 34 2d 33 38 36 33 38 35 32 37 38 39 2d 32 39 39 36 0a 00 90 00 00 00 20 00 00 00 10 cf 33 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 29 00 00 00 50 b7 33 08 f8 ce 33 08 10 00 00 00 18 00 00 00 48 2b 36 08 00 00 00 00 48 8d 3e 08 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 011c needed: 00000114 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0120 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 296 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 013c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537d [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000124 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..316] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=372 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25156 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 316 (0x13C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 316 (0x13C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=317 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,376) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,376) wrote 376 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x80 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150628 of length 132 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25220 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=61 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=44 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 44 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 002c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537e [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000014 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 001d [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[3].fn == 0x8142e00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_closeprinter [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000561 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_closeprinter [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: 00 00 00 00 00 00 00 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0014 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0030 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537e [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000018 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25220 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,108) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,108) wrote 108 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0xfa [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150629 of length 254 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=250 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25284 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 166 (0xA6) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 166 (0xA6) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=183 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=166 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 166 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 00a6 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537f [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 0000008e [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 0045 [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[1].fn == 0x8143160 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_open_printer_ex [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 printername_ptr: 010d22a0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 00001c spoolss_io_printer_default [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c datatype_ptr: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 size: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 devmode_ptr: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 access_required: 00020002 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 002c user_switch: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000030 spool_io_user_level [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0030 level: 00000001 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0034 ptr: 0120f548 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0038 size: 0000001c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 003c client_name_ptr: 003ecbb0 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0040 user_name_ptr: 0120f5a4 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0044 build: 00000a28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0048 major: 00000003 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c minor: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 processor: 00650000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 uni_max_len: 0000000c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0058 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 005c uni_str_len: 0000000c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0060 buffer : \.\.B.E.R.Y.L.L.I.U.M... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0078 uni_max_len: 00000005 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 007c offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0080 uni_str_len: 00000005 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0084 buffer : r.o.o.t... checking name: \\pcb [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[5] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469) Setting printer type=\\pcb Printer is a print server [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505) Setting printer name=\\pcb (len=5) [2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642) 5 printer handles active [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734) Setting print server access = SERVER_ACCESS_ENUMERATE [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_open_printer_ex [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000562 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0014 status code: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 46 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0030 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000537f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000018 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25284 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,108) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,108) wrote 108 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0xa4 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150630 of length 168 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=164 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25348 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 80 (0x50) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 80 (0x50) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=97 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=80 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 80 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0050 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005380 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000038 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 001a [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[2].fn == 0x8142fb0 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdata [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000562 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000014 smb_io_unistr2 valuename [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0014 uni_max_len: 0000000a [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0018 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c uni_str_len: 0000000a [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0020 buffer : O.S.V.e.r.s.i.o.n... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0034 size: 00000114 [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503) _spoolss_getprinterdata [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdata [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 type: 00000003 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000114 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 0008 data: 14 01 00 00 05 00 00 00 00 00 00 00 93 08 00 00 70 6f 6c 61 72 6d 65 64 69 61 2e 6e 6f 2f 63 67 69 2d 62 69 6e 2f 67 65 74 2d 63 65 72 74 2e 70 79 2f 52 6f 6f 74 2f 63 61 2e 63 72 74 00 00 00 00 00 00 00 d9 00 00 00 c8 cd 32 08 48 1e 36 08 10 00 00 00 20 00 00 00 f8 37 36 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 61 00 00 00 70 2a 36 08 e8 37 36 08 00 00 00 00 51 00 00 00 38 27 34 08 90 47 34 08 72 20 74 6f 6b 65 6e 20 6f 66 20 75 73 65 72 20 53 2d 31 2d 35 2d 32 31 2d 32 38 33 35 35 31 38 33 38 35 2d 31 35 39 36 37 38 33 38 38 34 2d 33 38 36 33 38 35 32 37 38 39 2d 32 39 39 36 0a 00 90 00 00 00 20 00 00 00 10 cf 33 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 29 00 00 00 50 b7 33 08 f8 ce 33 08 10 00 00 00 18 00 00 00 48 2b 36 08 00 00 00 00 48 8d 3e 08 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 011c needed: 00000114 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0120 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 296 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 013c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005380 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000124 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..316] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=372 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25348 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 316 (0x13C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 316 (0x13C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=317 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,376) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,376) wrote 376 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x80 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150631 of length 132 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25412 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=61 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=44 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 44 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 002c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005381 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000014 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 001d [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[3].fn == 0x8142e00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_closeprinter [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000562 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_closeprinter [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: 00 00 00 00 00 00 00 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0014 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0030 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005381 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000018 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25412 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,108) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,108) wrote 108 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0xfa [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150632 of length 254 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=250 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25476 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 166 (0xA6) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 166 (0xA6) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=183 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=166 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 166 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 00a6 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005382 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 0000008e [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 0045 [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[1].fn == 0x8143160 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_open_printer_ex [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 printername_ptr: 010dfb40 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 00001c spoolss_io_printer_default [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c datatype_ptr: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 size: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 devmode_ptr: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 access_required: 00020002 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 002c user_switch: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000030 spool_io_user_level [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0030 level: 00000001 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0034 ptr: 0148f548 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0038 size: 0000001c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 003c client_name_ptr: 003ecbb0 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0040 user_name_ptr: 0148f5a4 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0044 build: 00000a28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0048 major: 00000003 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c minor: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 processor: 00730000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 uni_max_len: 0000000c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0058 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 005c uni_str_len: 0000000c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0060 buffer : \.\.B.E.R.Y.L.L.I.U.M... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0078 uni_max_len: 00000005 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 007c offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0080 uni_str_len: 00000005 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0084 buffer : r.o.o.t... checking name: \\pcb [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[5] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469) Setting printer type=\\pcb Printer is a print server [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505) Setting printer name=\\pcb (len=5) [2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642) 5 printer handles active [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734) Setting print server access = SERVER_ACCESS_ENUMERATE [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_open_printer_ex [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000563 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0014 status code: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 46 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0030 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005382 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000018 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25476 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,108) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,108) wrote 108 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0xac [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150633 of length 176 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25540 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=105 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=88 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 88 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0058 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005383 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000040 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 001a [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[2].fn == 0x8142fb0 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdata [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000563 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000014 smb_io_unistr2 valuename [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0014 uni_max_len: 0000000d [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0018 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c uni_str_len: 0000000d [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0020 buffer : A.r.c.h.i.t.e.c.t.u.r.e... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 003c size: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503) _spoolss_getprinterdata [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdata [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 type: 00000001 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 0008 data: 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 78 00 38 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 +> 0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 0000001e [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 546 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005383 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25540 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x80 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150634 of length 132 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25604 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=61 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=44 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 44 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 002c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005384 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000014 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 001d [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[3].fn == 0x8142e00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_closeprinter [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000563 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: e4 f5 f9 42 42 29 00 00 [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B [010] 42 29 00 00 B).. [2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_closeprinter [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_pol_hnd printer handle [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 data1: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 data2: 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 data3: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a data4: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) 000c data5: 00 00 00 00 00 00 00 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0014 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0030 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005384 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000018 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25604 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,108) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,108) wrote 108 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150635 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25668 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005385 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005385 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25668 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150636 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25732 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005386 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005386 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25732 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150637 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25796 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005387 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005387 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25796 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150638 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25860 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005388 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005388 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25860 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150639 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25924 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005389 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005389 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25924 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150640 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25988 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538a [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538a [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=25988 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150641 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26052 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538b [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538b [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26052 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150642 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26116 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538c [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26116 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150643 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26180 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538d [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538d [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26180 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150644 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26244 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538e [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538e [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26244 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150645 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26308 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538f [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000538f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26308 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150646 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26372 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005390 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005390 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26372 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150647 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26436 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005391 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005391 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26436 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150648 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26500 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005392 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005392 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26500 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150649 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26564 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005393 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005393 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26564 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150650 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26628 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005394 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005394 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26628 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150651 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26692 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005395 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005395 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26692 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150652 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26756 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005396 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005396 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26756 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150653 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26820 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005397 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005397 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26820 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150654 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26884 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005398 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005398 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26884 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150655 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26948 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005399 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 00005399 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=26948 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150656 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27012 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539a [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539a [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27012 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150657 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27076 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539b [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539b [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27076 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150658 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27140 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539c [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27140 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150659 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27204 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539d [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539d [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27204 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150660 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27268 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539e [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539e [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27268 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150661 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27332 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539f [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 0000539f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27332 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150662 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27396 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a0 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27396 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150663 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27460 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a1 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a1 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27460 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150664 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27524 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a2 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27524 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150665 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27588 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a3 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a3 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27588 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150666 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27652 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a4 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a4 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27652 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150667 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27716 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a5 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a5 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27716 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150668 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27780 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a6 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a6 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27780 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150669 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27844 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a7 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a7 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27844 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150670 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27908 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a8 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27908 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150671 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27972 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a9 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053a9 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=27972 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150672 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=28036 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053aa [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053aa [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=28036 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150673 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=28100 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053ab [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053ab [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=28100 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150674 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=28164 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053ac [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053ac [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0014 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0016 cancel_ct : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0017 reserved : 00 [2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..560] [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=616 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=28164 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 560 (0x230) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 560 (0x230) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=561 [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) write_socket(30,620) [2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) write_socket(30,620) wrote 620 [2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) got message type 0x0 of len 0x2d0 [2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) Transaction 150675 of length 724 [2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) [2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) size=720 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=1236 smb_uid=126 smb_mid=28228 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 636 (0x27C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4140 (0x102C) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 636 (0x27C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29688 (0x73F8) smb_bcc=653 [2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) switch message SMBtrans (pid 10562) conn 0x83b1568 [2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=636 params=0 setup=2 [2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) search for pipe pnum=73f8 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) pipe name spoolss pnum=73f8 (pipes_open=1) [2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 73f8) [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) write_to_pipe: 73f8 name: spoolss open: Yes len: 636 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 027c [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053ad [2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) unmarshall_rpc_header: using little-endian RPC [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr_req req [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 alloc_hint: 00000264 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0004 context_id: 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0006 opnum : 000c [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) Requested \PIPE\spoolss [2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY [2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) api_rpc_cmds[28].fn == 0x8140300 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_q_getprinterdriverdir [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 name_ptr: 000a3ee0 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000004 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 uni_max_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0008 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c uni_str_len: 00000006 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 0010 buffer : \.\.p.c.b... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 001c : 000a3efc [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000020 smb_io_unistr2 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0020 uni_max_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0024 offset : 00000000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0028 uni_str_len: 0000000f [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 004c level: 00000001 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000050 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0050 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0054 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0260 offered: 00000208 [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) _spoolss_getprinterdriverdirectory [2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) printer driver directory: [\\pcb\print$\W32X86] [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_driverdir_1 [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_unistr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_r_getprinterdriverdir [2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) 000000 spoolss_io_buffer [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0000 ptr: 000a3f28 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0004 size: 00000208 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0210 needed: 00000028 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) 0214 status: WERR_OK [2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) api_rpcTNP: called spoolss successfully [2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 134 [2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) read_from_pipe: 73f8 name: spoolss len: 4140 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000000 smb_io_rpc_hdr hdr [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0000 major : 05 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0001 minor : 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0002 pkt_type : 02 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0003 flags : 03 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0004 pack_type0: 10 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0005 pack_type1: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0006 pack_type2: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) 0007 pack_type3: 00 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 0008 frag_len : 0230 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) 000a auth_len : 0000 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 000c call_id : 000053ad [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) 000010 smb_io_rpc_hdr_resp resp [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) 0010 alloc_hint: 00000218 [2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)