Suricata

if (uuid == NULL) {

return;

}

sstate->andx.datalengthhigh = *(p + 18);

sstate->andx.datalengthhigh |= *(p + 19) << 8;

sstate->andx.datalength = *(p + 20);

sstate->andx.datalength |= *(p + 21) << 8;

sstate->andx.datalengthhigh = *(p++);

sstate->andx.datalengthhigh |= *(p++) << 8;

sstate->andx.datalength = *(p++);

sstate->andx.datalength |= *(p++) << 8;

< sstate->andx.dataoffset && sstate->bytecount.bytecountleft--

SCLogDebug("0x%02x ", *p);

parsed = DCERPCParser(&sstate->dcerpc, input, input_len);

sstate->bytesprocessed += parsed;

sstate->bytecount.bytecountleft -= parsed;

input_len -= parsed;

sstate->wordcount.wordcountleft = sstate->wordcount.wordcount;

sstate->bytecount.bytecountleft = sstate->bytecount.bytecount;

sstate->wordcount.wordcountleft -= retval;

SCLogDebug("SMB_COM_READ_ANDX %u bytes at offset %"PRIu64"\n", sstate->andx.datalength, sstate->andx.dataoffset);

sstate->wordcount.wordcountleft -= retval;

SCLogDebug("SMB_COM_WRITE_ANDX %u bytes at offset %"PRIu64"\n", sstate->andx.datalength, sstate->andx.dataoffset);

retval = SMBParseTransact(f, sstate, pstate, input + parsed, input_len,

output);

parsed += retval;

input_len -= retval;

sstate->wordcount.wordcountleft -= retval;

SCLogDebug("SMB_COM_TRANSACTION %u bytes at offset %"PRIu64"\n", sstate->andx.datalength, sstate->andx.dataoffset);

SCReturnUInt(retval);

while (sstate->wordcount.wordcountleft-- && input_len--) {

SCLogDebug("0x%02x wordcount %u/%u input_len %u", *p,

sstate->wordcount.wordcountleft,

sstate->wordcount.wordcount, input_len);

if (sstate->andx.datalength && input_len) {

while (sstate->bytecount.bytecountleft-- && input_len--) {

SCLogDebug("0x%02x bytecount %u/%u input_len %u", *p,

sstate->bytecount.bytecountleft,

+ SMB_HDR_LEN + 3 + sstate->wordcount.wordcount)

&& (sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN + 3

int SMBParserTest03(void) {

int result = 1;

Flow f;

uint8_t smbbuf1[] = {

0x00, 0x00, 0x07, 0x57, 0xff, 0x53, 0x4d, 0x42,

0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7f, 0x13,

0x01, 0x08, 0xc9, 0x29, 0x0e, 0xff, 0x00, 0x00,

0x00, 0x00, 0x40, 0x55, 0x01, 0x00, 0x00, 0xff,

0xff, 0xff, 0xff, 0x08, 0x00, 0x0e, 0x00, 0x00,

0x00, 0x0e, 0x00, 0x49, 0x07, 0x00, 0x00, 0x00,

0x00, 0x18, 0x07, 0xcc, 0x1b, 0x19, 0xb8, 0x75,

0x2c, 0x85, 0x52, 0x39, 0x72, 0xfa, 0x9c, 0x5f,

0x5a, 0xb7, 0x59, 0xa1, 0x83, 0xba, 0x87, 0xd3,

0xc3, 0xbf, 0xf4, 0x5d, 0x08, 0x32, 0x22, 0x33,

0x2e, 0x62, 0x46, 0x4d, 0x03, 0x48, 0x1f, 0xea,

0x7c, 0x65, 0x3e, 0x71, 0xf8, 0xea, 0x20, 0x85,

0x29, 0x6f, 0x3c, 0xf2, 0x19, 0xb5, 0x65, 0xb0,

0xce, 0x06, 0xcc, 0x90, 0x86, 0x20, 0x77, 0xf5,

0xa0, 0xbc, 0x45, 0x9d, 0x4e, 0x92, 0xb4, 0x24,

0xc8, 0x58, 0x4a, 0xc3, 0x4e, 0xb8, 0x95, 0x8d,

0x93, 0x0c, 0xce, 0xe0, 0xf9, 0x7d, 0x7e, 0xd3,

0x46, 0x53, 0x32, 0x95, 0x7d, 0x22, 0x76, 0x0e,

0x95, 0x23, 0x2e, 0xa6, 0x58, 0x1a, 0xb6, 0x74,

0x54, 0x4f, 0x37, 0x5c, 0x60, 0x00, 0xb4, 0x55,

0x5b, 0xda, 0xea, 0x2c, 0xf3, 0x9b, 0x91, 0x6f,

0xa8, 0x20, 0xd3, 0x40, 0x0c, 0x7c, 0xc7, 0x85,

0x8c, 0x44, 0x76, 0xbc, 0x22, 0x9d, 0xfd, 0x8e,

0x21, 0x46, 0x05, 0x41, 0x73, 0x0c, 0x88, 0x62,

0xdc, 0x62, 0xc1, 0xc8, 0x14, 0xbb, 0x96, 0x60,

0x77, 0x6c, 0x5c, 0x31, 0x2a, 0xaa, 0x87, 0x69,

0x99, 0xaa, 0x83, 0x5e, 0x71, 0x11, 0x2a, 0x85,

0xca, 0x5d, 0xe1, 0x67, 0x4f, 0xa2, 0x3e, 0x4e,

0x94, 0xe7, 0xa3, 0xe6, 0xa0, 0xdb, 0xc2, 0x05,

0x01, 0x4f, 0xf5, 0xe9, 0xfc, 0xa2, 0x2a, 0x1c,

0x63, 0x21, 0xd5, 0x27, 0x98, 0x86, 0x9c, 0x66,

0x5e, 0xf1, 0x97, 0xb0, 0x86, 0x58, 0x5b, 0x94,

0x51, 0xfd, 0xb9, 0x83, 0x4c, 0xc4, 0x0f, 0x5f,

0xdd, 0xc8, 0xce, 0x43, 0xed, 0xe8, 0xae, 0xbc,

0x52, 0x73, 0xf6, 0x0f, 0x0d, 0xb4, 0xd6, 0xa7,

0xcf, 0xef, 0x0e, 0x72, 0x34, 0xff, 0x2b, 0x50,

0x71, 0x2a, 0x98, 0xf0, 0x60, 0x58, 0xde, 0x1d,

0x96, 0x50, 0xd8, 0xec, 0xeb, 0x40, 0xcb, 0x4c,

0x3b, 0x2c, 0xee, 0x76, 0xd6, 0x97, 0x1c, 0x69,

0x61, 0x89, 0xc1, 0x9b, 0x03, 0xda, 0x08, 0x0b,

0x15, 0xba, 0xd3, 0x3d, 0x8c, 0xea, 0xf7, 0x17,

0xc3, 0x77, 0xf8, 0x04, 0xca, 0x72, 0xed, 0xfe,

0xd0, 0x02, 0x73, 0x1b, 0x71, 0x72, 0x17, 0x9f,

0x14, 0x96, 0xe2, 0x5f, 0xae, 0x5b, 0x7d, 0x7f,

0xc9, 0x72, 0x9f, 0xd5, 0x32, 0xf4, 0xf3, 0x39,

0x89, 0x36, 0x00, 0x44, 0xa9, 0x18, 0x21, 0x4b,

0x26, 0xf2, 0x5a, 0x2a, 0x80, 0xea, 0x6b, 0x3e,

0x68, 0x27, 0xd0, 0xa0, 0x84, 0x81, 0xb5, 0xa6,

0x3b, 0xd5, 0xdc, 0xdd, 0xd1, 0xd4, 0x5b, 0xad,

0x80, 0x91, 0xf2, 0x30, 0x5e, 0x90, 0x17, 0x35,

0x59, 0xad, 0x34, 0x65, 0x54, 0x04, 0x5a, 0x3c,

0xe4, 0x68, 0xa7, 0x30, 0x06, 0x7a, 0x85, 0xe7,

0xf4, 0x20, 0xe3, 0xd7, 0xa5, 0x8b, 0x60, 0xfe,

0x51, 0xad, 0xda, 0xe2, 0xd1, 0x4f, 0xfb, 0x94,

0xc9, 0xba, 0xa4, 0x09, 0x5c, 0xde, 0x78, 0xdc,

0x78, 0x36, 0x96, 0x8b, 0xd6, 0x72, 0xc4, 0xa7,

0x1c, 0xde, 0x45, 0x85, 0xdf, 0x84, 0xb1, 0x3f,

0x2b, 0x3f, 0xfe, 0x56, 0x80, 0x8d, 0x26, 0x4a,

0x39, 0x22, 0x1f, 0x10, 0x89, 0x2e, 0x4e, 0x87,

0xf5, 0x9c, 0x0e, 0xd9, 0xdd, 0xb2, 0xc9, 0x9c,

0x3f, 0xc5, 0xe3, 0xab, 0xdc, 0x85, 0x1c, 0xf9,

0xda, 0xbb, 0x36, 0x9b, 0xe7, 0x21, 0x58, 0x44,

0xee, 0xb3, 0xe7, 0x37, 0xd3, 0xc3, 0x76, 0x09,

0x79, 0xe2, 0xf4, 0xf1, 0x27, 0x6b, 0x74, 0xc4,

0x5f, 0x06, 0x76, 0x78, 0x56, 0xb9, 0x80, 0x7f,

0x63, 0x53, 0xa2, 0xd1, 0xfc, 0xfb, 0x69, 0x38,

0x0c, 0x13, 0x6e, 0x9e, 0xea, 0x79, 0xc9, 0x6d,

0x45, 0x6b, 0xa3, 0xa8, 0x20, 0x21, 0x24, 0xff,

0x0d, 0x8d, 0xd9, 0x0a, 0x9e, 0xf4, 0x3f, 0xf5,

0x18, 0x39, 0xdd, 0x9f, 0xed, 0xd6, 0x2b, 0xb1,

0x4b, 0x3f, 0x24, 0x7e, 0x11, 0x79, 0x37, 0x01,

0x10, 0xe7, 0x34, 0x1d, 0x36, 0x5f, 0x26, 0x99,

0x5a, 0x4d, 0xe9, 0x1a, 0x89, 0x24, 0xf8, 0xea,

0xca, 0x16, 0x19, 0x6c, 0x3b, 0x8e, 0x44, 0x70,

0x20, 0x5f, 0x46, 0x3c, 0x60, 0xbe, 0x03, 0xfc,

0x99, 0x29, 0xd7, 0x30, 0x5e, 0xbe, 0x5b, 0x17,

0x4f, 0xfe, 0x3f, 0xe0, 0x50, 0xa0, 0x1b, 0x1a,

0x6b, 0x17, 0xf3, 0xf9, 0x01, 0xe8, 0xc6, 0xc8,

0x0f, 0x81, 0xbd, 0x2d, 0xc5, 0x8c, 0xa1, 0xab,

0x9d, 0x13, 0xce, 0x73, 0x14, 0x56, 0x56, 0xb4,

0x68, 0xac, 0x35, 0xf8, 0x6a, 0x55, 0x3e, 0x50,

0x34, 0x5a, 0x66, 0x17, 0x98, 0x4d, 0xd1, 0xa7,

0xdf, 0x57, 0xd6, 0xd4, 0x44, 0x64, 0xa7, 0x74,

0x18, 0x0a, 0x4f, 0xa9, 0xe4, 0xb4, 0x0f, 0x89,

0xa2, 0xc5, 0xb8, 0xa7, 0x20, 0xa2, 0xb1, 0xf8,

0x70, 0xaf, 0xee, 0x6e, 0x62, 0xa5, 0x89, 0x5d,

0xc9, 0x8a, 0xb9, 0x87, 0xac, 0x4d, 0x4d, 0x81,

0x1c, 0x62, 0xd3, 0xbf, 0x83, 0x79, 0x98, 0x81,

0xbd, 0xcc, 0x1f, 0x76, 0xc8, 0x7e, 0x2c, 0xec,

0xdb, 0xa7, 0xa5, 0xea, 0x05, 0x94, 0x3f, 0xef,

0x66, 0x1c, 0x5d, 0xc4, 0xbd, 0x73, 0x53, 0x1f,

0xf3, 0xac, 0x1f, 0xa4, 0xb9, 0x78, 0x1b, 0x93,

0xcb, 0x17, 0xb6, 0xda, 0xbb, 0x45, 0x21, 0xfa,

0x52, 0xc7, 0x71, 0x05, 0xb3, 0xeb, 0x82, 0x09,

0x99, 0x90, 0x5d, 0xa9, 0x76, 0xd1, 0x63, 0x6a,

0x14, 0x99, 0xe9, 0xa5, 0x98, 0x5d, 0xe0, 0xb5,

0x2a, 0xd1, 0xf1, 0x2e, 0xe7, 0x85, 0xdb, 0x42,

0xfc, 0x61, 0x09, 0x14, 0xe5, 0x8e, 0x92, 0x70,

0x91, 0x15, 0x74, 0x2c, 0x16, 0x30, 0xc4, 0xb0,

0xf1, 0x61, 0xd5, 0x55, 0xa8, 0xa3, 0xca, 0x88,

0xe6, 0xb1, 0x58, 0x76, 0xa5, 0x4c, 0x48, 0xe3,

0xdd, 0x7a, 0x5e, 0x0a, 0x86, 0xfd, 0xd6, 0xe8,

0xc0, 0x47, 0x27, 0x1a, 0x58, 0x92, 0xad, 0xa6,

0x51, 0x32, 0x4d, 0x0d, 0x29, 0xd3, 0xcf, 0xf1,

0xcc, 0x29, 0x1a, 0xfe, 0xf6, 0xa0, 0xf3, 0xdd,

0x98, 0x73, 0xcb, 0xbb, 0x8a, 0xe9, 0x55, 0xba,

0x89, 0x2d, 0x31, 0x9b, 0x3d, 0x04, 0x1f, 0xb5,

0x1c, 0x84, 0x63, 0xca, 0xde, 0x75, 0xac, 0x91,

0x78, 0x1f, 0x8b, 0x37, 0x8d, 0x46, 0xaa, 0x79,

0x51, 0xbf, 0x30, 0xfa, 0x3d, 0x9b, 0xd9, 0x20,

0x25, 0x18, 0x46, 0xb6, 0xe7, 0x8e, 0xf7, 0x5e,

0x7d, 0xf8, 0xd3, 0x01, 0x39, 0xe5, 0x9d, 0x46,

0x6b, 0x8c, 0xcf, 0x9d, 0xc6, 0xb9, 0xe8, 0xd8,

0x25, 0x2d, 0x96, 0x07, 0xc7, 0x4e, 0xa3, 0x3a,

0x9a, 0xbc, 0x9d, 0x80, 0xa6, 0x5d, 0xb1, 0xc0,

0x3e, 0x81, 0xe0, 0x52, 0x8f, 0x9a, 0x1a, 0xc2,

0xdb, 0x9f, 0x91, 0x85, 0x56, 0xdb, 0xb8, 0x69,

0x10, 0x35, 0xe4, 0xc4, 0xaf, 0xb6, 0x13, 0xf8,

0x86, 0xe1, 0x2d, 0x3c, 0xf8, 0x94, 0x60, 0xb7,

0xa1, 0xde, 0x25, 0x51, 0x7d, 0xff, 0xff, 0xa6,

0x23, 0x68, 0x28, 0x1f, 0x79, 0x33, 0x60, 0x86,

0xe9, 0x2c, 0x3a, 0xb9, 0x3c, 0x70, 0xb3, 0xe0,

0x4c, 0x8c, 0x7e, 0x06, 0xdf, 0x4d, 0xf6, 0x88,

0xda, 0x9e, 0x4f, 0x5b, 0xd2, 0x2e, 0x28, 0xb8,

0xe0, 0x27, 0x7a, 0x43, 0xfb, 0x23, 0x4b, 0x8a,

0xd9, 0x4f, 0x29, 0x53, 0x5d, 0x75, 0xc6, 0xfc };

uint8_t smbbuf2[] = {

0x0a, 0x30, 0xe0, 0x74, 0x3c, 0x23, 0xc3, 0x11,

0x95, 0x25, 0x04, 0xe4, 0x2d, 0x7b, 0x29, 0xa1,

0x75, 0x69, 0x3f, 0x49, 0x9c, 0xfa, 0x66, 0x78,

0x3c, 0xf1, 0xab, 0xee, 0xab, 0x9a, 0x75, 0x63,

0x54, 0x80, 0x2b, 0x5c, 0x07, 0xf7, 0xec, 0x72,

0xfb, 0xd0, 0x52, 0x5e, 0x7e, 0x99, 0xf5, 0x3b,

0xc4, 0x77, 0x96, 0x12, 0xb8, 0x36, 0xb2, 0xcf,

0xab, 0xf5, 0xd3, 0xf3, 0x19, 0x77, 0xbb, 0x03,

0xdb, 0xf7, 0x4d, 0x81, 0xe3, 0xe8, 0x6c, 0x23,

0x02, 0xe0, 0xcf, 0x24, 0xc1, 0xd5, 0x3d, 0x42,

0xa4, 0xbc, 0x97, 0xf4, 0x83, 0xee, 0xff, 0x85,

0x2c, 0xfd, 0xdd, 0xdc, 0x23, 0x1c, 0x87, 0x0c,

0xe4, 0xd5, 0xfc, 0xc3, 0x8b, 0x10, 0xa5, 0x42,

0x0f, 0x14, 0xd1, 0x89, 0xa6, 0xaf, 0xaa, 0x77,

0xfc, 0x3b, 0xce, 0x6c, 0xbe, 0x62, 0xc9, 0xdd,

0x16, 0xc6, 0x14, 0xc2, 0xa6, 0x13, 0x12, 0xfa,

0x5a, 0x8b, 0x05, 0x88, 0x06, 0xf9, 0xef, 0x9c,

0xce, 0xf7, 0x27, 0x46, 0x1d, 0x50, 0xe2, 0xeb,

0x49, 0xb2, 0xb1, 0x7c, 0x6b, 0xaf, 0xe9, 0xc7,

0xdd, 0x59, 0x8c, 0xda, 0x32, 0x55, 0xb5, 0xfe,

0xdc, 0xe0, 0x47, 0xf4, 0xa0, 0xe7, 0xaa, 0x47,

0x49, 0xdf, 0xcf, 0x9c, 0xd6, 0xfa, 0xd2, 0xca,

0x55, 0xa7, 0x3f, 0x62, 0x14, 0x6c, 0xc8, 0x7f,

0xad, 0x7c, 0xb1, 0x70, 0x88, 0xb3, 0x51, 0x13,

0x2c, 0x3b, 0x78, 0x1d, 0xa2, 0x5e, 0xf7, 0x83,

0x62, 0x6a, 0x51, 0xbd, 0xe9, 0x77, 0x62, 0xc6,

0x06, 0x06, 0x51, 0x9d, 0x03, 0x95, 0x51, 0x7c,

0xd3, 0x73, 0x50, 0x9b, 0x36, 0x5a, 0x28, 0x52,

0xc0, 0x05, 0xee, 0xd5, 0x2d, 0xd5, 0x77, 0x52,

0xab, 0x7c, 0x4a, 0x4c, 0x7e, 0xf6, 0xba, 0x52,

0xc5, 0x4d, 0xb5, 0x74, 0x83, 0x77, 0x5f, 0xaa,

0xba, 0x86, 0x94, 0xd2, 0x19, 0xca, 0xef, 0xc9,

0x6e, 0x5b, 0x50, 0xee, 0x2c, 0xdd, 0x67, 0xc8,

0xfd, 0xc3, 0xa4, 0x80, 0x63, 0x1d, 0xa2, 0x07,

0x1e, 0x1a, 0x9d, 0x70, 0xe4, 0xab, 0x34, 0x7a,

0xfb, 0x08, 0x82, 0x85, 0xec, 0x2d, 0x25, 0x3e,

0x70, 0x22, 0x6e, 0x9d, 0x0f, 0xed, 0x60, 0x8f,

0xc5, 0x06, 0x66, 0x42, 0x95, 0xcc, 0x77, 0xbe,

0x4d, 0x19, 0x7c, 0xd1, 0x31, 0x26, 0xfb, 0x52,

0xad, 0xbd, 0x19, 0x1d, 0x68, 0x56, 0x2c, 0xb9,

0x5b, 0xaa, 0x92, 0x48, 0xcf, 0xdf, 0x65, 0x2d,

0xdb, 0x87, 0x06, 0xbe, 0x51, 0x61, 0x6b, 0xf6,

0x87, 0xdc, 0xbb, 0xa5, 0x48, 0x81, 0xaf, 0xd7,

0xfc, 0x15, 0xf7, 0x41, 0xde, 0xe3, 0xe9, 0xd4,

0xad, 0x5d, 0x64, 0x8f, 0x13, 0x68, 0xe5, 0x2b,

0x4d, 0x87, 0x59, 0x7e, 0xcb, 0x2b, 0xbf, 0xbc,

0xaa, 0xd2, 0xc7, 0x60, 0xef, 0xe1, 0x25, 0xe2,

0x89, 0xb4, 0x78, 0x24, 0x52, 0xb4, 0x54, 0xe3,

0xf0, 0xe5, 0x81, 0xba, 0xe3, 0x00, 0x62, 0x09,

0x8a, 0x19, 0x7b, 0x9b, 0x0f, 0x50, 0x91, 0xa7,

0x80, 0xdb, 0x0e, 0x68, 0xe1, 0x22, 0x54, 0x89,

0x07, 0xc7, 0x39, 0x38, 0xca, 0xae, 0xbf, 0x5b,

0xbb, 0xe4, 0x70, 0x28, 0xc5, 0x18, 0x98, 0xea };

uint8_t smbbuf3[] = {

0x39, 0x99, 0x97, 0x1f, 0xf1, 0x6a, 0x72, 0x0d,

0x35, 0xd5, 0x33, 0x42, 0x5a, 0x9f, 0xea, 0x0f,

0x6f, 0x3b, 0xc7, 0xb9, 0xd3, 0x04, 0xdf, 0x44,

0x45, 0xc7, 0xc6, 0x06, 0x0b, 0x77, 0x8e, 0x8e,

0x9a, 0x3c, 0xa4, 0x15, 0x85, 0x80, 0xce, 0xd0,

0x8c, 0x54, 0x60, 0xf9, 0x1f, 0xb3, 0x3e, 0xed,

0x21, 0x3e, 0xfa, 0x30, 0xf4, 0x50, 0x2b, 0x00,

0x00, 0xea, 0xd1, 0xb3, 0xd2, 0x7e, 0x6c, 0x14,

0xe5, 0xf0, 0xf4, 0x9c, 0xb4, 0x2e, 0x32, 0x41,

0x20, 0x2a, 0x18, 0x78, 0x1a, 0xed, 0x04, 0x94,

0x83, 0xd1, 0x87, 0x39, 0xf6, 0xcb, 0xf4, 0xc1,

0xc7, 0xe0, 0x50, 0x87, 0x65, 0x4f, 0x36, 0x73,

0x70, 0xf5, 0x0a, 0xaa, 0x2b, 0x28, 0xad, 0x05,

0x28, 0x8d, 0x3b, 0x42, 0xfb, 0xe2, 0xd3, 0xb8,

0x82, 0x71, 0x25, 0xcd, 0xa2, 0xf2, 0x4b, 0x62,

0xeb, 0x14, 0x3b, 0x81, 0xaf, 0xd4, 0x68, 0x5a,

0xae, 0x8e, 0x10, 0x9a, 0x17, 0x4c, 0xf1, 0x3d,

0x43, 0xb9, 0xd2, 0xd5, 0x86, 0xee, 0x3a, 0xf3,

0xe5, 0x41, 0xe5, 0x52, 0xda, 0x61, 0xf3, 0x20,

0x30, 0x5b, 0xe5, 0x1f, 0xe2, 0x4e, 0x9d, 0xd6,

0xd6, 0x2e, 0x2a, 0x63, 0xbc, 0xf6, 0xb9, 0xc2,

0xec, 0xd0, 0xe9, 0xfd, 0x07, 0xfb, 0x2d, 0x8e,

0xbc, 0x43, 0xcb, 0x7e, 0x55, 0x63, 0x9f, 0xb6,

0xf8, 0x8b, 0x4c, 0xcd, 0x4b, 0x28, 0x47, 0x56,

0xc9, 0xd2, 0xfe, 0x0e, 0x63, 0x11, 0x09, 0xd9,

0xd9, 0x97, 0x0a, 0x5a, 0x21, 0xad, 0xdb, 0x53,

0x24, 0xee, 0x62, 0x4a, 0xaa, 0x49, 0x14, 0xdf,

0xc0, 0x61, 0x85, 0x11, 0x57, 0x6e, 0x3b, 0x8c,

0x37, 0x24, 0x13, 0xde, 0xc7, 0xf3, 0x44, 0x54,

0x8a, 0x69, 0x78, 0x0c, 0xf3, 0xd1, 0xcd, 0xc5,

0xad, 0x45, 0xc6, 0x06, 0x56, 0x0b, 0x53, 0x40,

0x79, 0x12, 0x90, 0x6b, 0xdf, 0xc5, 0x80, 0xde,

0x9c, 0x8e, 0xe1, 0x73, 0xdc, 0x92, 0xc2, 0xf1,

0xeb, 0xd9, 0x66, 0x0a, 0x12, 0xd2, 0x3f, 0x04,

0x03, 0xaa, 0x6f, 0xd0, 0x90, 0xfa, 0xb0, 0x6b,

0x7d, 0xfc, 0x76, 0xf9, 0xe3, 0xa2, 0x17, 0x28,

0x4e, 0x9d, 0x2d, 0xa6, 0x7e, 0xfa, 0x19, 0x91,

0xeb, 0xe5, 0xe4, 0xca, 0x09, 0x77, 0xfe, 0xc0,

0x1c, 0xaa, 0xc4, 0x7c, 0xc2, 0x6a, 0x0e, 0xf3,

0x4e, 0x79, 0x9b, 0x82, 0x2a, 0x4b, 0xd3, 0x35,

0x1d, 0x92, 0x6c, 0x3f, 0x85, 0x57, 0x5a, 0x16,

0xa1, 0x0d, 0xc7, 0x64, 0xb8, 0x46, 0x73, 0xbf,

0x91, 0x5f, 0x10, 0x2a, 0x2b, 0x51, 0x49, 0xe1,

0xea, 0xda, 0x2f, 0x41, 0x7b, 0x96, 0xa3, 0xd2,

0x7b, 0x72, 0xc0, 0x88, 0x84, 0xcb, 0xe0, 0xb7,

0xae, 0x74, 0xc9, 0x78, 0x82, 0x47, 0xf3, 0x19,

0x21, 0x53, 0xe6, 0xe1, 0x67, 0xbb, 0x39, 0x05,

0x6e, 0x1c, 0x38, 0x33, 0x10, 0x60, 0x24, 0x48,

0xb2, 0x7a, 0xb9, 0x4e, 0x8d, 0x36, 0xcf, 0xce,

0xf6, 0x31, 0x3b, 0xa3, 0x18, 0x78, 0x49, 0x91,

0xef, 0xed, 0x86, 0x2c, 0x98, 0x00, 0x18, 0x49,

0x73, 0xb8, 0xe5, 0x2f, 0xc1, 0x58, 0xe0, 0x47,

0x2b, 0x16, 0x41, 0xc3, 0x41, 0x05, 0x00, 0x0b,

0x03, 0x10, 0x00, 0x00, 0x00, 0xb0, 0x02, 0x00,

0x00, 0x00, 0x00 };

uint32_t smblen1 = sizeof(smbbuf1);

uint32_t smblen2 = sizeof(smbbuf2);

uint32_t smblen3 = sizeof(smbbuf3);

TcpSession ssn;

int r = 0;

memset(&f, 0, sizeof(f));

memset(&ssn, 0, sizeof(ssn));

StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());

f.protoctx = (void *)&ssn;

r = AppLayerParse(&f, ALPROTO_SMB, STREAM_TOSERVER|STREAM_START, smbbuf1, smblen1);

if (r != 0) {

printf("smb header check returned %" PRId32 ", expected 0: ", r);

result = 0;

goto end;

}

SMBState *smb_state = ssn.aldata[AlpGetStateIdx(ALPROTO_SMB)];

if (smb_state == NULL) {

printf("no smb state: ");

result = 0;

goto end;

}

if (smb_state->smb.command != SMB_COM_WRITE_ANDX) {

printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_WRITE_ANDX, smb_state->smb.command);

result = 0;

goto end;

}

r = AppLayerParse(&f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf2, smblen2);

if (r != 0) {

printf("smb header check returned %" PRId32 ", expected 0: ", r);

result = 0;

goto end;

}

r = AppLayerParse(&f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf3, smblen3);

if (r != 0) {

printf("smb header check returned %" PRId32 ", expected 0: ", r);

result = 0;

goto end;

}

printUUID("BIND", smb_state->dcerpc.dcerpcbindbindack.uuid_entry);

end:

return result;

}

#endif

#ifdef UNITTESTS

UtRegisterTest("SMBParserTest03", SMBParserTest03, 1);

}

uint8_t wordcountleft;

uint16_t bytecountleft;

uint16_t datalength;

uint16_t datalengthhigh;