Hello, the main dcerpc dissector uses the literal string "HMMM" to store uuid found in dcerpc packets. As a consequence, it is not possible to use display filters to filter, for example, dcerpc packets on object uuid. The attached patch tries to correct this. It modifies packet-dcerpc.c and packet-dcerpc-ndr.c, which contains the dissect_ndr_uuid_t() function, used by conversation manager and endpoint mapper dissectors when they need to extract uuids (dissect_ndr_uuid_t() used an empty string instead of "HMMM"). Thanks to Ronnie Sahlberg for helping me on this! The other attached patch fixes what is probably, if I understood correctly, a typo in README.developer (the function to check is a given column is displayed is check_col() and not col_info()). Jean-Baptiste Marchand -- Jean-Baptiste.Marchand@xxxxxx Hervé Schauer Consultants http://www.hsc.fr/
Attachment:
dcerpc_uuid_str.diff.gz
Description: application/gunzip
Attachment:
README.developer.diff.gz
Description: application/gunzip
Powered by MHonArc 2.6.10