[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wireshark-dev
Subject:    Re: [Wireshark-dev] Decode a union type?
From:       Alexis La Goutte <alexis.lagoutte () gmail ! com>
Date:       2016-05-31 6:03:15
Message-ID: CAHzrgZn_M3Z4ri9r7hkMvBV1MhnG28U+peera_5qihz7P-nu_Q () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


Hi Gordon,

There is no better solution but i think it will be better to always dissect
smb2fid.

Cheers

On Tue, May 31, 2016 at 4:58 AM, Gordon Ross <gordon.w.ross@gmail.com>
wrote:

> I have a type to decode in SMB2, which appears in a couple ioctl calls.
> The spec. says it's opaque, three "quad" words (8 bytes each).  Now I
> could just not decode it, but we happen to know that most
> implementations put an SMB2 file ID in there, and it would sometimes
> be really handy if wireshark could tell us the details about that file
> ID, if known, but also not make too much of a fuss if it turns out the
> implementation puts something else there (not a FID).
>
> In essence, I want to treat this as a union type:
>
> union {
>    quint64  opaque[3];
>    struct {
>         quint64  persistent;
>         quint64 temporal;
>         quint64 _pad;
>    } smb2fid;
> }
>
> Any suggestions how best to do this?
>
> Thanks,
> Gordon
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@wireshark.org>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request@wireshark.org
> ?subject=unsubscribe
>

[Attachment #5 (text/html)]

<div dir="ltr"><div><div>Hi Gordon,<br><br></div>There is no better solution but i \
think it will be better to always dissect \
smb2fid.<br><br></div><div>Cheers<br></div><div><div><div><div \
class="gmail_extra"><br><div class="gmail_quote">On Tue, May 31, 2016 at 4:58 AM, \
Gordon Ross <span dir="ltr">&lt;<a href="mailto:gordon.w.ross@gmail.com" \
target="_blank">gordon.w.ross@gmail.com</a>&gt;</span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex">I have a type to decode in SMB2, which appears in a couple \
ioctl calls.<br> The spec. says it&#39;s opaque, three &quot;quad&quot; words (8 \
bytes each).   Now I<br> could just not decode it, but we happen to know that \
most<br> implementations put an SMB2 file ID in there, and it would sometimes<br>
be really handy if wireshark could tell us the details about that file<br>
ID, if known, but also not make too much of a fuss if it turns out the<br>
implementation puts something else there (not a FID).<br>
<br>
In essence, I want to treat this as a union type:<br>
<br>
union {<br>
     quint64   opaque[3];<br>
     struct {<br>
            quint64   persistent;<br>
            quint64 temporal;<br>
            quint64 _pad;<br>
     } smb2fid;<br>
}<br>
<br>
Any suggestions how best to do this?<br>
<br>
Thanks,<br>
Gordon<br>
___________________________________________________________________________<br>
Sent via:      Wireshark-dev mailing list &lt;<a \
                href="mailto:wireshark-dev@wireshark.org">wireshark-dev@wireshark.org</a>&gt;<br>
                
Archives:      <a href="https://www.wireshark.org/lists/wireshark-dev" \
rel="noreferrer" target="_blank">https://www.wireshark.org/lists/wireshark-dev</a><br>
                
Unsubscribe: <a href="https://wireshark.org/mailman/options/wireshark-dev" \
rel="noreferrer" target="_blank">https://wireshark.org/mailman/options/wireshark-dev</a><br>
                
                    mailto:<a \
href="mailto:wireshark-dev-request@wireshark.org">wireshark-dev-request@wireshark.org</a>?subject=unsubscribe<br>
 </blockquote></div><br></div></div></div></div></div>



___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@wireshark.org?subject=unsubscribe

[prev in list] [next in list] [prev in thread] [next in thread]