nt-part2_84
Analysis of the Security of Windows NT
1 March 1999
84
C SMB Data Structures
The SMB data structure and the flags and flags2 fields according to [31].
UCHAR is 8 unsigned bits
USHORT is 16 unsigned bits
ULONG is 32 unsigned bits
typededef struct {
UCHAR Protocol [4]; // Contains 0xFF, ‘SMB’
UCHAR Command; // The SMB command code
union {
struct {
UCHAR ErrorClass; //The dos error class
UCHAR Reserved;
USHORT Error; //The dos error code
} DosError;
ULONG Status; // 32-bit error code
} Status;
UCHAR Flags; //Flag field see below.
USHORT Flags2; // Flag field see below.
union {
USHORT Pad[6] //To ensure that the section is
//12 bytes long.
struct {
USHORT Reserved;
UCHAR SecuritySignature[8]; //Reserved
//for MIC
//when SMB
//signing is
//used.
} Extra;
};
USHORT Tid; //Tree identifier.
USHORT Pid; //Process identifier.
USHORT Uid; //User identifier.
USHORT Mid; //Multiplex identifier.
UCHAR WordCount; // Number of parameter words.
USHORT ParameterWords[WordCount]; //The parameter
//words.
USHORT ByteCount; // Number of bytes in data buffer.
UCHAR Buffer[ByteCount];
}SMB_HEADER;
TABLE 7. The flags field
Bit
Name
Meaning
0
Reserved for obsolecent requests.
(LOCK_AND_READ, WRITE_AND_CLOSE)
1
Reserved (must be zero)
2
Reserved (must be zero)