The Samba-Bugzilla – Attachment 971 Details for
Bug 2354
Use of %U in includes fails after a /
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
This is a level 10 log from when it works (include = someplace/user-%U)
log-when-works (text/plain), 999.35 KB, created by
Gary Algier
on 2005-02-17 10:30:57 UTC
(
hide
)
Description:
This is a level 10 log from when it works (include = someplace/user-%U)
Filename:
MIME Type:
Creator:
Gary Algier
Created:
2005-02-17 10:30:57 UTC
Size:
999.35 KB
patch
obsolete
>[2005/02/17 12:15:59, 0] lib/smbldap.c:smbldap_search_domain_info(1406) > Adding domain info for CARP failed with NT_STATUS_UNSUCCESSFUL >[2005/02/17 12:16:07, 0] lib/util_sock.c:set_socket_options(202) > Failed to set socket option SO_KEEPALIVE (Error Invalid argument) >[2005/02/17 12:16:07, 0] lib/util_sock.c:set_socket_options(202) > Failed to set socket option TCP_NODELAY (Error Invalid argument) >[2005/02/17 12:16:07, 0] lib/util_sock.c:get_peer_addr(1150) > getpeername failed. Error was Transport endpoint is not connected >[2005/02/17 12:16:07, 0] lib/util_sock.c:get_peer_addr(1150) > getpeername failed. Error was Transport endpoint is not connected >[2005/02/17 12:16:07, 0] lib/util_sock.c:get_peer_addr(1150) > getpeername failed. Error was Transport endpoint is not connected >[2005/02/17 12:16:07, 0] lib/util_sock.c:write_socket_data(430) > write_socket_data: write failure. Error = Broken pipe >[2005/02/17 12:16:07, 0] lib/util_sock.c:write_socket(455) > write_socket: Error writing 4 bytes to socket 27: ERRNO = Broken pipe >[2005/02/17 12:16:07, 0] lib/util_sock.c:send_smb(647) > Error writing 4 bytes to client. -1. (Broken pipe) >[2005/02/17 12:16:07, 5] lib/debug.c:debug_dump_status(366) > INFO: Current debug levels: > all: True/10 > tdb: False/0 > printdrivers: False/0 > lanman: False/0 > smb: False/0 > rpc_parse: False/0 > rpc_srv: False/0 > rpc_cli: False/0 > passdb: False/0 > sam: False/0 > auth: False/0 > winbind: False/0 > vfs: False/0 > idmap: False/0 > quota: False/0 > acls: False/0 > doing parameter include = /etc/ulcmit/samba/carp/smb.conf.shares >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.shares" >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[homes]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 0 for homes > doing parameter comment = My Corporate Directory > doing parameter path = /corp/%S > doing parameter valid users = %S > doing parameter browseable = no > doing parameter writable = yes > doing parameter directory mask = 0755 > doing parameter create mask = 0755 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[users]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 1 for users > doing parameter comment = Links to all the user's home directories > doing parameter path = /etc/ulcmit/samba/carp/users > doing parameter browseable = yes > doing parameter writable = no >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[hosts]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 2 for hosts > doing parameter comment = Links to other file servers in the same NIS domain. > doing parameter path = /etc/ulcmit/samba/carp/hosts > doing parameter browseable = yes > doing parameter writable = no >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[public]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 3 for public > doing parameter comment = Here are files for public consumption > doing parameter path = /etc/ulcmit/samba/carp/public > doing parameter browseable = yes > doing parameter writable = yes > doing parameter include = /etc/ulcmit/samba/carp/auto-config/user-%U >[2005/02/17 12:16:07, 2] param/loadparm.c:handle_include(2804) > Can't find include file /etc/ulcmit/samba/carp/auto-config/user- > doing parameter include = /etc/ulcmit/samba/carp/smb.conf.oracleimp >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.oracleimp" >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[OracleImp]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 4 for OracleImp > doing parameter comment = ES Group Oracle Implementation > doing parameter path = /corp/es/OracleImp > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @esora > doing parameter valid users = > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02775 > doing parameter force create mode = 0664 > doing parameter directory mask = 02775 > doing parameter create mask = 0664 > doing parameter include = /etc/ulcmit/samba/carp/smb.conf.q-train >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.q-train" >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[Q-Train]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 5 for Q-Train > doing parameter comment = Quality Trainer > doing parameter path = /corp/qlty/q-train > doing parameter writable = yes > doing parameter browsable = yes > doing parameter valid users = > doing parameter force group = qlty > doing parameter force user = qlty > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 0777 > doing parameter force create mode = 0666 > doing parameter directory mask = 0777 > doing parameter create mask = 0666 >[2005/02/17 12:16:07, 4] param/loadparm.c:lp_load(3929) > pm_process() returned Yes >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 6 for IPC$ >[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392) > adding IPC service >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 7 for ADMIN$ >[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392) > adding IPC service >[2005/02/17 12:16:07, 10] param/loadparm.c:set_server_role(3847) > set_server_role: role = ROLE_STANDALONE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039) > lp_servicenumber: couldn't find printers >[2005/02/17 12:16:07, 3] printing/pcap.c:pcap_cache_reload(114) > reloading printcap cache >[2005/02/17 12:16:07, 5] printing/print_cups.c:cups_cache_reload(71) > reloading cups printcap cache >[2005/02/17 12:16:07, 10] printing/print_cups.c:cups_server(51) > cups server left to default localhost >[2005/02/17 12:16:07, 3] printing/pcap.c:pcap_cache_reload(213) > reload status: ok >[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039) > lp_servicenumber: couldn't find printers >[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039) > lp_servicenumber: couldn't find printers >[2005/02/17 12:16:07, 2] lib/interface.c:add_interface(79) > added interface ip=172.25.0.9 bcast=172.25.255.255 nmask=255.255.0.0 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_KEEPALIVE = 8 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_REUSEADDR = 4 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_BROADCAST = 0 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option TCP_NODELAY = 1 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_LOWDELAY = 0 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_THROUGHPUT = 0 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_SNDBUF = 49152 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_RCVBUF = 49640 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDLOWAT. >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVLOWAT. >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDTIMEO. >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVTIMEO. >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_KEEPALIVE = 8 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_REUSEADDR = 4 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_BROADCAST = 0 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option TCP_NODELAY = 1 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_LOWDELAY = 0 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_THROUGHPUT = 0 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_SNDBUF = 49152 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_RCVBUF = 49640 >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDLOWAT. >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVLOWAT. >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDTIMEO. >[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVTIMEO. >[2005/02/17 12:16:07, 3] smbd/oplock.c:init_oplocks(1345) > open_oplock_ipc: opening loopback UDP socket. >[2005/02/17 12:16:07, 10] lib/util_sock.c:open_socket_in(717) > bind succeeded on port 0 >[2005/02/17 12:16:07, 3] smbd/oplock.c:init_oplocks(1376) > open_oplock ipc: pid = 13681, global_oplock_port = 33918 >[2005/02/17 12:16:07, 4] lib/time.c:get_serverzone(122) > Serverzone is 18000 >[2005/02/17 12:16:07, 10] lib/smbldap.c:smbldap_idle_fn(1186) > ldap connection not idle... >[2005/02/17 12:16:07, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 133 >[2005/02/17 12:16:07, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x85 >[2005/02/17 12:16:07, 3] smbd/process.c:process_smb(1091) > Transaction 0 of length 137 >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474) > size=133 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51283 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=0 > smt_wct=0 > smb_bcc=98 >[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990) > [000] 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 .PC NETW ORK PROG > [010] 52 41 4D 20 31 2E 30 00 02 4C 41 4E 4D 41 4E 31 RAM 1.0. .LANMAN1 > [020] 2E 30 00 02 57 69 6E 64 6F 77 73 20 66 6F 72 20 .0..Wind ows for > [030] 57 6F 72 6B 67 72 6F 75 70 73 20 33 2E 31 61 00 Workgrou ps 3.1a. > [040] 02 4C 4D 31 2E 32 58 30 30 32 00 02 4C 41 4E 4D .LM1.2X0 02..LANM > [050] 41 4E 32 2E 31 00 02 4E 54 20 4C 4D 20 30 2E 31 AN2.1..N T LM 0.1 > [060] 32 00 2. >[2005/02/17 12:16:07, 3] smbd/process.c:switch_message(886) > switch message SMBnegprot (pid 13681) conn 0x0 >[2005/02/17 12:16:07, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:07, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461) > Requested protocol [PC NETWORK PROGRAM 1.0] >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461) > Requested protocol [LANMAN1.0] >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461) > Requested protocol [Windows for Workgroups 3.1a] >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461) > Requested protocol [LM1.2X002] >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461) > Requested protocol [LANMAN2.1] >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461) > Requested protocol [NT LM 0.12] >[2005/02/17 12:16:07, 10] lib/util.c:set_remote_arch(1965) > set_remote_arch: Client arch is 'Win2K' >[2005/02/17 12:16:07, 6] param/loadparm.c:lp_file_list_changed(2698) > lp_file_list_changed() > file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train last mod_time: Wed May 1 08:38:33 2002 > > file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp last mod_time: Thu May 2 15:57:49 2002 > > file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user- last mod_time: Wed Dec 31 19:00:00 1969 > > file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares last mod_time: Thu Feb 17 10:14:42 2005 > > file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13 last mod_time: Thu Feb 17 12:12:56 2005 > > file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf last mod_time: Thu Feb 17 12:13:35 2005 > >[2005/02/17 12:16:07, 5] smbd/connection.c:claim_connection(170) > claiming 0 >[2005/02/17 12:16:07, 6] param/loadparm.c:lp_file_list_changed(2698) > lp_file_list_changed() > file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train last mod_time: Wed May 1 08:38:33 2002 > > file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp last mod_time: Thu May 2 15:57:49 2002 > > file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user- last mod_time: Wed Dec 31 19:00:00 1969 > > file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares last mod_time: Thu Feb 17 10:14:42 2005 > > file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13 last mod_time: Thu Feb 17 12:12:56 2005 > > file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf last mod_time: Thu Feb 17 12:13:35 2005 > >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_nt1(333) > using SPNEGO >[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(555) > Selected protocol NT LM 0.12 >[2005/02/17 12:16:07, 5] smbd/negprot.c:reply_negprot(561) > negprot index=5 >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=0 > smt_wct=17 > smb_vwv[ 0]= 5 (0x5) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]=28928 (0x7100) > smb_vwv[ 8]= 53 (0x35) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=32995 (0x80E3) > smb_vwv[11]=32896 (0x8080) > smb_vwv[12]=63525 (0xF825) > smb_vwv[13]= 5213 (0x145D) > smb_vwv[14]=50453 (0xC515) > smb_vwv[15]=11265 (0x2C01) > smb_vwv[16]=14849 (0x3A01) > smb_bcc=58 >[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990) > [000] 63 61 72 70 00 00 00 00 00 00 00 00 00 00 00 00 carp.... ........ > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(449) > write_socket(27,131) >[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(452) > write_socket(27,131) wrote 131 >[2005/02/17 12:16:07, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 206 >[2005/02/17 12:16:07, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xce >[2005/02/17 12:16:07, 3] smbd/process.c:process_smb(1091) > Transaction 1 of length 210 >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474) > size=206 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=50688 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 206 (0xCE) > smb_vwv[ 2]=16644 (0x4104) > smb_vwv[ 3]= 50 (0x32) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 74 (0x4A) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 212 (0xD4) > smb_vwv[11]=32768 (0x8000) > smb_bcc=147 >[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990) > [000] 60 48 06 06 2B 06 01 05 05 02 A0 3E 30 3C A0 0E `H..+... ...>0<.. > [010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 2A 0...+... ..7....* > [020] 04 28 4E 54 4C 4D 53 53 50 00 01 00 00 00 97 82 .(NTLMSS P....... > [030] 08 E2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [040] 00 00 05 00 93 08 00 00 00 0F 00 57 00 69 00 6E ........ ...W.i.n > [050] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0 > [060] 00 30 00 20 00 32 00 31 00 39 00 35 00 00 00 57 .0. .2.1 .9.5...W > [070] 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 .i.n.d.o .w.s. .2 > [080] 00 30 00 30 00 30 00 20 00 35 00 2E 00 30 00 00 .0.0.0. .5...0.. > [090] 00 00 00 ... >[2005/02/17 12:16:07, 3] smbd/process.c:switch_message(886) > switch message SMBsesssetupX (pid 13681) conn 0x0 >[2005/02/17 12:16:07, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:07, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X(655) > wct=12 flg2=0xc807 >[2005/02/17 12:16:07, 2] smbd/sesssetup.c:setup_new_vc_session(608) > setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(535) > Doing spnego session setup >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(566) > NativeOS=[Windows 2000 2195] NativeLanMan=[Windows 2000 5.0] PrimaryDomain=[] >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_spnego_negotiate(444) > Got OID 1 3 6 1 4 1 311 2 2 10 >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_spnego_negotiate(447) > Got secblob of size 40 >[2005/02/17 12:16:07, 5] auth/auth.c:make_auth_context_subsystem(480) > Making default auth method list for standalone security=user, encrypt passwords = yes >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend rhosts >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'rhosts' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend hostsequiv >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'hostsequiv' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend sam >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'sam' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend sam_ignoredomain >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'sam_ignoredomain' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend unix >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'unix' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend winbind >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'winbind' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend smbserver >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'smbserver' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend trustdomain >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'trustdomain' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend ntdomain >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'ntdomain' >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45) > Attempting to register auth backend guest >[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57) > Successfully added auth method 'guest' >[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(384) > load_auth_module: Attempting to find an auth method to match guest >[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(409) > load_auth_module: auth method guest has a valid init >[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(384) > load_auth_module: Attempting to find an auth method to match sam >[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(409) > load_auth_module: auth method sam has a valid init >[2005/02/17 12:16:07, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62) > Got NTLMSSP neg_flags=0xe2088297 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_NEGOTIATE_OEM > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_LM_KEY > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(95) > auth_get_challenge: module guest did not want to specify a challenge >[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(95) > auth_get_challenge: module sam did not want to specify a challenge >[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(135) > auth_context challenge created by random >[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(136) > challenge is: >[2005/02/17 12:16:07, 5] lib/util.c:dump_data(1990) > [000] 34 46 61 70 FB 20 A3 F0 4Fap. .. >[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(449) > write_socket(27,276) >[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(452) > write_socket(27,276) wrote 276 >[2005/02/17 12:16:07, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 314 >[2005/02/17 12:16:07, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x13a >[2005/02/17 12:16:07, 3] smbd/process.c:process_smb(1091) > Transaction 2 of length 318 >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474) > size=314 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=0 > smb_mid=50752 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 314 (0x13A) > smb_vwv[ 2]=16644 (0x4104) > smb_vwv[ 3]= 50 (0x32) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 182 (0xB6) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 212 (0xD4) > smb_vwv[11]=32768 (0x8000) > smb_bcc=255 >[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990) > [000] A1 81 B3 30 81 B0 A2 81 AD 04 81 AA 4E 54 4C 4D ...0.... ....NTLM > [010] 53 53 50 00 03 00 00 00 18 00 18 00 6A 00 00 00 SSP..... ....j... > [020] 18 00 18 00 82 00 00 00 0E 00 0E 00 48 00 00 00 ........ ....H... > [030] 06 00 06 00 56 00 00 00 0E 00 0E 00 5C 00 00 00 ....V... ....\... > [040] 10 00 10 00 9A 00 00 00 15 82 88 62 05 00 93 08 ........ ...b.... > [050] 00 00 00 0F 41 00 5A 00 55 00 52 00 49 00 54 00 ....A.Z. U.R.I.T. > [060] 45 00 67 00 61 00 61 00 41 00 5A 00 55 00 52 00 E.g.a.a. A.Z.U.R. > [070] 49 00 54 00 45 00 3B A8 02 5B 19 E2 43 28 00 00 I.T.E.;. .[..C(.. > [080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 6F ........ .......o > [090] 24 06 11 C5 07 89 EA C7 9F 99 A3 B2 FC 02 2F F0 $....... ....../. > [0A0] 3A 1B 8B B5 8E 41 B9 54 64 D8 6C 55 81 56 9B 95 :....A.T d.lU.V.. > [0B0] C8 52 99 26 C0 50 00 57 00 69 00 6E 00 64 00 6F .R.&.P.W .i.n.d.o > [0C0] 00 77 00 73 00 20 00 32 00 30 00 30 00 30 00 20 .w.s. .2 .0.0.0. > [0D0] 00 32 00 31 00 39 00 35 00 00 00 57 00 69 00 6E .2.1.9.5 ...W.i.n > [0E0] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0 > [0F0] 00 30 00 20 00 35 00 2E 00 30 00 00 00 00 00 .0. .5.. .0..... >[2005/02/17 12:16:07, 3] smbd/process.c:switch_message(886) > switch message SMBsesssetupX (pid 13681) conn 0x0 >[2005/02/17 12:16:07, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:07, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X(655) > wct=12 flg2=0xc807 >[2005/02/17 12:16:07, 2] smbd/sesssetup.c:setup_new_vc_session(608) > setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(535) > Doing spnego session setup >[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(566) > NativeOS=[Windows 2000 2195] NativeLanMan=[Windows 2000 5.0] PrimaryDomain=[] >[2005/02/17 12:16:07, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(615) > Got user=[gaa] domain=[AZURITE] workstation=[AZURITE] len1=24 len2=24 >[2005/02/17 12:16:07, 5] auth/auth_ntlmssp.c:auth_ntlmssp_set_challenge(66) > auth_context challenge set by NTLMSSP callback (NTLM2) >[2005/02/17 12:16:07, 5] auth/auth_ntlmssp.c:auth_ntlmssp_set_challenge(67) > challenge is: >[2005/02/17 12:16:07, 5] lib/util.c:dump_data(1990) > [000] BC EA B7 0E B4 58 F8 01 .....X.. >[2005/02/17 12:16:07, 6] param/loadparm.c:lp_file_list_changed(2698) > lp_file_list_changed() > file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train last mod_time: Wed May 1 08:38:33 2002 > > file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp last mod_time: Thu May 2 15:57:49 2002 > > file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-gaa last mod_time: Wed Dec 31 19:00:00 1969 > > file /etc/ulcmit/samba/carp/auto-config/user-gaa modified: Thu Feb 17 10:22:09 2005 > >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service homes >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service users >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service hosts >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service public >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service OracleImp >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service Q-Train >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service IPC$ >[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205) > free_service: Freeing service ADMIN$ >[2005/02/17 12:16:07, 3] param/loadparm.c:lp_load(3898) > lp_load: refreshing parameters >[2005/02/17 12:16:07, 3] param/loadparm.c:init_globals(1314) > Initialising global parameters >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf" >[2005/02/17 12:16:07, 3] param/loadparm.c:do_section(3400) > Processing section "[global]" > doing parameter netbios name = carp >[2005/02/17 12:16:07, 4] param/loadparm.c:handle_netbios_name(2745) > handle_netbios_name: set global_myname to: CARP > doing parameter server string = Carp -- a test instance of Corp > doing parameter interfaces = 172.25.0.9 > doing parameter private dir = /var/ulcmit/samba/carp/private > doing parameter smb passwd file = /var/ulcmit/samba/carp/private/smbpasswd > doing parameter lock directory = /var/ulcmit/samba/carp/locks > doing parameter pid directory = /var/ulcmit/samba/carp/locks > doing parameter log level = 0 >[2005/02/17 12:16:07, 5] lib/debug.c:debug_dump_status(366) > INFO: Current debug levels: > all: True/10 > tdb: False/0 > printdrivers: False/0 > lanman: False/0 > smb: False/0 > rpc_parse: False/0 > rpc_srv: False/0 > rpc_cli: False/0 > passdb: False/0 > sam: False/0 > auth: False/0 > winbind: False/0 > vfs: False/0 > idmap: False/0 > quota: False/0 > acls: False/0 > doing parameter include = /etc/ulcmit/samba/carp/smb.conf.shares >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.shares" >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[homes]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 0 for homes > doing parameter comment = My Corporate Directory > doing parameter path = /corp/%S > doing parameter valid users = %S > doing parameter browseable = no > doing parameter writable = yes > doing parameter directory mask = 0755 > doing parameter create mask = 0755 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[users]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 1 for users > doing parameter comment = Links to all the user's home directories > doing parameter path = /etc/ulcmit/samba/carp/users > doing parameter browseable = yes > doing parameter writable = no >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[hosts]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 2 for hosts > doing parameter comment = Links to other file servers in the same NIS domain. > doing parameter path = /etc/ulcmit/samba/carp/hosts > doing parameter browseable = yes > doing parameter writable = no >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[public]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 3 for public > doing parameter comment = Here are files for public consumption > doing parameter path = /etc/ulcmit/samba/carp/public > doing parameter browseable = yes > doing parameter writable = yes > doing parameter include = /etc/ulcmit/samba/carp/auto-config/user-%U >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/auto-config/user-gaa" >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[doc-grp]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 4 for doc-grp > doing parameter comment = /corp/doc/group -- Group Only Share > doing parameter path = /corp/doc/group > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @doc > doing parameter valid users = +doc > doing parameter force group = doc > doing parameter force user = doc > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02750 > doing parameter force create mode = 0660 > doing parameter directory mask = 02750 > doing parameter create mask = 0660 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[doc-pub]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 5 for doc-pub > doing parameter comment = /corp/doc/public -- Publicly Readable Share > doing parameter path = /corp/doc/public > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @doc > doing parameter valid users = +doc > doing parameter force group = doc > doing parameter force user = doc > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02755 > doing parameter force create mode = 0664 > doing parameter directory mask = 02755 > doing parameter create mask = 0664 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[doc-web]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 6 for doc-web > doing parameter comment = /corp/doc/public_html -- Group's webspace > doing parameter path = /corp/doc/public_html > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @doc > doing parameter valid users = +doc > doing parameter force group = doc > doing parameter force user = doc > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02755 > doing parameter force create mode = 0664 > doing parameter directory mask = 02755 > doing parameter create mask = 0664 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[hradm-grp]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 7 for hradm-grp > doing parameter comment = /u/hradm/group -- Group Only Share > doing parameter path = /u/hradm/group > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @hradm > doing parameter valid users = +hradm > doing parameter force group = hradm > doing parameter force user = hradm > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02750 > doing parameter force create mode = 0660 > doing parameter directory mask = 02750 > doing parameter create mask = 0660 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[hradm-pub]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 8 for hradm-pub > doing parameter comment = /u/hradm/public -- Publicly Readable Share > doing parameter path = /u/hradm/public > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @hradm > doing parameter valid users = +hradm > doing parameter force group = hradm > doing parameter force user = hradm > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02755 > doing parameter force create mode = 0664 > doing parameter directory mask = 02755 > doing parameter create mask = 0664 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[hradm-web]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 9 for hradm-web > doing parameter comment = /u/hradm/public_html -- Group's webspace > doing parameter path = /u/hradm/public_html > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @hradm > doing parameter valid users = +hradm > doing parameter force group = hradm > doing parameter force user = hradm > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02755 > doing parameter force create mode = 0664 > doing parameter directory mask = 02755 > doing parameter create mask = 0664 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[it-grp]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 10 for it-grp > doing parameter comment = /corp/it/group -- Group Only Share > doing parameter path = /corp/it/group > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @it > doing parameter force group = +it > doing parameter valid users = +it > doing parameter force directory mode = 02770 > doing parameter force create mode = 0770 > doing parameter directory mask = 02770 > doing parameter create mask = 0770 >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[it-pub]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 11 for it-pub > doing parameter comment = /corp/it/public -- Publicly Readable Share > doing parameter path = /corp/it/public > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @it > doing parameter force group = +it > doing parameter valid users = +it > doing parameter force user = it > doing parameter force directory mode = 02755 > doing parameter force create mode = 0755 > doing parameter directory mask = 02755 > doing parameter create mask = 0755 > doing parameter include = /etc/ulcmit/samba/carp/smb.conf.oracleimp >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.oracleimp" >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[OracleImp]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 12 for OracleImp > doing parameter comment = ES Group Oracle Implementation > doing parameter path = /corp/es/OracleImp > doing parameter writable = yes > doing parameter browsable = yes > doing parameter write list = @esora > doing parameter valid users = > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 02775 > doing parameter force create mode = 0664 > doing parameter directory mask = 02775 > doing parameter create mask = 0664 > doing parameter include = /etc/ulcmit/samba/carp/smb.conf.q-train >[2005/02/17 12:16:07, 3] param/params.c:pm_process(566) > params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.q-train" >[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417) > Processing section "[Q-Train]" >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 13 for Q-Train > doing parameter comment = Quality Trainer > doing parameter path = /corp/qlty/q-train > doing parameter writable = yes > doing parameter browsable = yes > doing parameter valid users = > doing parameter force group = qlty > doing parameter force user = qlty > doing parameter map archive = no > doing parameter map hidden = no > doing parameter map system = no > doing parameter force directory mode = 0777 > doing parameter force create mode = 0666 > doing parameter directory mask = 0777 > doing parameter create mask = 0666 >[2005/02/17 12:16:07, 4] param/loadparm.c:lp_load(3929) > pm_process() returned Yes >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 14 for IPC$ >[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392) > adding IPC service >[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 15 for ADMIN$ >[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392) > adding IPC service >[2005/02/17 12:16:07, 10] param/loadparm.c:set_server_role(3847) > set_server_role: role = ROLE_STANDALONE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81) > Substituting charset '646' for LOCALE >[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039) > lp_servicenumber: couldn't find printers >[2005/02/17 12:16:07, 3] printing/pcap.c:pcap_cache_reload(114) > reloading printcap cache >[2005/02/17 12:16:07, 5] printing/print_cups.c:cups_cache_reload(71) > reloading cups printcap cache >[2005/02/17 12:16:07, 10] printing/print_cups.c:cups_server(51) > cups server left to default localhost >[2005/02/17 12:16:08, 3] printing/pcap.c:pcap_cache_reload(213) > reload status: ok >[2005/02/17 12:16:08, 7] param/loadparm.c:lp_servicenumber(4039) > lp_servicenumber: couldn't find printers >[2005/02/17 12:16:08, 7] param/loadparm.c:lp_servicenumber(4039) > lp_servicenumber: couldn't find printers >[2005/02/17 12:16:08, 2] lib/interface.c:add_interface(79) > added interface ip=172.25.0.9 bcast=172.25.255.255 nmask=255.255.0.0 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_KEEPALIVE = 8 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_REUSEADDR = 4 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_BROADCAST = 0 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option TCP_NODELAY = 1 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_LOWDELAY = 0 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_THROUGHPUT = 0 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_SNDBUF = 49152 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_RCVBUF = 49640 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDLOWAT. >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVLOWAT. >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDTIMEO. >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVTIMEO. >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_KEEPALIVE = 8 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_REUSEADDR = 4 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_BROADCAST = 0 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option TCP_NODELAY = 1 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_LOWDELAY = 0 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option IPTOS_THROUGHPUT = 0 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_SNDBUF = 49152 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147) > socket option SO_RCVBUF = 49640 >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDLOWAT. >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVLOWAT. >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_SNDTIMEO. >[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145) > Could not test socket option SO_RCVTIMEO. >[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info_map(225) > make_user_info_map: Mapping user [AZURITE]\[gaa] from workstation [AZURITE] >[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info(133) > attempting to make a user_info for gaa (gaa) >[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info(143) > making strings for gaa's user_info struct >[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info(185) > making blobs for gaa's user_info struct >[2005/02/17 12:16:08, 10] auth/auth_util.c:make_user_info(201) > made an encrypted user_info for gaa (gaa) >[2005/02/17 12:16:08, 3] auth/auth.c:check_ntlm_password(219) > check_ntlm_password: Checking password for unmapped user [AZURITE]\[gaa]@[AZURITE] with the new password interface >[2005/02/17 12:16:08, 3] auth/auth.c:check_ntlm_password(222) > check_ntlm_password: mapped user is: [CARP]\[gaa]@[AZURITE] >[2005/02/17 12:16:08, 10] auth/auth.c:check_ntlm_password(231) > check_ntlm_password: auth_context challenge created by NTLMSSP callback (NTLM2) >[2005/02/17 12:16:08, 10] auth/auth.c:check_ntlm_password(233) > challenge is: >[2005/02/17 12:16:08, 5] lib/util.c:dump_data(1990) > [000] BC EA B7 0E B4 58 F8 01 .....X.. >[2005/02/17 12:16:08, 10] auth/auth.c:check_ntlm_password(259) > check_ntlm_password: guest had nothing to say >[2005/02/17 12:16:08, 8] lib/util.c:is_myname(1810) > is_myname("CARP") returns 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031) > smbldap_search: base => [dc=ulticom,dc=com], filter => [(&(uid=gaa)(objectclass=sambaSamAccount))], scope => [2] >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939) > The connection to the LDAP server was closed >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939) > The connection to the LDAP server was closed >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596) > smbldap_open_connection: ldap://ldap.ulticom.com >[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692) > smbldap_open_connection: connection opened >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824) > ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com" >[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866) > ldap_connect_system: succesful connection to the LDAP server > ldap_connect_system: LDAP server does not support paged results >[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919) > The LDAP server is succesfully connected >[2005/02/17 12:16:08, 2] passdb/pdb_ldap.c:init_sam_from_ldap(512) > init_sam_from_ldap: Entry found for user: gaa >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_username(617) > pdb_set_username: setting username gaa, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_domain(644) > pdb_set_domain: setting domain CARP, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) > pdb_set_nt_username: setting nt username gaa, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557) > pdb_set_user_sid_from_string: setting user sid S-1-5-21-104134243-2275341451-782570472-1804 >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) > pdb_set_user_sid: setting user sid S-1-5-21-104134243-2275341451-782570472-1804 >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592) > pdb_set_group_sid_from_string: setting group sid S-1-5-21-104134243-2275341451-782570472-3205 >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) > pdb_set_group_sid: setting group sid S-1-5-21-104134243-2275341451-782570472-3205 >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaLogonTime] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaLogoffTime] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaKickoffTime] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [displayName] = [<does not exist>] >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) > pdb_set_full_name: setting full name Gary Algier, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) > pdb_set_dir_drive: setting dir drive H, was NULL >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) > pdb_set_homedir: setting home dir \\corp\gaa, was >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>] >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) > pdb_set_logon_script: setting logon script , was >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaProfilePath] = [<does not exist>] >[2005/02/17 12:16:08, 4] lib/substitute.c:automount_server(335) > Home server: carp >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) > pdb_set_profile_path: setting profile path \\carp\gaa\profile, was >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [description] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/account_pol.c:account_policy_get(210) > account_policy_get: password history:0 >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>] >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358) > smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>] >[2005/02/17 12:16:08, 5] passdb/login_cache.c:login_cache_init(41) > Opening cache file at /var/ulcmit/samba/carp/locks/login_cache.tdb >[2005/02/17 12:16:08, 7] passdb/login_cache.c:login_cache_read(83) > Looking up login cache for user gaa >[2005/02/17 12:16:08, 7] passdb/login_cache.c:login_cache_read(97) > No cache entry found >[2005/02/17 12:16:08, 9] passdb/pdb_ldap.c:init_sam_from_ldap(836) > No cache entry, bad count = 0, bad time = 0 >[2005/02/17 12:16:08, 10] lib/account_pol.c:account_policy_get(210) > account_policy_get: password history:0 >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_username(617) > pdb_set_username: setting username gaa, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_domain(644) > pdb_set_domain: setting domain CARP, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) > pdb_set_nt_username: setting nt username gaa, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) > pdb_set_full_name: setting full name Gary Algier, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) > pdb_set_homedir: setting home dir \\corp\gaa, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) > pdb_set_dir_drive: setting dir drive H, was NULL >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) > pdb_set_logon_script: setting logon script , was >[2005/02/17 12:16:08, 4] lib/substitute.c:automount_server(335) > Home server: carp >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) > pdb_set_profile_path: setting profile path \\carp\gaa\profile, was >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) > pdb_set_workstations: setting workstations , was >[2005/02/17 12:16:08, 10] lib/account_pol.c:account_policy_get(210) > account_policy_get: password history:0 >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) > pdb_set_user_sid: setting user sid S-1-5-21-3834718897-2476707436-3842496652-0 >[2005/02/17 12:16:08, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) > pdb_set_user_sid_from_rid: > setting user sid S-1-5-21-3834718897-2476707436-3842496652-0 from rid 0 >[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) > pdb_set_group_sid: setting group sid S-1-5-21-3834718897-2476707436-3842496652-0 >[2005/02/17 12:16:08, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) > pdb_set_group_sid_from_rid: > setting group sid S-1-5-21-3834718897-2476707436-3842496652-0 from rid 0 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:08, 9] passdb/passdb.c:pdb_update_autolock_flag(2348) > pdb_update_autolock_flag: Account gaa not autolocked, no check needed >[2005/02/17 12:16:08, 4] libsmb/ntlm_check.c:ntlm_password_check(326) > ntlm_password_check: Checking NT MD4 password >[2005/02/17 12:16:08, 4] auth/auth_sam.c:sam_account_ok(119) > sam_account_ok: Checking SMB password for user gaa >[2005/02/17 12:16:08, 5] auth/auth_sam.c:logon_hours_ok(101) > logon_hours_ok: user gaa allowed to logon at this time (Thu Feb 17 12:16:08 2005 > ) >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 10] lib/system_smbd.c:sys_getgrouplist(116) > sys_getgrouplist: user [gaa] >[2005/02/17 12:16:08, 10] lib/system_smbd.c:sys_getgrouplist(125) > sys_getgrouplist(): disabled winbindd for group lookup [user == gaa] >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 8] lib/util_getent.c:remove_duplicate_gids(330) > remove_duplicate_gids: Enter 6 gids >[2005/02/17 12:16:08, 8] lib/util_getent.c:remove_duplicate_gids(348) > remove_duplicate_gids: Exit 5 gids >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031) > smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=101))], scope => [2] >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939) > The connection to the LDAP server was closed >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596) > smbldap_open_connection: ldap://ldap.ulticom.com >[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692) > smbldap_open_connection: connection opened >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824) > ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com" >[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866) > ldap_connect_system: succesful connection to the LDAP server > ldap_connect_system: LDAP server does not support paged results >[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919) > The LDAP server is succesfully connected >[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080) > ldapsam_getgroup: Did not find group >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265) > local_gid_to_sid: Fall back to algorithmic mapping: 101 -> S-0-0 >[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231) > algorithmic_gid_to_sid: falling back to RID algorithm >[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235) > algorithmic_gid_to_sid: gid (101) -> SID S-1-5-21-3834718897-2476707436-3842496652-1203. >[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372) > gid_to_sid: local 101 -> S-1-5-21-3834718897-2476707436-3842496652-1203 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031) > smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=10))], scope => [2] >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939) > The connection to the LDAP server was closed >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596) > smbldap_open_connection: ldap://ldap.ulticom.com >[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692) > smbldap_open_connection: connection opened >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824) > ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com" >[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866) > ldap_connect_system: succesful connection to the LDAP server > ldap_connect_system: LDAP server does not support paged results >[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919) > The LDAP server is succesfully connected >[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080) > ldapsam_getgroup: Did not find group >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265) > local_gid_to_sid: Fall back to algorithmic mapping: 10 -> S-0-0 >[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231) > algorithmic_gid_to_sid: falling back to RID algorithm >[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235) > algorithmic_gid_to_sid: gid (10) -> SID S-1-5-21-3834718897-2476707436-3842496652-1021. >[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372) > gid_to_sid: local 10 -> S-1-5-21-3834718897-2476707436-3842496652-1021 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031) > smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=113))], scope => [2] >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939) > The connection to the LDAP server was closed >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596) > smbldap_open_connection: ldap://ldap.ulticom.com >[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692) > smbldap_open_connection: connection opened >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824) > ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com" >[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866) > ldap_connect_system: succesful connection to the LDAP server > ldap_connect_system: LDAP server does not support paged results >[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919) > The LDAP server is succesfully connected >[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080) > ldapsam_getgroup: Did not find group >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265) > local_gid_to_sid: Fall back to algorithmic mapping: 113 -> S-0-0 >[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231) > algorithmic_gid_to_sid: falling back to RID algorithm >[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235) > algorithmic_gid_to_sid: gid (113) -> SID S-1-5-21-3834718897-2476707436-3842496652-1227. >[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372) > gid_to_sid: local 113 -> S-1-5-21-3834718897-2476707436-3842496652-1227 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031) > smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=1102))], scope => [2] >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939) > The connection to the LDAP server was closed >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596) > smbldap_open_connection: ldap://ldap.ulticom.com >[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692) > smbldap_open_connection: connection opened >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824) > ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com" >[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866) > ldap_connect_system: succesful connection to the LDAP server > ldap_connect_system: LDAP server does not support paged results >[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919) > The LDAP server is succesfully connected >[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080) > ldapsam_getgroup: Did not find group >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265) > local_gid_to_sid: Fall back to algorithmic mapping: 1102 -> S-0-0 >[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231) > algorithmic_gid_to_sid: falling back to RID algorithm >[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235) > algorithmic_gid_to_sid: gid (1102) -> SID S-1-5-21-3834718897-2476707436-3842496652-3205. >[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372) > gid_to_sid: local 1102 -> S-1-5-21-3834718897-2476707436-3842496652-3205 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 1 >[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031) > smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=1138))], scope => [2] >[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939) > The connection to the LDAP server was closed >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596) > smbldap_open_connection: ldap://ldap.ulticom.com >[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692) > smbldap_open_connection: connection opened >[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824) > ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com" >[2005/02/17 12:16:09, 3] lib/smbldap.c:smbldap_connect_system(866) > ldap_connect_system: succesful connection to the LDAP server > ldap_connect_system: LDAP server does not support paged results >[2005/02/17 12:16:09, 4] lib/smbldap.c:smbldap_open(919) > The LDAP server is succesfully connected >[2005/02/17 12:16:09, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080) > ldapsam_getgroup: Did not find group >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:09, 10] passdb/passdb.c:local_gid_to_sid(1265) > local_gid_to_sid: Fall back to algorithmic mapping: 1138 -> S-0-0 >[2005/02/17 12:16:09, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231) > algorithmic_gid_to_sid: falling back to RID algorithm >[2005/02/17 12:16:09, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235) > algorithmic_gid_to_sid: gid (1138) -> SID S-1-5-21-3834718897-2476707436-3842496652-3277. >[2005/02/17 12:16:09, 10] passdb/lookup_sid.c:gid_to_sid(372) > gid_to_sid: local 1138 -> S-1-5-21-3834718897-2476707436-3842496652-3277 >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 10] auth/auth_util.c:debug_nt_user_token(491) > NT user token of user S-1-5-21-104134243-2275341451-782570472-1804 > contains 10 SIDs > SID[ 0]: S-1-5-21-104134243-2275341451-782570472-1804 > SID[ 1]: S-1-5-21-104134243-2275341451-782570472-3205 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-3834718897-2476707436-3842496652-1203 > SID[ 6]: S-1-5-21-3834718897-2476707436-3842496652-1021 > SID[ 7]: S-1-5-21-3834718897-2476707436-3842496652-1227 > SID[ 8]: S-1-5-21-3834718897-2476707436-3842496652-3205 > SID[ 9]: S-1-5-21-3834718897-2476707436-3842496652-3277 > SE_PRIV 0x0 0x0 0x0 0x0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:make_server_info_sam(830) > make_server_info_sam: made server info for user gaa -> gaa >[2005/02/17 12:16:09, 3] auth/auth.c:check_ntlm_password(268) > check_ntlm_password: sam authentication for user [gaa] succeeded >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:push_sec_ctx(256) > push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:09, 3] smbd/uid.c:push_conn_ctx(365) > push_conn_ctx(0) : conn_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:pop_sec_ctx(386) > pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 5] auth/auth.c:check_ntlm_password(292) > check_ntlm_password: PAM Account for user [gaa] succeeded >[2005/02/17 12:16:09, 2] auth/auth.c:check_ntlm_password(305) > check_ntlm_password: authentication for user [gaa] -> [gaa] -> [gaa] succeeded >[2005/02/17 12:16:09, 5] auth/auth_util.c:free_user_info(1348) > attempting to free (and zero) a user_info structure >[2005/02/17 12:16:09, 10] auth/auth_util.c:free_user_info(1351) > structure was created for gaa >[2005/02/17 12:16:09, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(117) > Got NT session key of length 16 >[2005/02/17 12:16:09, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(123) > Got LM session key of length 16 >[2005/02/17 12:16:09, 10] libsmb/ntlmssp.c:ntlmssp_server_auth(678) > ntlmssp_server_auth: Created NTLM2 session key. >[2005/02/17 12:16:09, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319) > NTLMSSP Sign/Seal - Initialising with flags: >[2005/02/17 12:16:09, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62) > Got NTLMSSP neg_flags=0x60088215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2005/02/17 12:16:09, 10] smbd/password.c:register_vuid(158) > register_vuid: allocated vuid = 100 >[2005/02/17 12:16:09, 10] lib/util_pw.c:getpwnam_alloc(84) > Got gaa from pwnam_cache >[2005/02/17 12:16:09, 10] smbd/password.c:register_vuid(220) > register_vuid: (402,101) gaa gaa CARP guest=0 >[2005/02/17 12:16:09, 3] smbd/password.c:register_vuid(222) > User name: gaa Real name: Gary Algier >[2005/02/17 12:16:09, 3] smbd/password.c:register_vuid(241) > UNIX uid 402 is UNIX user gaa, and will be vuid 100 >[2005/02/17 12:16:09, 2] smbd/utmp.c:sys_utmp_update(419) > utmp_update: uname:/var/adm/utmpx wname:/var/adm/wtmpx >[2005/02/17 12:16:09, 7] param/loadparm.c:lp_servicenumber(4039) > lp_servicenumber: couldn't find gaa >[2005/02/17 12:16:09, 3] smbd/password.c:register_vuid(270) > Adding homes service for user 'gaa' using home directory: '/u/gaa' >[2005/02/17 12:16:09, 8] param/loadparm.c:add_a_service(2310) > add_a_service: Creating snum = 16 for gaa >[2005/02/17 12:16:09, 3] param/loadparm.c:lp_add_home(2351) > adding home's share [gaa] for user 'gaa' at '/corp/%S' >[2005/02/17 12:16:09, 6] param/loadparm.c:lp_file_list_changed(2698) > lp_file_list_changed() > file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train last mod_time: Wed May 1 08:38:33 2002 > > file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp last mod_time: Thu May 2 15:57:49 2002 > > file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-gaa last mod_time: Thu Feb 17 10:22:09 2005 > > file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares last mod_time: Thu Feb 17 10:14:42 2005 > > file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13 last mod_time: Thu Feb 17 12:12:56 2005 > > file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf last mod_time: Thu Feb 17 12:13:35 2005 > >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,108) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,108) wrote 108 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 74 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x4a >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 3 of length 78 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=74 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=0 > smb_pid=65279 > smb_uid=100 > smb_mid=50816 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 74 (0x4A) > smb_vwv[ 2]= 8 (0x8) > smb_vwv[ 3]= 1 (0x1) > smb_bcc=31 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 5C 00 43 00 41 00 52 00 50 00 5C 00 49 .\.\.C.A .R.P.\.I > [010] 00 50 00 43 00 24 00 00 00 3F 3F 3F 3F 3F 00 .P.C.$.. .?????. >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtconX (pid 13681) conn 0x0 >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/02/17 12:16:09, 4] smbd/reply.c:reply_tcon_and_X(407) > Client requested device type [?????] for share [IPC$] >[2005/02/17 12:16:09, 5] smbd/service.c:make_connection(810) > making a connection to 'normal' service ipc$ >[2005/02/17 12:16:09, 5] lib/username.c:Get_Pwnam(293) > Finding user gaa >[2005/02/17 12:16:09, 5] lib/username.c:Get_Pwnam_internals(223) > Trying _Get_Pwnam(), username as lowercase is gaa >[2005/02/17 12:16:09, 10] lib/util_pw.c:getpwnam_alloc(84) > Got gaa from pwnam_cache >[2005/02/17 12:16:09, 5] lib/username.c:Get_Pwnam_internals(251) > Get_Pwnam_internals did find user [gaa]! >[2005/02/17 12:16:09, 3] smbd/service.c:make_connection_snum(469) > Connect path is '/tmp' for service [IPC$] >[2005/02/17 12:16:09, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217) > get_share_security: using default secdesc for IPC$ >[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_map_generic(176) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_access_check(234) > se_access_check: requested access 0x00000002, for NT token with 10 entries and first sid S-1-5-21-104134243-2275341451-782570472-1804. >[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(251) >[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(252) > se_access_check: user sid is S-1-5-21-104134243-2275341451-782570472-1804 > se_access_check: also S-1-5-21-104134243-2275341451-782570472-3205 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1203 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1021 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1227 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3205 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3277 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 >[2005/02/17 12:16:09, 5] lib/util_seaccess.c:se_access_check(309) > se_access_check: access (2) granted. >[2005/02/17 12:16:09, 3] smbd/vfs.c:vfs_init_default(206) > Initialising default vfs hooks >[2005/02/17 12:16:09, 5] smbd/connection.c:claim_connection(170) > claiming IPC$ 0 >[2005/02/17 12:16:09, 10] smbd/uid.c:is_share_read_only_for_user(99) > is_share_read_only_for_user: share IPC$ is read-only for unix user gaa >[2005/02/17 12:16:09, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217) > get_share_security: using default secdesc for IPC$ >[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_map_generic(176) > se_map_generic(): mapped mask 0x10000000 to 0x001f01ff >[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_access_check(234) > se_access_check: requested access 0x00000001, for NT token with 10 entries and first sid S-1-5-21-104134243-2275341451-782570472-1804. >[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(251) >[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(252) > se_access_check: user sid is S-1-5-21-104134243-2275341451-782570472-1804 > se_access_check: also S-1-5-21-104134243-2275341451-782570472-3205 > se_access_check: also S-1-1-0 > se_access_check: also S-1-5-2 > se_access_check: also S-1-5-11 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1203 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1021 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1227 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3205 > se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3277 > se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 >[2005/02/17 12:16:09, 5] lib/util_seaccess.c:se_access_check(309) > se_access_check: access (1) granted. >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(491) > NT user token of user S-1-5-21-104134243-2275341451-782570472-1804 > contains 10 SIDs > SID[ 0]: S-1-5-21-104134243-2275341451-782570472-1804 > SID[ 1]: S-1-5-21-104134243-2275341451-782570472-3205 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-3834718897-2476707436-3842496652-1203 > SID[ 6]: S-1-5-21-3834718897-2476707436-3842496652-1021 > SID[ 7]: S-1-5-21-3834718897-2476707436-3842496652-1227 > SID[ 8]: S-1-5-21-3834718897-2476707436-3842496652-3205 > SID[ 9]: S-1-5-21-3834718897-2476707436-3842496652-3277 > SE_PRIV 0x0 0x0 0x0 0x0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 402 > Primary group is 101 and contains 5 supplementary groups > Group[ 0]: 101 > Group[ 1]: 10 > Group[ 2]: 113 > Group[ 3]: 1102 > Group[ 4]: 1138 >[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_user(281) > change_to_user uid=(0,402) gid=(0,101) >[2005/02/17 12:16:09, 3] smbd/service.c:make_connection_snum(645) > azurite (172.25.32.13) connect to service IPC$ initially as user gaa (uid=402, gid=101) (pid 13681) >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/02/17 12:16:09, 3] smbd/reply.c:reply_tcon_and_X(455) > tconX service=IPC$ >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=48 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=50816 > smt_wct=3 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_bcc=7 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 49 50 43 00 00 00 00 IPC.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,52) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,52) wrote 52 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 4 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=50880 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(491) > NT user token of user S-1-5-21-104134243-2275341451-782570472-1804 > contains 10 SIDs > SID[ 0]: S-1-5-21-104134243-2275341451-782570472-1804 > SID[ 1]: S-1-5-21-104134243-2275341451-782570472-3205 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-3834718897-2476707436-3842496652-1203 > SID[ 6]: S-1-5-21-3834718897-2476707436-3842496652-1021 > SID[ 7]: S-1-5-21-3834718897-2476707436-3842496652-1227 > SID[ 8]: S-1-5-21-3834718897-2476707436-3842496652-3205 > SID[ 9]: S-1-5-21-3834718897-2476707436-3842496652-3277 > SE_PRIV 0x0 0x0 0x0 0x0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 402 > Primary group is 101 and contains 5 supplementary groups > Group[ 0]: 101 > Group[ 1]: 10 > Group[ 2]: 113 > Group[ 3]: 1102 > Group[ 4]: 1138 >[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_user(281) > change_to_user uid=(0,402) gid=(0,101) >[2005/02/17 12:16:09, 4] smbd/vfs.c:vfs_ChDir(657) > vfs_ChDir to /tmp >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 7428 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7428 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=50880 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=10240 (0x2800) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 5 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=50944 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29736 (0x7428) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7428 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7428 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7428) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7428 name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7428 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=50944 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 6 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51008 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29736 (0x7428) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 34 E4 A3 09 07 00 00 .$...... .4...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7428 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7428 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7428) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7428 name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09a3e434 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7428 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51008 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 7 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51072 > smt_wct=3 > smb_vwv[ 0]=29736 (0x7428) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7428 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7428 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7428 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=7428 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51072 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 8 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51136 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 7429 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=7429 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51136 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=10496 (0x2900) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 9 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51200 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29737 (0x7429) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7429 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7429 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7429) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7429 name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7429 name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51200 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 10 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51264 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29737 (0x7429) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 34 E4 A3 09 07 00 00 .$...... .4...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7429 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7429 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7429) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7429 name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09a3e434 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7429 name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51264 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 11 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51328 > smt_wct=3 > smb_vwv[ 0]=29737 (0x7429) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7429 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7429 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7429 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=7429 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51328 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 12 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51392 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 742a (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=742a >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51392 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=10752 (0x2A00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 13 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51456 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29738 (0x742A) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742a >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742a (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 742a) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742a name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742a name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51456 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 14 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51520 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29738 (0x742A) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 94 E1 A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742a >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742a (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 742a) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742a name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09a3e194 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742a name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51520 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 15 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51584 > smt_wct=3 > smb_vwv[ 0]=29738 (0x742A) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742a >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742a (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:742a >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=742a (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51584 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 16 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51648 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 742b (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=742b >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51648 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=11008 (0x2B00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 17 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51712 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29739 (0x742B) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742b >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742b (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 742b) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742b name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742b name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51712 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 18 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51776 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29739 (0x742B) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 94 E1 A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742b >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742b (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 742b) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742b name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09a3e194 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742b name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51776 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 19 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51840 > smt_wct=3 > smb_vwv[ 0]=29739 (0x742B) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742b >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742b (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:742b >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=742b (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=51840 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 20 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51904 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 742c (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=742c >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51904 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=11264 (0x2C00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 21 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51968 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29740 (0x742C) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742c >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742c (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 742c) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742c name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742c name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=51968 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 22 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52032 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29740 (0x742C) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 C4 E3 A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742c >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742c (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 742c) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742c name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09a3e3c4 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742c name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52032 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 23 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52096 > smt_wct=3 > smb_vwv[ 0]=29740 (0x742C) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742c >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742c (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:742c >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=742c (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52096 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 24 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52160 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 742d (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=742d >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52160 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=11520 (0x2D00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 25 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52224 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29741 (0x742D) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742d >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742d (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 742d) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742d name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742d name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52224 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 26 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52288 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29741 (0x742D) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 C4 E3 A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742d >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742d (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 742d) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742d name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09a3e3c4 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742d name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52288 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 27 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52352 > smt_wct=3 > smb_vwv[ 0]=29741 (0x742D) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742d >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742d (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:742d >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=742d (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52352 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 28 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52416 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 742e (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=742e >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52416 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=11776 (0x2E00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 29 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52480 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29742 (0x742E) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742e >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742e (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 742e) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742e name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742e name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52480 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 30 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52544 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29742 (0x742E) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 A0 BE A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742e >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742e (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 742e) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742e name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09a3bea0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742e name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52544 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 31 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52608 > smt_wct=3 > smb_vwv[ 0]=29742 (0x742E) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742e >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=742e (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:742e >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=742e (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52608 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 32 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52672 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 742f (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=742f >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52672 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=12032 (0x2F00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 33 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52736 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29743 (0x742F) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742f >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742f (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 742f) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742f name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742f name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52736 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 34 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52800 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29743 (0x742F) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 A0 BE A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742f >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742f (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 742f) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 742f name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09a3bea0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 742f name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52800 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 35 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52864 > smt_wct=3 > smb_vwv[ 0]=29743 (0x742F) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=742f >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=742f (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:742f >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=742f (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=52864 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 36 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52928 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 7430 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7430 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52928 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=12288 (0x3000) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 37 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52992 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29744 (0x7430) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7430 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7430 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7430) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7430 name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7430 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=52992 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 38 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53056 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29744 (0x7430) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 A4 BE A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7430 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7430 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7430) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7430 name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09a3bea4 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7430 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53056 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 39 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53120 > smt_wct=3 > smb_vwv[ 0]=29744 (0x7430) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7430 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7430 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7430 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=7430 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53120 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 40 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53184 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 7431 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7431 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53184 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=12544 (0x3100) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 41 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53248 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29745 (0x7431) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7431 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7431 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7431) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7431 name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7431 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53248 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 42 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53312 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29745 (0x7431) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 D8 C5 A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7431 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7431 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7431) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7431 name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09a3c5d8 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7431 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53312 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 43 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53376 > smt_wct=3 > smb_vwv[ 0]=29745 (0x7431) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7431 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7431 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7431 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=7431 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53376 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 44 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53440 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 7432 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=7432 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53440 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=12800 (0x3200) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 45 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53504 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29746 (0x7432) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7432 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7432 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7432) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7432 name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7432 name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53504 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 46 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53568 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29746 (0x7432) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 D8 C5 A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7432 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7432 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7432) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7432 name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09a3c5d8 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7432 name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53568 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 47 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53632 > smt_wct=3 > smb_vwv[ 0]=29746 (0x7432) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7432 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7432 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7432 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=7432 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53632 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 48 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53696 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 7433 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7433 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53696 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=13056 (0x3300) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 49 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53760 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29747 (0x7433) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7433 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7433 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7433) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7433 name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7433 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53760 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 50 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53824 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29747 (0x7433) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 DC C5 A3 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(491) > NT user token of user S-1-5-21-104134243-2275341451-782570472-1804 > contains 10 SIDs > SID[ 0]: S-1-5-21-104134243-2275341451-782570472-1804 > SID[ 1]: S-1-5-21-104134243-2275341451-782570472-3205 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-3834718897-2476707436-3842496652-1203 > SID[ 6]: S-1-5-21-3834718897-2476707436-3842496652-1021 > SID[ 7]: S-1-5-21-3834718897-2476707436-3842496652-1227 > SID[ 8]: S-1-5-21-3834718897-2476707436-3842496652-3205 > SID[ 9]: S-1-5-21-3834718897-2476707436-3842496652-3277 > SE_PRIV 0x0 0x0 0x0 0x0 >[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 402 > Primary group is 101 and contains 5 supplementary groups > Group[ 0]: 101 > Group[ 1]: 10 > Group[ 2]: 113 > Group[ 3]: 1102 > Group[ 4]: 1138 >[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_user(281) > change_to_user uid=(0,402) gid=(0,101) >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7433 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7433 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7433) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7433 name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09a3c5dc >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7433 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53824 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 51 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53888 > smt_wct=3 > smb_vwv[ 0]=29747 (0x7433) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7433 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7433 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7433 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=7433 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=53888 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 52 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53952 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 7434 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7434 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=53952 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=13312 (0x3400) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 53 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54016 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29748 (0x7434) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 69 .\.P.I.P .E.\...i > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7434 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7434 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7434) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7434 name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7434 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54016 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 54 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54080 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29748 (0x7434) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 69 .\.P.I.P .E.\...i > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 2C D1 FB 00 07 00 00 .$...... .,...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7434 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7434 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7434) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7434 name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 00fbd12c >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7434 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54080 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 55 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54144 > smt_wct=3 > smb_vwv[ 0]=29748 (0x7434) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7434 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7434 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7434 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=7434 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54144 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 56 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54208 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 7435 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=7435 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54208 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=13568 (0x3500) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 57 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54272 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29749 (0x7435) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 69 .\.P.I.P .E.\...i > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7435 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7435 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7435) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7435 name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7435 name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54272 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 58 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54336 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29749 (0x7435) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 69 .\.P.I.P .E.\...i > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 2C D1 FB 00 07 00 00 .$...... .,...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7435 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7435 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7435) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7435 name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 00fbd12c >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7435 name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54336 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 59 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54400 > smt_wct=3 > smb_vwv[ 0]=29749 (0x7435) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7435 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7435 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7435 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=7435 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54400 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 60 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54464 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 7436 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7436 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54464 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=13824 (0x3600) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 61 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54528 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29750 (0x7436) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 69 .\.P.I.P .E.\...i > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7436 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7436 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7436) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7436 name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7436 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54528 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 62 of length 148 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54592 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29750 (0x7436) > smb_bcc=77 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 30 D1 FB 00 07 00 00 .$...... .0...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7436 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7436 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7436) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7436 name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 00fbd130 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7436 name: wkssvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54592 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 63 of length 45 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54656 > smt_wct=3 > smb_vwv[ 0]=29750 (0x7436) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7436 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7436 (pipes_open=1) >[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7436 >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=7436 (pipes_open=0) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54656 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 64 of length 104 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54720 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 7437 (pipes_open=1) >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=7437 >[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54720 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=14080 (0x3700) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 65 of length 160 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54784 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29751 (0x7437) > smb_bcc=89 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7437 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7437 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7437) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7437 name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7437 name: srvsvc len: 1024 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54784 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 168 >[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xa8 >[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091) > Transaction 66 of length 172 >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474) > size=168 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54848 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 84 (0x54) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 84 (0x54) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29751 (0x7437) > smb_bcc=101 >[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 54 00 00 00 01 00 00 ........ .T...... > [020] 00 3C 00 00 00 00 00 0F 00 04 73 81 00 07 00 00 .<...... ..s..... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 01 00 00 00 01 00 00 .r.p.... ........ > [050] 00 F8 DD CF 09 00 00 00 00 00 00 00 00 FF FF FF ........ ........ > [060] FF 00 00 00 00 ..... >[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=84 params=0 setup=2 >[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7437 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7437 (pipes_open=1) >[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 7437) >[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7437 name: srvsvc open: Yes len: 84 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 84 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 68 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0054 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 68 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 68, incoming data = 68 >[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 0000003c >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000f >[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0xf - api_rpcTNP: rpc command: SRV_NET_SHARE_ENUM_ALL >[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[2].fn == e0e30 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_share_enum >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 00817304 >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00001e srv_io_srv_share_ctr share_ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 info_level: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 switch_value: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 ptr_share_info: 09cfddf8 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 002c num_entries: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 ptr_entries: 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 preferred_len: ffffffff >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000038 smb_io_enum_hnd enum_hnd >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 ptr_hnd: 00000000 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_enum_all(1357) > _srv_net_share_enum: 1357 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:init_srv_r_net_share_enum(730) > init_srv_r_net_share_enum: 730 >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:init_srv_share_info_ctr(502) > init_srv_share_info_ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: users 0 Links to all the user's home directories >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: hosts 0 Links to other file servers in the same NIS domain. >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: public 0 Here are files for public consumption >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: doc-grp 0 /corp/doc/group -- Group Only Share >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: doc-pub 0 /corp/doc/public -- Publicly Readable Share >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: doc-web 0 /corp/doc/public_html -- Group's webspace >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: hradm-grp 0 /u/hradm/group -- Group Only Share >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: hradm-pub 0 /u/hradm/public -- Publicly Readable Share >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: hradm-web 0 /u/hradm/public_html -- Group's webspace >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: it-grp 0 /corp/it/group -- Group Only Share >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: it-pub 0 /corp/it/public -- Publicly Readable Share >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: OracleImp 0 ES Group Oracle Implementation >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: Q-Train 0 Quality Trainer >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: IPC$ 3 IPC Service (Carp -- a test instance of Corp) >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: ADMIN$ 3 IPC Service (Carp -- a test instance of Corp) >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142) > init_srv_share_info1: gaa 0 My Corporate Directory >[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101) > init_srv_share_info1_str >[2005/02/17 12:16:09, 5] rpc_parse/parse_misc.c:init_enum_hnd(171) > smb_io_enum_hnd >[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_enum_all(1369) > _srv_net_share_enum: 1369 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_share_enum >[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_srv_share_ctr share_ctr >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 info_level: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 switch_value: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 ptr_share_info: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c num_entries: 00000010 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_entries: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 num_entries2: 00000010 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000018 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 002c ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000030 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00003c srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0044 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000048 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0048 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000054 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0058 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 005c ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000060 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0060 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0064 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0068 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00006c srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 006c ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0070 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0074 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000078 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0078 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 007c type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0080 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000084 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0084 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0088 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 008c ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000090 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0090 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0094 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0098 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00009c srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 009c ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00a0 type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00a4 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0000a8 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00a8 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00ac type : 00000000 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00b0 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0000b4 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00b4 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00b8 type : 00000003 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00bc ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0000c0 srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00c0 ptr_netname: 00000001 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00c4 type : 00000003 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00c8 ptr_remark : 00000001 >[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0000cc srv_io_share_info1 >[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00cc ptr_netname: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00d0 type : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00d4 ptr_remark : 00000001 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0000d8 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0000d8 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00d8 uni_max_len: 00000006 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00dc offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00e0 uni_str_len: 00000006 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 00e4 buffer : u.s.e.r.s... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0000f0 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00f0 uni_max_len: 00000029 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00f4 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 00f8 uni_str_len: 00000029 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 00fc buffer : L.i.n.k.s. .t.o. .a.l.l. .t.h.e. .u.s.e.r.'.s. .h.o.m.e. .d.i.r.e.c.t.o.r.i.e.s... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00014e srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000150 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0150 uni_max_len: 00000006 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0154 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0158 uni_str_len: 00000006 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 015c buffer : h.o.s.t.s... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000168 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0168 uni_max_len: 00000034 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 016c offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0170 uni_str_len: 00000034 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0174 buffer : L.i.n.k.s. .t.o. .o.t.h.e.r. .f.i.l.e. .s.e.r.v.e.r.s. .i.n. .t.h.e. .s.a.m.e. .N.I.S. .d.o.m.a.i.n..... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0001dc srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0001dc smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 01dc uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 01e0 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 01e4 uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 01e8 buffer : p.u.b.l.i.c... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0001f8 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 01f8 uni_max_len: 00000026 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 01fc offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0200 uni_str_len: 00000026 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0204 buffer : H.e.r.e. .a.r.e. .f.i.l.e.s. .f.o.r. .p.u.b.l.i.c. .c.o.n.s.u.m.p.t.i.o.n... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000250 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000250 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0250 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0254 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0258 uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 025c buffer : d.o.c.-.g.r.p... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 00026c smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 026c uni_max_len: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0270 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0274 uni_str_len: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0278 buffer : /.c.o.r.p./.d.o.c./.g.r.o.u.p. .-.-. .G.r.o.u.p. .O.n.l.y. .S.h.a.r.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0002c0 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0002c0 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 02c0 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 02c4 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 02c8 uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 02cc buffer : d.o.c.-.p.u.b... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0002dc smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 02dc uni_max_len: 0000002c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 02e0 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 02e4 uni_str_len: 0000002c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 02e8 buffer : /.c.o.r.p./.d.o.c./.p.u.b.l.i.c. .-.-. .P.u.b.l.i.c.l.y. .R.e.a.d.a.b.l.e. .S.h.a.r.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000340 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000340 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0340 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0344 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0348 uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 034c buffer : d.o.c.-.w.e.b... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 00035c smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 035c uni_max_len: 0000002a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0360 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0364 uni_str_len: 0000002a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0368 buffer : /.c.o.r.p./.d.o.c./.p.u.b.l.i.c._.h.t.m.l. .-.-. .G.r.o.u.p.'.s. .w.e.b.s.p.a.c.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0003bc srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0003bc smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 03bc uni_max_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 03c0 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 03c4 uni_str_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 03c8 buffer : h.r.a.d.m.-.g.r.p... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0003dc smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 03dc uni_max_len: 00000023 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 03e0 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 03e4 uni_str_len: 00000023 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 03e8 buffer : /.u./.h.r.a.d.m./.g.r.o.u.p. .-.-. .G.r.o.u.p. .O.n.l.y. .S.h.a.r.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00042e srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000430 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0430 uni_max_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0434 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0438 uni_str_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 043c buffer : h.r.a.d.m.-.p.u.b... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000450 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0450 uni_max_len: 0000002b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0454 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0458 uni_str_len: 0000002b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 045c buffer : /.u./.h.r.a.d.m./.p.u.b.l.i.c. .-.-. .P.u.b.l.i.c.l.y. .R.e.a.d.a.b.l.e. .S.h.a.r.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0004b2 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0004b4 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 04b4 uni_max_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 04b8 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 04bc uni_str_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 04c0 buffer : h.r.a.d.m.-.w.e.b... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0004d4 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 04d4 uni_max_len: 00000029 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 04d8 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 04dc uni_str_len: 00000029 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 04e0 buffer : /.u./.h.r.a.d.m./.p.u.b.l.i.c._.h.t.m.l. .-.-. .G.r.o.u.p.'.s. .w.e.b.s.p.a.c.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000532 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000534 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0534 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0538 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 053c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0540 buffer : i.t.-.g.r.p... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000550 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0550 uni_max_len: 00000023 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0554 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0558 uni_str_len: 00000023 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 055c buffer : /.c.o.r.p./.i.t./.g.r.o.u.p. .-.-. .G.r.o.u.p. .O.n.l.y. .S.h.a.r.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0005a2 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0005a4 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 05a4 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 05a8 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 05ac uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 05b0 buffer : i.t.-.p.u.b... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0005c0 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 05c0 uni_max_len: 0000002b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 05c4 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 05c8 uni_str_len: 0000002b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 05cc buffer : /.c.o.r.p./.i.t./.p.u.b.l.i.c. .-.-. .P.u.b.l.i.c.l.y. .R.e.a.d.a.b.l.e. .S.h.a.r.e... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000622 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000624 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0624 uni_max_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0628 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 062c uni_str_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0630 buffer : O.r.a.c.l.e.I.m.p... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000644 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0644 uni_max_len: 0000001f >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0648 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 064c uni_str_len: 0000001f >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0650 buffer : E.S. .G.r.o.u.p. .O.r.a.c.l.e. .I.m.p.l.e.m.e.n.t.a.t.i.o.n... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00068e srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000690 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0690 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0694 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0698 uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 069c buffer : Q.-.T.r.a.i.n... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0006ac smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06ac uni_max_len: 00000010 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06b0 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06b4 uni_str_len: 00000010 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 06b8 buffer : Q.u.a.l.i.t.y. .T.r.a.i.n.e.r... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0006d8 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0006d8 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06d8 uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06dc offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06e0 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 06e4 buffer : I.P.C.$... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0006f0 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06f0 uni_max_len: 0000002e >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06f4 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 06f8 uni_str_len: 0000002e >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 06fc buffer : I.P.C. .S.e.r.v.i.c.e. .(.C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p.)... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000758 srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000758 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0758 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 075c offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0760 uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0764 buffer : A.D.M.I.N.$... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000774 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0774 uni_max_len: 0000002e >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0778 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 077c uni_str_len: 0000002e >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0780 buffer : I.P.C. .S.e.r.v.i.c.e. .(.C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p.)... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 0007dc srv_io_share_info1_str >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0007dc smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 07dc uni_max_len: 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 07e0 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 07e4 uni_str_len: 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 07e8 buffer : g.a.a... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 0007f0 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 07f0 uni_max_len: 00000017 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 07f4 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 07f8 uni_str_len: 00000017 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 07fc buffer : M.y. .C.o.r.p.o.r.a.t.e. .D.i.r.e.c.t.o.r.y... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 082c total_entries: 00000010 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000830 smb_io_enum_hnd enum_hnd >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0830 ptr_hnd: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0834 status: WERR_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 2248 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 68 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7437 name: srvsvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 2104. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0850 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000838 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:send_trans_reply(89) > send_trans_reply: buffer 1024 too large >[2005/02/17 12:16:10, 3] smbd/error.c:error_packet(129) > error packet at smbd/ipc.c(97) cmd=37 (SMBtrans) STATUS_BUFFER_OVERFLOW >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..1024] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=1080 > smb_com=0x25 > smb_rcls=5 > smb_reh=0 > smb_err=32768 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=54848 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 1024 (0x400) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 1024 (0x400) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=1025 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 50 08 00 00 01 00 00 ........ .P...... > [010] 00 38 08 00 00 00 00 00 00 01 00 00 00 01 00 00 .8...... ........ > [020] 00 01 00 00 00 10 00 00 00 01 00 00 00 10 00 00 ........ ........ > [030] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [040] 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 ........ ........ > [050] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [060] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [070] 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 ........ ........ > [080] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [090] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [0A0] 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 ........ ........ > [0B0] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [0C0] 00 01 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [0D0] 00 03 00 00 00 01 00 00 00 01 00 00 00 03 00 00 ........ ........ > [0E0] 00 01 00 00 00 01 00 00 00 00 00 00 00 01 00 00 ........ ........ > [0F0] 00 06 00 00 00 00 00 00 00 06 00 00 00 75 00 73 ........ .....u.s > [100] 00 65 00 72 00 73 00 00 00 29 00 00 00 00 00 00 .e.r.s.. .)...... > [110] 00 29 00 00 00 4C 00 69 00 6E 00 6B 00 73 00 20 .)...L.i .n.k.s. > [120] 00 74 00 6F 00 20 00 61 00 6C 00 6C 00 20 00 74 .t.o. .a .l.l. .t > [130] 00 68 00 65 00 20 00 75 00 73 00 65 00 72 00 27 .h.e. .u .s.e.r.' > [140] 00 73 00 20 00 68 00 6F 00 6D 00 65 00 20 00 64 .s. .h.o .m.e. .d > [150] 00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 69 .i.r.e.c .t.o.r.i > [160] 00 65 00 73 00 00 00 00 00 06 00 00 00 00 00 00 .e.s.... ........ > [170] 00 06 00 00 00 68 00 6F 00 73 00 74 00 73 00 00 .....h.o .s.t.s.. > [180] 00 34 00 00 00 00 00 00 00 34 00 00 00 4C 00 69 .4...... .4...L.i > [190] 00 6E 00 6B 00 73 00 20 00 74 00 6F 00 20 00 6F .n.k.s. .t.o. .o > [1A0] 00 74 00 68 00 65 00 72 00 20 00 66 00 69 00 6C .t.h.e.r . .f.i.l > [1B0] 00 65 00 20 00 73 00 65 00 72 00 76 00 65 00 72 .e. .s.e .r.v.e.r > [1C0] 00 73 00 20 00 69 00 6E 00 20 00 74 00 68 00 65 .s. .i.n . .t.h.e > [1D0] 00 20 00 73 00 61 00 6D 00 65 00 20 00 4E 00 49 . .s.a.m .e. .N.I > [1E0] 00 53 00 20 00 64 00 6F 00 6D 00 61 00 69 00 6E .S. .d.o .m.a.i.n > [1F0] 00 2E 00 00 00 07 00 00 00 00 00 00 00 07 00 00 ........ ........ >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,1084) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,1084) wrote 1084 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 59 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x3b >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 67 of length 63 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=59 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54912 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]=29751 (0x7437) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1104 (0x450) > smb_vwv[ 6]= 1104 (0x450) > smb_vwv[ 7]=65535 (0xFFFF) > smb_vwv[ 8]=65535 (0xFFFF) > smb_vwv[ 9]= 1104 (0x450) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBreadX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7437 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7437 (pipes_open=1) >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7437 name: srvsvc len: 1104 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 2128, current_pdu_sent = 1024 returning 1104 bytes. >[2005/02/17 12:16:10, 3] smbd/pipes.c:reply_pipe_read_and_X(242) > readX-IPC pnum=7437 min=1104 max=1104 nread=1104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=1163 > smb_com=0x2e > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54912 > smt_wct=12 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 1104 (0x450) > smb_vwv[ 6]= 59 (0x3B) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_bcc=1104 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 2F 00 75 00 2F 00 68 00 72 00 61 00 64 00 6D 00 /.u./.h. r.a.d.m. > [010] 2F 00 67 00 72 00 6F 00 75 00 70 00 20 00 2D 00 /.g.r.o. u.p. .-. > [020] 2D 00 20 00 47 00 72 00 6F 00 75 00 70 00 20 00 -. .G.r. o.u.p. . > [030] 4F 00 6E 00 6C 00 79 00 20 00 53 00 68 00 61 00 O.n.l.y. .S.h.a. > [040] 72 00 65 00 00 00 00 00 0A 00 00 00 00 00 00 00 r.e..... ........ > [050] 0A 00 00 00 68 00 72 00 61 00 64 00 6D 00 2D 00 ....h.r. a.d.m.-. > [060] 70 00 75 00 62 00 00 00 2B 00 00 00 00 00 00 00 p.u.b... +....... > [070] 2B 00 00 00 2F 00 75 00 2F 00 68 00 72 00 61 00 +.../.u. /.h.r.a. > [080] 64 00 6D 00 2F 00 70 00 75 00 62 00 6C 00 69 00 d.m./.p. u.b.l.i. > [090] 63 00 20 00 2D 00 2D 00 20 00 50 00 75 00 62 00 c. .-.-. .P.u.b. > [0A0] 6C 00 69 00 63 00 6C 00 79 00 20 00 52 00 65 00 l.i.c.l. y. .R.e. > [0B0] 61 00 64 00 61 00 62 00 6C 00 65 00 20 00 53 00 a.d.a.b. l.e. .S. > [0C0] 68 00 61 00 72 00 65 00 00 00 00 00 0A 00 00 00 h.a.r.e. ........ > [0D0] 00 00 00 00 0A 00 00 00 68 00 72 00 61 00 64 00 ........ h.r.a.d. > [0E0] 6D 00 2D 00 77 00 65 00 62 00 00 00 29 00 00 00 m.-.w.e. b...)... > [0F0] 00 00 00 00 29 00 00 00 2F 00 75 00 2F 00 68 00 ....)... /.u./.h. > [100] 72 00 61 00 64 00 6D 00 2F 00 70 00 75 00 62 00 r.a.d.m. /.p.u.b. > [110] 6C 00 69 00 63 00 5F 00 68 00 74 00 6D 00 6C 00 l.i.c._. h.t.m.l. > [120] 20 00 2D 00 2D 00 20 00 47 00 72 00 6F 00 75 00 .-.-. . G.r.o.u. > [130] 70 00 27 00 73 00 20 00 77 00 65 00 62 00 73 00 p.'.s. . w.e.b.s. > [140] 70 00 61 00 63 00 65 00 00 00 00 00 07 00 00 00 p.a.c.e. ........ > [150] 00 00 00 00 07 00 00 00 69 00 74 00 2D 00 67 00 ........ i.t.-.g. > [160] 72 00 70 00 00 00 00 00 23 00 00 00 00 00 00 00 r.p..... #....... > [170] 23 00 00 00 2F 00 63 00 6F 00 72 00 70 00 2F 00 #.../.c. o.r.p./. > [180] 69 00 74 00 2F 00 67 00 72 00 6F 00 75 00 70 00 i.t./.g. r.o.u.p. > [190] 20 00 2D 00 2D 00 20 00 47 00 72 00 6F 00 75 00 .-.-. . G.r.o.u. > [1A0] 70 00 20 00 4F 00 6E 00 6C 00 79 00 20 00 53 00 p. .O.n. l.y. .S. > [1B0] 68 00 61 00 72 00 65 00 00 00 00 00 07 00 00 00 h.a.r.e. ........ > [1C0] 00 00 00 00 07 00 00 00 69 00 74 00 2D 00 70 00 ........ i.t.-.p. > [1D0] 75 00 62 00 00 00 00 00 2B 00 00 00 00 00 00 00 u.b..... +....... > [1E0] 2B 00 00 00 2F 00 63 00 6F 00 72 00 70 00 2F 00 +.../.c. o.r.p./. > [1F0] 69 00 74 00 2F 00 70 00 75 00 62 00 6C 00 69 00 i.t./.p. u.b.l.i. >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,1167) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,1167) wrote 1167 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 68 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54976 > smt_wct=3 > smb_vwv[ 0]=29751 (0x7437) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7437 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=7437 (pipes_open=1) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7437 >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=7437 (pipes_open=0) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=54976 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 69 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55040 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 66 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 f\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 7438 (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7438 >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55040 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=14336 (0x3800) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 102 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x66 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 70 of length 106 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=102 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55105 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 4096 (0x1000) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=19 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] A0 5C 00 73 00 70 00 6F 00 6F 00 6C 00 73 00 73 .\.s.p.o .o.l.s.s > [010] 00 00 00 ... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \spoolss. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe spoolss opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested spoolss (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205) > open_rpc_pipe_p: name wkssvc pnum=7438 >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested spoolss >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe spoolss >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe spoolss >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe spoolss (pipes_open=1) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe spoolss with handle 7439 (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name spoolss pnum=7439 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=7438 >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \spoolss >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55105 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=14592 (0x3900) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 71 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55168 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29752 (0x7438) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7438 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=7439 (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7438 (pipes_open=2) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7438) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7438 name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7438 name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55168 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 72 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55233 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29753 (0x7439) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xV4.4.. ....#Eg. > [040] AB 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7439 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=7439 (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7438 (pipes_open=2) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 7439) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2e5878 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7439 name: spoolss open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\spoolss -> \PIPE\spoolss >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 12345678 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1234 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : abcd >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : ef 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 01 23 45 67 89 ab >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\spoolss >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000e >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\spoolss. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000018 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7439 name: spoolss len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55233 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0E 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 73 70 6F 6F 6C 73 73 00 01 00 00 00 00 00 00 \spoolss ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 73 of length 148 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55296 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29752 (0x7438) > smb_bcc=77 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 1C 8B CF 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7438 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=7439 (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7438 (pipes_open=2) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 7438) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7438 name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09cf8b1c >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7438 name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55296 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 268 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x10c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 74 of length 272 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=268 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55361 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 184 (0xB8) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 184 (0xB8) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29753 (0x7439) > smb_bcc=201 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 00 03 10 00 00 00 B8 00 00 00 01 00 00 ........ ........ > [020] 00 A0 00 00 00 00 00 45 00 30 24 EC 00 07 00 00 .......E .0$..... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 00 00 00 00 00 00 00 .r.p.... ........ > [050] 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ > [060] 00 A0 F7 86 05 1C 00 00 00 C8 45 EB 00 8C F5 86 ........ ..E..... > [070] 05 93 08 00 00 03 00 00 00 00 00 00 00 00 00 00 ........ ........ > [080] 00 0A 00 00 00 00 00 00 00 0A 00 00 00 5C 00 5C ........ .....\.\ > [090] 00 41 00 5A 00 55 00 52 00 49 00 54 00 45 00 00 .A.Z.U.R .I.T.E.. > [0A0] 00 0E 00 00 00 00 00 00 00 0E 00 00 00 41 00 64 ........ .....A.d > [0B0] 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 .m.i.n.i .s.t.r.a > [0C0] 00 74 00 6F 00 72 00 00 00 .t.o.r.. . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=184 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7439 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=7439 (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7438 (pipes_open=2) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 7439) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2e5878 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7439 name: spoolss open: Yes len: 184 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 184 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 184 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 184, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 168 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 168 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 168 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 168, incoming data = 168 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 000000a0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0045 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[1].fn == e7aac >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_open_printer_ex >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 printername_ptr: 00ec2430 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 spoolss_io_printer_default >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 datatype_ptr: 00000000 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_unistr2 - NULL datatype >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 spoolss_io_devmode_cont >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 size: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 devmode_ptr: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 002c access_required: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 user_switch: 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000034 spool_io_user_level >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 level: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 ptr: 0586f7a0 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c size: 0000001c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 client_name_ptr: 00eb45c8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0044 user_name_ptr: 0586f58c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0048 build: 00000893 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 004c major: 00000003 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0050 minor: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0054 processor: 00000000 >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000058 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0058 uni_max_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 005c offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0060 uni_str_len: 0000000a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0064 buffer : \.\.A.Z.U.R.I.T.E... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000078 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0078 uni_max_len: 0000000e >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 007c offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0080 uni_str_len: 0000000e >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0084 buffer : A.d.m.i.n.i.s.t.r.a.t.o.r... > checking name: \\carp >[2005/02/17 12:16:10, 10] rpc_server/srv_spoolss_nt.c:open_printer_hnd(607) > open_printer_hnd: name [\\carp] >[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) > Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5A D1 14 42 ........ ....Z..B > [010] 71 35 00 00 q5.. >[2005/02/17 12:16:10, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469) > Setting printer type=\\carp > Printer is a print server >[2005/02/17 12:16:10, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505) > Setting printer name=\\carp (len=6) >[2005/02/17 12:16:10, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642) > 1 printer handles active >[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5A D1 14 42 ........ ....Z..B > [010] 71 35 00 00 q5.. >[2005/02/17 12:16:10, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734) > Setting print server access = SERVER_ACCESS_ENUMERATE >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_open_printer_ex >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 01000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 5a d1 14 42 71 35 00 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status code: WERR_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 62 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 168 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7439 name: spoolss len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55361 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 01 00 00 00 00 5A D1 14 42 71 35 00 00 00 00 00 .....Z.. Bq5..... > [030] 00 . >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,108) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,108) wrote 108 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 75 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=55424 > smt_wct=3 > smb_vwv[ 0]=29752 (0x7438) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7438 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=7439 (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=7438 (pipes_open=2) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7438 >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=7438 (pipes_open=1) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=55424 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 128 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x80 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 76 of length 132 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55489 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 44 (0x2C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 44 (0x2C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29753 (0x7439) > smb_bcc=61 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 02 00 00 ........ .,...... > [020] 00 14 00 00 00 00 00 1D 00 00 00 00 00 00 00 00 ........ ........ > [030] 01 00 00 00 00 5A D1 14 42 71 35 00 00 .....Z.. Bq5.. >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=44 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7439 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=7439 (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "spoolss" (pnum 7439) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2e5878 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7439 name: spoolss open: Yes len: 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 28 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 002c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 28 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28, incoming data = 28 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000014 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 001d >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\spoolss >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[3].fn == e7f84 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_q_closeprinter >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 01000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 5a d1 14 42 71 35 00 00 >[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5A D1 14 42 ........ ....Z..B > [010] 71 35 00 00 q5.. >[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5A D1 14 42 ........ ....Z..B > [010] 71 35 00 00 q5.. >[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 5A D1 14 42 ........ ....Z..B > [010] 71 35 00 00 q5.. >[2005/02/17 12:16:10, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) > Closed policy >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 spoolss_io_r_closeprinter >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd printer handle >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 00 00 00 00 00 00 00 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status: WERR_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called spoolss successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 28 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7439 name: spoolss len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=528 > smb_uid=100 > smb_mid=55489 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [030] 00 . >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,108) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,108) wrote 108 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 77 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55552 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205) > open_rpc_pipe_p: name spoolss pnum=7439 >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=1) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 743a (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=743a >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name spoolss pnum=7439 >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55552 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=14848 (0x3A00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 78 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=55617 > smt_wct=3 > smb_vwv[ 0]=29753 (0x7439) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7439 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743a (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name spoolss pnum=7439 (pipes_open=2) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:7439 >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe spoolss >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name spoolss pnum=7439 (pipes_open=1) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=55617 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 79 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55680 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29754 (0x743A) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743a >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743a (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 743a) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743a name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743a name: srvsvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55680 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 80 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55745 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205) > open_rpc_pipe_p: name srvsvc pnum=743a >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=1) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 743b (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=743b >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=743a >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55745 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=15104 (0x3B00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 81 of length 148 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55808 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29754 (0x743A) > smb_bcc=77 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 1C 8B CF 09 07 00 00 .$...... ........ > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743a >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743a (pipes_open=2) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 743a) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743a name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09cf8b1c >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743a name: srvsvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55808 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 82 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55873 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29755 (0x743B) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743b >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743a (pipes_open=2) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 743b) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2f2be8 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743b name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743b name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=55873 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 83 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=55936 > smt_wct=3 > smb_vwv[ 0]=29754 (0x743A) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743a >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743a (pipes_open=2) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:743a >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=743a (pipes_open=1) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=55936 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 84 of length 148 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56001 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29755 (0x743B) > smb_bcc=77 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 40 F6 C3 09 07 00 00 .$...... .@...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743b >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 743b) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2f2be8 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743b name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09c3f640 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743b name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56001 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 85 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56064 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205) > open_rpc_pipe_p: name wkssvc pnum=743b >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 2 for pipe wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=1) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 743c (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=743c >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=743b >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56064 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=15360 (0x3C00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 86 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56129 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205) > open_rpc_pipe_p: name wkssvc pnum=743c >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205) > open_rpc_pipe_p: name wkssvc pnum=743b >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=2) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 743d (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=743d >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=743c >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=743b >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56129 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=15616 (0x3D00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 87 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56192 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29756 (0x743C) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 02 00 00 ........ .H...... > [020] 00 B8 10 B8 10 F0 53 00 00 01 00 00 00 00 00 01 ......S. ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743c >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743d (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743c (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=3) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 743c) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743c name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743c name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56192 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 02 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 88 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56257 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29757 (0x743D) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743d >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743d (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743c (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=3) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 743d) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2e5878 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743d name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743d name: srvsvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56257 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 89 of length 148 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56320 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29756 (0x743C) > smb_bcc=77 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 02 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 20 8B CF 09 07 00 00 .$...... . ...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743c >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743d (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743c (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=3) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 743c) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743c name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09cf8b20 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743c name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56320 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 02 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 90 of length 148 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56385 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29757 (0x743D) > smb_bcc=77 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 30 .\.P.I.P .E.\...0 > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 40 F6 C3 09 07 00 00 .$...... .@...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743d >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743d (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743c (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=3) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 743d) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2e5878 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743d name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09c3f640 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743d name: srvsvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56385 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 91 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56448 > smt_wct=3 > smb_vwv[ 0]=29755 (0x743B) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743b >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743d (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743c (pipes_open=3) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743b (pipes_open=3) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:743b >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=743b (pipes_open=2) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56448 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 92 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56513 > smt_wct=3 > smb_vwv[ 0]=29757 (0x743D) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743d >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743d (pipes_open=2) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743c (pipes_open=2) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:743d >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=743d (pipes_open=1) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56513 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 93 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56576 > smt_wct=3 > smb_vwv[ 0]=29756 (0x743C) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743c >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743c (pipes_open=1) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:743c >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=743c (pipes_open=0) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56576 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 94 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56640 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 256 (0x100) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 6B 00 73 00 73 00 76 00 63 00 00 .\.w.k.s .s.v.c.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \wkssvc. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe wkssvc opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested wkssvc (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested wkssvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe wkssvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe wkssvc (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe wkssvc with handle 743e (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name wkssvc pnum=743e >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \wkssvc >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56640 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=15872 (0x3E00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 95 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56704 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29758 (0x743E) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 ....k... 6.3F..~4 > [040] 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 Z.....]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743e >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743e (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 743e) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743e name: wkssvc open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 6bffd098 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : a112 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 3610 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 98 33 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 46 c3 f8 7e 34 5a >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\wkssvc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743e name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56704 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 96 of length 148 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56768 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29758 (0x743E) > smb_bcc=77 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 00 00 40 F6 C3 09 07 00 00 .$...... .@...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 64 00 00 00 .r.p.... .d... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743e >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743e (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "wkssvc" (pnum 743e) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743e name: wkssvc open: Yes len: 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0000 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[0].fn == dc5e4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_q_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name: 09c3f640 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0020 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66) > _wks_query_info: 66 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40) > create_wks_info_100: 40 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79) > Init WKS_INFO_100: 79 >[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139) > init_wks_r_unknown_0: 139 >[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76) > _wks_query_info: 76 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 wks_io_r_query_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 switch_value: 0064 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_1 : 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 wks_io_wks_info_100 inf >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_compname: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ptr_lan_grp : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_major : 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 ver_minor : 00000009 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : C.A.R.P... >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000034 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 uni_max_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c uni_str_len: 00000008 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0040 buffer : U.L.T.I.C.O.M... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672) > 0050 status : NT_STATUS_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called wkssvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 92 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743e name: wkssvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 006c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000054 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..108] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56768 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 01 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 64 00 00 00 01 00 00 .T...... .d...... > [020] 00 F4 01 00 00 01 00 00 00 01 00 00 00 04 00 00 ........ ........ > [030] 00 09 00 00 00 05 00 00 00 00 00 00 00 05 00 00 ........ ........ > [040] 00 43 00 41 00 52 00 50 00 00 00 00 00 08 00 00 .C.A.R.P ........ > [050] 00 00 00 00 00 08 00 00 00 55 00 4C 00 54 00 49 ........ .U.L.T.I > [060] 00 43 00 4F 00 4D 00 00 00 00 00 00 00 .C.O.M.. ..... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,168) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,168) wrote 168 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 97 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56832 > smt_wct=3 > smb_vwv[ 0]=29758 (0x743E) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743e >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name wkssvc pnum=743e (pipes_open=1) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:743e >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe wkssvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name wkssvc pnum=743e (pipes_open=0) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=56832 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 98 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56896 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]=16384 (0x4000) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 256 (0x100) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 73 00 72 00 76 00 73 00 76 00 63 00 00 .\.s.r.v .s.v.c.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \srvsvc. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe srvsvc opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested srvsvc (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested srvsvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe srvsvc >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe srvsvc (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe srvsvc with handle 743f (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name srvsvc pnum=743f >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \srvsvc >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56896 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=16128 (0x3F00) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 99 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56960 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29759 (0x743F) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 ..O2Kp.. ..xZG.n. > [040] 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743f >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743f (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 743f) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743f name: srvsvc open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 4b324fc8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 1670 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 01d3 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : 12 78 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 5a 47 bf 6e e1 88 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000003 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\srvsvc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\ntsvcs. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743f name: srvsvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=56960 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6E 74 73 76 63 73 00 00 01 00 00 00 00 00 00 \ntsvcs. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_nt_user_token(486) > NT user token: (NULL) >[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 0 > Primary group is 0 and contains 0 supplementary groups >[2005/02/17 12:16:10, 5] smbd/uid.c:change_to_root_user(296) > change_to_root_user: now uid=(0,0) gid=(0,0) >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 144 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x90 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 100 of length 148 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57024 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 60 (0x3C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 60 (0x3C) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29759 (0x743F) > smb_bcc=77 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 3C 00 00 00 01 00 00 ........ .<...... > [020] 00 24 00 00 00 00 00 15 00 40 F6 C3 09 07 00 00 .$...... .@...... > [030] 00 00 00 00 00 07 00 00 00 5C 00 5C 00 63 00 61 ........ .\.\.c.a > [040] 00 72 00 70 00 00 00 00 00 65 00 00 00 .r.p.... .e... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 3] smbd/sec_ctx.c:set_sec_ctx(288) > setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0 >[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_nt_user_token(491) > NT user token of user S-1-5-21-104134243-2275341451-782570472-1804 > contains 10 SIDs > SID[ 0]: S-1-5-21-104134243-2275341451-782570472-1804 > SID[ 1]: S-1-5-21-104134243-2275341451-782570472-3205 > SID[ 2]: S-1-1-0 > SID[ 3]: S-1-5-2 > SID[ 4]: S-1-5-11 > SID[ 5]: S-1-5-21-3834718897-2476707436-3842496652-1203 > SID[ 6]: S-1-5-21-3834718897-2476707436-3842496652-1021 > SID[ 7]: S-1-5-21-3834718897-2476707436-3842496652-1227 > SID[ 8]: S-1-5-21-3834718897-2476707436-3842496652-3205 > SID[ 9]: S-1-5-21-3834718897-2476707436-3842496652-3277 > SE_PRIV 0x0 0x0 0x0 0x0 >[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_unix_user_token(507) > UNIX token of user 402 > Primary group is 101 and contains 5 supplementary groups > Group[ 0]: 101 > Group[ 1]: 10 > Group[ 2]: 113 > Group[ 3]: 1102 > Group[ 4]: 1138 >[2005/02/17 12:16:10, 5] smbd/uid.c:change_to_user(281) > change_to_user uid=(0,402) gid=(0,101) >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=60 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743f >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743f (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "srvsvc" (pnum 743f) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 743f name: srvsvc open: Yes len: 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 003c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0015 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[10].fn == e0a54 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_q_net_srv_get_info >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr_srv_name : 09c3f640 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000004 smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 uni_max_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c uni_str_len: 00000007 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0010 buffer : \.\.c.a.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 switch_value : 00000065 >[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213) > srv_net_srv_get_info: 1213 >[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736) > init_srv_info_101 >[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971) > init_srv_r_net_srv_get_info >[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258) > srv_net_srv_get_info: 1258 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_r_net_srv_get_info >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 srv_io_info_ctr ctr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 switch_value: 00000065 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 ptr_srv_ctr : 00000001 >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000008 srv_io_info_101 sv101 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 platform_id : 000001f4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c ptr_name : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 ver_major : 00000004 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0014 ver_minor : 00000009 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 srv_type : 00009a03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c ptr_comment : 00000001 >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_unistr2 uni_name >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 uni_max_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0028 uni_str_len: 00000005 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 002c buffer : C.A.R.P... >[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82) > 000036 smb_io_unistr2 uni_comment >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0038 uni_max_len: 00000020 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 003c offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0040 uni_str_len: 00000020 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0044 buffer : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0084 status: WERR_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called srvsvc successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 196 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 44 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 743f name: srvsvc len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 00a0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000088 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..160] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=216 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57024 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 160 (0xA0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 160 (0xA0) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=161 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ > [010] 00 88 00 00 00 00 00 00 00 65 00 00 00 01 00 00 ........ .e...... > [020] 00 F4 01 00 00 01 00 00 00 04 00 00 00 09 00 00 ........ ........ > [030] 00 03 9A 00 00 01 00 00 00 05 00 00 00 00 00 00 ........ ........ > [040] 00 05 00 00 00 43 00 41 00 52 00 50 00 00 00 00 .....C.A .R.P.... > [050] 00 20 00 00 00 00 00 00 00 20 00 00 00 43 00 61 . ...... . ...C.a > [060] 00 72 00 70 00 20 00 2D 00 2D 00 20 00 61 00 20 .r.p. .- .-. .a. > [070] 00 74 00 65 00 73 00 74 00 20 00 69 00 6E 00 73 .t.e.s.t . .i.n.s > [080] 00 74 00 61 00 6E 00 63 00 65 00 20 00 6F 00 66 .t.a.n.c .e. .o.f > [090] 00 20 00 43 00 6F 00 72 00 70 00 00 00 00 00 00 . .C.o.r .p...... > [0A0] 00 . >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,220) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,220) wrote 220 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 41 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x29 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 101 of length 45 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=41 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=57088 > smt_wct=3 > smb_vwv[ 0]=29759 (0x743F) > smb_vwv[ 1]=65535 (0xFFFF) > smb_vwv[ 2]=65535 (0xFFFF) > smb_bcc=0 >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBclose (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=743f >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name srvsvc pnum=743f (pipes_open=1) >[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260) > reply_pipe_close: pnum:743f >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) > close_policy_by_pipe: deleted handle list for pipe srvsvc >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081) > closed pipe name srvsvc pnum=743f (pipes_open=0) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=65279 > smb_uid=100 > smb_mid=57088 > smt_wct=0 > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,39) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,39) wrote 39 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 100 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x64 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 102 of length 104 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=100 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57152 > smt_wct=24 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]=57054 (0xDEDE) > smb_vwv[ 2]= 3584 (0xE00) > smb_vwv[ 3]= 5632 (0x1600) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]=40704 (0x9F00) > smb_vwv[ 8]= 513 (0x201) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 768 (0x300) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 256 (0x100) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]=16384 (0x4000) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]= 512 (0x200) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 768 (0x300) > smb_bcc=17 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 77 00 69 00 6E 00 72 00 65 00 67 00 00 .\.w.i.n .r.e.g.. > [010] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBntcreateX (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607) > reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0 >[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497) > nt_open_pipe: Opening pipe \winreg. >[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514) > nt_open_pipe: Known pipe winreg opening. >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178) > Open pipe requested winreg (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278) > Create pipe requested winreg >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) > init_pipe_handles: created handle list for pipe winreg >[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) > init_pipe_handles: pipe_handles ref count = 1 for pipe winreg >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370) > Created internal pipe winreg (pipes_open=0) >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257) > Opened pipe winreg with handle 7440 (pipes_open=1) >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) > open pipes: name winreg pnum=7440 >[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562) > do_ntcreate_pipe_open: open pipe = \winreg >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57152 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=16384 (0x4000) > smb_vwv[ 3]= 372 (0x174) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,107) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,107) wrote 107 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 156 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x9c >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 103 of length 160 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=156 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57216 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29760 (0x7440) > smb_bcc=89 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... > [020] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ > [030] 00 01 D0 8C 33 44 22 F1 31 AA AA 90 00 38 00 10 ....3D". 1....8.. > [040] 03 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ > [050] 00 2B 10 48 60 02 00 00 00 .+.H`... . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=72 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7440 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name winreg pnum=7440 (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "winreg" (pnum 7440) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7440 name: winreg open: Yes len: 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0b >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0048 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 11, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 11 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876) > api_pipe_bind_req: decode request. 876 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887) > api_pipe_bind_req: \PIPE\winreg -> \PIPE\winreg >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_rb >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 num_elements: 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000c context_id : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 000e num_syntaxes: 01 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00000f smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 data : 338cd001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 data : 2244 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 data : 31f1 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0018 data : aa aa >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 001a data : 90 00 38 00 10 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 version: 00000001 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000024 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0028 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 002a data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002c data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002e data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0034 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017) > api_pipe_bind_req: make response. 1017 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762) > check_bind_req for \PIPE\winreg >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_ba >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_bba >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0000 max_tsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0002 max_rsize: 10b8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 assoc_gid: 000053f0 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000008 smb_io_rpc_addr_str >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 len: 000d >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000a str: \PIPE\winreg. >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000017 smb_io_rpc_results >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0018 num_results: 01 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001c result : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 001e reason : 0000 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_rpc_iface >[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82) > 000020 smb_io_uuid uuid >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 data : 8a885d04 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0024 data : 1ceb >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0026 data : 11c9 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 0028 data : 9f e8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 002a data : 08 00 2b 10 48 60 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0030 version: 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 0c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0044 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 56 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7440 name: winreg len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968) > read_from_pipe: winreg: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..68] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57216 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0D 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 77 69 6E 72 65 67 00 00 01 00 00 00 00 00 00 \winreg. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,128) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,128) wrote 128 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 120 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0x78 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 104 of length 124 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=120 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57280 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 36 (0x24) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 36 (0x24) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29760 (0x7440) > smb_bcc=53 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 24 00 00 00 01 00 00 ........ .$...... > [020] 00 0C 00 00 00 00 00 02 00 D4 F9 C3 09 F8 B6 00 ........ ........ > [030] 00 00 00 00 02 ..... >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=36 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7440 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name winreg pnum=7440 (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "winreg" (pnum 7440) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7440 name: winreg open: Yes len: 36 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 36 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 36 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 36, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 20 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 20 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0024 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 20 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 20, incoming data = 20 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 0000000c >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 0002 >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\winreg >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: winreg op 0x2 - api_rpcTNP: rpc command: REG_OPEN_HKLM >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[3].fn == d9dac >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 reg_io_q_open_hklm >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 ptr : 09c3f9d4 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 unknown_0: b6f8 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 unknown_1: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0008 access_mask: 02000000 >[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(92) > open_registry_key: name = [NULL][HKLM] >[2005/02/17 12:16:10, 10] registry/reg_cachehook.c:reghook_cache_find(94) > reghook_cache_find: Searching for keyname [/HKLM] >[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(387) > sorted_tree_find: Enter [/HKLM] >[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(459) > sorted_tree_find: Exit >[2005/02/17 12:16:10, 10] registry/reg_db.c:regdb_fetch_reg_keys(245) > regdb_fetch_reg_keys: Enter key => [HKLM] >[2005/02/17 12:16:10, 10] registry/reg_db.c:regdb_fetch_reg_keys(272) > regdb_fetch_reg_keys: Exit [1] items >[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) > Opened policy hnd[1] [000] 00 00 00 00 02 00 00 00 00 00 00 00 5A D1 14 42 ........ ....Z..B > [010] 71 35 00 00 q5.. >[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(164) > open_registry_key: exit >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 reg_io_r_open_hklm >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 02000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 5a d1 14 42 71 35 00 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status: WERR_OK >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called winreg successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 20 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7440 name: winreg len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000001 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57280 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [020] 02 00 00 00 00 5A D1 14 42 71 35 00 00 00 00 00 .....Z.. Bq5..... > [030] 00 . >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449) > write_socket(27,108) >[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452) > write_socket(27,108) wrote 108 >[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505) > got smb length of 228 >[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090) > got message type 0x0 of len 0xe4 >[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091) > Transaction 105 of length 232 >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=228 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=24 > smb_flg2=51207 > smb_tid=1 > smb_pid=1340 > smb_uid=100 > smb_mid=57344 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 144 (0x90) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 84 (0x54) > smb_vwv[11]= 144 (0x90) > smb_vwv[12]= 84 (0x54) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29760 (0x7440) > smb_bcc=161 >[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 6C .\.P.I.P .E.\...l > [010] 00 05 00 00 03 10 00 00 00 90 00 00 00 02 00 00 ........ ........ > [020] 00 78 00 00 00 00 00 0F 00 00 00 00 00 00 00 00 .x...... ........ > [030] 02 00 00 00 00 5A D1 14 42 71 35 00 00 46 00 46 .....Z.. Bq5..F.F > [040] 00 EC 1B C2 6A 23 00 00 00 00 00 00 00 23 00 00 ....j#.. .....#.. > [050] 00 53 00 4F 00 46 00 54 00 57 00 41 00 52 00 45 .S.O.F.T .W.A.R.E > [060] 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F .\.M.i.c .r.o.s.o > [070] 00 66 00 74 00 5C 00 53 00 63 00 68 00 65 00 64 .f.t.\.S .c.h.e.d > [080] 00 75 00 6C 00 69 00 6E 00 67 00 41 00 67 00 65 .u.l.i.n .g.A.g.e > [090] 00 6E 00 74 00 00 00 00 00 00 00 00 00 3F 00 0F .n.t.... .....?.. > [0A0] 00 . >[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886) > switch message SMBtrans (pid 13681) conn 0x2e5138 >[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194) > change_to_user: Skipping user change - already user >[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539) > trans <\PIPE\> data=144 params=0 setup=2 >[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560) > calling named_pipe >[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334) > named pipe command on <> name >[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265) > api_fd_reply >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168) > search for pipe pnum=7440 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172) > pipe name winreg pnum=7440 (pipes_open=1) >[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294) > Got API command 0x26 on pipe "winreg" (pnum 7440) >[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299) > api_fd_reply: p:2ebb78 max_trans_reply: 1024 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852) > write_to_pipe: 7440 name: winreg open: Yes len: 144 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 144 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 144 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399) > fill_rpc_header: data_to_copy = 144, len_needed_to_complete_hdr = 16, receive_len = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 16 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 128 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 128 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0090 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486) > unmarshall_rpc_header: using little-endian RPC >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515) > unmarshall_rpc_header: type = 0, flags = 3 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 0 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874) > write_to_pipe: data_left = 128 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777) > process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 128, incoming data = 128 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720) > process_complete_pdu: processing packet type 0 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr_req req >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 alloc_hint: 00000078 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0004 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0006 opnum : 000f >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 0 >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497) > Requested \PIPE\winreg >[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531) > api_rpcTNP: winreg op 0xf - api_rpcTNP: rpc command: REG_OPEN_ENTRY >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557) > api_rpc_cmds[1].fn == d9fbc >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 reg_io_q_entry >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 02000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 5a d1 14 42 71 35 00 00 >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000014 smb_io_unihdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 uni_str_len: 0046 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0016 uni_max_len: 0046 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0018 buffer : 6ac21bec >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 00001c smb_io_unistr2 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 001c uni_max_len: 00000023 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0020 offset : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0024 uni_str_len: 00000023 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814) > 0028 buffer : S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.S.c.h.e.d.u.l.i.n.g.A.g.e.n.t... >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0070 unknown_0 : 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0074 access_desired : 000f003f >[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) > Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 5A D1 14 42 ........ ....Z..B > [010] 71 35 00 00 q5.. >[2005/02/17 12:16:10, 5] rpc_server/srv_reg_nt.c:_reg_open_entry(326) > reg_open_entry: Enter >[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(92) > open_registry_key: name = [HKLM][SOFTWARE\Microsoft\SchedulingAgent] >[2005/02/17 12:16:10, 10] registry/reg_cachehook.c:reghook_cache_find(94) > reghook_cache_find: Searching for keyname [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] >[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(387) > sorted_tree_find: Enter [/HKLM/SOFTWARE/Microsoft/SchedulingAgent] >[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(459) > sorted_tree_find: Exit >[2005/02/17 12:16:10, 10] registry/reg_db.c:regdb_fetch_reg_keys(245) > regdb_fetch_reg_keys: Enter key => [HKLM\SOFTWARE\Microsoft\SchedulingAgent] >[2005/02/17 12:16:10, 5] registry/reg_db.c:regdb_fetch_reg_keys(259) > regdb_fetch_reg_keys: tdb lookup failed to locate key [HKLM\SOFTWARE\Microsoft\SchedulingAgent] >[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(164) > open_registry_key: exit >[2005/02/17 12:16:10, 5] rpc_server/srv_reg_nt.c:_reg_open_entry(337) > reg_open_entry: Exit >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 reg_io_r_open_entry >[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_pol_hnd >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0000 data1: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0004 data2: 00000000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 data3: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a data4: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729) > 000c data5: 00 00 00 00 00 00 00 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702) > 0014 status: WERR_BADFILE >[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578) > api_rpcTNP: called winreg successfully >[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) > free_pipe_context: destroying talloc pool of size 70 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878) > write_to_pipe: data_used = 128 >[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909) > read_from_pipe: 7440 name: winreg len: 1024 >[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982) > read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000000 smb_io_rpc_hdr hdr >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0000 major : 05 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0001 minor : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0002 pkt_type : 02 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0003 flags : 03 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0004 pack_type0: 10 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0005 pack_type1: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0006 pack_type2: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0007 pack_type3: 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0008 frag_len : 0030 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 000a auth_len : 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 000c call_id : 00000002 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82) > 000010 smb_io_rpc_hdr_resp resp >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642) > 0010 alloc_hint: 00000018 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613) > 0014 context_id: 0000 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0016 cancel_ct : 00 >[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584) > 0017 reserved : 00 >[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60) > copy_trans_params_and_data: params[0..0] data[0..48] >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464) >[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474) > size=104 > smb_com=0x25 > smb_rcls=0 > s