The Samba-Bugzilla – Attachment 2201 Details for
Bug 4213
Permission denied errors when accessing shares on second DC after upgrade
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
Debug Level 10 LogFile
Debug-Level-10-LogFile.txt (text/plain), 628.09 KB, created by
Marc Muehlfeld
on 2006-11-08 02:58:27 UTC
(
hide
)
Description:
Debug Level 10 LogFile
Filename:
MIME Type:
Creator:
Marc Muehlfeld
Created:
2006-11-08 02:58:27 UTC
Size:
628.09 KB
patch
obsolete
> >[2006/11/08 09:30:48, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 36 >[2006/11/08 09:30:48, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x24 >[2006/11/08 09:30:48, 3] smbd/process.c:process_smb(1110) > Transaction 725 of length 40 >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(488) > size=36 > smb_com=0xa4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=3 > smb_pid=1032 > smb_uid=101 > smb_mid=37441 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:48, 3] smbd/process.c:switch_message(914) > switch message SMBntcancel (pid 7739) conn 0x803864c8 >[2006/11/08 09:30:48, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:48, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:48, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:48, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:48, 3] smbd/error.c:error_packet(146) > error packet at smbd/notify.c(55) cmd=160 (SMBnttrans) NT_STATUS_CANCELLED >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(488) > size=71 > smb_com=0xa0 > smb_rcls=32 > smb_reh=1 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=3 > smb_pid=1032 > smb_uid=101 > smb_mid=37441 > smt_wct=18 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:48, 3] smbd/notify_kernel.c:kernel_remove_notify(144) > kernel_remove_notify: fd=28 >[2006/11/08 09:30:48, 3] smbd/nttrans.c:reply_ntcancel(1564) > reply_ntcancel: cancel called on mid = 37441. >[2006/11/08 09:30:48, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:48, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:48, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:48, 3] smbd/process.c:process_smb(1110) > Transaction 726 of length 45 >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=55303 > smb_tid=3 > smb_pid=65279 > smb_uid=101 > smb_mid=46337 > smt_wct=3 > smb_vwv[ 0]= 6122 (0x17EA) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:48, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7739) conn 0x803864c8 >[2006/11/08 09:30:48, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:48, 5] auth/auth_util.c:debug_nt_user_token(454) > NT user token of user S-1-5-21-1362721961-1801182073-732966438-3122 > contains 19 SIDs > SID[ 0]: S-1-5-21-1362721961-1801182073-732966438-3122 > SID[ 1]: S-1-5-21-1362721961-1801182073-732966438-513 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-1362721961-1801182073-732966438-1185 > SID[ 6]: S-1-5-21-1362721961-1801182073-732966438-1405 > SID[ 7]: S-1-5-21-1362721961-1801182073-732966438-1413 > SID[ 8]: S-1-5-21-1362721961-1801182073-732966438-1421 > SID[ 9]: S-1-5-21-1362721961-1801182073-732966438-1423 > SID[ 10]: S-1-5-21-1362721961-1801182073-732966438-1425 > SID[ 11]: S-1-5-21-1362721961-1801182073-732966438-1439 > SID[ 12]: S-1-5-21-1362721961-1801182073-732966438-1443 > SID[ 13]: S-1-5-21-1362721961-1801182073-732966438-3021 > SID[ 14]: S-1-5-21-1362721961-1801182073-732966438-3047 > SID[ 15]: S-1-5-21-1362721961-1801182073-732966438-3055 > SID[ 16]: S-1-5-21-1362721961-1801182073-732966438-3063 > SID[ 17]: S-1-5-21-1362721961-1801182073-732966438-3065 > SID[ 18]: S-1-5-21-1362721961-1801182073-732966438-3085 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:48, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 1061 > Primary group is 513 and contains 0 supplementary groups >[2006/11/08 09:30:48, 5] smbd/uid.c:change_to_user(260) > change_to_user uid=(1061,1061) gid=(0,513) >[2006/11/08 09:30:48, 3] smbd/reply.c:reply_close(3298) > close directory fnum=6122 >[2006/11/08 09:30:48, 10] locking/locking.c:parse_share_modes(501) > parse_share_modes: delete_on_close: 0, initial_delete_on_close: 0, num_share_modes: 1 >[2006/11/08 09:30:48, 10] locking/locking.c:parse_share_modes(594) > parse_share_modes: share_mode_entry[0]: pid = 7739, share_access = 0x7, private_options = 0x1, access_mask = 0x100001, mid = 0x0, type= 0x0, file_id = 18, uid = 1061, dev = 0xfd03, inode = 4 >[2006/11/08 09:30:48, 5] smbd/files.c:file_free(448) > freed files structure 6122 (0 used) >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:48, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=3 > smb_pid=65279 > smb_uid=101 > smb_mid=46337 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:48, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x23 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 727 of length 39 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=4 > smb_pid=65279 > smb_uid=101 > smb_mid=46401 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtdis (pid 7739) conn 0x8034c740 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /shares/MetaSystems/Msd >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 1] smbd/service.c:close_cnum(1141) > it-01 (192.168.29.254) closed connection to service Msd >[2006/11/08 09:30:50, 3] smbd/connection.c:yield_connection(69) > Yielding connection to Msd >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to / >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=4 > smb_pid=65279 > smb_uid=101 > smb_mid=46401 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x23 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 728 of length 39 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=46465 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtdis (pid 7739) conn 0x80382568 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /tmp >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 3] smbd/service.c:close_cnum(1141) > it-01 (192.168.29.254) closed connection to service IPC$ >[2006/11/08 09:30:50, 3] smbd/connection.c:yield_connection(69) > Yielding connection to IPC$ >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to / >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=46465 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x23 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 729 of length 39 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=46529 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtdis (pid 7739) conn 0x80389110 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /shares/MetaSystems/MetaSystems >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 1] smbd/service.c:close_cnum(1141) > it-01 (192.168.29.254) closed connection to service MetaSystems >[2006/11/08 09:30:50, 3] smbd/connection.c:yield_connection(69) > Yielding connection to MetaSystems >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to / >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=46529 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 39 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x27 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 730 of length 43 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=39 > smb_com=0x74 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=46593 > smt_wct=2 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBulogoffX (pid 7739) conn 0x0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 2] smbd/utmp.c:sys_utmp_update(419) > utmp_update: uname:/var/run/utmp wname:/var/log/wtmp >[2006/11/08 09:30:50, 3] smbd/reply.c:reply_ulogoffX(1618) > ulogoffX vuid=101 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=39 > smb_com=0x74 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=46593 > smt_wct=2 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x23 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 731 of length 39 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=3 > smb_pid=65279 > smb_uid=101 > smb_mid=46657 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtdis (pid 7739) conn 0x803864c8 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /shares/MetaSystems/MetaSetup >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 1] smbd/service.c:close_cnum(1141) > it-01 (192.168.29.254) closed connection to service MetaSetup >[2006/11/08 09:30:50, 3] smbd/connection.c:yield_connection(69) > Yielding connection to MetaSetup >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to / >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=3 > smb_pid=65279 > smb_uid=101 > smb_mid=46657 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_data(525) > read_data: read of 4 returned 0. Error = Success >[2006/11/08 09:30:50, 10] lib/util_sock.c:receive_smb_raw(672) > receive_smb_raw: length < 0! >[2006/11/08 09:30:50, 3] smbd/process.c:timeout_processing(1359) > timeout_processing: End of file from client (client has disconnected). >[2006/11/08 09:30:50, 5] lib/gencache.c:gencache_shutdown(90) > Closing cache file >[2006/11/08 09:30:50, 5] libsmb/namecache.c:namecache_shutdown(79) > namecache_shutdown: netbios namecache closed successfully. >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 3] smbd/connection.c:yield_connection(69) > Yielding connection to >[2006/11/08 09:30:50, 3] smbd/server.c:exit_server_common(675) > Server exit (normal exit) >[2006/11/08 09:30:50, 6] param/loadparm.c:lp_file_list_changed(2998) > lp_file_list_changed() > file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Oct 16 11:15:28 2006 > > file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Wed Nov 8 09:24:47 2006 > > file /etc/samba//smb.conf -> /etc/samba//smb.conf last mod_time: Wed Nov 8 09:28:49 2006 > >[2006/11/08 09:30:50, 5] smbd/reply.c:reply_special(543) > init msg_type=0x81 msg_flags=0x0 >[2006/11/08 09:30:50, 0] lib/util_sock.c:write_data(562) > write_data: write failure in writing to client 0.0.0.0. Error Connection reset by peer >[2006/11/08 09:30:50, 0] lib/util_sock.c:send_smb(769) > Error writing 4 bytes to client. -1. (Connection reset by peer) >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 3] smbd/connection.c:yield_connection(69) > Yielding connection to >[2006/11/08 09:30:50, 3] smbd/connection.c:yield_connection(76) > yield_connection: tdb_delete for name failed with error Record does not exist. >[2006/11/08 09:30:50, 3] smbd/server.c:exit_server_common(675) > Server exit (process_smb: send_smb failed.) >[2006/11/08 09:30:50, 6] param/loadparm.c:lp_file_list_changed(2998) > lp_file_list_changed() > file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Oct 16 11:15:28 2006 > > file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Wed Nov 8 09:24:47 2006 > > file /etc/samba//smb.conf -> /etc/samba//smb.conf last mod_time: Wed Nov 8 09:28:49 2006 > >[2006/11/08 09:30:50, 5] auth/auth_util.c:make_user_info_map(161) > make_user_info_map: Mapping user [MUC]\[muehlfeld] from workstation [IT-01] >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] auth/auth_util.c:is_trusted_domain(2019) > is_trusted_domain: Checking for domain trust with [MUC] >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:make_user_info(75) > attempting to make a user_info for muehlfeld (muehlfeld) >[2006/11/08 09:30:50, 5] auth/auth_util.c:make_user_info(85) > making strings for muehlfeld's user_info struct >[2006/11/08 09:30:50, 5] auth/auth_util.c:make_user_info(117) > making blobs for muehlfeld's user_info struct >[2006/11/08 09:30:50, 10] auth/auth_util.c:make_user_info(135) > made an encrypted user_info for muehlfeld (muehlfeld) >[2006/11/08 09:30:50, 3] auth/auth.c:check_ntlm_password(221) > check_ntlm_password: Checking password for unmapped user [MUC]\[muehlfeld]@[IT-01] with the new password interface >[2006/11/08 09:30:50, 3] auth/auth.c:check_ntlm_password(224) > check_ntlm_password: mapped user is: [MUC]\[muehlfeld]@[IT-01] >[2006/11/08 09:30:50, 10] auth/auth.c:check_ntlm_password(233) > check_ntlm_password: auth_context challenge created by NTLMSSP callback (NTLM2) >[2006/11/08 09:30:50, 10] auth/auth.c:check_ntlm_password(235) > challenge is: >[2006/11/08 09:30:50, 5] lib/util.c:dump_data(2215) > [000] C4 AD 6D E1 7B 65 A4 65 ..m.{e.e >[2006/11/08 09:30:50, 10] auth/auth.c:check_ntlm_password(261) > check_ntlm_password: guest had nothing to say >[2006/11/08 09:30:50, 8] lib/util.c:is_myname(2036) > is_myname("MUC") returns 0 >[2006/11/08 09:30:50, 6] auth/auth_sam.c:check_samstrict_security(421) > check_samstrict_security: MUC is not one of my local names or domain name (DC) >[2006/11/08 09:30:50, 10] auth/auth.c:check_ntlm_password(261) > check_ntlm_password: sam had nothing to say >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] auth/auth_util.c:is_trusted_domain(2019) > is_trusted_domain: Checking for domain trust with [MUC] >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 8] libsmb/namequery.c:get_sorted_dc_list(1551) > get_sorted_dc_list: attempting lookup using [lmhosts wins host bcast] >[2006/11/08 09:30:50, 10] lib/gencache.c:gencache_get(287) > Returning valid cache entry: key = SAF/DOMAIN/MUC, value = GENOME, timeout = Wed Nov 8 09:44:01 2006 >[2006/11/08 09:30:50, 5] libsmb/namequery.c:saf_fetch(108) > saf_fetch: Returning "GENOME" for "MUC" domain >[2006/11/08 09:30:50, 3] libsmb/namequery.c:get_dc_list(1426) > get_dc_list: preferred server list: "GENOME, *" >[2006/11/08 09:30:50, 10] libsmb/namequery.c:internal_resolve_name(1132) > internal_resolve_name: looking up MUC#1c >[2006/11/08 09:30:50, 10] lib/gencache.c:gencache_get(287) > Returning valid cache entry: key = NBT/MUC#1C, value = 192.168.29.4:0, timeout = Wed Nov 8 09:35:54 2006 >[2006/11/08 09:30:50, 5] libsmb/namecache.c:namecache_fetch(201) > name MUC#1C found. >[2006/11/08 09:30:50, 8] libsmb/namequery.c:get_dc_list(1441) > Adding 1 DC's from auto lookup >[2006/11/08 09:30:50, 10] libsmb/namequery.c:internal_resolve_name(1132) > internal_resolve_name: looking up GENOME#20 >[2006/11/08 09:30:50, 10] lib/gencache.c:gencache_get(287) > Returning valid cache entry: key = NBT/GENOME#20, value = 192.168.29.4:0, timeout = Wed Nov 8 09:35:54 2006 >[2006/11/08 09:30:50, 5] libsmb/namecache.c:namecache_fetch(201) > name GENOME#20 found. >[2006/11/08 09:30:50, 10] libsmb/namequery.c:remove_duplicate_addrs2(408) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2006/11/08 09:30:50, 4] libsmb/namequery.c:get_dc_list(1529) > get_dc_list: returning 1 ip addresses in an ordered list >[2006/11/08 09:30:50, 4] libsmb/namequery.c:get_dc_list(1530) > get_dc_list: 192.168.29.4:0 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:name_status_find(276) > name_status_find: looking up MUC#1c at 192.168.29.4 >[2006/11/08 09:30:50, 10] lib/gencache.c:gencache_get(312) > Cache entry with key = NBT/MUC#1C.20.192.168.29.4 couldn't be found >[2006/11/08 09:30:50, 5] libsmb/namecache.c:namecache_status_fetch(308) > namecache_status_fetch: no entry for NBT/MUC#1C.20.192.168.29.4 found. >[2006/11/08 09:30:50, 10] lib/gencache.c:gencache_del(218) > Deleting cache entry (key = NBT/MUC#1C.20.192.168.29.4) >[2006/11/08 09:30:50, 10] lib/util_sock.c:open_socket_in(839) > bind succeeded on port 0 >[2006/11/08 09:30:50, 5] libsmb/nmblib.c:send_udp(777) > Sending a packet of len 50 to (192.168.29.4) on port 137 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_udp_socket(294) > read_udp_socket: lastip 192.168.29.4 lastport 137 read: 265 >[2006/11/08 09:30:50, 10] libsmb/nmblib.c:parse_nmb(506) > parse_nmb: packet id = 6760 >[2006/11/08 09:30:50, 5] libsmb/nmblib.c:read_packet(755) > Received a packet of len 265 from (192.168.29.4) port 137 >[2006/11/08 09:30:50, 4] libsmb/nmblib.c:debug_nmb_packet(112) > nmb packet from 192.168.29.4(137) header: id=6760 opcode=Query(0) response=Yes > header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes > header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 > answers: nmb_name=MUC<1c> rr_type=33 rr_class=1 ttl=0 > answers 0 char .GENOME hex 0947454E4F4D45202020202020202020 > answers 10 char .d.GENOME hex 00640047454E4F4D4520202020202020 > answers 20 char .d.GENOME hex 202003640047454E4F4D452020202020 > answers 30 char d...__MSBRO hex 2020202020640001025F5F4D5342524F > answers 40 char WSE__....MUC hex 5753455F5F0201E4004D554320202020 > answers 50 char .d.MUC hex 20202020202020201D64004D55432020 > answers 60 char .d.MUC hex 202020202020202020201B64004D5543 > answers 70 char ...M hex 2020202020202020202020201CE4004D > answers 80 char UC .. hex 55432020202020202020202020201EE4 > answers 90 char .MUC hex 004D5543202020202020202020202020 > answers a0 char ................ hex 00E40000000000000000000000000000 > answers b0 char ................ hex 00000000000000000000000000000000 > answers c0 char ................ hex 00000000000000000000000000000000 > answers d0 char . hex 00 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > GENOME#00: flags = 0x64 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > GENOME#03: flags = 0x64 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > GENOME#20: flags = 0x64 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > __MSBROWSE__#01: flags = 0xe4 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > MUC#1d: flags = 0x64 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > MUC#1b: flags = 0x64 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > MUC#1c: flags = 0xe4 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > MUC#1e: flags = 0xe4 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:parse_node_status(158) > MUC#00: flags = 0xe4 >[2006/11/08 09:30:50, 10] libsmb/namequery.c:name_status_find(315) > name_status_find: name found, name GENOME ip address is 192.168.29.4 >[2006/11/08 09:30:50, 3] libsmb/namequery_dc.c:rpc_dc_name(117) > rpc_dc_name: Returning DC GENOME (192.168.29.4) for domain MUC >[2006/11/08 09:30:50, 10] passdb/secrets.c:secrets_named_mutex(779) > secrets_named_mutex: got mutex for GENOME >[2006/11/08 09:30:50, 3] libsmb/cliconnect.c:cli_start_connection(1417) > Connecting to host=GENOME >[2006/11/08 09:30:50, 3] lib/util_sock.c:open_socket_out(874) > Connecting to 192.168.29.4 at port 445 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_KEEPALIVE = 1 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_REUSEADDR = 0 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_BROADCAST = 0 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option TCP_NODELAY = 1 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option TCP_KEEPCNT = 9 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option TCP_KEEPIDLE = 7200 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option TCP_KEEPINTVL = 75 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option IPTOS_LOWDELAY = 0 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option IPTOS_THROUGHPUT = 0 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_SNDBUF = 16384 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_RCVBUF = 16384 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_SNDLOWAT = 1 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_RCVLOWAT = 1 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_SNDTIMEO = 0 >[2006/11/08 09:30:50, 5] lib/util_sock.c:print_socket_options(206) > socket option SO_RCVTIMEO = 0 >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,183) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,183) wrote 183 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 127 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=7769 > smb_uid=0 > smb_mid=1 > smt_wct=17 > smb_vwv[ 0]= 7 (0x7) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]=54784 (0xD600) > smb_vwv[ 8]= 26 (0x1A) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=33011 (0x80F3) > smb_vwv[11]= 128 (0x80) > smb_vwv[12]=10810 (0x2A3A) > smb_vwv[13]= 4152 (0x1038) > smb_vwv[14]=50947 (0xC703) > smb_vwv[15]=50177 (0xC401) > smb_vwv[16]= 255 (0xFF) > smb_bcc=58 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 67 65 6E 6F 6D 65 00 00 00 00 00 00 00 00 00 00 genome.. ........ > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=7769 > smb_uid=0 > smb_mid=1 > smt_wct=17 > smb_vwv[ 0]= 7 (0x7) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]=54784 (0xD600) > smb_vwv[ 8]= 26 (0x1A) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=33011 (0x80F3) > smb_vwv[11]= 128 (0x80) > smb_vwv[12]=10810 (0x2A3A) > smb_vwv[13]= 4152 (0x1038) > smb_vwv[14]=50947 (0xC703) > smb_vwv[15]=50177 (0xC401) > smb_vwv[16]= 255 (0xFF) > smb_bcc=58 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 67 65 6E 6F 6D 65 00 00 00 00 00 00 00 00 00 00 genome.. ........ > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,92) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,92) wrote 92 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 88 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=88 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=7769 > smb_uid=100 > smb_mid=2 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_bcc=47 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 55 00 6E 00 69 00 78 00 00 00 53 00 61 00 6D .U.n.i.x ...S.a.m > [010] 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E 00 32 .b.a. .3 ...0...2 > [020] 00 33 00 63 00 00 00 4D 00 55 00 43 00 00 00 .3.c...M .U.C... >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=88 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=7769 > smb_uid=100 > smb_mid=2 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_bcc=47 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 55 00 6E 00 69 00 78 00 00 00 53 00 61 00 6D .U.n.i.x ...S.a.m > [010] 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E 00 32 .b.a. .3 ...0...2 > [020] 00 33 00 63 00 00 00 4D 00 55 00 43 00 00 00 .3.c...M .U.C... >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,80) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,80) wrote 80 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 48 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=48 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=3 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 3 (0x3) > smb_bcc=7 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 49 50 43 00 00 00 00 IPC.... >[2006/11/08 09:30:50, 10] libsmb/clientgen.c:cli_init_creds(233) > cli_init_creds: user domain >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,108) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,108) wrote 108 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 103 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=4 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 4608 (0x1200) > smb_vwv[ 3]= 375 (0x177) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044) > Bind RPC Pipe[7712]: \NETLOGON auth_type 0, auth_level 0 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647) > Bind Abstract Syntax: [000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [010] 01 00 00 00 .... >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) > Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [010] 02 00 00 00 .... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0010 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0012 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 001e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00001f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 12345678 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1234 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : abcd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : ef 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 01 23 45 67 cf fb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0038 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 003a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 003c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 003e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0044 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7712 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=154 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=55297 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=5 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30482 (0x7712) > smb_bcc=87 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 .......H ........ > [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x > [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... > [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ > [050] 10 48 60 02 00 00 00 .H`.... >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,158) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,158) wrote 158 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 124 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=5 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=5 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 68 at offset 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7712 returned 68 bytes. >[2006/11/08 09:30:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081) > rpc_pipe_bind: Remote machine GENOME pipe \NETLOGON fnum 0x7712 bind request returned ok. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0010 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0012 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0018 len: 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a str: \PIPE\lsass. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000026 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0028 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0034 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0036 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0038 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 003a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:check_bind_response(1701) > check_bind_response: accepted! >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2271) > cli_rpc_pipe_open_noauth: opened pipe \NETLOGON to machine GENOME and bound anonymously. >[2006/11/08 09:30:50, 4] rpc_client/cli_netlogon.c:rpccli_net_req_chal(46) > cli_net_req_chal: LSA Request Challenge from CODON to \\GENOME >[2006/11/08 09:30:50, 5] rpc_parse/parse_net.c:init_q_req_chal(679) > init_q_req_chal: 679 >[2006/11/08 09:30:50, 5] rpc_parse/parse_net.c:init_q_req_chal(688) > init_q_req_chal: 688 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_q_req_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 undoc_buffer: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.G.E.N.O.M.E... >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000022 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0030 buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00003c smb_io_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 003c data: 21 38 c1 73 3e 28 5d ff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 005c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 opnum : 0004 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7712 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=174 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=55297 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=6 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 92 (0x5C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 92 (0x5C) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30482 (0x7712) > smb_bcc=107 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 5C 00 00 00 02 00 00 00 44 .......\ .......D > [020] 00 00 00 00 00 04 00 01 00 00 00 09 00 00 00 00 ........ ........ > [030] 00 00 00 09 00 00 00 5C 00 5C 00 47 00 45 00 4E .......\ .\.G.E.N > [040] 00 4F 00 4D 00 45 00 00 00 00 00 06 00 00 00 00 .O.M.E.. ........ > [050] 00 00 00 06 00 00 00 43 00 4F 00 44 00 4F 00 4E .......C .O.D.O.N > [060] 00 00 00 21 38 C1 73 3E 28 5D FF ...!8.s> (]. >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,178) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,178) wrote 178 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 92 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=92 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=6 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 36 (0x24) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 36 (0x24) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=37 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 02 00 00 ........ .$...... > [010] 00 0C 00 00 00 00 00 00 00 80 D2 E8 AC 47 44 25 ........ .....GD% > [020] B7 00 00 00 00 ..... >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=92 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=6 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 36 (0x24) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 36 (0x24) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=37 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 02 00 00 ........ .$...... > [010] 00 0C 00 00 00 00 00 00 00 80 D2 E8 AC 47 44 25 ........ .....GD% > [020] B7 00 00 00 00 ..... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 0000000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 36, data_len 12, ss_len 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 36 at offset 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7712 returned 24 bytes. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_r_req_chal >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0000 data: 80 d2 e8 ac 47 44 25 b7 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(763) > 0008 status: NT_STATUS_OK >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_init(286) > creds_client_init: neg_flags : 400701ff >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_init(287) > creds_client_init: client chal : 2138C1733E285DFF >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_init(288) > creds_client_init: server chal : 80D2E8AC474425B7 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_init_64(117) > creds_init_64 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_init_64(118) > clnt_chal_in: 2138C1733E285DFF >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_init_64(119) > srv_chal_in : 80D2E8AC474425B7 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_init_64(120) > clnt+srv : A10AAA20856C82B6 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_init_64(121) > sess_key_out : 0612B47F29A29C36 >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_init(306) > creds_client_init: clnt : 73081E2AF6CD08E2 >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_init(307) > creds_client_init: server : 4C4E6179ABF01B0A >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_init(308) > creds_client_init: seed : 73081E2AF6CD08E2 >[2006/11/08 09:30:50, 4] rpc_client/cli_netlogon.c:rpccli_net_auth2(170) > cli_net_auth2: srv:\\GENOME acct:PASING$ sc:4 mc: CODON neg: 400701ff >[2006/11/08 09:30:50, 5] rpc_parse/parse_net.c:init_q_auth_2(800) > init_q_auth_2: 800 >[2006/11/08 09:30:50, 5] rpc_parse/parse_misc.c:init_log_info(1409) > make_log_info 1409 >[2006/11/08 09:30:50, 5] rpc_parse/parse_net.c:init_q_auth_2(806) > init_q_auth_2: 806 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_q_auth_2 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_log_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 undoc_buffer: 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.G.E.N.O.M.E... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000022 smb_io_unistr2 unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0030 buffer : P.A.S.I.N.G.$... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0040 sec_chan: 0004 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000042 smb_io_unistr2 unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0044 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0048 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 004c uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0050 buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00005c smb_io_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 005c data: 73 08 1e 2a f6 cd 08 e2 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000064 net_io_neg_flags >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0064 neg_flags: 400701ff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0080 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000068 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 opnum : 000f >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7712 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=210 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=55297 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=7 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 128 (0x80) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 128 (0x80) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30482 (0x7712) > smb_bcc=143 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 80 00 00 00 03 00 00 00 68 ........ .......h > [020] 00 00 00 00 00 0F 00 01 00 00 00 09 00 00 00 00 ........ ........ > [030] 00 00 00 09 00 00 00 5C 00 5C 00 47 00 45 00 4E .......\ .\.G.E.N > [040] 00 4F 00 4D 00 45 00 00 00 00 00 08 00 00 00 00 .O.M.E.. ........ > [050] 00 00 00 08 00 00 00 50 00 41 00 53 00 49 00 4E .......P .A.S.I.N > [060] 00 47 00 24 00 00 00 04 00 00 00 06 00 00 00 00 .G.$.... ........ > [070] 00 00 00 06 00 00 00 43 00 4F 00 44 00 4F 00 4E .......C .O.D.O.N > [080] 00 00 00 73 08 1E 2A F6 CD 08 E2 FF 01 07 40 ...s..*. ......@ >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,214) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,214) wrote 214 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 96 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=96 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=7 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=41 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 03 00 00 ........ .(...... > [010] 00 10 00 00 00 00 00 00 00 4C 4E 61 79 AB F0 1B ........ .LNay... > [020] 0A FF 01 00 40 00 00 00 00 ....@... . >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=96 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=7 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=41 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 03 00 00 ........ .(...... > [010] 00 10 00 00 00 00 00 00 00 4C 4E 61 79 AB F0 1B ........ .LNay... > [020] 0A FF 01 00 40 00 00 00 00 ....@... . >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0028 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000010 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 40, data_len 16, ss_len 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 40 at offset 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7712 returned 32 bytes. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_r_auth_2 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0000 data: 4c 4e 61 79 ab f0 1b 0a >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 net_io_neg_flags >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 neg_flags: 400001ff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(763) > 000c status: NT_STATUS_OK >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_check(325) > creds_client_check: credentials check OK. >[2006/11/08 09:30:50, 5] rpc_client/cli_netlogon.c:rpccli_netlogon_setup_creds(346) > rpccli_netlogon_setup_creds: server GENOME credential chain established. >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,108) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,108) wrote 108 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 103 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=8 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 4864 (0x1300) > smb_vwv[ 3]= 375 (0x177) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044) > Bind RPC Pipe[7713]: \NETLOGON auth_type 2, auth_level 6 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647) > Bind Abstract Syntax: [000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [010] 01 00 00 00 .... >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) > Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [010] 02 00 00 00 .... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_auth_schannel_neg schannel_neg >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 type1: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 type2: 00000003 >[2006/11/08 09:30:50, 6] lib/util.c:dump_data(2215) > [000] 4D 55 43 MUC >[2006/11/08 09:30:50, 6] lib/util.c:dump_data(2215) > [000] 43 4F 44 4F 4E CODON >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0062 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0010 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0012 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 001e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00001f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 12345678 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1234 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : abcd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : ef 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 01 23 45 67 cf fb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0038 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 003a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 003c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 003e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0044 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000048 smb_io_rpc_hdr_auth hdr_auth >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0048 auth_type : 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0049 auth_level : 06 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 004a auth_pad_len : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 004b auth_reserved: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 004c auth_context_id: 00000001 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7713 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=180 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=55297 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=9 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 98 (0x62) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 98 (0x62) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30483 (0x7713) > smb_bcc=113 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 0B 03 10 00 00 00 62 00 12 00 04 00 00 00 B8 .......b ........ > [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x > [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... > [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ > [050] 10 48 60 02 00 00 00 44 06 00 00 01 00 00 00 00 .H`....D ........ > [060] 00 00 00 03 00 00 00 4D 55 43 00 43 4F 44 4F 4E .......M UC.CODON > [070] 00 . >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,184) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,184) wrote 184 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=9 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 88 (0x58) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 88 (0x58) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=89 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 0C 03 10 00 00 00 58 00 0C 00 04 00 00 ........ .X...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 44 06 08 00 01 00 00 00 01 00 00 `....D.. ........ > [050] 00 00 00 00 00 05 00 00 00 ........ . >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=9 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 88 (0x58) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 88 (0x58) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=89 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 0C 03 10 00 00 00 58 00 0C 00 04 00 00 ........ .X...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 44 06 08 00 01 00 00 00 01 00 00 `....D.. ........ > [050] 00 00 00 00 00 05 00 00 00 ........ . >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0058 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000004 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 88 at offset 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7713 returned 88 bytes. >[2006/11/08 09:30:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081) > rpc_pipe_bind: Remote machine GENOME pipe \NETLOGON fnum 0x7713 bind request returned ok. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0058 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0010 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0012 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0018 len: 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a str: \PIPE\lsass. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000026 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0028 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0034 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0036 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0038 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 003a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:check_bind_response(1701) > check_bind_response: accepted! >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_schannel_with_key(2537) > cli_rpc_pipe_open_schannel_with_key: opened pipe \NETLOGON to machine GENOME for domain MUC and bound using schannel. >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,45) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,45) wrote 45 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=10 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] libsmb/clientgen.c:cli_rpc_pipe_close(384) > cli_rpc_pipe_close: closed pipe \NETLOGON to machine GENOME >[2006/11/08 09:30:50, 10] libsmb/namequery.c:saf_store(71) > saf_store: domain = [MUC], server = [GENOME], expire = [1162975550] >[2006/11/08 09:30:50, 10] lib/gencache.c:gencache_set(131) > Adding cache entry with key = SAF/DOMAIN/MUC; value = GENOME and timeout = Wed Nov 8 09:45:50 2006 > (900 seconds ahead) >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_step(148) > sequence = 0x455195bc >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_step(150) > seed: 73081E2AF6CD08E2 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_step(155) > seed+seq 2F9E6F6FF6CD08E2 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_step(159) > CLIENT 39E06B504614AFAE >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_step(164) > seed+seq+1 309E6F6FF6CD08E2 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_step(168) > SERVER 85D8918444E44361 >[2006/11/08 09:30:50, 5] libsmb/credentials.c:creds_reseed(238) > cred_reseed: seed 309E6F6FF6CD08E2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_net.c:init_id_info2(1181) > init_id_info2: 1181 >[2006/11/08 09:30:50, 5] rpc_parse/parse_misc.c:init_logon_id(1588) > make_logon_id: 1588 >[2006/11/08 09:30:50, 5] rpc_parse/parse_net.c:init_sam_info(1275) > init_sam_info: 1275 >[2006/11/08 09:30:50, 5] rpc_parse/parse_misc.c:init_clnt_info2(1503) > make_clnt_info: 1503 >[2006/11/08 09:30:50, 5] rpc_parse/parse_misc.c:init_clnt_srv(1348) > init_clnt_srv: 1348 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_q_sam_logon >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_sam_info >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_clnt_info2 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_clnt_srv >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 undoc_buffer : 00000001 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.G.E.N.O.M.E... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 undoc_buffer2: 00000001 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000028 smb_io_unistr2 unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0034 buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 ptr_cred: 00000001 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000044 smb_io_cred >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000044 smb_io_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0044 data: 39 e0 6b 50 46 14 af ae >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 00004c smb_io_utime >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 004c time: 455195bc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0050 ptr_rtn_cred : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000054 smb_io_cred >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000054 smb_io_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0054 data: 00 00 00 00 00 00 00 00 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 00005c smb_io_utime >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 005c time: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0060 logon_level : 0002 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000062 smb_io_sam_info_ctr logon_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0062 switch_value : 0002 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000064 net_io_id_info2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0064 ptr_id_info2: 00000001 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000068 smb_io_unihdr unihdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0068 uni_str_len: 0006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 006a uni_max_len: 0006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 006c buffer : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0070 param_ctrl: 00000820 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000074 smb_io_logon_id >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0074 low : 0000dead >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0078 high: 0000beef >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 00007c smb_io_unihdr unihdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 007c uni_str_len: 0012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 007e uni_max_len: 0012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0080 buffer : 00000001 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000084 smb_io_unihdr unihdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0084 uni_str_len: 000e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0086 uni_max_len: 000e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0088 buffer : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 008c lm_chal: c4 ad 6d e1 7b 65 a4 65 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000094 smb_io_strhdr hdr_nt_chal_resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0094 str_str_len: 0018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0096 str_max_len: 0018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0098 buffer : 00000001 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 00009c smb_io_strhdr hdr_lm_chal_resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 009c str_str_len: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 009e str_max_len: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a0 buffer : 00000000 >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 0000a4 smb_io_unistr2 uni_domain_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a4 uni_max_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00ac uni_str_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 00b0 buffer : M.U.C. >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 0000b6 smb_io_unistr2 uni_user_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b8 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00bc offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c0 uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 00c4 buffer : m.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 0000d6 smb_io_unistr2 uni_wksta_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d8 uni_max_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00dc offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00e0 uni_str_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 00e4 buffer : \.\.I.T.-.0.1. >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 0000f2 smb_io_string2 nt_chal_resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00f4 str_max_len: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00f8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00fc str_str_len: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_string2(1096) > 0100 buffer : ..8..O....A....t.s..8)l* >[2006/11/08 09:30:50, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000118 smb_io_string2 - NULL lm_chal_resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0118 validation_level: 0003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0160 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0020 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000005 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 0000011a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 opnum : 0002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000138 smb_io_rpc_hdr_auth hdr_auth >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0138 auth_type : 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0139 auth_level : 06 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 013a auth_pad_len : 06 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 013b auth_reserved: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 013c auth_context_id: 00000001 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:add_schannel_auth_footer(1357) > add_schannel_auth_footer: SCHANNEL seq_num=0 >[2006/11/08 09:30:50, 10] rpc_parse/parse_prs.c:schannel_encode(1633) > SCHANNEL: schannel_encode seq_num=0 data_len=288 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000140 smb_io_rpc_auth_schannel_chk >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0140 sig : 77 00 7a 00 ff ff 00 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0148 seq_num: b9 d8 06 73 60 a3 93 5a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0150 packet_digest: a3 10 9d e3 ff 1e 2e 0f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0158 confounder: 1b 6c 0a f4 ea 66 b4 7e >[2006/11/08 09:30:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7713 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=434 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=55297 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=11 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 352 (0x160) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 352 (0x160) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30483 (0x7713) > smb_bcc=367 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 60 01 20 00 05 00 00 00 1A .......` . ...... > [020] 01 00 00 00 00 02 00 97 83 35 B0 1F 2A 2F F2 25 ........ .5..*/.% > [030] B7 EE 7B E5 AE 0D 70 DF 18 E2 C7 2A DC 5B 03 1E ..{...p. ...*.[.. > [040] 6B 86 5C 02 60 FA 8A 2D 3B 8D F9 18 2E CD 13 23 k.\.`..- ;......# > [050] 6F 61 20 A8 04 0D 90 67 5A 45 6B A9 30 77 EE FC oa ....g ZEk.0w.. > [060] B5 DB D1 79 FC D6 BF 69 FA 09 B5 98 D0 35 8B ED ...y...i .....5.. > [070] 5E 1D 2B 5B DC E7 FA B1 F5 94 DC 19 41 60 D1 FF ^.+[.... ....A`.. > [080] 1A E0 80 22 8B BE A2 E4 9D 32 AB 17 22 A2 64 EE ...".... .2..".d. > [090] 4B 78 F4 A6 C0 0E A9 58 A4 60 03 49 E8 D2 32 F9 Kx.....X .`.I..2. > [0A0] A3 7B DE D3 FC B0 7B 65 3F FD FA BE 43 89 FD 43 .{....{e ?...C..C > [0B0] 57 F7 E1 F6 E6 6C BD BD 20 B1 2A 57 F9 C1 C0 20 W....l.. .*W... > [0C0] 67 29 35 00 58 4D AC 46 E7 03 37 E3 84 E5 66 57 g)5.XM.F ..7...fW > [0D0] 61 B9 5F D2 25 4C 56 FB 8B 9C 0E 6D 92 65 86 86 a._.%LV. ...m.e.. > [0E0] 61 91 AD E2 FA 8E 80 C9 7C 67 CE 57 CA 70 0F F5 a....... |g.W.p.. > [0F0] 8A 9A 58 A8 EA 51 03 7E 89 35 D4 8F D8 EC 29 B8 ..X..Q.~ .5....). > [100] D6 80 E8 C4 4E BA C7 9C CC 5C 82 3E 3A 8E 98 1A ....N... .\.>:... > [110] 10 0A 7E 86 36 27 26 A5 CB EE 3B 5F 70 A0 F0 D4 ..~.6'&. ..;_p... > [120] 69 43 6D 53 1B C2 30 71 B5 6A C9 EE AC 7B 04 8E iCmS..0q .j...{.. > [130] 12 30 90 A8 A4 37 C3 D5 D9 CB 50 E9 D5 45 2D 6E .0...7.. ..P..E-n > [140] 03 56 49 B8 94 91 D7 44 06 06 00 01 00 00 00 77 .VI....D .......w > [150] 00 7A 00 FF FF 00 00 B9 D8 06 73 60 A3 93 5A A3 .z...... ..s`..Z. > [160] 10 9D E3 FF 1E 2E 0F 1B 6C 0A F4 EA 66 B4 7E ........ l...f.~ >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,438) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,438) wrote 438 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 800 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=800 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=11 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 744 (0x2E8) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 744 (0x2E8) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=745 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 E8 02 20 00 05 00 00 ........ ... .... > [010] 00 A8 02 00 00 00 00 00 00 B7 7D CA AE D9 E1 8E ........ ..}..... > [020] 8B 17 40 35 FC 8A 75 A2 27 0F 99 74 4E 81 89 52 ..@5..u. '..tN..R > [030] 7C 12 12 A5 38 DA E2 68 A7 EE 11 EE B3 FE BC 68 |...8..h .......h > [040] 55 69 07 A0 08 2B 33 C0 91 6B 9A F2 3E 7A FE 3C Ui...+3. .k..>z.< > [050] F9 AD FB 77 2E EA 17 11 3F 29 E3 5A A5 8B B1 F5 ...w.... ?).Z.... > [060] 44 B8 38 4D C6 E9 E2 1B 47 D1 8F 17 0E 9F DE 3D D.8M.... G......= > [070] C5 D8 EE DA 11 19 57 97 7A D6 BC 8D C5 2E 56 61 ......W. z.....Va > [080] 80 93 FC E7 8C 28 CD E8 3E 9B B5 F4 85 E7 FB F3 .....(.. >....... > [090] A1 4E 77 88 66 E0 5E 67 90 E0 B4 A2 14 3E 70 CF .Nw.f.^g .....>p. > [0A0] DC D0 BF D5 B8 E2 EB 69 8E E8 7D 2C 07 70 F7 F7 .......i ..},.p.. > [0B0] BA E6 74 5C 9F 65 6F 83 E0 50 63 13 6A CC 7D CE ..t\.eo. .Pc.j.}. > [0C0] F0 F4 42 B1 37 FC E7 3F 0A 3F 40 E4 18 2F 7C BE ..B.7..? .?@../|. > [0D0] DA 95 08 9B 2A 77 47 AA EE 26 5E CD B7 6C 11 46 ....*wG. .&^..l.F > [0E0] 1E 75 C6 6A 7E 78 6E CD 60 D1 3E D5 8F 35 33 A1 .u.j~xn. `.>..53. > [0F0] 74 D5 53 25 A6 12 60 EC 7E 60 4F B9 05 33 A6 4A t.S%..`. ~`O..3.J > [100] E0 76 41 34 CF 87 32 28 49 74 60 78 DD 5F 41 6B .vA4..2( It`x._Ak > [110] F6 17 B9 0C 65 1D 03 6F FF 39 82 32 6F 8C 1B 47 ....e..o .9.2o..G > [120] F0 7A 9C 02 E5 D2 73 9B 2F AD 32 6D BC E5 32 36 .z....s. /.2m..26 > [130] 0D 00 B1 3A 35 13 CA AC D6 6E 85 7E 2E AE AF BE ...:5... .n.~.... > [140] 26 F7 42 6C 54 FC 10 32 34 80 78 AF 22 28 D1 61 &.BlT..2 4.x."(.a > [150] 23 8A 6F 09 E0 B8 E9 A9 26 72 63 96 1F E9 0F 38 #.o..... &rc....8 > [160] 83 2D B5 7D 1F E8 4D B3 0B FF 9C 3D 35 BF BD 22 .-.}..M. ...=5.." > [170] 2C 5E 28 AA C8 F1 F5 3A 8A CB D6 5E 64 7D EC A5 ,^(....: ...^d}.. > [180] B7 75 48 36 84 E2 A3 DA 70 71 B5 7C 77 F9 60 FF .uH6.... pq.|w.`. > [190] 88 3B 50 B8 2B AD 40 94 98 C2 02 CD 3F 23 7A 2C .;P.+.@. ....?#z, > [1A0] 4B AE 76 08 8F 83 9B 70 D4 0A 33 0E 4B F7 21 AA K.v....p ..3.K.!. > [1B0] BF 85 1D 45 FA 69 5D 66 E4 FE 95 AA 40 D9 43 D7 ...E.i]f ....@.C. > [1C0] F5 EC 9D 4D 04 A2 6A 37 FE FF 87 39 02 19 52 E1 ...M..j7 ...9..R. > [1D0] EA 96 5D BD C4 A3 6F E7 A8 05 2E 3B 19 37 A3 68 ..]...o. ...;.7.h > [1E0] 5F 96 D9 97 5C 95 A0 8F 99 BF 47 FA 8F DC 0F 4E _...\... ..G....N > [1F0] 70 9C BD 57 A1 7A 52 70 DD 2C EC F4 FD CA B4 40 p..W.zRp .,.....@ >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=800 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=11 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 744 (0x2E8) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 744 (0x2E8) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=745 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 E8 02 20 00 05 00 00 ........ ... .... > [010] 00 A8 02 00 00 00 00 00 00 B7 7D CA AE D9 E1 8E ........ ..}..... > [020] 8B 17 40 35 FC 8A 75 A2 27 0F 99 74 4E 81 89 52 ..@5..u. '..tN..R > [030] 7C 12 12 A5 38 DA E2 68 A7 EE 11 EE B3 FE BC 68 |...8..h .......h > [040] 55 69 07 A0 08 2B 33 C0 91 6B 9A F2 3E 7A FE 3C Ui...+3. .k..>z.< > [050] F9 AD FB 77 2E EA 17 11 3F 29 E3 5A A5 8B B1 F5 ...w.... ?).Z.... > [060] 44 B8 38 4D C6 E9 E2 1B 47 D1 8F 17 0E 9F DE 3D D.8M.... G......= > [070] C5 D8 EE DA 11 19 57 97 7A D6 BC 8D C5 2E 56 61 ......W. z.....Va > [080] 80 93 FC E7 8C 28 CD E8 3E 9B B5 F4 85 E7 FB F3 .....(.. >....... > [090] A1 4E 77 88 66 E0 5E 67 90 E0 B4 A2 14 3E 70 CF .Nw.f.^g .....>p. > [0A0] DC D0 BF D5 B8 E2 EB 69 8E E8 7D 2C 07 70 F7 F7 .......i ..},.p.. > [0B0] BA E6 74 5C 9F 65 6F 83 E0 50 63 13 6A CC 7D CE ..t\.eo. .Pc.j.}. > [0C0] F0 F4 42 B1 37 FC E7 3F 0A 3F 40 E4 18 2F 7C BE ..B.7..? .?@../|. > [0D0] DA 95 08 9B 2A 77 47 AA EE 26 5E CD B7 6C 11 46 ....*wG. .&^..l.F > [0E0] 1E 75 C6 6A 7E 78 6E CD 60 D1 3E D5 8F 35 33 A1 .u.j~xn. `.>..53. > [0F0] 74 D5 53 25 A6 12 60 EC 7E 60 4F B9 05 33 A6 4A t.S%..`. ~`O..3.J > [100] E0 76 41 34 CF 87 32 28 49 74 60 78 DD 5F 41 6B .vA4..2( It`x._Ak > [110] F6 17 B9 0C 65 1D 03 6F FF 39 82 32 6F 8C 1B 47 ....e..o .9.2o..G > [120] F0 7A 9C 02 E5 D2 73 9B 2F AD 32 6D BC E5 32 36 .z....s. /.2m..26 > [130] 0D 00 B1 3A 35 13 CA AC D6 6E 85 7E 2E AE AF BE ...:5... .n.~.... > [140] 26 F7 42 6C 54 FC 10 32 34 80 78 AF 22 28 D1 61 &.BlT..2 4.x."(.a > [150] 23 8A 6F 09 E0 B8 E9 A9 26 72 63 96 1F E9 0F 38 #.o..... &rc....8 > [160] 83 2D B5 7D 1F E8 4D B3 0B FF 9C 3D 35 BF BD 22 .-.}..M. ...=5.." > [170] 2C 5E 28 AA C8 F1 F5 3A 8A CB D6 5E 64 7D EC A5 ,^(....: ...^d}.. > [180] B7 75 48 36 84 E2 A3 DA 70 71 B5 7C 77 F9 60 FF .uH6.... pq.|w.`. > [190] 88 3B 50 B8 2B AD 40 94 98 C2 02 CD 3F 23 7A 2C .;P.+.@. ....?#z, > [1A0] 4B AE 76 08 8F 83 9B 70 D4 0A 33 0E 4B F7 21 AA K.v....p ..3.K.!. > [1B0] BF 85 1D 45 FA 69 5D 66 E4 FE 95 AA 40 D9 43 D7 ...E.i]f ....@.C. > [1C0] F5 EC 9D 4D 04 A2 6A 37 FE FF 87 39 02 19 52 E1 ...M..j7 ...9..R. > [1D0] EA 96 5D BD C4 A3 6F E7 A8 05 2E 3B 19 37 A3 68 ..]...o. ...;.7.h > [1E0] 5F 96 D9 97 5C 95 A0 8F 99 BF 47 FA 8F DC 0F 4E _...\... ..G....N > [1F0] 70 9C BD 57 A1 7A 52 70 DD 2C EC F4 FD CA B4 40 p..W.zRp .,.....@ >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 02e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0020 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000005 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 000002a8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 0002c0 smb_io_rpc_hdr_auth hdr_auth >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 02c0 auth_type : 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 02c1 auth_level : 06 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 02c2 auth_pad_len : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 02c3 auth_reserved: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02c4 auth_context_id: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 0002c8 smb_io_rpc_auth_schannel_chk >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 02c8 sig : 77 00 7a 00 ff ff 00 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 02d0 seq_num: 3d 0d ad 2e b4 72 02 da >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 02d8 packet_digest: c1 65 f0 c7 25 9e ce a1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 02e0 confounder: 65 a2 35 20 c9 76 6b a6 >[2006/11/08 09:30:50, 10] rpc_parse/parse_prs.c:schannel_decode(1710) > SCHANNEL: schannel_decode seq_num=1 data_len=680 >[2006/11/08 09:30:50, 10] rpc_parse/parse_prs.c:schannel_decode(1730) > SCHANNEL: schannel_decode seq_num=1 data_len=680 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 744, data_len 680, ss_len 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 744 at offset 0 >[2006/11/08 09:30:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine GENOME pipe \NETLOGON fnum 0x7713 returned 1360 bytes. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_r_sam_logon >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 buffer_creds: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_cred >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_chal >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0004 data: 85 d8 91 84 44 e4 43 61 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00000c smb_io_utime >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c time: 455195bd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0010 switch_value: 0003 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000014 net_io_user_info3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ptr_user_info : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_time logon time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 low : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c high: 00000000 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_time logoff time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 low : ffffffff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 high: 7fffffff >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000028 smb_io_time kickoff time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 low : ffffffff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c high: 7fffffff >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_time last set time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 low : e30e9d00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 high: 01c5f72a >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000038 smb_io_time can change time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 low : e30e9d00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c high: 01c5f72a >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000040 smb_io_time must change time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 low : ffffffff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0044 high: 7fffffff >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000048 smb_io_unihdr hdr_user_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0048 uni_str_len: 0012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 004a uni_max_len: 0012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 004c buffer : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000050 smb_io_unihdr hdr_full_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0050 uni_str_len: 001c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0052 uni_max_len: 001c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0054 buffer : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000058 smb_io_unihdr hdr_logon_script >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0058 uni_str_len: 001e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 005a uni_max_len: 001e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 005c buffer : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000060 smb_io_unihdr hdr_profile_path >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0060 uni_str_len: 0036 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0062 uni_max_len: 0036 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0064 buffer : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000068 smb_io_unihdr hdr_home_dir >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0068 uni_str_len: 0024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 006a uni_max_len: 0024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 006c buffer : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000070 smb_io_unihdr hdr_dir_drive >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0070 uni_str_len: 0004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0072 uni_max_len: 0004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0074 buffer : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0078 logon_count : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 007a bad_pw_count : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 007c user_rid : 00000c32 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0080 group_rid : 00000201 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0084 num_groups : 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0088 buffer_groups : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 008c user_flgs : 00000020 >[2006/11/08 09:30:50, 10] rpc_parse/parse_net.c:dump_user_flgs(1555) > dump_user_flgs > account has LOGON_EXTRA_SIDS >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0090 user_sess_key: 8e 30 ae 64 e4 de 59 d2 48 1c cd 00 b1 1d 8b 5a >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000a0 smb_io_unihdr hdr_logon_srv >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 00a0 uni_str_len: 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 00a2 uni_max_len: 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a4 buffer : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000a8 smb_io_unihdr hdr_logon_dom >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 00a8 uni_str_len: 0006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 00aa uni_max_len: 0006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00ac buffer : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b0 buffer_dom_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 00b4 lm_sess_key: 26 de 61 51 42 28 94 ef >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00bc acct_flags : 00000210 >[2006/11/08 09:30:50, 10] rpc_parse/parse_net.c:dump_acct_flags(1528) > dump_acct_flags > account has ACB_NORMAL > account has ACB_PWNOEXP >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c0 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c4 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c8 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00cc unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d0 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d4 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d8 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00dc num_other_sids: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00e0 buffer_other_sids: 00000000 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000e4 smb_io_unistr2 uni_user_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00e4 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00e8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00ec uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 00f0 buffer : m.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000102 smb_io_unistr2 uni_full_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0104 uni_max_len: 0000000e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0108 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 010c uni_str_len: 0000000e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0110 buffer : M.a.r.c. .M.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00012c smb_io_unistr2 uni_logon_script >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 012c uni_max_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0130 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0134 uni_str_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0138 buffer : l.o.g.o.n.s.c.r.i.p.t...b.a.t. >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000156 smb_io_unistr2 uni_profile_path >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0158 uni_max_len: 0000001b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 015c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0160 uni_str_len: 0000001b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0164 buffer : \.\.g.e.n.o.m.e.\.P.r.o.f.i.l.e.s.\.m.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00019a smb_io_unistr2 uni_home_dir >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 019c uni_max_len: 00000012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01a0 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01a4 uni_str_len: 00000012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 01a8 buffer : \.\.g.e.n.o.m.e.\.m.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0001cc smb_io_unistr2 uni_dir_drive >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01cc uni_max_len: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d0 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d4 uni_str_len: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 01d8 buffer : H.:. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01dc num_groups2 : 0000000f >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0001e0 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01e0 g_rid: 00000201 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01e4 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0001e8 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01e8 g_rid: 000004a1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01ec attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0001f0 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f0 g_rid: 0000057d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f4 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0001f8 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f8 g_rid: 00000585 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01fc attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000200 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0200 g_rid: 0000058d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0204 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000208 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0208 g_rid: 0000058f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 020c attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000210 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0210 g_rid: 00000591 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0214 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000218 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0218 g_rid: 0000059f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 021c attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000220 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0220 g_rid: 000005a3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0224 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000228 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0228 g_rid: 00000bcd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 022c attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000230 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0230 g_rid: 00000be7 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0234 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000238 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0238 g_rid: 00000bef >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 023c attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000240 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0240 g_rid: 00000bf7 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0244 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000248 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0248 g_rid: 00000bf9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 024c attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000250 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0250 g_rid: 00000c0d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0254 attr : 00000007 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000258 smb_io_unistr2 uni_logon_srv >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0258 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 025c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0260 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0264 buffer : G.E.N.O.M.E. >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000270 smb_io_unistr2 uni_logon_dom >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0270 uni_max_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0274 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0278 uni_str_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 027c buffer : M.U.C. >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000282 smb_io_dom_sid2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0284 num_auths: 00000004 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000288 smb_io_dom_sid sid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0288 sid_rev_num: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0289 num_auths : 04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 028a id_auth[0] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 028b id_auth[1] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 028c id_auth[2] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 028d id_auth[3] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 028e id_auth[4] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 028f id_auth[5] : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32s(991) > 0290 sub_auths : 00000015 51397ca9 6b5bdb79 2bb02e26 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02a0 auth_resp : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(763) > 02a4 status : NT_STATUS_OK >[2006/11/08 09:30:50, 10] libsmb/credentials.c:creds_client_check(325) > creds_client_check: credentials check OK. >[2006/11/08 09:30:50, 10] passdb/secrets.c:secrets_named_mutex_release(791) > secrets_named_mutex: released mutex for GENOME >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_alloc(131) > Finding user MUC+muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(75) > Trying _Get_Pwnam(), username as lowercase is muc+muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(83) > Trying _Get_Pwnam(), username as given is MUC+muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(93) > Trying _Get_Pwnam(), username as uppercase is MUC+MUEHLFELD >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(102) > Checking combinations of 0 uppercase letters in muc+muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(108) > Get_Pwnam_internals didn't find user [MUC+muehlfeld]! >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_alloc(131) > Finding user muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(75) > Trying _Get_Pwnam(), username as lowercase is muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(108) > Get_Pwnam_internals did find user [muehlfeld]! >[2006/11/08 09:30:50, 5] auth/auth_util.c:fill_sam_account(1532) > fill_sam_account: located username was [muehlfeld] >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_username(534) > pdb_set_username: setting username muehlfeld, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_fullname(603) > pdb_set_full_name: setting full name Marc Muehlfeld, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_domain(557) > pdb_set_domain: setting domain PASING, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_profile_path(649) > pdb_set_profile_path: setting profile path \\codon\Profiles\muehlfeld, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_homedir(696) > pdb_set_homedir: setting home dir \\codon\muehlfeld, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(672) > pdb_set_dir_drive: setting dir drive H:, was NULL >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_logon_script(626) > pdb_set_logon_script: setting logon script logonscript.bat, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_user_sid(463) > pdb_set_user_sid: setting user sid S-1-5-21-1183370737-3874734740-1589004535-3122 >[2006/11/08 09:30:50, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-1183370737-3874734740-1589004535-3122 from rid 3122 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_nt_username(580) > pdb_set_nt_username: setting nt username muehlfeld, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_username(534) > pdb_set_username: setting username muehlfeld, was muehlfeld >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_domain(557) > pdb_set_domain: setting domain MUC, was PASING >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_user_sid(463) > pdb_set_user_sid: setting user sid S-1-5-21-1362721961-1801182073-732966438-3122 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_group_sid(521) > pdb_set_group_sid: setting group sid S-1-5-21-1183370737-3874734740-1589004535-513 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_fullname(603) > pdb_set_full_name: setting full name Marc Muehlfeld, was Marc Muehlfeld >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_logon_script(626) > pdb_set_logon_script: setting logon script logonscript.bat, was logonscript.bat >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_profile_path(649) > pdb_set_profile_path: setting profile path \\genome\Profiles\muehlfeld, was \\codon\Profiles\muehlfeld >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_homedir(696) > pdb_set_homedir: setting home dir \\genome\muehlfeld, was \\codon\muehlfeld >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(672) > pdb_set_dir_drive: setting dir drive H:, was H: >[2006/11/08 09:30:50, 10] libsmb/samlogon_cache.c:netsamlogon_cache_store(134) > netsamlogon_cache_store: SID [S-1-5-21-1362721961-1801182073-732966438-3122] >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 timestamp: 455195ba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000004 net_io_user_info3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_user_info : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_time logon time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 low : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c high: 00000000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_time logoff time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 low : ffffffff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 high: 7fffffff >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_time kickoff time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 low : ffffffff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c high: 7fffffff >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_time last set time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 low : e30e9d00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 high: 01c5f72a >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000028 smb_io_time can change time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 low : e30e9d00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c high: 01c5f72a >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_time must change time >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 low : ffffffff >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 high: 7fffffff >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000038 smb_io_unihdr hdr_user_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0038 uni_str_len: 0012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 003a uni_max_len: 0012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c buffer : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000040 smb_io_unihdr hdr_full_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0040 uni_str_len: 001c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0042 uni_max_len: 001c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0044 buffer : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000048 smb_io_unihdr hdr_logon_script >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0048 uni_str_len: 001e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 004a uni_max_len: 001e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 004c buffer : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000050 smb_io_unihdr hdr_profile_path >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0050 uni_str_len: 0036 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0052 uni_max_len: 0036 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0054 buffer : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000058 smb_io_unihdr hdr_home_dir >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0058 uni_str_len: 0024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 005a uni_max_len: 0024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 005c buffer : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000060 smb_io_unihdr hdr_dir_drive >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0060 uni_str_len: 0004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0062 uni_max_len: 0004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0064 buffer : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0068 logon_count : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 006a bad_pw_count : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 006c user_rid : 00000c32 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0070 group_rid : 00000201 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0074 num_groups : 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0078 buffer_groups : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 007c user_flgs : 00000020 >[2006/11/08 09:30:50, 10] rpc_parse/parse_net.c:dump_user_flgs(1555) > dump_user_flgs > account has LOGON_EXTRA_SIDS >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0080 user_sess_key: e9 c5 3e ea d4 5b 5f 22 af 6a 5b 7b b1 35 ae 7b >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000090 smb_io_unihdr hdr_logon_srv >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0090 uni_str_len: 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0092 uni_max_len: 000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0094 buffer : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000098 smb_io_unihdr hdr_logon_dom >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0098 uni_str_len: 0006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 009a uni_max_len: 0006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 009c buffer : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a0 buffer_dom_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 00a4 lm_sess_key: 41 2b f1 df 72 ad 92 1f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00ac acct_flags : 00000210 >[2006/11/08 09:30:50, 10] rpc_parse/parse_net.c:dump_acct_flags(1528) > dump_acct_flags > account has ACB_NORMAL > account has ACB_PWNOEXP >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b0 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b4 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b8 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00bc unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c0 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c4 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c8 unkown: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00cc num_other_sids: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d0 buffer_other_sids: 00000000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0000d4 smb_io_unistr2 uni_user_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d4 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00dc uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 00e0 buffer : m.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0000f2 smb_io_unistr2 uni_full_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00f4 uni_max_len: 0000000e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00f8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00fc uni_str_len: 0000000e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0100 buffer : M.a.r.c. .M.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00011c smb_io_unistr2 uni_logon_script >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 011c uni_max_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0120 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0124 uni_str_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0128 buffer : l.o.g.o.n.s.c.r.i.p.t...b.a.t. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000146 smb_io_unistr2 uni_profile_path >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0148 uni_max_len: 0000001b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 014c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0150 uni_str_len: 0000001b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0154 buffer : \.\.g.e.n.o.m.e.\.P.r.o.f.i.l.e.s.\.m.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00018a smb_io_unistr2 uni_home_dir >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 018c uni_max_len: 00000012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0190 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0194 uni_str_len: 00000012 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0198 buffer : \.\.g.e.n.o.m.e.\.m.u.e.h.l.f.e.l.d. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0001bc smb_io_unistr2 uni_dir_drive >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01bc uni_max_len: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01c0 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01c4 uni_str_len: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 01c8 buffer : H.:. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01cc num_groups2 : 0000000f >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0001d0 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d0 g_rid: 00000201 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d4 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0001d8 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d8 g_rid: 000004a1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01dc attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0001e0 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01e0 g_rid: 0000057d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01e4 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0001e8 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01e8 g_rid: 00000585 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01ec attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0001f0 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f0 g_rid: 0000058d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f4 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0001f8 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f8 g_rid: 0000058f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01fc attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000200 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0200 g_rid: 00000591 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0204 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000208 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0208 g_rid: 0000059f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 020c attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000210 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0210 g_rid: 000005a3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0214 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000218 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0218 g_rid: 00000bcd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 021c attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000220 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0220 g_rid: 00000be7 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0224 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000228 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0228 g_rid: 00000bef >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 022c attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000230 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0230 g_rid: 00000bf7 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0234 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000238 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0238 g_rid: 00000bf9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 023c attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000240 smb_io_gid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0240 g_rid: 00000c0d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0244 attr : 00000007 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000248 smb_io_unistr2 uni_logon_srv >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0248 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 024c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0250 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0254 buffer : G.E.N.O.M.E. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000260 smb_io_unistr2 uni_logon_dom >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0260 uni_max_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0264 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0268 uni_str_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 026c buffer : M.U.C. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000272 smb_io_dom_sid2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0274 num_auths: 00000004 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000278 smb_io_dom_sid sid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0278 sid_rev_num: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0279 num_auths : 04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 027a id_auth[0] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 027b id_auth[1] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 027c id_auth[2] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 027d id_auth[3] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 027e id_auth[4] : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 027f id_auth[5] : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32s(991) > 0280 sub_auths : 00000015 51397ca9 6b5bdb79 2bb02e26 >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,45) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,45) wrote 45 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=12 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] libsmb/clientgen.c:cli_rpc_pipe_close(384) > cli_rpc_pipe_close: closed pipe \NETLOGON to machine GENOME >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(132) > write_socket(19,39) >[2006/11/08 09:30:50, 6] libsmb/clientgen.c:write_socket(135) > write_socket(19,39) wrote 39 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=7769 > smb_uid=100 > smb_mid=13 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 3] auth/auth.c:check_ntlm_password(270) > check_ntlm_password: winbind authentication for user [muehlfeld] succeeded >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth.c:check_ntlm_password(296) > check_ntlm_password: PAM Account for user [muehlfeld] succeeded >[2006/11/08 09:30:50, 2] auth/auth.c:check_ntlm_password(309) > check_ntlm_password: authentication for user [muehlfeld] -> [muehlfeld] -> [muehlfeld] succeeded >[2006/11/08 09:30:50, 5] auth/auth_util.c:free_user_info(1866) > attempting to free (and zero) a user_info structure >[2006/11/08 09:30:50, 10] auth/auth_util.c:free_user_info(1870) > structure was created for muehlfeld >[2006/11/08 09:30:50, 3] passdb/lookup_sid.c:fetch_gid_from_cache(1015) > fetch gid from cache 544 -> S-1-5-32-544 >[2006/11/08 09:30:50, 3] passdb/lookup_sid.c:fetch_gid_from_cache(1015) > fetch gid from cache 545 -> S-1-5-32-545 >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3122)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-513)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-11)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1185)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1405)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1413)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1421)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1423)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1425)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1439)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1443)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3021)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3047)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3055)(sambaSIDList=S-1-5-21-1362721961-1801182073-73 +> > 2The connection to the LDAP server was closed >[2006/11/08 09:30:50, 10] lib/smbldap.c:smb_ldap_setup_conn(632) > smb_ldap_setup_connection: ldap://192.168.30.4/ >[2006/11/08 09:30:50, 2] lib/smbldap.c:smbldap_open_connection(788) > smbldap_open_connection: connection opened >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_connect_system(947) > ldap_connect_system: Binding to ldap server ldap://192.168.30.4/ as "uid=samba,ou=Users,dc=pa,dc=lfmg,dc=de" >[2006/11/08 09:30:50, 3] lib/smbldap.c:smbldap_connect_system(992) > ldap_connect_system: succesful connection to the LDAP server > ldap_connect_system: LDAP server does support paged results >[2006/11/08 09:30:50, 4] lib/smbldap.c:smbldap_open(1060) > The LDAP server is succesfully connected >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3122)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-513)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-11)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1185)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1405)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1413)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1421)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1423)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1425)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1439)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-1443)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3021)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3047)(sambaSIDList=S-1-5-21-1362721961-1801182073-732966438-3055)(sambaSIDList=S-1-5-21-1362721961-1801182073-73 +> > 2get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-3122] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-513] >[2006/11/08 09:30:50, 5] lib/privileges.c:get_privileges_for_sids(459) > get_privileges_for_sids: sid = S-1-1-0 > Privilege set: > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-2] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-11] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1185] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1405] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1413] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1421] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1423] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1425] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1439] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-1443] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-3021] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-3047] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-3055] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-3063] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-3065] >[2006/11/08 09:30:50, 3] lib/privileges.c:get_privileges(261) > get_privileges: No privileges assigned to SID [S-1-5-21-1362721961-1801182073-732966438-3085] >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-513 to gid, ignoring it >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-1-0))], scope => [2] >[2006/11/08 09:30:50, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2213) > ldapsam_getgroup: Did not find group >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-1-0 to gid, ignoring it >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-2))], scope => [2] >[2006/11/08 09:30:50, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2213) > ldapsam_getgroup: Did not find group >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-2 to gid, ignoring it >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-11))], scope => [2] >[2006/11/08 09:30:50, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2213) > ldapsam_getgroup: Did not find group >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-11 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1185 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1405 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1413 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1421 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1423 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1425 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1439 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-1443 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-3021 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-3047 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-3055 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-3063 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-3065 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:create_local_token(1023) > Could not convert SID S-1-5-21-1362721961-1801182073-732966438-3085 to gid, ignoring it >[2006/11/08 09:30:50, 10] auth/auth_util.c:debug_nt_user_token(454) > NT user token of user S-1-5-21-1362721961-1801182073-732966438-3122 > contains 19 SIDs > SID[ 0]: S-1-5-21-1362721961-1801182073-732966438-3122 > SID[ 1]: S-1-5-21-1362721961-1801182073-732966438-513 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-1362721961-1801182073-732966438-1185 > SID[ 6]: S-1-5-21-1362721961-1801182073-732966438-1405 > SID[ 7]: S-1-5-21-1362721961-1801182073-732966438-1413 > SID[ 8]: S-1-5-21-1362721961-1801182073-732966438-1421 > SID[ 9]: S-1-5-21-1362721961-1801182073-732966438-1423 > SID[ 10]: S-1-5-21-1362721961-1801182073-732966438-1425 > SID[ 11]: S-1-5-21-1362721961-1801182073-732966438-1439 > SID[ 12]: S-1-5-21-1362721961-1801182073-732966438-1443 > SID[ 13]: S-1-5-21-1362721961-1801182073-732966438-3021 > SID[ 14]: S-1-5-21-1362721961-1801182073-732966438-3047 > SID[ 15]: S-1-5-21-1362721961-1801182073-732966438-3055 > SID[ 16]: S-1-5-21-1362721961-1801182073-732966438-3063 > SID[ 17]: S-1-5-21-1362721961-1801182073-732966438-3065 > SID[ 18]: S-1-5-21-1362721961-1801182073-732966438-3085 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:50, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(133) > Got NT session key of length 16 >[2006/11/08 09:30:50, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(140) > Got LM session key of length 8 >[2006/11/08 09:30:50, 10] libsmb/ntlmssp.c:ntlmssp_server_auth(738) > ntlmssp_server_auth: Created NTLM2 session key. >[2006/11/08 09:30:50, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338) > NTLMSSP Sign/Seal - Initialising with flags: >[2006/11/08 09:30:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) > Got NTLMSSP neg_flags=0xe2088215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH > NTLMSSP_NEGOTIATE_56 >[2006/11/08 09:30:50, 10] smbd/password.c:register_vuid(186) > register_vuid: allocated vuid = 101 >[2006/11/08 09:30:50, 10] lib/util_pw.c:getpwnam_alloc(76) > Got muehlfeld from pwnam_cache >[2006/11/08 09:30:50, 10] smbd/password.c:register_vuid(277) > register_vuid: (1061,513) muehlfeld muehlfeld MUC guest=0 >[2006/11/08 09:30:50, 3] smbd/password.c:register_vuid(280) > User name: muehlfeld Real name: Marc Muehlfeld >[2006/11/08 09:30:50, 3] smbd/password.c:register_vuid(301) > UNIX uid 1061 is UNIX user muehlfeld, and will be vuid 101 >[2006/11/08 09:30:50, 2] smbd/utmp.c:sys_utmp_update(419) > utmp_update: uname:/var/run/utmp wname:/var/log/wtmp >[2006/11/08 09:30:50, 7] param/loadparm.c:lp_servicenumber(5112) > lp_servicenumber: couldn't find muehlfeld >[2006/11/08 09:30:50, 3] smbd/password.c:register_vuid(332) > Adding homes service for user 'muehlfeld' using home directory: '/home/muehlfeld' >[2006/11/08 09:30:50, 8] param/loadparm.c:add_a_service(2495) > add_a_service: Creating snum = 19 for muehlfeld >[2006/11/08 09:30:50, 10] param/loadparm.c:hash_a_service(2542) > hash_a_service: hashing index 19 for service name muehlfeld >[2006/11/08 09:30:50, 3] param/loadparm.c:lp_add_home(2588) > adding home's share [muehlfeld] for user 'muehlfeld' at '/home/muehlfeld' >[2006/11/08 09:30:50, 6] param/loadparm.c:lp_file_list_changed(2998) > lp_file_list_changed() > file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Oct 16 11:15:28 2006 > > file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Wed Nov 8 09:24:47 2006 > > file /etc/samba//smb.conf -> /etc/samba//smb.conf last mod_time: Wed Nov 8 09:28:49 2006 > >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=104 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=128 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 9 (0x9) > smb_bcc=61 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x > [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 > [020] 00 2E 00 30 00 2E 00 32 00 33 00 63 00 00 00 50 ...0...2 .3.c...P > [030] 00 41 00 53 00 49 00 4E 00 47 00 00 00 .A.S.I.N .G... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 76 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x4c >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 3 of length 80 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=76 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=192 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 76 (0x4C) > smb_vwv[ 2]= 8 (0x8) > smb_vwv[ 3]= 1 (0x1) > smb_bcc=33 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 5C 00 43 00 4F 00 44 00 4F 00 4E 00 5C .\.\.C.O .D.O.N.\ > [010] 00 49 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F 3F .I.P.C.$ ...????? > [020] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtconX (pid 7769) conn 0x0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 4] smbd/reply.c:reply_tcon_and_X(668) > Client requested device type [?????] for share [IPC$] >[2006/11/08 09:30:50, 5] smbd/service.c:make_connection(1116) > making a connection to 'normal' service ipc$ >[2006/11/08 09:30:50, 10] smbd/share_access.c:user_ok_token(225) > user_ok_token: share IPC$ is ok for unix user muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_alloc(131) > Finding user muehlfeld >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(75) > Trying _Get_Pwnam(), username as lowercase is muehlfeld >[2006/11/08 09:30:50, 10] lib/util_pw.c:getpwnam_alloc(76) > Got muehlfeld from pwnam_cache >[2006/11/08 09:30:50, 5] lib/username.c:Get_Pwnam_internals(108) > Get_Pwnam_internals did find user [muehlfeld]! >[2006/11/08 09:30:50, 10] smbd/service.c:set_conn_connectpath(122) > set_conn_connectpath: service IPC$, connectpath = /tmp >[2006/11/08 09:30:50, 3] smbd/service.c:make_connection_snum(752) > Connect path is '/tmp' for service [IPC$] >[2006/11/08 09:30:50, 4] lib/sharesec.c:get_share_security(130) > get_share_security: using default secdesc for IPC$ >[2006/11/08 09:30:50, 10] lib/util_seaccess.c:se_map_generic(176) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/11/08 09:30:50, 10] lib/util_seaccess.c:se_access_check(233) > se_access_check: requested access 0x00000002, for NT token with 19 entries and first sid S-1-5-21-1362721961-1801182073-732966438-3122. >[2006/11/08 09:30:50, 3] lib/util_seaccess.c:se_access_check(250) >[2006/11/08 09:30:50, 3] lib/util_seaccess.c:se_access_check(251) > se_access_check: user sid is S-1-5-21-1362721961-1801182073-732966438-3122 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-513 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1185 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1405 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1413 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1421 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1423 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1425 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1439 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1443 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3021 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3047 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3055 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3063 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3065 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3085 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/11/08 09:30:50, 5] lib/util_seaccess.c:se_access_check(308) > se_access_check: access (2) granted. >[2006/11/08 09:30:50, 3] smbd/vfs.c:vfs_init_default(219) > Initialising default vfs hooks >[2006/11/08 09:30:50, 5] smbd/connection.c:claim_connection(170) > claiming IPC$ 0 >[2006/11/08 09:30:50, 10] smbd/share_access.c:user_ok_token(225) > user_ok_token: share IPC$ is ok for unix user muehlfeld >[2006/11/08 09:30:50, 10] smbd/share_access.c:is_share_read_only_for_token(267) > is_share_read_only_for_user: share IPC$ is read-only for unix user muehlfeld >[2006/11/08 09:30:50, 4] lib/sharesec.c:get_share_security(130) > get_share_security: using default secdesc for IPC$ >[2006/11/08 09:30:50, 10] lib/util_seaccess.c:se_map_generic(176) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/11/08 09:30:50, 10] lib/util_seaccess.c:se_access_check(233) > se_access_check: requested access 0x00000001, for NT token with 19 entries and first sid S-1-5-21-1362721961-1801182073-732966438-3122. >[2006/11/08 09:30:50, 3] lib/util_seaccess.c:se_access_check(250) >[2006/11/08 09:30:50, 3] lib/util_seaccess.c:se_access_check(251) > se_access_check: user sid is S-1-5-21-1362721961-1801182073-732966438-3122 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-513 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1185 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1405 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1413 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1421 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1423 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1425 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1439 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1443 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3021 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3047 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3055 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3063 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3065 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3085 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 >[2006/11/08 09:30:50, 5] lib/util_seaccess.c:se_access_check(308) > se_access_check: access (1) granted. >[2006/11/08 09:30:50, 3] lib/util_sid.c:string_to_sid(223) > string_to_sid: Sid root does not start with 'S-'. >[2006/11/08 09:30:50, 10] passdb/lookup_sid.c:lookup_name(64) > lookup_name: PASING\root => PASING (domain), root (name) >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [dc=pa,dc=lfmg,dc=de], filter => [(&(uid=root)(objectclass=sambaSamAccount))], scope => [2] >[2006/11/08 09:30:50, 4] passdb/pdb_ldap.c:ldapsam_getsampwnam(1396) > ldapsam_getsampwnam: Unable to locate user [root] count=0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=root)(cn=root)))], scope => [2] >[2006/11/08 09:30:50, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2213) > ldapsam_getgroup: Did not find group >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 10] passdb/lookup_sid.c:lookup_name(64) > lookup_name: Unix User\root => Unix User (domain), root (name) >[2006/11/08 09:30:50, 3] lib/util_sid.c:string_to_sid(223) > string_to_sid: Sid Administrator does not start with 'S-'. >[2006/11/08 09:30:50, 10] passdb/lookup_sid.c:lookup_name(64) > lookup_name: PASING\Administrator => PASING (domain), Administrator (name) >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [dc=pa,dc=lfmg,dc=de], filter => [(&(uid=Administrator)(objectclass=sambaSamAccount))], scope => [2] >[2006/11/08 09:30:50, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541) > init_sam_from_ldap: Entry found for user: Administrator >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_username(534) > pdb_set_username: setting username Administrator, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_domain(557) > pdb_set_domain: setting domain PASING, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_nt_username(580) > pdb_set_nt_username: setting nt username Administrator, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(476) > pdb_set_user_sid_from_string: setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_user_sid(463) > pdb_set_user_sid: setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_fullname(603) > pdb_set_full_name: setting full name Domainadministrator, was >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaHomeDrive] = [<does not exist>] >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(672) > pdb_set_dir_drive: setting dir drive H:, was NULL >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaHomePath] = [<does not exist>] >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_homedir(696) > pdb_set_homedir: setting home dir \\codon\administrator, was >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>] >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_logon_script(626) > pdb_set_logon_script: setting logon script logonscript.bat, was >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaProfilePath] = [<does not exist>] >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_profile_path(649) > pdb_set_profile_path: setting profile path \\codon\Profiles\administrator, was >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [description] = [<does not exist>] >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>] >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>] >[2006/11/08 09:30:50, 10] lib/account_pol.c:account_policy_get(337) > account_policy_get: name: password history, val: 3 >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>] >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>] >[2006/11/08 09:30:50, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>] >[2006/11/08 09:30:50, 5] passdb/login_cache.c:login_cache_init(41) > Opening cache file at /usr/var/locks/login_cache.tdb >[2006/11/08 09:30:50, 7] passdb/login_cache.c:login_cache_read(87) > Looking up login cache for user Administrator >[2006/11/08 09:30:50, 7] passdb/login_cache.c:login_cache_read(101) > No cache entry found >[2006/11/08 09:30:50, 9] passdb/pdb_ldap.c:init_sam_from_ldap(898) > No cache entry, bad count = 0, bad time = 0 >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=512))], scope => [2] >[2006/11/08 09:30:50, 2] passdb/pdb_ldap.c:init_group_from_ldap(2136) > init_group_from_ldap: Entry found for group: 512 >[2006/11/08 09:30:50, 10] passdb/lookup_sid.c:check_dom_sid_to_level(613) > Accepting SID S-1-5-21-1183370737-3874734740-1589004535 in level 1 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] passdb/pdb_interface.c:lookup_global_sam_rid(1478) > lookup_global_sam_rid: looking up RID 512. >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 2 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [dc=pa,dc=lfmg,dc=de], filter => [(&(sambaSID=S-1-5-21-1183370737-3874734740-1589004535-512)(objectclass=sambaSamAccount))], scope => [2] >[2006/11/08 09:30:50, 4] passdb/pdb_ldap.c:ldapsam_getsampwsid(1491) > ldapsam_getsampwsid: Unable to locate SID [S-1-5-21-1183370737-3874734740-1589004535-512] count=0 >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-21-1183370737-3874734740-1589004535-512))], scope => [2] >[2006/11/08 09:30:50, 2] passdb/pdb_ldap.c:init_group_from_ldap(2136) > init_group_from_ldap: Entry found for group: 512 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:50, 5] passdb/pdb_interface.c:pdb_default_lookup_rids(1599) > lookup_rids: Domain Admins:2 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 10] passdb/lookup_sid.c:lookup_sid(867) > Sid S-1-5-21-1183370737-3874734740-1589004535-512 -> PASING\Domain Admins(2) >[2006/11/08 09:30:50, 10] lib/account_pol.c:account_policy_get(337) > account_policy_get: name: password history, val: 3 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_username(534) > pdb_set_username: setting username Administrator, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_domain(557) > pdb_set_domain: setting domain PASING, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_nt_username(580) > pdb_set_nt_username: setting nt username Administrator, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_fullname(603) > pdb_set_full_name: setting full name Domainadministrator, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_homedir(696) > pdb_set_homedir: setting home dir \\codon\administrator, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(672) > pdb_set_dir_drive: setting dir drive H:, was NULL >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_logon_script(626) > pdb_set_logon_script: setting logon script logonscript.bat, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_profile_path(649) > pdb_set_profile_path: setting profile path \\codon\Profiles\administrator, was >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_workstations(739) > pdb_set_workstations: setting workstations , was >[2006/11/08 09:30:50, 10] lib/account_pol.c:account_policy_get(337) > account_policy_get: name: password history, val: 3 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_user_sid(463) > pdb_set_user_sid: setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 >[2006/11/08 09:30:50, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 from rid 2996 >[2006/11/08 09:30:50, 5] passdb/pdb_interface.c:lookup_global_sam_rid(1478) > lookup_global_sam_rid: looking up RID 512. >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [dc=pa,dc=lfmg,dc=de], filter => [(&(sambaSID=S-1-5-21-1183370737-3874734740-1589004535-512)(objectclass=sambaSamAccount))], scope => [2] >[2006/11/08 09:30:50, 4] passdb/pdb_ldap.c:ldapsam_getsampwsid(1491) > ldapsam_getsampwsid: Unable to locate SID [S-1-5-21-1183370737-3874734740-1589004535-512] count=0 >[2006/11/08 09:30:50, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-21-1183370737-3874734740-1589004535-512))], scope => [2] >[2006/11/08 09:30:50, 2] passdb/pdb_ldap.c:init_group_from_ldap(2136) > init_group_from_ldap: Entry found for group: 512 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 10] passdb/lookup_sid.c:sid_to_gid(1295) > sid_to_gid: S-1-5-21-1183370737-3874734740-1589004535-512 -> 512 >[2006/11/08 09:30:50, 3] passdb/lookup_sid.c:store_gid_sid_cache(1059) > store_gid_sid_cache: gid 512 in cache -> S-1-5-21-1183370737-3874734740-1589004535-512 >[2006/11/08 09:30:50, 10] passdb/pdb_get_set.c:pdb_set_group_sid(521) > pdb_set_group_sid: setting group sid S-1-5-21-1183370737-3874734740-1589004535-512 >[2006/11/08 09:30:50, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) > pdb_set_group_sid_from_rid: > setting group sid S-1-5-21-1183370737-3874734740-1589004535-512 from rid 512 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(454) > NT user token of user S-1-5-21-1362721961-1801182073-732966438-3122 > contains 19 SIDs > SID[ 0]: S-1-5-21-1362721961-1801182073-732966438-3122 > SID[ 1]: S-1-5-21-1362721961-1801182073-732966438-513 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-1362721961-1801182073-732966438-1185 > SID[ 6]: S-1-5-21-1362721961-1801182073-732966438-1405 > SID[ 7]: S-1-5-21-1362721961-1801182073-732966438-1413 > SID[ 8]: S-1-5-21-1362721961-1801182073-732966438-1421 > SID[ 9]: S-1-5-21-1362721961-1801182073-732966438-1423 > SID[ 10]: S-1-5-21-1362721961-1801182073-732966438-1425 > SID[ 11]: S-1-5-21-1362721961-1801182073-732966438-1439 > SID[ 12]: S-1-5-21-1362721961-1801182073-732966438-1443 > SID[ 13]: S-1-5-21-1362721961-1801182073-732966438-3021 > SID[ 14]: S-1-5-21-1362721961-1801182073-732966438-3047 > SID[ 15]: S-1-5-21-1362721961-1801182073-732966438-3055 > SID[ 16]: S-1-5-21-1362721961-1801182073-732966438-3063 > SID[ 17]: S-1-5-21-1362721961-1801182073-732966438-3065 > SID[ 18]: S-1-5-21-1362721961-1801182073-732966438-3085 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 1061 > Primary group is 513 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_user(260) > change_to_user uid=(1061,1061) gid=(0,513) >[2006/11/08 09:30:50, 3] smbd/service.c:make_connection_snum(941) > it-01 (192.168.29.254) connect to service IPC$ initially as user muehlfeld (uid=1061, gid=513) (pid 7769) >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 2] smbd/reply.c:reply_tcon_and_X(711) > Serving IPC$ as a Dfs root >[2006/11/08 09:30:50, 3] smbd/reply.c:reply_tcon_and_X(716) > tconX service=IPC$ >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=48 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=192 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 3 (0x3) > smb_bcc=7 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 49 50 43 00 00 00 00 IPC.... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 4 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=256 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(454) > NT user token of user S-1-5-21-1362721961-1801182073-732966438-3122 > contains 19 SIDs > SID[ 0]: S-1-5-21-1362721961-1801182073-732966438-3122 > SID[ 1]: S-1-5-21-1362721961-1801182073-732966438-513 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-1362721961-1801182073-732966438-1185 > SID[ 6]: S-1-5-21-1362721961-1801182073-732966438-1405 > SID[ 7]: S-1-5-21-1362721961-1801182073-732966438-1413 > SID[ 8]: S-1-5-21-1362721961-1801182073-732966438-1421 > SID[ 9]: S-1-5-21-1362721961-1801182073-732966438-1423 > SID[ 10]: S-1-5-21-1362721961-1801182073-732966438-1425 > SID[ 11]: S-1-5-21-1362721961-1801182073-732966438-1439 > SID[ 12]: S-1-5-21-1362721961-1801182073-732966438-1443 > SID[ 13]: S-1-5-21-1362721961-1801182073-732966438-3021 > SID[ 14]: S-1-5-21-1362721961-1801182073-732966438-3047 > SID[ 15]: S-1-5-21-1362721961-1801182073-732966438-3055 > SID[ 16]: S-1-5-21-1362721961-1801182073-732966438-3063 > SID[ 17]: S-1-5-21-1362721961-1801182073-732966438-3065 > SID[ 18]: S-1-5-21-1362721961-1801182073-732966438-3085 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 1061 > Primary group is 513 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_user(260) > change_to_user uid=(1061,1061) gid=(0,513) >[2006/11/08 09:30:50, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /tmp >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \wkssvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe wkssvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe wkssvc with handle 73e3 (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name wkssvc pnum=73e3 >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=256 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=58112 (0xE300) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 5 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=320 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29667 (0x73E3) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e3 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e3 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e3 name: wkssvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 6bffd098 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : a112 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 3610 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 98 33 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 46 c3 f8 7e 34 5a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\wkssvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73e3 nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=320 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 6 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=384 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29667 (0x73E3) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e3 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e3 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e3 name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e3 min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=384 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x90 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 7 of length 148 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=448 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29667 (0x73E3) > smb_bcc=77 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 14 83 F1 00 08 00 00 .$...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 64 00 00 00 .d.o.n.. .d... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e3 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e3 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "wkssvc" (pnum 73e3) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e3 name: wkssvc open: Yes len: 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0000 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[0].fn == 0x800ec7b4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_q_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name: 00f18314 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0020 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_r_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_1 : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 wks_io_wks_info_100 inf >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 platform_id : 000001f4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c ptr_compname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ptr_lan_grp : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ver_major : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 ver_minor : 00000009 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00001c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0028 buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 uni_max_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c uni_str_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0040 buffer : P.A.S.I.N.G... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(763) > 0050 status : NT_STATUS_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called wkssvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 94 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 44 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e3 name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 006c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000054 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=448 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 4F 00 44 00 4F 00 4E 00 00 00 07 00 00 .C.O.D.O .N...... > [050] 00 00 00 00 00 07 00 00 00 50 00 41 00 53 00 49 ........ .P.A.S.I > [060] 00 4E 00 47 00 00 00 00 00 00 00 00 00 .N.G.... ..... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 8 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=512 > smt_wct=3 > smb_vwv[ 0]=29667 (0x73E3) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e3 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e3 (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73e3 >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name wkssvc pnum=73e3 (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=512 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 9 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=576 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \srvsvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe srvsvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe srvsvc with handle 73e4 (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name srvsvc pnum=73e4 >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=576 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=58368 (0xE400) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 10 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=640 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29668 (0x73E4) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e4 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e4 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e4 name: srvsvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 4b324fc8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : 1670 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 01d3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 12 78 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 5a 47 bf 6e e1 88 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000003 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73e4 nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=640 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 11 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=704 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29668 (0x73E4) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e4 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e4 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e4 name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e4 min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=704 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x90 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 12 of length 148 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=768 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29668 (0x73E4) > smb_bcc=77 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 14 83 F1 00 08 00 00 .$...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 65 00 00 00 .d.o.n.. .e... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e4 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e4 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "srvsvc" (pnum 73e4) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e4 name: srvsvc open: Yes len: 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0015 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[11].fn == 0x800f7034 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_q_net_srv_get_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name : 00f18314 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 switch_value : 00000065 >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1045) > srv_net_srv_get_info: 1045 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_info_101(2809) > init_srv_info_101 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(3044) > init_srv_r_net_srv_get_info >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1090) > srv_net_srv_get_info: 1090 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_r_net_srv_get_info >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_info_ctr ctr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 switch_value: 00000065 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_srv_ctr : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000008 srv_io_info_101 sv101 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 platform_id : 000001f4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c ptr_name : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ver_major : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ver_minor : 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 srv_type : 00809a2b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c ptr_comment : 00000001 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_unistr2 uni_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 002c buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000038 smb_io_unistr2 uni_comment >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 uni_max_len: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 uni_str_len: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0044 buffer : .. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0048 status: WERR_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called srvsvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 138 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 44 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e4 name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 76. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0064 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 0000004c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..100] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=768 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 100 (0x64) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 100 (0x64) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=101 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 64 00 00 00 01 00 00 ........ .d...... > [010] 00 4C 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .L...... .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 2B 9A 80 00 01 00 00 00 06 00 00 00 00 00 00 .+...... ........ > [040] 00 06 00 00 00 43 00 4F 00 44 00 4F 00 4E 00 00 .....C.O .D.O.N.. > [050] 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 ........ ........ > [060] 00 00 00 00 00 ..... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 13 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=832 > smt_wct=3 > smb_vwv[ 0]=29668 (0x73E4) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e4 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e4 (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73e4 >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name srvsvc pnum=73e4 (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=832 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 14 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=896 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \wkssvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe wkssvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe wkssvc with handle 73e5 (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name wkssvc pnum=73e5 >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=896 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=58624 (0xE500) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 15 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=960 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29669 (0x73E5) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e5 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e5 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e5 name: wkssvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 6bffd098 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : a112 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 3610 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 98 33 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 46 c3 f8 7e 34 5a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\wkssvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73e5 nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=960 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 16 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1024 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29669 (0x73E5) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e5 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e5 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e5 name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e5 min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1024 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x90 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 17 of length 148 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1088 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29669 (0x73E5) > smb_bcc=77 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 F4 82 F1 00 08 00 00 .$...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 64 00 00 00 .d.o.n.. .d... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e5 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e5 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "wkssvc" (pnum 73e5) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e5 name: wkssvc open: Yes len: 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0000 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[0].fn == 0x800ec7b4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_q_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name: 00f182f4 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0020 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_r_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_1 : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 wks_io_wks_info_100 inf >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 platform_id : 000001f4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c ptr_compname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ptr_lan_grp : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ver_major : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 ver_minor : 00000009 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00001c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0028 buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 uni_max_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c uni_str_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0040 buffer : P.A.S.I.N.G... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(763) > 0050 status : NT_STATUS_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called wkssvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 94 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 44 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e5 name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 006c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000054 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1088 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 4F 00 44 00 4F 00 4E 00 00 00 07 00 00 .C.O.D.O .N...... > [050] 00 00 00 00 00 07 00 00 00 50 00 41 00 53 00 49 ........ .P.A.S.I > [060] 00 4E 00 47 00 00 00 00 00 00 00 00 00 .N.G.... ..... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 18 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1152 > smt_wct=3 > smb_vwv[ 0]=29669 (0x73E5) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e5 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e5 (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73e5 >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name wkssvc pnum=73e5 (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1152 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 19 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1216 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \srvsvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe srvsvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe srvsvc with handle 73e6 (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name srvsvc pnum=73e6 >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1216 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=58880 (0xE600) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 20 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1280 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29670 (0x73E6) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e6 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e6 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e6 name: srvsvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 4b324fc8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : 1670 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 01d3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 12 78 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 5a 47 bf 6e e1 88 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000003 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73e6 nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1280 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 21 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1344 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29670 (0x73E6) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e6 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e6 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e6 name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e6 min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1344 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 168 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0xa8 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 22 of length 172 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=168 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1408 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 84 (0x54) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 84 (0x54) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29670 (0x73E6) > smb_bcc=101 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 54 00 00 00 01 00 00 ........ .T...... > [020] 00 3C 00 00 00 00 00 0F 00 84 90 03 00 08 00 00 .<...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 01 00 00 00 01 00 00 .d.o.n.. ........ > [050] 00 DC E7 F1 00 00 00 00 00 00 00 00 00 FF FF FF ........ ........ > [060] FF 00 00 00 00 ..... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=84 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e6 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e6 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "srvsvc" (pnum 73e6) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e6 name: srvsvc open: Yes len: 84 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 84 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 68 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0054 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 68 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 68, incoming data = 68 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 0000003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 000f >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: srvsvc op 0xf - api_rpcTNP: rpc command: SRV_NET_SHARE_ENUM_ALL >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[3].fn == 0x800f74c0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_q_net_share_enum >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name: 00039084 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 srv_io_srv_share_ctr share_ctr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 info_level: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 switch_value: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 ptr_share_info: 00f1e7dc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c num_entries: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 ptr_entries: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 preferred_len: ffffffff >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000038 smb_io_enum_hnd enum_hnd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 ptr_hnd: 00000000 >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_enum_all(1253) > _srv_net_share_enum: 1253 >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:init_srv_r_net_share_enum(558) > init_srv_r_net_share_enum: 558 >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:init_srv_share_info_ctr(325) > init_srv_share_info_ctr >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(1061, 513) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(101) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: IPC$ 3 IPC Service () >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: HPLJ2420-4 1 HP LaserJet 2420 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: HPLJ1320-2 1 HP LaserJet 1320 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: HPLJ1320-1 1 HP LaserJet 1320 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: LEOP630-1 1 Lexmark Optra T630 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: HPLJ2200-1 1 HP LaserJet 2200 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: XEPH6200-1 1 Xerox Phaser 6200n >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: print$ 0 Printer Drivers >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: MetaSystems 0 Zytogenetik MetaSystems >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: MetaSetupBAK 0 Zytogenetik MetaSystems MetaSetup BackUp >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: MetaSetup 0 Zytogenetik MetaSystems MetaSetup >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: Msd 0 Zytogenetik MetaSystems Daten >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: Abteilungen 0 Abteilungsverzeichnisse >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: Programs 0 Netzwerkinstallationen und Netzwerkprogramme >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: IT 0 IT-Abteilung >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: Netlogon 0 Anmeldescripte >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: muehlfeld 0 Persoenliches Verzeichnis >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_misc.c:init_enum_hnd(159) > smb_io_enum_hnd >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_enum_all(1265) > _srv_net_share_enum: 1265 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_r_net_share_enum >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_srv_share_ctr share_ctr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 info_level: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 switch_value: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 ptr_share_info: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c num_entries: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ptr_entries: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 num_entries2: 00000011 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000018 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c type : 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 type : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 type : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00003c srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 type : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0044 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000048 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0048 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 004c type : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0050 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000054 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0054 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0058 type : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 005c ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000060 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0060 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0064 type : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0068 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00006c srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 006c ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0070 type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0074 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000078 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0078 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 007c type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0080 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000084 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0084 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0088 type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 008c ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000090 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0090 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0094 type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0098 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00009c srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 009c ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a0 type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a4 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000a8 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00a8 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00ac type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b0 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000b4 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b4 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00b8 type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00bc ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000c0 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c0 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c4 type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00c8 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000cc srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00cc ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d0 type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d4 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000d8 srv_io_share_info1 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00d8 ptr_netname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00dc type : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00e0 ptr_remark : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0000e4 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0000e4 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00e4 uni_max_len: 00000005 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00e8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00ec uni_str_len: 00000005 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 00f0 buffer : I.P.C.$... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0000fc smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 00fc uni_max_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0100 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0104 uni_str_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0108 buffer : I.P.C. .S.e.r.v.i.c.e. .(.)... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000126 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000128 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0128 uni_max_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 012c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0130 uni_str_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0134 buffer : H.P.L.J.2.4.2.0.-.4... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 00014c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 014c uni_max_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0150 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0154 uni_str_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0158 buffer : H.P. .L.a.s.e.r.J.e.t. .2.4.2.0... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00017a srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 00017c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 017c uni_max_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0180 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0184 uni_str_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0188 buffer : H.P.L.J.1.3.2.0.-.2... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0001a0 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01a0 uni_max_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01a4 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01a8 uni_str_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 01ac buffer : H.P. .L.a.s.e.r.J.e.t. .1.3.2.0... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0001ce srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0001d0 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d0 uni_max_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d4 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01d8 uni_str_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 01dc buffer : H.P.L.J.1.3.2.0.-.1... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0001f4 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f4 uni_max_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01f8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 01fc uni_str_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0200 buffer : H.P. .L.a.s.e.r.J.e.t. .1.3.2.0... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000222 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000224 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0224 uni_max_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0228 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 022c uni_str_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0230 buffer : L.E.O.P.6.3.0.-.1... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000244 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0244 uni_max_len: 00000013 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0248 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 024c uni_str_len: 00000013 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0250 buffer : L.e.x.m.a.r.k. .O.p.t.r.a. .T.6.3.0... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000276 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000278 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0278 uni_max_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 027c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0280 uni_str_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0284 buffer : H.P.L.J.2.2.0.0.-.1... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 00029c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 029c uni_max_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02a0 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02a4 uni_str_len: 00000011 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 02a8 buffer : H.P. .L.a.s.e.r.J.e.t. .2.2.0.0... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0002ca srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0002cc smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02cc uni_max_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02d0 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02d4 uni_str_len: 0000000b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 02d8 buffer : X.E.P.H.6.2.0.0.-.1... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0002f0 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02f0 uni_max_len: 00000013 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02f4 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 02f8 uni_str_len: 00000013 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 02fc buffer : X.e.r.o.x. .P.h.a.s.e.r. .6.2.0.0.n... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000322 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000324 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0324 uni_max_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0328 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 032c uni_str_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0330 buffer : p.r.i.n.t.$... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000340 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0340 uni_max_len: 00000010 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0344 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0348 uni_str_len: 00000010 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 034c buffer : P.r.i.n.t.e.r. .D.r.i.v.e.r.s... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00036c srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 00036c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 036c uni_max_len: 0000000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0370 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0374 uni_str_len: 0000000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0378 buffer : M.e.t.a.S.y.s.t.e.m.s... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000390 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0390 uni_max_len: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0394 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0398 uni_str_len: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 039c buffer : Z.y.t.o.g.e.n.e.t.i.k. .M.e.t.a.S.y.s.t.e.m.s... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0003cc srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0003cc smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 03cc uni_max_len: 0000000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 03d0 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 03d4 uni_str_len: 0000000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 03d8 buffer : M.e.t.a.S.e.t.u.p.B.A.K... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0003f4 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 03f4 uni_max_len: 00000029 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 03f8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 03fc uni_str_len: 00000029 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0400 buffer : Z.y.t.o.g.e.n.e.t.i.k. .M.e.t.a.S.y.s.t.e.m.s. .M.e.t.a.S.e.t.u.p. .B.a.c.k.U.p... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000452 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000454 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0454 uni_max_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0458 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 045c uni_str_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0460 buffer : M.e.t.a.S.e.t.u.p... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000474 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0474 uni_max_len: 00000022 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0478 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 047c uni_str_len: 00000022 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0480 buffer : Z.y.t.o.g.e.n.e.t.i.k. .M.e.t.a.S.y.s.t.e.m.s. .M.e.t.a.S.e.t.u.p... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 0004c4 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0004c4 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 04c4 uni_max_len: 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 04c8 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 04cc uni_str_len: 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 04d0 buffer : M.s.d... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0004d8 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 04d8 uni_max_len: 0000001e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 04dc offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 04e0 uni_str_len: 0000001e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 04e4 buffer : Z.y.t.o.g.e.n.e.t.i.k. .M.e.t.a.S.y.s.t.e.m.s. .D.a.t.e.n... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000520 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000520 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0520 uni_max_len: 0000000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0524 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0528 uni_str_len: 0000000c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 052c buffer : A.b.t.e.i.l.u.n.g.e.n... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000544 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0544 uni_max_len: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0548 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 054c uni_str_len: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0550 buffer : A.b.t.e.i.l.u.n.g.s.v.e.r.z.e.i.c.h.n.i.s.s.e... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000580 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000580 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0580 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0584 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0588 uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 058c buffer : P.r.o.g.r.a.m.s... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0005a0 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 05a0 uni_max_len: 0000002d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 05a4 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 05a8 uni_str_len: 0000002d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 05ac buffer : N.e.t.z.w.e.r.k.i.n.s.t.a.l.l.a.t.i.o.n.e.n. .u.n.d. .N.e.t.z.w.e.r.k.p.r.o.g.r.a.m.m.e... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000606 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000608 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0608 uni_max_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 060c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0610 uni_str_len: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0614 buffer : I.T... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 00061c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 061c uni_max_len: 0000000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0620 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0624 uni_str_len: 0000000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0628 buffer : I.T.-.A.b.t.e.i.l.u.n.g... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000642 srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000644 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0644 uni_max_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0648 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 064c uni_str_len: 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0650 buffer : N.e.t.l.o.g.o.n... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000664 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0664 uni_max_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0668 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 066c uni_str_len: 0000000f >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0670 buffer : A.n.m.e.l.d.e.s.c.r.i.p.t.e... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00068e srv_io_share_info1_str >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000690 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0690 uni_max_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0694 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0698 uni_str_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 069c buffer : m.u.e.h.l.f.e.l.d... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 0006b0 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 06b0 uni_max_len: 0000001a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 06b4 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 06b8 uni_str_len: 0000001a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 06bc buffer : P.e.r.s.o.e.n.l.i.c.h.e.s. .V.e.r.z.e.i.c.h.n.i.s... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 06f0 total_entries: 00000011 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 0006f4 smb_io_enum_hnd enum_hnd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 06f4 ptr_hnd: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_werror(824) > 06f8 status: WERR_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called srvsvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 1928 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 68 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e6 name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 1788. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0714 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 000006fc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:send_trans_reply(89) > send_trans_reply: buffer 1024 too large >[2006/11/08 09:30:50, 3] smbd/error.c:error_packet(146) > error packet at smbd/ipc.c(97) cmd=37 (SMBtrans) STATUS_BUFFER_OVERFLOW >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..1024] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=1080 > smb_com=0x25 > smb_rcls=5 > smb_reh=0 > smb_err=32768 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1408 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 1024 (0x400) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=1025 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 14 07 00 00 01 00 00 ........ ........ > [010] 00 FC 06 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [020] 00 01 00 00 00 11 00 00 00 01 00 00 00 11 00 00 ........ ........ > [030] 00 01 00 00 00 03 00 00 00 01 00 00 00 01 00 00 ........ ........ > [040] 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 ........ ........ > [050] 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 ........ ........ > [060] 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 ........ ........ > [070] 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 ........ ........ > [080] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [090] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [0A0] 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 ........ ........ > [0B0] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [0C0] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [0D0] 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 ........ ........ > [0E0] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [0F0] 00 01 00 00 00 00 00 00 00 01 00 00 00 05 00 00 ........ ........ > [100] 00 00 00 00 00 05 00 00 00 49 00 50 00 43 00 24 ........ .I.P.C.$ > [110] 00 00 00 00 00 0F 00 00 00 00 00 00 00 0F 00 00 ........ ........ > [120] 00 49 00 50 00 43 00 20 00 53 00 65 00 72 00 76 .I.P.C. .S.e.r.v > [130] 00 69 00 63 00 65 00 20 00 28 00 29 00 00 00 00 .i.c.e. .(.).... > [140] 00 0B 00 00 00 00 00 00 00 0B 00 00 00 48 00 50 ........ .....H.P > [150] 00 4C 00 4A 00 32 00 34 00 32 00 30 00 2D 00 34 .L.J.2.4 .2.0.-.4 > [160] 00 00 00 00 00 11 00 00 00 00 00 00 00 11 00 00 ........ ........ > [170] 00 48 00 50 00 20 00 4C 00 61 00 73 00 65 00 72 .H.P. .L .a.s.e.r > [180] 00 4A 00 65 00 74 00 20 00 32 00 34 00 32 00 30 .J.e.t. .2.4.2.0 > [190] 00 00 00 00 00 0B 00 00 00 00 00 00 00 0B 00 00 ........ ........ > [1A0] 00 48 00 50 00 4C 00 4A 00 31 00 33 00 32 00 30 .H.P.L.J .1.3.2.0 > [1B0] 00 2D 00 32 00 00 00 00 00 11 00 00 00 00 00 00 .-.2.... ........ > [1C0] 00 11 00 00 00 48 00 50 00 20 00 4C 00 61 00 73 .....H.P . .L.a.s > [1D0] 00 65 00 72 00 4A 00 65 00 74 00 20 00 31 00 33 .e.r.J.e .t. .1.3 > [1E0] 00 32 00 30 00 00 00 00 00 0B 00 00 00 00 00 00 .2.0.... ........ > [1F0] 00 0B 00 00 00 48 00 50 00 4C 00 4A 00 31 00 33 .....H.P .L.J.1.3 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 23 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1472 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29670 (0x73E6) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 788 (0x314) > smb_vwv[ 6]= 788 (0x314) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 788 (0x314) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e6 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e6 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e6 name: srvsvc len: 788 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: srvsvc: current_pdu_len = 1812, current_pdu_sent = 1024 returning 788 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e6 min=788 max=788 nread=788 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=847 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1472 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 788 (0x314) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=788 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 70 00 42 00 41 00 4B 00 00 00 00 00 29 00 00 00 p.B.A.K. ....)... > [010] 00 00 00 00 29 00 00 00 5A 00 79 00 74 00 6F 00 ....)... Z.y.t.o. > [020] 67 00 65 00 6E 00 65 00 74 00 69 00 6B 00 20 00 g.e.n.e. t.i.k. . > [030] 4D 00 65 00 74 00 61 00 53 00 79 00 73 00 74 00 M.e.t.a. S.y.s.t. > [040] 65 00 6D 00 73 00 20 00 4D 00 65 00 74 00 61 00 e.m.s. . M.e.t.a. > [050] 53 00 65 00 74 00 75 00 70 00 20 00 42 00 61 00 S.e.t.u. p. .B.a. > [060] 63 00 6B 00 55 00 70 00 00 00 00 00 0A 00 00 00 c.k.U.p. ........ > [070] 00 00 00 00 0A 00 00 00 4D 00 65 00 74 00 61 00 ........ M.e.t.a. > [080] 53 00 65 00 74 00 75 00 70 00 00 00 22 00 00 00 S.e.t.u. p..."... > [090] 00 00 00 00 22 00 00 00 5A 00 79 00 74 00 6F 00 ...."... Z.y.t.o. > [0A0] 67 00 65 00 6E 00 65 00 74 00 69 00 6B 00 20 00 g.e.n.e. t.i.k. . > [0B0] 4D 00 65 00 74 00 61 00 53 00 79 00 73 00 74 00 M.e.t.a. S.y.s.t. > [0C0] 65 00 6D 00 73 00 20 00 4D 00 65 00 74 00 61 00 e.m.s. . M.e.t.a. > [0D0] 53 00 65 00 74 00 75 00 70 00 00 00 04 00 00 00 S.e.t.u. p....... > [0E0] 00 00 00 00 04 00 00 00 4D 00 73 00 64 00 00 00 ........ M.s.d... > [0F0] 1E 00 00 00 00 00 00 00 1E 00 00 00 5A 00 79 00 ........ ....Z.y. > [100] 74 00 6F 00 67 00 65 00 6E 00 65 00 74 00 69 00 t.o.g.e. n.e.t.i. > [110] 6B 00 20 00 4D 00 65 00 74 00 61 00 53 00 79 00 k. .M.e. t.a.S.y. > [120] 73 00 74 00 65 00 6D 00 73 00 20 00 44 00 61 00 s.t.e.m. s. .D.a. > [130] 74 00 65 00 6E 00 00 00 0C 00 00 00 00 00 00 00 t.e.n... ........ > [140] 0C 00 00 00 41 00 62 00 74 00 65 00 69 00 6C 00 ....A.b. t.e.i.l. > [150] 75 00 6E 00 67 00 65 00 6E 00 00 00 18 00 00 00 u.n.g.e. n....... > [160] 00 00 00 00 18 00 00 00 41 00 62 00 74 00 65 00 ........ A.b.t.e. > [170] 69 00 6C 00 75 00 6E 00 67 00 73 00 76 00 65 00 i.l.u.n. g.s.v.e. > [180] 72 00 7A 00 65 00 69 00 63 00 68 00 6E 00 69 00 r.z.e.i. c.h.n.i. > [190] 73 00 73 00 65 00 00 00 09 00 00 00 00 00 00 00 s.s.e... ........ > [1A0] 09 00 00 00 50 00 72 00 6F 00 67 00 72 00 61 00 ....P.r. o.g.r.a. > [1B0] 6D 00 73 00 00 00 00 00 2D 00 00 00 00 00 00 00 m.s..... -....... > [1C0] 2D 00 00 00 4E 00 65 00 74 00 7A 00 77 00 65 00 -...N.e. t.z.w.e. > [1D0] 72 00 6B 00 69 00 6E 00 73 00 74 00 61 00 6C 00 r.k.i.n. s.t.a.l. > [1E0] 6C 00 61 00 74 00 69 00 6F 00 6E 00 65 00 6E 00 l.a.t.i. o.n.e.n. > [1F0] 20 00 75 00 6E 00 64 00 20 00 4E 00 65 00 74 00 .u.n.d. .N.e.t. >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 24 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1536 > smt_wct=3 > smb_vwv[ 0]=29670 (0x73E6) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e6 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e6 (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73e6 >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name srvsvc pnum=73e6 (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1536 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 102 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x66 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 25 of length 106 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=102 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1456 > smb_uid=101 > smb_mid=1600 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 4096 (0x1000) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=19 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 73 00 70 00 6F 00 6F 00 6C 00 73 00 73 .\.s.p.o .o.l.s.s > [010] 00 00 00 ... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \spoolss. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe spoolss opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested spoolss (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested spoolss >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe spoolss >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe spoolss >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe spoolss (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe spoolss with handle 73e7 (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name spoolss pnum=73e7 >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \spoolss >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1456 > smb_uid=101 > smb_mid=1600 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=59136 (0xE700) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 26 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1664 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29671 (0x73E7) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xV4.4.. ....#Eg. > [030] AB 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e7 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name spoolss pnum=73e7 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e7 name: spoolss open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\spoolss -> \PIPE\spoolss >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 12345678 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : 1234 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : abcd >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : ef 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 01 23 45 67 89 ab >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\spoolss >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\winreg >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\spoolss >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000e >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\spoolss. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73e7 nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1664 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 27 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1728 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29671 (0x73E7) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e7 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name spoolss pnum=73e7 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e7 name: spoolss len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e7 min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1728 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0E 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 73 70 6F 6F 6C 73 73 00 01 00 00 00 00 00 00 00 spoolss. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 256 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x100 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 28 of length 260 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=256 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1456 > smb_uid=101 > smb_mid=1792 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 172 (0xAC) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 172 (0xAC) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29671 (0x73E7) > smb_bcc=189 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 AC 00 00 00 01 00 00 ........ ........ > [020] 00 94 00 00 00 00 00 45 00 00 68 E0 00 08 00 00 .......E ..h..... > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 00 00 00 00 00 00 00 .d.o.n.. ........ > [050] 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [060] 00 48 F5 95 00 1C 00 00 00 30 C0 A2 00 A4 F5 95 .H...... .0...... > [070] 00 28 0A 00 00 03 00 00 00 00 00 00 00 00 00 00 .(...... ........ > [080] 00 08 00 00 00 00 00 00 00 08 00 00 00 5C 00 5C ........ .....\.\ > [090] 00 49 00 54 00 2D 00 30 00 31 00 00 00 0A 00 00 .I.T.-.0 .1...... > [0A0] 00 00 00 00 00 0A 00 00 00 6D 00 75 00 65 00 68 ........ .m.u.e.h > [0B0] 00 6C 00 66 00 65 00 6C 00 64 00 00 00 .l.f.e.l .d... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=172 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e7 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name spoolss pnum=73e7 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "spoolss" (pnum 73e7) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803875e0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e7 name: spoolss open: Yes len: 172 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 172 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 172 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 172, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 156 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 156 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 00ac >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 156 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 156, incoming data = 156 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000094 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0045 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 72 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\spoolss >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[1].fn == 0x800fdb71 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 spoolss_io_q_open_printer_ex >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr: 00e06800 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 printername >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 spoolss_io_printer_default >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 datatype_ptr: 00000000 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_unistr2 - NULL datatype >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 spoolss_io_devmode_cont >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 size: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 devmode_ptr: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 002c access_required: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 user_switch: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000034 spool_io_user_level >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 level: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 ptr: 0095f548 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c size: 0000001c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 ptr: 00a2c030 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0044 ptr: 0095f5a4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0048 build: 00000a28 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 004c major: 00000003 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0050 minor: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0054 processor: 00000000 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000058 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0058 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 005c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0060 uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0064 buffer : \.\.I.T.-.0.1... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000074 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0074 uni_max_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0078 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 007c uni_str_len: 0000000a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0080 buffer : m.u.e.h.l.f.e.l.d... > checking name: \\codon >[2006/11/08 09:30:50, 10] rpc_server/srv_spoolss_nt.c:open_printer_hnd(567) > open_printer_hnd: name [\\codon] >[2006/11/08 09:30:50, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) > Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00 00 00 00 00 BA 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:50, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(408) > Setting printer type=\\codon > Printer is a print server >[2006/11/08 09:30:50, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(447) > Setting printer name=\\codon (len=7) >[2006/11/08 09:30:50, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(602) > 1 printer handles active >[2006/11/08 09:30:50, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 BA 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:50, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1624) > Setting print server access = SERVER_ACCESS_ENUMERATE >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 spoolss_io_r_open_printer_ex >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd printer handle >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: ba 95 51 45 59 1e 00 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0014 status code: WERR_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called spoolss successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 128 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 156 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e7 name: spoolss len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0030 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1456 > smb_uid=101 > smb_mid=1792 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ > [020] 00 00 00 00 00 BA 95 51 45 59 1E 00 00 00 00 00 .......Q EY...... > [030] 00 . >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 128 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x80 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 29 of length 132 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1456 > smb_uid=101 > smb_mid=1856 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29671 (0x73E7) > smb_bcc=61 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 02 00 00 ........ .,...... > [020] 00 14 00 00 00 00 00 1D 00 00 00 00 00 01 00 00 ........ ........ > [030] 00 00 00 00 00 BA 95 51 45 59 1E 00 00 .......Q EY... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=44 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e7 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name spoolss pnum=73e7 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "spoolss" (pnum 73e7) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803875e0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e7 name: spoolss open: Yes len: 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 28 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 002c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 28 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000014 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 001d >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 0 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\spoolss >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[3].fn == 0x800fdfd0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 spoolss_io_q_closeprinter >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd printer handle >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: ba 95 51 45 59 1e 00 00 >[2006/11/08 09:30:50, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 BA 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:50, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 BA 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:50, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 BA 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:50, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) > Closed policy >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 spoolss_io_r_closeprinter >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd printer handle >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: 00 00 00 00 00 00 00 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0014 status: WERR_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called spoolss successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 28 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e7 name: spoolss len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0030 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000018 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1456 > smb_uid=101 > smb_mid=1856 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [030] 00 . >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 30 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1920 > smt_wct=3 > smb_vwv[ 0]=29671 (0x73E7) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e7 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name spoolss pnum=73e7 (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73e7 >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe spoolss >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name spoolss pnum=73e7 (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=1920 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 31 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1984 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \wkssvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe wkssvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe wkssvc with handle 73e8 (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name wkssvc pnum=73e8 >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=1984 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=59392 (0xE800) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 32 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2048 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29672 (0x73E8) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e8 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e8 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e8 name: wkssvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 6bffd098 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : a112 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 3610 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 98 33 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 46 c3 f8 7e 34 5a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\wkssvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73e8 nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2048 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 33 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2112 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29672 (0x73E8) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e8 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e8 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e8 name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e8 min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2112 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x90 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 34 of length 148 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2176 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29672 (0x73E8) > smb_bcc=77 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 00 E5 F1 00 08 00 00 .$...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 64 00 00 00 .d.o.n.. .d... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e8 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e8 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "wkssvc" (pnum 73e8) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e8 name: wkssvc open: Yes len: 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0000 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[0].fn == 0x800ec7b4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_q_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name: 00f1e500 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0020 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_r_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_1 : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 wks_io_wks_info_100 inf >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 platform_id : 000001f4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c ptr_compname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ptr_lan_grp : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ver_major : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 ver_minor : 00000009 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00001c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0028 buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 uni_max_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c uni_str_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0040 buffer : P.A.S.I.N.G... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(763) > 0050 status : NT_STATUS_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called wkssvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 94 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 44 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e8 name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 006c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000054 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2176 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 4F 00 44 00 4F 00 4E 00 00 00 07 00 00 .C.O.D.O .N...... > [050] 00 00 00 00 00 07 00 00 00 50 00 41 00 53 00 49 ........ .P.A.S.I > [060] 00 4E 00 47 00 00 00 00 00 00 00 00 00 .N.G.... ..... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 35 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2240 > smt_wct=3 > smb_vwv[ 0]=29672 (0x73E8) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e8 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73e8 (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73e8 >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name wkssvc pnum=73e8 (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2240 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 36 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2304 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \srvsvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe srvsvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe srvsvc with handle 73e9 (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name srvsvc pnum=73e9 >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2304 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=59648 (0xE900) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 37 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2368 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29673 (0x73E9) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e9 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e9 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e9 name: srvsvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 4b324fc8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : 1670 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 01d3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 12 78 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 5a 47 bf 6e e1 88 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000003 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73e9 nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2368 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 38 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2432 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29673 (0x73E9) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e9 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e9 (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e9 name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73e9 min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2432 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x90 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 39 of length 148 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2496 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29673 (0x73E9) > smb_bcc=77 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 00 E5 F1 00 08 00 00 .$...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 65 00 00 00 .d.o.n.. .e... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e9 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e9 (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "srvsvc" (pnum 73e9) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73e9 name: srvsvc open: Yes len: 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0015 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[11].fn == 0x800f7034 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_q_net_srv_get_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name : 00f1e500 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 switch_value : 00000065 >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1045) > srv_net_srv_get_info: 1045 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_info_101(2809) > init_srv_info_101 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(3044) > init_srv_r_net_srv_get_info >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1090) > srv_net_srv_get_info: 1090 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_r_net_srv_get_info >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_info_ctr ctr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 switch_value: 00000065 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_srv_ctr : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000008 srv_io_info_101 sv101 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 platform_id : 000001f4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c ptr_name : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ver_major : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ver_minor : 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 srv_type : 00809a2b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c ptr_comment : 00000001 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_unistr2 uni_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 002c buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000038 smb_io_unistr2 uni_comment >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 uni_max_len: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 uni_str_len: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0044 buffer : .. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0048 status: WERR_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called srvsvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 138 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 44 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73e9 name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 76. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0064 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 0000004c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..100] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2496 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 100 (0x64) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 100 (0x64) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=101 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 64 00 00 00 01 00 00 ........ .d...... > [010] 00 4C 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .L...... .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 2B 9A 80 00 01 00 00 00 06 00 00 00 00 00 00 .+...... ........ > [040] 00 06 00 00 00 43 00 4F 00 44 00 4F 00 4E 00 00 .....C.O .D.O.N.. > [050] 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 ........ ........ > [060] 00 00 00 00 00 ..... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 40 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2560 > smt_wct=3 > smb_vwv[ 0]=29673 (0x73E9) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73e9 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73e9 (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73e9 >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name srvsvc pnum=73e9 (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2560 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 41 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2624 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \wkssvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe wkssvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe wkssvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe wkssvc with handle 73ea (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name wkssvc pnum=73ea >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2624 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=59904 (0xEA00) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 42 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2688 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29674 (0x73EA) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [030] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ea >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73ea (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73ea name: wkssvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 6bffd098 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : a112 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 3610 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 98 33 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 46 c3 f8 7e 34 5a >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\wkssvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\wkssvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73ea nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2688 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 43 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2752 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29674 (0x73EA) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ea >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73ea (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73ea name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73ea min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2752 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x90 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 44 of length 148 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2816 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29674 (0x73EA) > smb_bcc=77 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 00 E5 F1 00 08 00 00 .$...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 64 00 00 00 .d.o.n.. .d... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ea >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73ea (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "wkssvc" (pnum 73ea) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73ea name: wkssvc open: Yes len: 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0000 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[0].fn == 0x800ec7b4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_q_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name: 00f1e500 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0020 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2006/11/08 09:30:50, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2006/11/08 09:30:50, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 wks_io_r_query_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 switch_value: 0064 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_1 : 00000001 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 wks_io_wks_info_100 inf >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 platform_id : 000001f4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c ptr_compname: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ptr_lan_grp : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ver_major : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 ver_minor : 00000009 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00001c smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0028 buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 uni_max_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c uni_str_len: 00000007 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0040 buffer : P.A.S.I.N.G... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(763) > 0050 status : NT_STATUS_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called wkssvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 94 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 44 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73ea name: wkssvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 006c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000054 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2816 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 06 00 00 00 00 00 00 00 06 00 00 ........ ........ > [040] 00 43 00 4F 00 44 00 4F 00 4E 00 00 00 07 00 00 .C.O.D.O .N...... > [050] 00 00 00 00 00 07 00 00 00 50 00 41 00 53 00 49 ........ .P.A.S.I > [060] 00 4E 00 47 00 00 00 00 00 00 00 00 00 .N.G.... ..... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 45 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2880 > smt_wct=3 > smb_vwv[ 0]=29674 (0x73EA) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ea >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name wkssvc pnum=73ea (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73ea >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name wkssvc pnum=73ea (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=2880 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 46 of length 104 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2944 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2006/11/08 09:30:50, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \srvsvc. >[2006/11/08 09:30:50, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe srvsvc opening. >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe srvsvc (pipes_open=0) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe srvsvc with handle 73eb (pipes_open=1) >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name srvsvc pnum=73eb >[2006/11/08 09:30:50, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=2944 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=60160 (0xEB00) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 47 of length 140 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3008 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29675 (0x73EB) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [030] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73eb >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73eb (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73eb name: srvsvc open: Yes len: 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 4b324fc8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : 1670 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 01d3 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : 12 78 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 5a 47 bf 6e e1 88 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000003 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\srvsvc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\ntsvcs. >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73eb nwritten=72 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3008 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 48 of length 63 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3072 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29675 (0x73EB) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73eb >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73eb (pipes_open=1) >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73eb name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:50, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73eb min=1024 max=1024 nread=68 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3072 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 00 ntsvcs.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x90 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 49 of length 148 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3136 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29675 (0x73EB) > smb_bcc=77 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 00 E5 F1 00 08 00 00 .$...... ........ > [030] 00 00 00 00 00 08 00 00 00 5C 00 5C 00 63 00 6F ........ .\.\.c.o > [040] 00 64 00 6F 00 6E 00 00 00 65 00 00 00 .d.o.n.. .e... >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:50, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=60 params=0 setup=2 >[2006/11/08 09:30:50, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:50, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:50, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73eb >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73eb (pipes_open=1) >[2006/11/08 09:30:50, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "srvsvc" (pnum 73eb) >[2006/11/08 09:30:50, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73eb name: srvsvc open: Yes len: 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 003c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000024 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0015 >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[11].fn == 0x800f7034 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_q_net_srv_get_info >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr_srv_name : 00f1e500 >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 uni_max_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c uni_str_len: 00000008 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0010 buffer : \.\.c.o.d.o.n... >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 switch_value : 00000065 >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1045) > srv_net_srv_get_info: 1045 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_info_101(2809) > init_srv_info_101 >[2006/11/08 09:30:50, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(3044) > init_srv_r_net_srv_get_info >[2006/11/08 09:30:50, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1090) > srv_net_srv_get_info: 1090 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_r_net_srv_get_info >[2006/11/08 09:30:50, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 srv_io_info_ctr ctr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 switch_value: 00000065 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 ptr_srv_ctr : 00000001 >[2006/11/08 09:30:50, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000008 srv_io_info_101 sv101 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 platform_id : 000001f4 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c ptr_name : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 ver_major : 00000004 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0014 ver_minor : 00000009 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 srv_type : 00809a2b >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c ptr_comment : 00000001 >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_unistr2 uni_name >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 uni_max_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0028 uni_str_len: 00000006 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 002c buffer : C.O.D.O.N... >[2006/11/08 09:30:50, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000038 smb_io_unistr2 uni_comment >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0038 uni_max_len: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 003c offset : 00000000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0040 uni_str_len: 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0044 buffer : .. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0048 status: WERR_OK >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called srvsvc successfully >[2006/11/08 09:30:50, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 138 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 44 >[2006/11/08 09:30:50, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73eb name: srvsvc len: 1024 >[2006/11/08 09:30:50, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 76. >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0064 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 0000004c >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:50, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:50, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..100] >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3136 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 100 (0x64) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 100 (0x64) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=101 >[2006/11/08 09:30:50, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 64 00 00 00 01 00 00 ........ .d...... > [010] 00 4C 00 00 00 00 00 00 00 65 00 00 00 01 00 00 .L...... .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 2B 9A 80 00 01 00 00 00 06 00 00 00 00 00 00 .+...... ........ > [040] 00 06 00 00 00 43 00 4F 00 44 00 4F 00 4E 00 00 .....C.O .D.O.N.. > [050] 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 ........ ........ > [060] 00 00 00 00 00 ..... >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:50, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:50, 3] smbd/process.c:process_smb(1110) > Transaction 50 of length 45 >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3200 > smt_wct=3 > smb_vwv[ 0]=29675 (0x73EB) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:50, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:50, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_nt_user_token(454) > NT user token of user S-1-5-21-1362721961-1801182073-732966438-3122 > contains 19 SIDs > SID[ 0]: S-1-5-21-1362721961-1801182073-732966438-3122 > SID[ 1]: S-1-5-21-1362721961-1801182073-732966438-513 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-1362721961-1801182073-732966438-1185 > SID[ 6]: S-1-5-21-1362721961-1801182073-732966438-1405 > SID[ 7]: S-1-5-21-1362721961-1801182073-732966438-1413 > SID[ 8]: S-1-5-21-1362721961-1801182073-732966438-1421 > SID[ 9]: S-1-5-21-1362721961-1801182073-732966438-1423 > SID[ 10]: S-1-5-21-1362721961-1801182073-732966438-1425 > SID[ 11]: S-1-5-21-1362721961-1801182073-732966438-1439 > SID[ 12]: S-1-5-21-1362721961-1801182073-732966438-1443 > SID[ 13]: S-1-5-21-1362721961-1801182073-732966438-3021 > SID[ 14]: S-1-5-21-1362721961-1801182073-732966438-3047 > SID[ 15]: S-1-5-21-1362721961-1801182073-732966438-3055 > SID[ 16]: S-1-5-21-1362721961-1801182073-732966438-3063 > SID[ 17]: S-1-5-21-1362721961-1801182073-732966438-3065 > SID[ 18]: S-1-5-21-1362721961-1801182073-732966438-3085 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:50, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 1061 > Primary group is 513 and contains 0 supplementary groups >[2006/11/08 09:30:50, 5] smbd/uid.c:change_to_user(260) > change_to_user uid=(1061,1061) gid=(0,513) >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73eb >[2006/11/08 09:30:50, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name srvsvc pnum=73eb (pipes_open=1) >[2006/11/08 09:30:50, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73eb >[2006/11/08 09:30:50, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2006/11/08 09:30:50, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name srvsvc pnum=73eb (pipes_open=0) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:50, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3200 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:50, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 100 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x64 >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 51 of length 104 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3264 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=17 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 77 00 69 00 6E 00 72 00 65 00 67 00 00 .\.w.i.n .r.e.g.. > [010] 00 . >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBntcreateX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 10] smbd/nttrans.c:reply_ntcreate_and_X(501) > reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0 >[2006/11/08 09:30:51, 4] smbd/nttrans.c:nt_open_pipe(325) > nt_open_pipe: Opening pipe \winreg. >[2006/11/08 09:30:51, 3] smbd/nttrans.c:nt_open_pipe(346) > nt_open_pipe: Known pipe winreg opening. >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) > Open pipe requested winreg (pipes_open=0) >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) > Create pipe requested winreg >[2006/11/08 09:30:51, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe winreg >[2006/11/08 09:30:51, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe winreg >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) > Created internal pipe winreg (pipes_open=0) >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > Opened pipe winreg with handle 73ec (pipes_open=1) >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) > open pipes: name winreg pnum=73ec >[2006/11/08 09:30:51, 5] smbd/nttrans.c:do_ntcreate_pipe_open(395) > do_ntcreate_pipe_open: open pipe = \winreg >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3264 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=60416 (0xEC00) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 136 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x88 >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 52 of length 140 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=136 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3328 > smt_wct=14 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29676 (0x73EC) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]=65535 (0xFFFF) > smb_vwv[ 6]=65535 (0xFFFF) > smb_vwv[ 7]= 8 (0x8) > smb_vwv[ 8]= 72 (0x48) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 72 (0x48) > smb_vwv[11]= 64 (0x40) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_bcc=73 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [020] 00 01 D0 8C 33 44 22 F1 31 AA AA 90 00 38 00 10 ....3D". 1....8.. > [030] 03 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [040] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBwriteX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ec >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name winreg pnum=73ec (pipes_open=1) >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73ec name: winreg open: Yes len: 72 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 72 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0b >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0048 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 11, flags = 3 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 56 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 11 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1523) > api_pipe_bind_req: decode request. 1523 >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1534) > api_pipe_bind_req: \PIPE\winreg -> \PIPE\winreg >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_rb >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0008 num_contexts: 01 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000c context_id : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 000e num_transfer_syntaxes: 01 >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00000f smb_io_rpc_iface >[2006/11/08 09:30:51, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_uuid uuid >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 data : 338cd001 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 data : 2244 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 data : 31f1 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0018 data : aa aa >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 001a data : 90 00 38 00 10 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 version: 00000001 >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_rpc_iface >[2006/11/08 09:30:51, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000024 smb_io_uuid uuid >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 data : 8a885d04 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0028 data : 1ceb >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 002a data : 11c9 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002c data : 9f e8 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002e data : 08 00 2b 10 48 60 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0034 version: 00000002 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1576) > api_pipe_bind_req: make response. 1576 >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe.c:check_bind_req(985) > check_bind_req for \PIPE\winreg >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\lsarpc >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\samr >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\NETLOGON >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\srvsvc >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\wkssvc >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe.c:check_bind_req(990) > checking \PIPE\winreg >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_ba >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_bba >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0000 max_tsize: 10b8 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0002 max_rsize: 10b8 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 assoc_gid: 000053f0 >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 smb_io_rpc_addr_str >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 len: 000d >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000a str: \PIPE\winreg. >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000017 smb_io_rpc_results >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0018 num_results: 01 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001c result : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 001e reason : 0000 >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_rpc_iface >[2006/11/08 09:30:51, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 data : 8a885d04 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0024 data : 1ceb >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0026 data : 11c9 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 0028 data : 9f e8 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 002a data : 08 00 2b 10 48 60 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0030 version: 00000002 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 0c >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0044 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 56 >[2006/11/08 09:30:51, 3] smbd/pipes.c:reply_pipe_write_and_X(217) > writeX-IPC pnum=73ec nwritten=72 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=47 > smb_com=0x2f > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3328 > smt_wct=6 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 72 (0x48) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 59 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x3b >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 53 of length 63 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3392 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29676 (0x73EC) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1024 (0x400) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1024 (0x400) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBreadX (pid 7769) conn 0x80382568 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ec >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name winreg pnum=73ec (pipes_open=1) >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73ec name: winreg len: 1024 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054) > read_from_pipe: winreg: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2006/11/08 09:30:51, 3] smbd/pipes.c:reply_pipe_read_and_X(262) > readX-IPC pnum=73ec min=1024 max=1024 nread=68 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=127 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3392 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 68 (0x44) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=68 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 ........ D....... > [010] B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 5C .....S.. ..\PIPE\ > [020] 77 69 6E 72 65 67 00 00 01 00 00 00 00 00 00 00 winreg.. ........ > [030] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [040] 02 00 00 00 .... >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 120 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x78 >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 54 of length 124 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=120 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3456 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 36 (0x24) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 36 (0x24) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29676 (0x73EC) > smb_bcc=53 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 24 00 00 00 01 00 00 ........ .$...... > [020] 00 0C 00 00 00 00 00 02 00 38 E8 F1 00 A0 99 01 ........ .8...... > [030] 00 00 00 00 02 ..... >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=36 params=0 setup=2 >[2006/11/08 09:30:51, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:51, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:51, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ec >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name winreg pnum=73ec (pipes_open=1) >[2006/11/08 09:30:51, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "winreg" (pnum 73ec) >[2006/11/08 09:30:51, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73ec name: winreg open: Yes len: 36 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 36 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 36 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 36, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 20 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 20 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0024 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 20 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 20, incoming data = 20 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 0000000c >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0002 >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 71 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\winreg >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: winreg op 0x2 - api_rpcTNP: rpc command: REG_OPEN_HKLM >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[3].fn == 0x800e506f >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 reg_io_q_open_hive >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 ptr: 00f1e838 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 server: 99a0 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0008 access: 02000000 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(1061, 513) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(101) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 10] registry/reg_db.c:regdb_open(265) > regdb_open: refcount reset (1) >[2006/11/08 09:30:51, 7] registry/reg_frontend.c:regkey_open_internal(359) > regkey_open_internal: name = [HKLM] >[2006/11/08 09:30:51, 10] registry/reg_cachehook.c:reghook_cache_find(95) > reghook_cache_find: Searching for keyname [/HKLM] >[2006/11/08 09:30:51, 10] lib/adt_tree.c:pathtree_find(341) > pathtree_find: Enter [/HKLM] >[2006/11/08 09:30:51, 10] lib/adt_tree.c:pathtree_find(413) > pathtree_find: Exit >[2006/11/08 09:30:51, 10] lib/util_seaccess.c:se_access_check(233) > se_access_check: requested access 0x02000000, for NT token with 19 entries and first sid S-1-5-21-1362721961-1801182073-732966438-3122. >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(250) >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(251) > se_access_check: user sid is S-1-5-21-1362721961-1801182073-732966438-3122 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-513 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1185 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1405 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1413 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1421 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1423 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1425 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1439 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1443 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3021 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3047 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3055 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3063 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3065 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3085 >[2006/11/08 09:30:51, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) > Opened policy hnd[1] [000] 00 00 00 00 02 00 00 00 00 00 00 00 BB 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 reg_io_r_open_hive >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000002 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: bb 95 51 45 59 1e 00 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0014 status: WERR_OK >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called winreg successfully >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 510 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 20 >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73ec name: winreg len: 1024 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0030 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000001 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000018 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:51, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3456 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ > [020] 00 00 00 00 00 BB 95 51 45 59 1E 00 00 00 00 00 .......Q EY...... > [030] 00 . >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 228 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0xe4 >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 55 of length 232 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=228 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3520 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 144 (0x90) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 144 (0x90) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29676 (0x73EC) > smb_bcc=161 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 90 00 00 00 02 00 00 ........ ........ > [020] 00 78 00 00 00 00 00 0F 00 00 00 00 00 02 00 00 .x...... ........ > [030] 00 00 00 00 00 BB 95 51 45 59 1E 00 00 46 00 46 .......Q EY...F.F > [040] 00 10 15 54 73 23 00 00 00 00 00 00 00 23 00 00 ...Ts#.. .....#.. > [050] 00 53 00 4F 00 46 00 54 00 57 00 41 00 52 00 45 .S.O.F.T .W.A.R.E > [060] 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F .\.M.i.c .r.o.s.o > [070] 00 66 00 74 00 5C 00 53 00 63 00 68 00 65 00 64 .f.t.\.S .c.h.e.d > [080] 00 75 00 6C 00 69 00 6E 00 67 00 41 00 67 00 65 .u.l.i.n .g.A.g.e > [090] 00 6E 00 74 00 00 00 00 00 00 00 00 00 19 00 02 .n.t.... ........ > [0A0] 00 . >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=144 params=0 setup=2 >[2006/11/08 09:30:51, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:51, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:51, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ec >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name winreg pnum=73ec (pipes_open=1) >[2006/11/08 09:30:51, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "winreg" (pnum 73ec) >[2006/11/08 09:30:51, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73ec name: winreg open: Yes len: 144 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 144 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 144 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 144, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 128 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 128 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0090 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000002 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 128 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 128, incoming data = 128 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000078 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 000f >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 0 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\winreg >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: winreg op 0xf - api_rpcTNP: rpc command: REG_OPEN_ENTRY >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[1].fn == 0x800e52c1 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 reg_io_q_open_entry >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000002 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: bb 95 51 45 59 1e 00 00 >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000014 prs_unistr4 name >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 length: 0046 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0016 size: 0046 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0018 ptr: 73541510 >[2006/11/08 09:30:51, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00001c smb_io_unistr2 name >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 001c uni_max_len: 00000023 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0020 offset : 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0024 uni_str_len: 00000023 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:dbg_rw_punival(936) > 0028 buffer : S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.S.c.h.e.d.u.l.i.n.g.A.g.e.n.t... >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0070 unknown_0 : 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0074 access: 00020019 >[2006/11/08 09:30:51, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 BB 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:51, 10] registry/reg_db.c:regdb_open(248) > regdb_open: incrementing refcount (1) >[2006/11/08 09:30:51, 7] registry/reg_frontend.c:regkey_open_internal(359) > regkey_open_internal: name = [HKLM\SOFTWARE\Microsoft\SchedulingAgent] >[2006/11/08 09:30:51, 10] registry/reg_cachehook.c:reghook_cache_find(95) > reghook_cache_find: Searching for keyname [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] >[2006/11/08 09:30:51, 10] lib/adt_tree.c:pathtree_find(341) > pathtree_find: Enter [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] >[2006/11/08 09:30:51, 10] lib/adt_tree.c:pathtree_find(413) > pathtree_find: Exit >[2006/11/08 09:30:51, 5] registry/reg_db.c:regdb_fetch_keys(456) > regdb_fetch_keys: tdb lookup failed to locate key [HKLM\SOFTWARE\Microsoft\SchedulingAgent] >[2006/11/08 09:30:51, 10] registry/reg_db.c:regdb_close(279) > regdb_close: decrementing refcount (1) >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 reg_io_r_open_entry >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd handle >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: 00 00 00 00 00 00 00 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0014 status: WERR_BADFILE >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called winreg successfully >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 86 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 128 >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73ec name: winreg len: 1024 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0030 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000002 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000018 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:51, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3520 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ > [030] 00 . >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 128 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x80 >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 56 of length 132 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3584 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29676 (0x73EC) > smb_bcc=61 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... > [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... > [020] 00 14 00 00 00 00 00 05 00 00 00 00 00 02 00 00 ........ ........ > [030] 00 00 00 00 00 BB 95 51 45 59 1E 00 00 .......Q EY... >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBtrans (pid 7769) conn 0x80382568 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 3] smbd/ipc.c:handle_trans(373) > trans <\PIPE\> data=44 params=0 setup=2 >[2006/11/08 09:30:51, 5] smbd/ipc.c:handle_trans(404) > calling named_pipe >[2006/11/08 09:30:51, 3] smbd/ipc.c:named_pipe(340) > named pipe command on <> name >[2006/11/08 09:30:51, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ec >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name winreg pnum=73ec (pipes_open=1) >[2006/11/08 09:30:51, 3] smbd/ipc.c:api_fd_reply(300) > Got API command 0x26 on pipe "winreg" (pnum 73ec) >[2006/11/08 09:30:51, 10] smbd/ipc.c:api_fd_reply(305) > api_fd_reply: p:0x803a27a0 max_trans_reply: 1024 >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(937) > write_to_pipe: 73ec name: winreg open: Yes len: 44 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 44 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) > fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 16 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 28 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 002c >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000003 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) > unmarshall_rpc_header: using little-endian RPC >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) > unmarshall_rpc_header: type = 0, flags = 3 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959) > write_to_pipe: data_left = 28 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(852) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) > process_complete_pdu: processing packet type 0 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr_req req >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 alloc_hint: 00000014 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0004 context_id: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0006 opnum : 0005 >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 0 >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_pipe_request(2223) > Requested \PIPE\winreg >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe.c:api_rpcTNP(2258) > api_rpcTNP: winreg op 0x5 - api_rpcTNP: rpc command: REG_CLOSE >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) > api_rpc_cmds[0].fn == 0x800e4f94 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 reg_io_q_close >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000002 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: bb 95 51 45 59 1e 00 00 >[2006/11/08 09:30:51, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 BB 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:51, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 BB 95 51 45 ........ ......QE > [010] 59 1E 00 00 Y... >[2006/11/08 09:30:51, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) > Closed policy >[2006/11/08 09:30:51, 10] registry/reg_db.c:regdb_close(279) > regdb_close: decrementing refcount (0) >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 reg_io_r_close >[2006/11/08 09:30:51, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0000 data1: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0004 data2: 00000000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 data3: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a data4: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8s(851) > 000c data5: 00 00 00 00 00 00 00 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_werror(824) > 0014 status: WERR_OK >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe.c:api_rpcTNP(2305) > api_rpcTNP: called winreg successfully >[2006/11/08 09:30:51, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) > free_pipe_context: destroying talloc pool of size 0 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963) > write_to_pipe: data_used = 28 >[2006/11/08 09:30:51, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(995) > read_from_pipe: 73ec name: winreg len: 1024 >[2006/11/08 09:30:51, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0000 major : 05 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0001 minor : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0002 pkt_type : 02 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0003 flags : 03 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0004 pack_type0: 10 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0005 pack_type1: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0006 pack_type2: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0007 pack_type3: 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0008 frag_len : 0030 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 000a auth_len : 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 000c call_id : 00000003 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp resp >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint32(704) > 0010 alloc_hint: 00000018 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint16(675) > 0014 context_id: 0000 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0016 cancel_ct : 00 >[2006/11/08 09:30:51, 5] rpc_parse/parse_prs.c:prs_uint8(615) > 0017 reserved : 00 >[2006/11/08 09:30:51, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1032 > smb_uid=101 > smb_mid=3584 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [030] 00 . >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 41 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x29 >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 57 of length 45 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3648 > smt_wct=3 > smb_vwv[ 0]=29676 (0x73EC) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBclose (pid 7769) conn 0x80382568 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264) > search for pipe pnum=73ec >[2006/11/08 09:30:51, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268) > pipe name winreg pnum=73ec (pipes_open=1) >[2006/11/08 09:30:51, 5] smbd/pipes.c:reply_pipe_close(282) > reply_pipe_close: pnum:73ec >[2006/11/08 09:30:51, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe winreg >[2006/11/08 09:30:51, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169) > closed pipe name winreg pnum=73ec (pipes_open=0) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=101 > smb_mid=3648 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 86 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x56 >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 58 of length 90 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=86 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=101 > smb_mid=3712 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 86 (0x56) > smb_vwv[ 2]= 8 (0x8) > smb_vwv[ 3]= 1 (0x1) > smb_bcc=43 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 5C 00 5C 00 43 00 4F 00 44 00 4F 00 4E 00 5C .\.\.C.O .D.O.N.\ > [010] 00 4D 00 45 00 54 00 41 00 53 00 45 00 54 00 55 .M.E.T.A .S.E.T.U > [020] 00 50 00 00 00 3F 3F 3F 3F 3F 00 .P...??? ??. >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBtconX (pid 7769) conn 0x0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:51, 4] smbd/reply.c:reply_tcon_and_X(668) > Client requested device type [?????] for share [METASETUP] >[2006/11/08 09:30:51, 5] smbd/service.c:make_connection(1116) > making a connection to 'normal' service metasetup >[2006/11/08 09:30:51, 10] smbd/share_access.c:user_ok_token(225) > user_ok_token: share MetaSetup is ok for unix user muehlfeld >[2006/11/08 09:30:51, 5] lib/username.c:Get_Pwnam_alloc(131) > Finding user muehlfeld >[2006/11/08 09:30:51, 5] lib/username.c:Get_Pwnam_internals(75) > Trying _Get_Pwnam(), username as lowercase is muehlfeld >[2006/11/08 09:30:51, 10] lib/util_pw.c:getpwnam_alloc(76) > Got muehlfeld from pwnam_cache >[2006/11/08 09:30:51, 5] lib/username.c:Get_Pwnam_internals(108) > Get_Pwnam_internals did find user [muehlfeld]! >[2006/11/08 09:30:51, 10] smbd/service.c:set_conn_connectpath(122) > set_conn_connectpath: service MetaSetup, connectpath = /shares/MetaSystems/MetaSetup >[2006/11/08 09:30:51, 3] smbd/service.c:make_connection_snum(752) > Connect path is '/shares/MetaSystems/MetaSetup' for service [MetaSetup] >[2006/11/08 09:30:51, 4] lib/sharesec.c:get_share_security(130) > get_share_security: using default secdesc for MetaSetup >[2006/11/08 09:30:51, 10] lib/util_seaccess.c:se_map_generic(176) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/11/08 09:30:51, 10] lib/util_seaccess.c:se_access_check(233) > se_access_check: requested access 0x00000002, for NT token with 19 entries and first sid S-1-5-21-1362721961-1801182073-732966438-3122. >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(250) >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(251) > se_access_check: user sid is S-1-5-21-1362721961-1801182073-732966438-3122 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-513 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1185 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1405 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1413 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1421 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1423 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1425 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1439 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1443 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3021 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3047 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3055 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3063 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3065 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3085 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/11/08 09:30:51, 5] lib/util_seaccess.c:se_access_check(308) > se_access_check: access (2) granted. >[2006/11/08 09:30:51, 3] smbd/vfs.c:vfs_init_default(219) > Initialising default vfs hooks >[2006/11/08 09:30:51, 5] smbd/connection.c:claim_connection(170) > claiming MetaSetup 0 >[2006/11/08 09:30:51, 10] smbd/share_access.c:user_ok_token(225) > user_ok_token: share MetaSetup is ok for unix user muehlfeld >[2006/11/08 09:30:51, 10] smbd/share_access.c:is_share_read_only_for_token(267) > is_share_read_only_for_user: share MetaSetup is read-write for unix user muehlfeld >[2006/11/08 09:30:51, 4] lib/sharesec.c:get_share_security(130) > get_share_security: using default secdesc for MetaSetup >[2006/11/08 09:30:51, 10] lib/util_seaccess.c:se_map_generic(176) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/11/08 09:30:51, 10] lib/util_seaccess.c:se_access_check(233) > se_access_check: requested access 0x00000002, for NT token with 19 entries and first sid S-1-5-21-1362721961-1801182073-732966438-3122. >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(250) >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(251) > se_access_check: user sid is S-1-5-21-1362721961-1801182073-732966438-3122 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-513 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1185 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1405 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1413 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1421 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1423 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1425 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1439 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1443 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3021 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3047 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3055 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3063 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3065 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3085 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/11/08 09:30:51, 5] lib/util_seaccess.c:se_access_check(308) > se_access_check: access (2) granted. >[2006/11/08 09:30:51, 4] lib/sharesec.c:get_share_security(130) > get_share_security: using default secdesc for MetaSetup >[2006/11/08 09:30:51, 10] lib/util_seaccess.c:se_map_generic(176) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2006/11/08 09:30:51, 10] lib/util_seaccess.c:se_access_check(233) > se_access_check: requested access 0x00000002, for NT token with 19 entries and first sid S-1-5-21-1362721961-1801182073-732966438-3122. >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(250) >[2006/11/08 09:30:51, 3] lib/util_seaccess.c:se_access_check(251) > se_access_check: user sid is S-1-5-21-1362721961-1801182073-732966438-3122 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-513 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1185 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1405 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1413 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1421 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1423 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1425 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1439 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-1443 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3021 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3047 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3055 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3063 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3065 > se_access_check: also S-1-5-21-1362721961-1801182073-732966438-3085 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2006/11/08 09:30:51, 5] lib/util_seaccess.c:se_access_check(308) > se_access_check: access (2) granted. >[2006/11/08 09:30:51, 3] lib/util_sid.c:string_to_sid(223) > string_to_sid: Sid root does not start with 'S-'. >[2006/11/08 09:30:51, 10] passdb/lookup_sid.c:lookup_name(64) > lookup_name: PASING\root => PASING (domain), root (name) >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [dc=pa,dc=lfmg,dc=de], filter => [(&(uid=root)(objectclass=sambaSamAccount))], scope => [2] >[2006/11/08 09:30:51, 4] passdb/pdb_ldap.c:ldapsam_getsampwnam(1396) > ldapsam_getsampwnam: Unable to locate user [root] count=0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=root)(cn=root)))], scope => [2] >[2006/11/08 09:30:51, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2213) > ldapsam_getgroup: Did not find group >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 10] passdb/lookup_sid.c:lookup_name(64) > lookup_name: Unix User\root => Unix User (domain), root (name) >[2006/11/08 09:30:51, 10] lib/util_pw.c:getpwnam_alloc(76) > Got root from pwnam_cache >[2006/11/08 09:30:51, 3] lib/util_sid.c:string_to_sid(223) > string_to_sid: Sid Administrator does not start with 'S-'. >[2006/11/08 09:30:51, 10] passdb/lookup_sid.c:lookup_name(64) > lookup_name: PASING\Administrator => PASING (domain), Administrator (name) >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [dc=pa,dc=lfmg,dc=de], filter => [(&(uid=Administrator)(objectclass=sambaSamAccount))], scope => [2] >[2006/11/08 09:30:51, 2] passdb/pdb_ldap.c:init_sam_from_ldap(541) > init_sam_from_ldap: Entry found for user: Administrator >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_username(534) > pdb_set_username: setting username Administrator, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_domain(557) > pdb_set_domain: setting domain PASING, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_nt_username(580) > pdb_set_nt_username: setting nt username Administrator, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(476) > pdb_set_user_sid_from_string: setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_user_sid(463) > pdb_set_user_sid: setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_fullname(603) > pdb_set_full_name: setting full name Domainadministrator, was >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaHomeDrive] = [<does not exist>] >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(672) > pdb_set_dir_drive: setting dir drive H:, was NULL >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaHomePath] = [<does not exist>] >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_homedir(696) > pdb_set_homedir: setting home dir \\codon\administrator, was >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>] >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_logon_script(626) > pdb_set_logon_script: setting logon script logonscript.bat, was >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaProfilePath] = [<does not exist>] >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_profile_path(649) > pdb_set_profile_path: setting profile path \\codon\Profiles\administrator, was >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [description] = [<does not exist>] >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>] >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>] >[2006/11/08 09:30:51, 10] lib/account_pol.c:account_policy_get(337) > account_policy_get: name: password history, val: 3 >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>] >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>] >[2006/11/08 09:30:51, 10] lib/smbldap.c:smbldap_get_single_attribute(276) > smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>] >[2006/11/08 09:30:51, 7] passdb/login_cache.c:login_cache_read(87) > Looking up login cache for user Administrator >[2006/11/08 09:30:51, 7] passdb/login_cache.c:login_cache_read(101) > No cache entry found >[2006/11/08 09:30:51, 9] passdb/pdb_ldap.c:init_sam_from_ldap(898) > No cache entry, bad count = 0, bad time = 0 >[2006/11/08 09:30:51, 10] lib/util_pw.c:getpwnam_alloc(76) > Got Administrator from pwnam_cache >[2006/11/08 09:30:51, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=512))], scope => [2] >[2006/11/08 09:30:51, 2] passdb/pdb_ldap.c:init_group_from_ldap(2136) > init_group_from_ldap: Entry found for group: 512 >[2006/11/08 09:30:51, 10] passdb/lookup_sid.c:check_dom_sid_to_level(613) > Accepting SID S-1-5-21-1183370737-3874734740-1589004535 in level 1 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:51, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] passdb/pdb_interface.c:lookup_global_sam_rid(1478) > lookup_global_sam_rid: looking up RID 512. >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:push_sec_ctx(208) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3 >[2006/11/08 09:30:51, 3] smbd/uid.c:push_conn_ctx(345) > push_conn_ctx(0) : conn_ctx_stack_ndx = 2 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [dc=pa,dc=lfmg,dc=de], filter => [(&(sambaSID=S-1-5-21-1183370737-3874734740-1589004535-512)(objectclass=sambaSamAccount))], scope => [2] >[2006/11/08 09:30:51, 4] passdb/pdb_ldap.c:ldapsam_getsampwsid(1491) > ldapsam_getsampwsid: Unable to locate SID [S-1-5-21-1183370737-3874734740-1589004535-512] count=0 >[2006/11/08 09:30:51, 5] lib/smbldap.c:smbldap_search_ext(1179) > smbldap_search_ext: base => [ou=Groups,dc=pa,dc=lfmg,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-21-1183370737-3874734740-1589004535-512))], scope => [2] >[2006/11/08 09:30:51, 2] passdb/pdb_ldap.c:init_group_from_ldap(2136) > init_group_from_ldap: Entry found for group: 512 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2006/11/08 09:30:51, 5] passdb/pdb_interface.c:pdb_default_lookup_rids(1599) > lookup_rids: Domain Admins:2 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2006/11/08 09:30:51, 10] passdb/lookup_sid.c:lookup_sid(867) > Sid S-1-5-21-1183370737-3874734740-1589004535-512 -> PASING\Domain Admins(2) >[2006/11/08 09:30:51, 10] lib/account_pol.c:account_policy_get(337) > account_policy_get: name: password history, val: 3 >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_username(534) > pdb_set_username: setting username Administrator, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_domain(557) > pdb_set_domain: setting domain PASING, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_nt_username(580) > pdb_set_nt_username: setting nt username Administrator, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_fullname(603) > pdb_set_full_name: setting full name Domainadministrator, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_homedir(696) > pdb_set_homedir: setting home dir \\codon\administrator, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(672) > pdb_set_dir_drive: setting dir drive H:, was NULL >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_logon_script(626) > pdb_set_logon_script: setting logon script logonscript.bat, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_profile_path(649) > pdb_set_profile_path: setting profile path \\codon\Profiles\administrator, was >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_workstations(739) > pdb_set_workstations: setting workstations , was >[2006/11/08 09:30:51, 10] lib/account_pol.c:account_policy_get(337) > account_policy_get: name: password history, val: 3 >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_user_sid(463) > pdb_set_user_sid: setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 >[2006/11/08 09:30:51, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-1183370737-3874734740-1589004535-2996 from rid 2996 >[2006/11/08 09:30:51, 3] passdb/lookup_sid.c:fetch_gid_from_cache(1015) > fetch gid from cache 512 -> S-1-5-21-1183370737-3874734740-1589004535-512 >[2006/11/08 09:30:51, 10] passdb/pdb_get_set.c:pdb_set_group_sid(521) > pdb_set_group_sid: setting group sid S-1-5-21-1183370737-3874734740-1589004535-512 >[2006/11/08 09:30:51, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) > pdb_set_group_sid_from_rid: > setting group sid S-1-5-21-1183370737-3874734740-1589004535-512 from rid 512 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:pop_sec_ctx(339) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(454) > NT user token of user S-1-5-21-1362721961-1801182073-732966438-3122 > contains 19 SIDs > SID[ 0]: S-1-5-21-1362721961-1801182073-732966438-3122 > SID[ 1]: S-1-5-21-1362721961-1801182073-732966438-513 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-1362721961-1801182073-732966438-1185 > SID[ 6]: S-1-5-21-1362721961-1801182073-732966438-1405 > SID[ 7]: S-1-5-21-1362721961-1801182073-732966438-1413 > SID[ 8]: S-1-5-21-1362721961-1801182073-732966438-1421 > SID[ 9]: S-1-5-21-1362721961-1801182073-732966438-1423 > SID[ 10]: S-1-5-21-1362721961-1801182073-732966438-1425 > SID[ 11]: S-1-5-21-1362721961-1801182073-732966438-1439 > SID[ 12]: S-1-5-21-1362721961-1801182073-732966438-1443 > SID[ 13]: S-1-5-21-1362721961-1801182073-732966438-3021 > SID[ 14]: S-1-5-21-1362721961-1801182073-732966438-3047 > SID[ 15]: S-1-5-21-1362721961-1801182073-732966438-3055 > SID[ 16]: S-1-5-21-1362721961-1801182073-732966438-3063 > SID[ 17]: S-1-5-21-1362721961-1801182073-732966438-3065 > SID[ 18]: S-1-5-21-1362721961-1801182073-732966438-3085 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 1061 > Primary group is 513 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] smbd/uid.c:change_to_user(260) > change_to_user uid=(1061,1061) gid=(0,513) >[2006/11/08 09:30:51, 1] smbd/service.c:make_connection_snum(941) > it-01 (192.168.29.254) connect to service MetaSetup initially as user muehlfeld (uid=1061, gid=513) (pid 7769) >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:30:51, 2] smbd/reply.c:reply_tcon_and_X(711) > Serving MetaSetup as a Dfs root >[2006/11/08 09:30:51, 3] smbd/reply.c:reply_tcon_and_X(716) > tconX service=METASETUP >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=54 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=65279 > smb_uid=101 > smb_mid=3712 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 3 (0x3) > smb_bcc=13 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 41 3A 00 4E 00 54 00 46 00 53 00 00 00 A:.N.T.F .S... >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 108 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x6c >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 59 of length 112 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=108 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=55303 > smb_tid=2 > smb_pid=1032 > smb_uid=101 > smb_mid=3776 > smt_wct=15 > smb_vwv[ 0]= 40 (0x28) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 40 (0x28) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=43 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 63 00 6F 00 64 ........ .\.c.o.d > [010] 00 6F 00 6E 00 5C 00 6D 00 65 00 74 00 61 00 73 .o.n.\.m .e.t.a.s > [020] 00 65 00 74 00 75 00 70 00 00 00 .e.t.u.p ... >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBtrans2 (pid 7769) conn 0x80383da0 >[2006/11/08 09:30:51, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (1061, 513) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_nt_user_token(454) > NT user token of user S-1-5-21-1362721961-1801182073-732966438-3122 > contains 19 SIDs > SID[ 0]: S-1-5-21-1362721961-1801182073-732966438-3122 > SID[ 1]: S-1-5-21-1362721961-1801182073-732966438-513 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-1362721961-1801182073-732966438-1185 > SID[ 6]: S-1-5-21-1362721961-1801182073-732966438-1405 > SID[ 7]: S-1-5-21-1362721961-1801182073-732966438-1413 > SID[ 8]: S-1-5-21-1362721961-1801182073-732966438-1421 > SID[ 9]: S-1-5-21-1362721961-1801182073-732966438-1423 > SID[ 10]: S-1-5-21-1362721961-1801182073-732966438-1425 > SID[ 11]: S-1-5-21-1362721961-1801182073-732966438-1439 > SID[ 12]: S-1-5-21-1362721961-1801182073-732966438-1443 > SID[ 13]: S-1-5-21-1362721961-1801182073-732966438-3021 > SID[ 14]: S-1-5-21-1362721961-1801182073-732966438-3047 > SID[ 15]: S-1-5-21-1362721961-1801182073-732966438-3055 > SID[ 16]: S-1-5-21-1362721961-1801182073-732966438-3063 > SID[ 17]: S-1-5-21-1362721961-1801182073-732966438-3065 > SID[ 18]: S-1-5-21-1362721961-1801182073-732966438-3085 > SE_PRIV 0x0 0x0 0x0 0x0 >[2006/11/08 09:30:51, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 1061 > Primary group is 513 and contains 0 supplementary groups >[2006/11/08 09:30:51, 5] smbd/uid.c:change_to_user(260) > change_to_user uid=(1061,1061) gid=(0,513) >[2006/11/08 09:30:51, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /shares/MetaSystems/MetaSetup >[2006/11/08 09:30:51, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /shares/MetaSystems/MetaSetup >[2006/11/08 09:30:51, 0] smbd/service.c:set_current_service(150) > chdir (/shares/MetaSystems/MetaSetup) failed >[2006/11/08 09:30:51, 3] smbd/error.c:error_packet(146) > error packet at smbd/process.c(979) cmd=50 (SMBtrans2) NT_STATUS_NETWORK_ACCESS_DENIED >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x32 > smb_rcls=202 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1032 > smb_uid=101 > smb_mid=3776 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:30:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 108 >[2006/11/08 09:30:51, 6] smbd/process.c:process_smb(1109) > got message type 0x0 of len 0x6c >[2006/11/08 09:30:51, 3] smbd/process.c:process_smb(1110) > Transaction 60 of length 112 >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=108 > smb_com=0x32 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=55303 > smb_tid=2 > smb_pid=1032 > smb_uid=101 > smb_mid=3840 > smt_wct=15 > smb_vwv[ 0]= 40 (0x28) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 2 (0x2) > smb_vwv[ 3]= 40 (0x28) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 40 (0x28) > smb_vwv[10]= 68 (0x44) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 1 (0x1) > smb_vwv[14]= 5 (0x5) > smb_bcc=43 >[2006/11/08 09:30:51, 10] lib/util.c:dump_data(2215) > [000] 00 00 00 EC 03 00 00 00 00 5C 00 63 00 6F 00 64 ........ .\.c.o.d > [010] 00 6F 00 6E 00 5C 00 6D 00 65 00 74 00 61 00 73 .o.n.\.m .e.t.a.s > [020] 00 65 00 74 00 75 00 70 00 00 00 .e.t.u.p ... >[2006/11/08 09:30:51, 3] smbd/process.c:switch_message(914) > switch message SMBtrans2 (pid 7769) conn 0x80383da0 >[2006/11/08 09:30:51, 4] smbd/uid.c:change_to_user(176) > change_to_user: Skipping user change - already user >[2006/11/08 09:30:51, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /shares/MetaSystems/MetaSetup >[2006/11/08 09:30:51, 4] smbd/vfs.c:vfs_ChDir(741) > vfs_ChDir to /shares/MetaSystems/MetaSetup >[2006/11/08 09:30:51, 0] smbd/service.c:set_current_service(150) > chdir (/shares/MetaSystems/MetaSetup) failed >[2006/11/08 09:30:51, 3] smbd/error.c:error_packet(146) > error packet at smbd/process.c(979) cmd=50 (SMBtrans2) NT_STATUS_NETWORK_ACCESS_DENIED >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(478) >[2006/11/08 09:30:51, 5] lib/util.c:show_msg(488) > size=35 > smb_com=0x32 > smb_rcls=202 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=2 > smb_pid=1032 > smb_uid=101 > smb_mid=3840 > smt_wct=0 > smb_bcc=0 >[2006/11/08 09:30:51, 10] smbd/process.c:setup_select_timeout(1284) > change_notify_timeout: -1 >[2006/11/08 09:31:00, 10] smbd/process.c:async_processing(291) > async_processing: Doing async processing. >[2006/11/08 09:31:00, 3] smbd/sec_ctx.c:set_sec_ctx(241) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2006/11/08 09:31:00, 5] auth/auth_util.c:debug_nt_user_token(448) > NT user token: (NULL) >[2006/11/08 09:31:00, 5] auth/auth_util.c:debug_unix_user_token(474) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2006/11/08 09:31:00, 5] smbd/uid.c:change_to_root_user(275) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2006/11/08 09:31:00, 1] smbd/process.c:async_processing(312) > Reloading services after SIGHUP >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service HPLJ2420-4 >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service HPLJ1320-2 >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service HPLJ1320-1 >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service LEOP630-1 >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service HPLJ2200-1 >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service XEPH6200-1 >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service print$ >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service printers >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service MetaSystems >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service MetaSetupBAK >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service Msd >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service Abteilungen >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service Programs >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service IT >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service homes >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service Profiles >[2006/11/08 09:31:00, 5] param/loadparm.c:free_service(2356) > free_service: Freeing service Netlogon >[2006/11/08 09:31:00, 3] param/loadparm.c:lp_load(4945) > lp_load: refreshing parameters >[2006/11/08 09:31:00, 3] param/loadparm.c:init_globals(1410) > Initialising global parameters >[2006/11/08 09:31:00, 3] param/params.c:pm_process(572) > params.c:pm_process() - Processing configuration file "/etc/samba//smb.conf" >[2006/11/08 09:31:00, 3] param/loadparm.c:do_section(3687) > Processing section "[global]" > doing parameter panic action = "/usr/local/bin/panic-action %d" > doing parameter pid directory = /var/run/samba > doing parameter log file = /var/log/samba/%m.log > doing parameter interfaces = 127.0.0.1 192.168.30.4 > doing parameter bind interfaces only = true > doing parameter log level = 1 >[2006/11/08 09:31:01, 1] smbd/service.c:close_cnum(1141) > it-01 (192.168.29.254) closed connection to service MetaSetup
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 4213
: 2201