The Samba-Bugzilla – Attachment 1362 Details for
Bug 2975
Uploading the Kyocera KM-1650 KPDL driver fails
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
Log of operation at level 6
fileupload2.log (text/plain), 470.90 KB, created by
tarjei
on 2005-08-10 05:44:56 UTC
(
hide
)
Description:
Log of operation at level 6
Filename:
MIME Type:
Creator:
tarjei
Created:
2005-08-10 05:44:56 UTC
Size:
470.90 KB
patch
obsolete
> smb_tid=5 > smb_pid=65279 > smb_uid=126 > smb_mid=25028 > smt_wct=0 > smb_bcc=0 >[2005/08/10 14:40:52, 6] lib/util_sock.c:write_socket(449) > write_socket(30,39) >[2005/08/10 14:40:52, 6] lib/util_sock.c:write_socket(452) > write_socket(30,39) wrote 39 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xfa >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150626 of length 254 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=250 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25092 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 166 (0xA6) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 166 (0xA6) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=183 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/08/10 14:41:08, 5] auth/auth_util.c:debug_nt_user_token(490) > NT user token of user S-1-5-21-2835518385-1596783884-3863852789-2996 > contains 6 SIDs > SID[ 0]: S-1-5-21-2835518385-1596783884-3863852789-2996 > SID[ 1]: S-1-5-21-2835518385-1596783884-3863852789-512 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-2835518385-1596783884-3863852789-1001 > SE_PRIV 0x0 0x0 0x0 0x0 >[2005/08/10 14:41:08, 5] auth/auth_util.c:debug_unix_user_token(506) > UNIX token of user 0 > Primary group is 0 and contains 1 supplementary groups > Group[ 0]: 0 >[2005/08/10 14:41:08, 5] smbd/uid.c:change_to_user(304) > change_to_user uid=(0,0) gid=(0,0) >[2005/08/10 14:41:08, 4] smbd/vfs.c:vfs_ChDir(660) > vfs_ChDir to /var/tmp >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=166 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 166 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a6 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537c >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 0000008e >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0045 >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[1].fn == 0x8143160 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_open_printer_ex >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 printername_ptr: 010dfb40 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00001c spoolss_io_printer_default >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c datatype_ptr: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 size: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 devmode_ptr: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 access_required: 00020002 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 002c user_switch: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000030 spool_io_user_level >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 level: 00000001 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 ptr: 014cf548 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 size: 0000001c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c client_name_ptr: 003ecbb0 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 user_name_ptr: 014cf5a4 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0044 build: 00000a28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0048 major: 00000003 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c minor: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 processor: 00610000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 uni_max_len: 0000000c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0058 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 005c uni_str_len: 0000000c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0060 buffer : \.\.B.E.R.Y.L.L.I.U.M... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0078 uni_max_len: 00000005 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 007c offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0080 uni_str_len: 00000005 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0084 buffer : r.o.o.t... > checking name: \\pcb >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) > Opened policy hnd[5] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469) > Setting printer type=\\pcb > Printer is a print server >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505) > Setting printer name=\\pcb (len=5) >[2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642) > 5 printer handles active >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734) > Setting print server access = SERVER_ACCESS_ENUMERATE >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_open_printer_ex >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000561 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status code: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 46 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25092 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,108) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,108) wrote 108 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xa4 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150627 of length 168 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25156 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 80 (0x50) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 80 (0x50) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=97 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=80 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 80 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0050 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537d >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000038 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 001a >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[2].fn == 0x8142fb0 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdata >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000561 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000014 smb_io_unistr2 valuename >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 uni_max_len: 0000000a >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_str_len: 0000000a >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0020 buffer : O.S.V.e.r.s.i.o.n... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 size: 00000114 >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503) > _spoolss_getprinterdata >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdata >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 type: 00000003 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000114 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0008 data: 14 01 00 00 05 00 00 00 00 00 00 00 93 08 00 00 70 6f 6c 61 72 6d 65 64 69 61 2e 6e 6f 2f 63 67 69 2d 62 69 6e 2f 67 65 74 2d 63 65 72 74 2e 70 79 2f 52 6f 6f 74 2f 63 61 2e 63 72 74 00 00 00 00 00 00 00 d9 00 00 00 c8 cd 32 08 48 1e 36 08 10 00 00 00 20 00 00 00 f8 37 36 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 61 00 00 00 70 2a 36 08 e8 37 36 08 00 00 00 00 51 00 00 00 38 27 34 08 90 47 34 08 72 20 74 6f 6b 65 6e 20 6f 66 20 75 73 65 72 20 53 2d 31 2d 35 2d 32 31 2d 32 38 33 35 35 31 38 33 38 35 2d 31 35 39 36 37 38 33 38 38 34 2d 33 38 36 33 38 35 32 37 38 39 2d 32 39 39 36 0a 00 90 00 00 00 20 00 00 00 10 cf 33 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 29 00 00 00 50 b7 33 08 f8 ce 33 08 10 00 00 00 18 00 00 00 48 2b 36 08 00 00 00 00 48 8d 3e 08 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 011c needed: 00000114 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0120 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 296 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 013c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537d >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000124 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..316] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=372 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25156 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 316 (0x13C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 316 (0x13C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=317 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,376) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,376) wrote 376 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x80 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150628 of length 132 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25220 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=61 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=44 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 44 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 002c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537e >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000014 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 001d >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[3].fn == 0x8142e00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_closeprinter >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000561 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 61 05 00 00 00 00 00 00 E4 F5 F9 42 ....a... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) > Closed policy >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_closeprinter >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 00 00 00 00 00 00 00 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537e >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25220 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,108) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,108) wrote 108 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xfa >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150629 of length 254 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=250 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25284 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 166 (0xA6) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 166 (0xA6) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=183 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=166 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 166 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a6 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537f >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 0000008e >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0045 >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[1].fn == 0x8143160 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_open_printer_ex >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 printername_ptr: 010d22a0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00001c spoolss_io_printer_default >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c datatype_ptr: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 size: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 devmode_ptr: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 access_required: 00020002 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 002c user_switch: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000030 spool_io_user_level >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 level: 00000001 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 ptr: 0120f548 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 size: 0000001c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c client_name_ptr: 003ecbb0 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 user_name_ptr: 0120f5a4 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0044 build: 00000a28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0048 major: 00000003 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c minor: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 processor: 00650000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 uni_max_len: 0000000c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0058 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 005c uni_str_len: 0000000c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0060 buffer : \.\.B.E.R.Y.L.L.I.U.M... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0078 uni_max_len: 00000005 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 007c offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0080 uni_str_len: 00000005 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0084 buffer : r.o.o.t... > checking name: \\pcb >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) > Opened policy hnd[5] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469) > Setting printer type=\\pcb > Printer is a print server >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505) > Setting printer name=\\pcb (len=5) >[2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642) > 5 printer handles active >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734) > Setting print server access = SERVER_ACCESS_ENUMERATE >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_open_printer_ex >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000562 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status code: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 46 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000537f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25284 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,108) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,108) wrote 108 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xa4 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150630 of length 168 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25348 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 80 (0x50) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 80 (0x50) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=97 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=80 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 80 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0050 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005380 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000038 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 001a >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[2].fn == 0x8142fb0 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdata >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000562 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000014 smb_io_unistr2 valuename >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 uni_max_len: 0000000a >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_str_len: 0000000a >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0020 buffer : O.S.V.e.r.s.i.o.n... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 size: 00000114 >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503) > _spoolss_getprinterdata >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdata >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 type: 00000003 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000114 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0008 data: 14 01 00 00 05 00 00 00 00 00 00 00 93 08 00 00 70 6f 6c 61 72 6d 65 64 69 61 2e 6e 6f 2f 63 67 69 2d 62 69 6e 2f 67 65 74 2d 63 65 72 74 2e 70 79 2f 52 6f 6f 74 2f 63 61 2e 63 72 74 00 00 00 00 00 00 00 d9 00 00 00 c8 cd 32 08 48 1e 36 08 10 00 00 00 20 00 00 00 f8 37 36 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 61 00 00 00 70 2a 36 08 e8 37 36 08 00 00 00 00 51 00 00 00 38 27 34 08 90 47 34 08 72 20 74 6f 6b 65 6e 20 6f 66 20 75 73 65 72 20 53 2d 31 2d 35 2d 32 31 2d 32 38 33 35 35 31 38 33 38 35 2d 31 35 39 36 37 38 33 38 38 34 2d 33 38 36 33 38 35 32 37 38 39 2d 32 39 39 36 0a 00 90 00 00 00 20 00 00 00 10 cf 33 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 29 00 00 00 50 b7 33 08 f8 ce 33 08 10 00 00 00 18 00 00 00 48 2b 36 08 00 00 00 00 48 8d 3e 08 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 011c needed: 00000114 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0120 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 296 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 013c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005380 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000124 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..316] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=372 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25348 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 316 (0x13C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 316 (0x13C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=317 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,376) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,376) wrote 376 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x80 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150631 of length 132 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25412 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=61 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=44 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 44 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 002c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005381 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000014 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 001d >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[3].fn == 0x8142e00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_closeprinter >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000562 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 62 05 00 00 00 00 00 00 E4 F5 F9 42 ....b... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) > Closed policy >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_closeprinter >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 00 00 00 00 00 00 00 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005381 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25412 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,108) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,108) wrote 108 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xfa >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150632 of length 254 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=250 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25476 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 166 (0xA6) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 166 (0xA6) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=183 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=166 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 166 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a6 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005382 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 0000008e >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0045 >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[1].fn == 0x8143160 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_open_printer_ex >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 printername_ptr: 010dfb40 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00001c spoolss_io_printer_default >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c datatype_ptr: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 size: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 devmode_ptr: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 access_required: 00020002 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 002c user_switch: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000030 spool_io_user_level >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 level: 00000001 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 ptr: 0148f548 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 size: 0000001c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c client_name_ptr: 003ecbb0 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 user_name_ptr: 0148f5a4 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0044 build: 00000a28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0048 major: 00000003 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c minor: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 processor: 00730000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 uni_max_len: 0000000c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0058 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 005c uni_str_len: 0000000c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0060 buffer : \.\.B.E.R.Y.L.L.I.U.M... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0078 uni_max_len: 00000005 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 007c offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0080 uni_str_len: 00000005 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0084 buffer : r.o.o.t... > checking name: \\pcb >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) > Opened policy hnd[5] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469) > Setting printer type=\\pcb > Printer is a print server >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505) > Setting printer name=\\pcb (len=5) >[2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642) > 5 printer handles active >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734) > Setting print server access = SERVER_ACCESS_ENUMERATE >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_open_printer_ex >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000563 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status code: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 46 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005382 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25476 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,108) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,108) wrote 108 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xac >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150633 of length 176 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=172 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25540 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 88 (0x58) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 88 (0x58) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=105 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=88 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 88 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0058 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005383 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000040 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 001a >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[2].fn == 0x8142fb0 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdata >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000563 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000014 smb_io_unistr2 valuename >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 uni_max_len: 0000000d >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_str_len: 0000000d >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0020 buffer : A.r.c.h.i.t.e.c.t.u.r.e... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c size: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503) > _spoolss_getprinterdata >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdata >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 type: 00000001 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0008 data: 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 78 00 38 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 +> > 0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 0000001e >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 546 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005383 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25540 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x80 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150634 of length 132 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25604 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=61 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=44 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 44 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 002c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005384 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000014 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 001d >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[3].fn == 0x8142e00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_closeprinter >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000563 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: e4 f5 f9 42 42 29 00 00 >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 63 05 00 00 00 00 00 00 E4 F5 F9 42 ....c... .......B > [010] 42 29 00 00 B).. >[2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) > Closed policy >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_closeprinter >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 00 00 00 00 00 00 00 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005384 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25604 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,108) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,108) wrote 108 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150635 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25668 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005385 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005385 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25668 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150636 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25732 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005386 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005386 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25732 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150637 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25796 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005387 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005387 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25796 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150638 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25860 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005388 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005388 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25860 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150639 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25924 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005389 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005389 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25924 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150640 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25988 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538a >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538a >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=25988 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150641 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26052 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538b >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538b >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26052 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150642 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26116 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538c >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26116 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150643 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26180 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538d >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538d >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26180 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150644 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26244 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538e >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538e >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26244 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150645 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26308 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538f >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000538f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26308 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150646 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26372 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005390 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005390 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26372 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150647 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26436 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005391 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005391 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26436 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150648 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26500 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005392 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005392 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26500 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150649 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26564 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005393 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005393 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26564 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150650 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26628 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005394 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005394 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26628 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150651 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26692 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005395 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005395 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26692 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150652 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26756 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005396 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005396 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26756 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150653 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26820 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005397 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005397 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26820 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150654 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26884 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005398 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005398 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26884 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150655 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26948 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005399 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00005399 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=26948 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150656 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27012 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539a >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539a >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27012 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150657 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27076 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539b >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539b >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27076 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150658 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27140 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539c >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27140 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150659 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27204 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539d >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539d >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27204 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150660 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27268 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539e >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539e >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27268 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150661 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27332 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539f >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 0000539f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27332 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150662 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27396 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a0 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27396 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150663 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27460 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a1 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a1 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27460 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150664 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27524 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a2 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27524 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150665 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27588 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a3 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a3 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27588 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150666 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27652 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a4 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a4 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27652 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150667 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27716 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a5 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a5 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27716 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150668 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27780 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a6 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a6 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27780 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150669 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27844 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a7 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a7 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27844 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150670 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27908 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a8 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27908 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150671 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27972 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a9 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053a9 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=27972 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150672 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=28036 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053aa >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053aa >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=28036 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150673 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=28100 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053ab >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053ab >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=28100 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150674 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=28164 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053ac >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053ac >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..560] >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=616 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=28164 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 560 (0x230) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 560 (0x230) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=561 >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449) > write_socket(30,620) >[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452) > write_socket(30,620) wrote 620 >[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x2d0 >[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091) > Transaction 150675 of length 724 >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464) >[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474) > size=720 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=1236 > smb_uid=126 > smb_mid=28228 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 636 (0x27C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4140 (0x102C) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 636 (0x27C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29688 (0x73F8) > smb_bcc=653 >[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 10562) conn 0x83b1568 >[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217) > change_to_user: Skipping user change - already user >[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=636 params=0 setup=2 >[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=73f8 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=73f8 (pipes_open=1) >[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 73f8) >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 73f8 name: spoolss open: Yes len: 636 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 027c >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053ad >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000264 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000c >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[28].fn == 0x8140300 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_getprinterdriverdir >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 name_ptr: 000a3ee0 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000006 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.p.c.b... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c : 000a3efc >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 0000000f >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : W.i.n.d.o.w.s. .N.T. .x.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c level: 00000001 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000050 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0260 offered: 00000208 >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812) > _spoolss_getprinterdriverdirectory >[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775) > printer driver directory: [\\pcb\print$\W32X86] >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_driverdir_1 >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_unistr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102) > 0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6... >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_getprinterdriverdir >[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_buffer >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr: 000a3f28 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 size: 00000208 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0210 needed: 00000028 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0214 status: WERR_OK >[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 134 >[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 73f8 name: spoolss len: 4140 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0230 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 000053ad >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000218 >[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 2975
: 1362