1467 lines
34 KiB
Plaintext
1467 lines
34 KiB
Plaintext
//******************************************
|
|
// Guid Definitions
|
|
// 10/23/98
|
|
//******************************************
|
|
|
|
// The #type statement and the #typev statement may be used to convert
|
|
// messages into user readable forms.
|
|
// With #type all parameters are processed as strings and the default string
|
|
// processing of FormTMessage is used
|
|
// With #typev wherever possible parameters are processed as their native format
|
|
// and the %x!x! style of FormatMessage should be used.
|
|
//
|
|
// Note Parameter %1 through %9 are predefined
|
|
// Parameter is #typev
|
|
// %1 GUID Friendly Name string
|
|
// %2 GUID SubType Name string
|
|
// %3 Thread ID ULONG_PTR
|
|
// %4 System Time String
|
|
// %5 Kernel Time or User Time String
|
|
// %6 User Time or NULL String
|
|
// %7 Sequence Number LONG
|
|
// %8 Unused String
|
|
// %9 CPU Number LONG
|
|
// %10 and above are the user parameters
|
|
// %255 Is reserved
|
|
//
|
|
// Note these parameters are always present, but may not be valid
|
|
// depending on the source.
|
|
//
|
|
// User defined messages always start at message number 10
|
|
// Messages 0 through 9 are reserved for system use.
|
|
// Message number 255 is reserved.
|
|
//
|
|
// Available formats for user arguments are -
|
|
//
|
|
//Name Description #typev Format
|
|
//ItemChar CHAR
|
|
//ItemUChar UCHAR
|
|
//ItemCharShort USHORT
|
|
//ItemCharSign SHORT
|
|
//ItemShort Signed Short SHORT
|
|
//ItemUShort Unsigned Short USHORT
|
|
//ItemLong Signed Long, decoded as decimal LONG
|
|
//ItemULong Unsigned Long, decoded as decimal ULONG
|
|
//ItemULongX Unsigned Long, seen as hexadecimal ULONG
|
|
//ItemLongLong Signed 64 Bit value LONGLONG
|
|
//ItemULongLong Unsigned 64 Bit value ULONGLONG
|
|
//ItemRString Reduced Ascii String String
|
|
// (\t, \n, \r, \,, converted to space, trailing sp removed)
|
|
//ItemWString Unicode String, null terminated String
|
|
//ItemPString Counted Ascii String String
|
|
//ItemPWString Counted Unicode String String
|
|
//ItemMLString Multi-Line Ascii String String
|
|
//ItemSid Security identifier String
|
|
//ItemChar4 CHAR4
|
|
//ItemIPAddr IP Address String (If needed raw, use ItemUlong)
|
|
// (string of form xxx.xxx.xxx.xxx)
|
|
//ItemPort String (If needed raw use ItemUshort)
|
|
//ItemNWString Non-null terminated Wide Char String String
|
|
//ItemListByte (element1,element2,....) String
|
|
// byte index into a list of strings
|
|
//ItemListShort(element1,element2,....) String
|
|
// short index into a list of strings
|
|
//ItemListLong (element1,element2,....) String
|
|
// Long index into a list of strings
|
|
//ItemGUID Normal GUID format String
|
|
//ItemNTerror Translates a ULONG error code to the String
|
|
// NT Error Text
|
|
//ItemNTSTATUS Converts NTSTATUS to symbolic name String
|
|
//ItemWINERROR Converts WINERROR to symbolic name String
|
|
//ItemNETEVENT Converts NETEVENT to symbolic name String
|
|
//ItemMerror module.ext String
|
|
// Translates a ULONG error code using the
|
|
// module specified.
|
|
//ItemTimeStamp Treats a LONGLONG as a timestamp String
|
|
//ItemUnknown String
|
|
|
|
|
|
ce5b1020-8ea9-11d0-a4ec-00a0c9062910 TraceDp
|
|
#type Start 1 "TraceDp TID=0x%3 Start"
|
|
#type End 2 "TraceDp TID=0x%3End"
|
|
|
|
|
|
2cb15d1d-5fc1-11d2-abe1-00a0c911f518 ImageLoad
|
|
#typev Load 10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>ImageLoad of %12!s! (Base=0x%10!X!,size=0x%11!X!)"
|
|
{
|
|
Base Address, ItemULongX
|
|
Module Size, ItemULongX
|
|
Image Filename, ItemWString
|
|
}
|
|
|
|
3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c Process
|
|
#typev Start 1 "%10!08X!.%3!08X!::%4!s! [%1!s!] <*>Process %13!s! Started for %12"
|
|
#typev End 2 "%10!08X!.%3!08X!::%4!s! [%1!s!] <*>Process %13!s!(PID=%10!5d!) Completed"
|
|
#typev DCStart 3 "%10!08X!.%3!08X!::%4!s! [%1!s!DC] <*>Process Data Collection Started of %13!s! for %12!s!"
|
|
#typev DCEnd 4 "%10!08X!.%3!08X!::%4!s! [%1!s!DC] <*>Process Data Colection Ended for %13!s!"
|
|
#typev Load 5 "%10!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>Load of %13!s![%12!s! - %11!d!]
|
|
{
|
|
Process Id, ItemULongX
|
|
Parent Id, ItemULongX
|
|
User SID, ItemSid
|
|
Image Filename, ItemString
|
|
}
|
|
|
|
3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c Thread
|
|
#typev Start 1 "%11!08X!.%10!08X!::%4!s! [%1!s!] <%9!d!>Started"
|
|
#typev End 2 "%11!08X!.%10!08X!::%4!s! [%1!s!] <%9!d!>Ended"
|
|
#typev DCStart 3 "%11!08X!.%10!08X!::%4!s! [%1!s!DC] <%9!d!>Data Collection Started "
|
|
#typev DCEnd 4 "%11!08X!.%10!08X!::%4!s! [%1!s!DC] <%9!d!>Data Collection Ended"
|
|
{
|
|
Thread Id, ItemULongX
|
|
Process Id, ItemULong
|
|
}
|
|
|
|
3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c PageFault
|
|
#typev TransitionFault 10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault Transition VA=0x%10!08X!, PC=0x%11!08X!"
|
|
#typev DemandZeroFault 11 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault DemandZero VA=0x%10!08X!, PC=0x%11!08X!"
|
|
#typev CopyOnWrite 12 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault CopyOnWrite VA=0x%10!08X!, PC=0x%11!08X!"
|
|
#typev GlobalPageFault 13 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault GuardPageFault VA=0x%10!08X!, PC=0x%11!08X!"
|
|
#typev Hard 14 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault Hard VA=0x%10!08X!, PC=0x%11!08X!, in %12!016X!"
|
|
#typev Notification 15 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Pagefault Notification VA=0x%10!08X!, PC=0x%11!08X!, in %12!016X!"
|
|
{
|
|
Virtual Address,ItemULongX
|
|
Program Counter,ItemUlongX
|
|
Byte Offset, ItemLongLong
|
|
File Object, ItemUlongX
|
|
Byte Count, ItemUlong
|
|
HotFile Name, ItemNWString
|
|
}
|
|
|
|
3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c DiskIo
|
|
#typev Read 10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Disk %10!2d! Read of %12!5d! bytes (FileObj=0x%15!08X!)"
|
|
#typev Write 11 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Disk %10!2d! Write of %12!5d! bytes (FileObj=0x%15!08X!)"
|
|
{
|
|
Disk Number, ItemULong
|
|
Irp Flags, ItemULongX
|
|
Transfer Size, ItemULong
|
|
QueueDepth, ItemULong
|
|
Byte Offset, ItemLongLong
|
|
File Object, ItemULongX
|
|
}
|
|
AE53722E-C863-11d2-8659-00C04FA321A1 Registry
|
|
#typev Create 10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Create of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev Open 11 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Open of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev Delete 12 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Delete of Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev Query 13 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Query Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev SetValue 14 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>SetValue of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev DeleteValue 15 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>DeleteValue of %13!s! Handle = 0x%11!08X! Status = %10!0X! (TID =%3!0X!)"
|
|
#typev QueryValue 16 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>QueryValue Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev EnumerateKey 17 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>EnumerateKey of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev EnumerateValueKey 18 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>EnumerateValueKey of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev QueryMultipleValue 19 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>QueryMultiple of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev SetInformation 20 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>SetInformation of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
#typev Flush 21 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Flush of %13!s! Handle = 0x%11!08X! Status = %10!0X!"
|
|
{
|
|
Status,ItemUlongX
|
|
Key Handle, ItemULongX
|
|
Elapsed Time, ItemLongLong
|
|
KeyName, ItemWString
|
|
}
|
|
90cbdc39-4a3e-11d1-84f4-0000f80464e3 FileIo
|
|
#typev All 0 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!>Filio for %11 (FileObj=0x%10!X!)"
|
|
{
|
|
File Object, ItemULongX
|
|
File Name, ItemWString
|
|
}
|
|
|
|
9a280ac0-c8e0-11d1-84e2-00c04fb998a2 TcpIp
|
|
#typev Send 10 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Send to %10!13s!:%12!05d! from %11!13s!:%13!05d! of %14!5d! bytes"
|
|
{
|
|
saddr, ItemIPAddr
|
|
daddr, ItemIPAddr
|
|
sport, ItemUShort
|
|
dport, ItemUShort
|
|
size, ItemULong
|
|
PID, ItemULongX
|
|
}
|
|
#typev Recv 11 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Receive from %10!13s!:%12!05d! to %11!13s!:%13!05d! of %14!5d! bytes"
|
|
{
|
|
saddr, ItemIPAddr
|
|
daddr, ItemIPAddr
|
|
sport, ItemUShort
|
|
dport, ItemUShort
|
|
size, ItemULong
|
|
PID, ItemULongX
|
|
}
|
|
#typev Connect 12 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Connect to %10:%12!05D! from %11:%13!05D!"
|
|
#typev Disconnect 13 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>TCPIP Discon From %10:%12!05D! to %11:%13!05D!"
|
|
{
|
|
saddr, ItemIPAddr
|
|
daddr, ItemIPAddr
|
|
sport, ItemUShort
|
|
dport, ItemUShort
|
|
size, ItemULong
|
|
PID, ItemULongX
|
|
}
|
|
|
|
bf3a50c5-a9c9-4988-a005-2df0b7c80f80 UdpIp
|
|
#typev Send 10 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>UDP Send to %11!13s!:%12!05d! from %14!13s!:%15!05d! of %13!5d! bytes (Context= %10!08X!)"
|
|
#typev Recv 11 "%15!08X!.%3!08X!::%4!s! [%1!s!] <%9!d!>UDP Receive from %11!13s!:%12!05d! to %14!13s!:%15!05d! of %13!5d! bytes (Context= %10!08X!)"
|
|
{
|
|
context, ItemULongX /10
|
|
destaddr, ItemIPAddr /11
|
|
destport, ItemUShort /12
|
|
Bufrsize, ItemUShort /13
|
|
srcdaddr, ItemIPAddr /14
|
|
srcport, ItemUShort /15
|
|
sentsize, ItemUShort /16
|
|
}
|
|
|
|
//******************************************
|
|
// Test Events
|
|
// d58c126f-b309-11d1-969e-0000f875a5bc
|
|
//******************************************
|
|
ce5b1020-8ea9-11d0-a4ec-00a0c9062910 TraceDp
|
|
#type Start 1
|
|
#type End 2
|
|
{
|
|
UserData, ItemULong
|
|
}
|
|
//******************************************
|
|
// Test Events
|
|
// 1bd67283-57cc-11d2-9a03-00c04f72c722
|
|
//******************************************
|
|
1bd67283-57cc-11d2-9a03-00c04f72c722 TranProv
|
|
#type Start 1
|
|
#type End 2
|
|
{
|
|
UserData, ItemULong
|
|
}
|
|
|
|
//******************************************
|
|
// DS Events
|
|
// 1c83b2fc-c04f-11d1-8afc-00c04fc21914
|
|
//******************************************
|
|
|
|
5b7eb15d-7441-11d2-b711-00c04fb998a2 DsKccGuid
|
|
#type Start 1
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Null1, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd000-daeb-11d1-be80-00c04fadfff5 DsDirSearch
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
Caller, ItemDSString
|
|
Choice, ItemDSString
|
|
ObjDN, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd001-daeb-11d1-be80-00c04fadfff5 DsDirAddEntry
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
Caller, ItemDSString
|
|
ObjDn, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd002-daeb-11d1-be80-00c04fadfff5 DsDirMod
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
Caller, ItemDSString
|
|
ObjDn, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemMLString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemMLString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd005-daeb-11d1-be80-00c04fadfff5 DsDirModDN
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Caller, ItemDSString
|
|
ObjDn, ItemDSString
|
|
NewParentDn, ItemDSString
|
|
NewName, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd003-daeb-11d1-be80-00c04fadfff5 DsDirDel
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
Caller, ItemDSString
|
|
ObjDn, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemMLString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemMLString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd004-daeb-11d1-be80-00c04fadfff5 DsDirCompare
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
Caller, ItemDSString
|
|
AssertType, ItemDSString
|
|
ObjDn, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd006-daeb-11d1-be80-00c04fadfff5 DsDirGtNcChg
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
UuidDest, ItemDSString
|
|
NcDn, ItemDSString
|
|
UsnVecFrom, ItemDSString
|
|
flags, ItemDSString
|
|
RetCrit, ItemDSString
|
|
ExtOp, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
NumObj, ItemDSString
|
|
NumBytes, ItemDSString
|
|
UsnVecTo, ItemDSString
|
|
ExtRet, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd007-daeb-11d1-be80-00c04fadfff5 DsDirReplSync
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
NcDn, ItemDSString
|
|
DsaOrUuid, ItemDSString
|
|
Options, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId, ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd008-daeb-11d1-be80-00c04fadfff5 DsDirFind
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Caller, ItemDSString
|
|
AttId, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
05acd009-daeb-11d1-be80-00c04fadfff5 DsLdapBind
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Null1, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa22-7f4b-11d2-b389-0000f87a46c8 DsKccTask
|
|
#type Start 1
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Null1, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa23-7f4b-11d2-b389-0000f87a46c8 DsDrsReplSync
|
|
#type Start 1
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ObjDN, ItemDSString
|
|
DraSrc, ItemDSString
|
|
UuidSrc, ItemDSString
|
|
Options, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa24-7f4b-11d2-b389-0000f87a46c8 DsDrsReplGtChg
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
UuidDest, ItemDSString
|
|
NcDn, ItemDSString
|
|
UsnFromHighObj, ItemDSString
|
|
UsnFromHighProp, ItemDSString
|
|
Flags, ItemDSString
|
|
MaxObj, ItemDSString
|
|
MaxBytes, ItemDSString
|
|
ExtOp, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
UsnToHighObj, ItemDSString
|
|
UsnToHighProp, ItemDSString
|
|
NumObj, ItemDSString
|
|
NumByte, ItemDSString
|
|
ExtRet, ItemDSString
|
|
ErrCode, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa25-7f4b-11d2-b389-0000f87a46c8 DsDrsUpdtRefs
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
NcDn, ItemDSString
|
|
DsaDest, ItemDSString
|
|
UuidDest, ItemDSString
|
|
Options, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa26-7f4b-11d2-b389-0000f87a46c8 DsDrsReplAdd
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
NcDn, ItemDSString
|
|
SrcDsaDn, ItemDSString
|
|
TransDn, ItemDSString
|
|
DsaSrc, ItemDSString
|
|
Options, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa27-7f4b-11d2-b389-0000f87a46c8 DsDrsReplMod
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
NcDn, ItemDSString
|
|
UuidSrc, ItemDSString
|
|
SrcDra, ItemDSString
|
|
RepFlags, ItemDSString
|
|
ModFields, ItemDSString
|
|
Options, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa28-7f4b-11d2-b389-0000f87a46c8 DsDrsReplDel
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
NcDn, ItemDSString
|
|
DsaSrc, ItemDSString
|
|
Options, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa29-7f4b-11d2-b389-0000f87a46c8 DsDrsVrfyNames
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
cNames, ItemDSString
|
|
Flags, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa2a-7f4b-11d2-b389-0000f87a46c8 DsDrsIntDmMv
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
SrcDsaDn, ItemDSString
|
|
SrcObjDn, ItemDSString
|
|
DstNameDn, ItemDSString
|
|
TargetNcDn, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa2b-7f4b-11d2-b389-0000f87a46c8 DsDrsAddEntry
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
cObj, ItemDSString
|
|
NameDn, ItemDSString
|
|
NextNameDn, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
cObjAdded, ItemDSString
|
|
ErrCode, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa2c-7f4b-11d2-b389-0000f87a46c8 DsDrsExecKcc
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
TaskId, ItemDSString
|
|
Flags, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa2d-7f4b-11d2-b389-0000f87a46c8 DsDrsGtReplInfo
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
InfoType, ItemDSString
|
|
ObjDn, ItemDSString
|
|
UuidSrc, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa2e-7f4b-11d2-b389-0000f87a46c8 DsDrsGtNT4ChgLg
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
flags, ItemDSString
|
|
maxLen, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
NtStatus, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa2f-7f4b-11d2-b389-0000f87a46c8 DsDrsCrackNames
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
cNames, ItemDSString
|
|
CodePage, ItemDSString
|
|
LocaleId, ItemDSString
|
|
FmtOffered, ItemDSString
|
|
FmtDesired, ItemDSString
|
|
Flags, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa30-7f4b-11d2-b389-0000f87a46c8 DsDrsWrtSPN
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Account, ItemDSString
|
|
Op, ItemDSString
|
|
cSpn, ItemDSString
|
|
Flags, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa31-7f4b-11d2-b389-0000f87a46c8 DsDrsDCInfo
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Domain, ItemDSString
|
|
InfoLevel, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
14f8aa32-7f4b-11d2-b389-0000f87a46c8 DsDrsGtMbrshps
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
cDsNames, ItemDSString
|
|
OpType, ItemDSString
|
|
LimitDomDn, ItemDSString
|
|
Flags, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
ErrCode, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
5b7eb154-7441-11d2-b711-00c04fb998a2 LdapAtqGuid
|
|
#type Start 1
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
}
|
|
|
|
b9d4702a-6a98-11d2-b710-00c04fb998a2 LdapRequest
|
|
#type Start 1
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Choice, ItemDSString
|
|
Null2, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
#type End 2
|
|
{
|
|
Signature, ItemCharSign
|
|
Version, ItemCharShort
|
|
Inserts, ItemCharShort
|
|
messageId, ItemULong
|
|
BindId,ItemULong
|
|
Id, ItemDSString
|
|
ErrCode, ItemDSString
|
|
Null3, ItemDSString
|
|
Null4, ItemDSString
|
|
Null5, ItemDSString
|
|
Null6, ItemDSString
|
|
Null7, ItemDSString
|
|
Null8, ItemDSString
|
|
}
|
|
|
|
//******************************************
|
|
// KDC Events
|
|
// 24db8964-e6bc-11d1-916a-0000f8045b04
|
|
//******************************************
|
|
|
|
50af5304-e6bc-11d1-916a-0000f8045b04 GetASTicket
|
|
#type Start 1
|
|
{
|
|
KdcOption, ItemULongX
|
|
}
|
|
#type End 2
|
|
{
|
|
KerbErr, ItemULongX
|
|
Client, ItemPWString
|
|
Server, ItemPWString
|
|
RequestRealm, ItemPWString
|
|
}
|
|
|
|
c11cf384-e6bd-11d1-916a-0000f8045b04 TGSRequest
|
|
#type Start 1
|
|
{
|
|
KdcOption, ItemULongX
|
|
}
|
|
#type End 2
|
|
{
|
|
KerbErr, ItemULongX
|
|
Client, ItemPWString
|
|
ServerAcct, ItemPWString
|
|
ClientRealm, ItemPWString
|
|
}
|
|
|
|
//******************************************
|
|
// SAM Events
|
|
// 8e598056-8993-11d2-819e-0000f875a064
|
|
//******************************************
|
|
|
|
39511dbe-899b-11d2-819e-0000f875a064 SamUserCreate
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
abb14b68-899b-11d2-819e-0000f875a064 SamCompCreate
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
c8eb5e5c-899c-11d2-819e-0000f875a064 SamGrpCreate
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
f9d2ba6a-899c-11d2-819e-0000f875a064 SamAddMemGrp
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
250959aa-899d-11d2-819e-0000f875a064 SamDelMemGrp
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
45fc997e-899d-11d2-819e-0000f875a064 SamPwdChng
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
62bef71e-899d-11d2-819e-0000f875a064 SamUserPwdSet
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
880217b8-899d-11d2-819e-0000f875a064 SamCompPwdSet
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
1f228de8-8a6c-11d2-819e-0000f875a064 SamPwdPushPdc
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
a41d90bc-899d-11d2-819e-0000f875a064 SamIdByName
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
25059476-899f-11d2-819e-0000f875a064 SamNameById
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
//******************************************
|
|
// LSA Events
|
|
// cc85922f-db41-11d2-9244-006008269001 MSLSATrace
|
|
//******************************************
|
|
|
|
cc85922e-db41-11d2-9244-006008269001 QuerySecret
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe3b-dbf6-11d2-9244-006008269001 Close
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe3a-dbf6-11d2-9244-006008269001 OpenPolicy
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe39-dbf6-11d2-9244-006008269001 QueryInformationPolicy
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe38-dbf6-11d2-9244-006008269001 SetInformationPolicy
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe37-dbf6-11d2-9244-006008269001 EnumerateTrustedDomains
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe36-dbf6-11d2-9244-006008269001 LookupNames
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe35-dbf6-11d2-9244-006008269001 LookupSids
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe34-dbf6-11d2-9244-006008269001 OpenTrustedDomain
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe33-dbf6-11d2-9244-006008269001 QueryInfoTrustedDomain
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe32-dbf6-11d2-9244-006008269001 SetInformationTrustedDomain
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe31-dbf6-11d2-9244-006008269001 QueryInformationPolicy2
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe30-dbf6-11d2-9244-006008269001 SetInformationPolicy2
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe2f-dbf6-11d2-9244-006008269001 QueryTrustedDomainInfoByName
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe2e-dbf6-11d2-9244-006008269001 SetTrustedDomainInfoByName
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe2d-dbf6-11d2-9244-006008269001 EnumerateTrustedDomainsEx
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe2c-dbf6-11d2-9244-006008269001 CreateTrustedDomainEx
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe2b-dbf6-11d2-9244-006008269001 QueryDomainInformationPolicy
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe2a-dbf6-11d2-9244-006008269001 SetDomainInformationPolicy
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
2306fe29-dbf6-11d2-9244-006008269001 OpenTrustedDomainByName
|
|
#type Start 1
|
|
#type End 2
|
|
|
|
// Netdevice
|
|
f404cdf8-6926-11d2-a059-00a0c95b7f08 NetDevice
|
|
#typev Normal 10 "%11!2d!, %4: %12!s!"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
Message, ItemString // 12
|
|
}
|
|
#type BytesIndicated 11 "%11, %4: NDBothHandleReceiveIndication (%15): Conn[%12], Indicated %13, Available %14"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
ConnIdx, ItemUShort // 12
|
|
Indicated, ItemULong // 13
|
|
Available, ItemULong // 14
|
|
Message, ItemString // 15
|
|
}
|
|
#type BuildReceiveIrpEnter 20 "%11, %4: NDBothBuildReceiveIrp: Entry"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
}
|
|
#type BuildReceiveIrpInfo 23 "%11, %4: NDBothBuildReceiveIrp as %13: Conn[%12], Phase = %14"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
ConnIdx, ItemUShort // 12
|
|
DriverType,ItemString // 13
|
|
ConnPhase, ItemString // 14
|
|
}
|
|
#type BuildReceiveIrpCounts 26 "%11, %4: NDBothBuildReceiveIrp as %17: Bytes for Sec %12, Buf %13, Hdr %14, Rcb In = %15, Out = %16"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
SecBytes,ItemULong // 12
|
|
BufBytes,ItemULong // 13
|
|
HdrBytes,ItemULong // 14
|
|
RcbInIdx,ItemUShort // 15
|
|
RcbOutIdx,ItemUShort // 16
|
|
DriverType,ItemString // 17
|
|
}
|
|
#type BuildReceiveIrpExit 29 "%11, %4: NDBothBuildReceiveIrp: Exit"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
}
|
|
#type ProcessIncomingBufferEntry 120 "%11, %4: NDBothProcessIncomingBuffer: Entry"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
}
|
|
#type ProcessIncomingBufferIgnore 126 "%11, %4: NDBothProcessIncomingBuffer: Ignoring Message"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
}
|
|
#type ProcessIncomingBufferExit 129 "%11, %4: NDBothProcessIncomingBuffer: Exit"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
}
|
|
#type ProcessNewHeaderEnter 130 "%11, %4: NDBothProcessNewHeader: Entry"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
}
|
|
#type ProcessNewHeaderAnnounce 132 "%11, %4: NDBothProcessNewHeader as %16 for RCB[%12] on Conn[%15] is Rqst Id 0x%13_%14"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
RCB Idx, ItemUShort // 12
|
|
Rqst IdH,ItemULongX // 13
|
|
Rqst IdL,ItemULongX // 14
|
|
Conn Idx,ItemUShort // 15
|
|
DriverType,ItemString // 16
|
|
}
|
|
#type ProcessNewHeaderExit 148 "%11, %4: NDBothProcessNewHeader: Exit"
|
|
{
|
|
Ordinal, ItemULongX // 10
|
|
CPU Num, ItemUShort // 11
|
|
}
|
|
|
|
|
|
5eb2d7d2-c2af-11d2-afc3-00c04f8ef2f7 Sample
|
|
#typev Ascii 10 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!> Type: %2, Seq: %10!d! Str1: %11!s!"
|
|
//#typev Ascii 0 "0,%3!08X!,%4!s!,%1!s!,%9!d!,%2,%10!d!,%11!s!"
|
|
{
|
|
Sequence, ItemUlong // 10
|
|
AsciiStr, ItemString // 11
|
|
}
|
|
//#typev Wchar 11 "00000000.%3!08X!::%4!s! [%1!s!] <%9!d!> Type: %2!s!, Seq: %10!d! Str1: %11!s!"
|
|
//#typev Wchar 11 "0,%3!08X!,%4!s!,%1!s!,%9!d!,%2,%10!d!,%11!s!"
|
|
//{
|
|
// Sequence,ItemUlong // 10
|
|
// UnicodeStr, ItemWString // 11
|
|
//}
|
|
|
|
|
|
|