Coverage Report

Created: 2026-09-28 06:52

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/wireshark/epan/dissectors/packet-windows-common.c
Line
Count
Source
1
/* packet-windows-common.c
2
 * Routines for dissecting various Windows data types
3
 *
4
 * Wireshark - Network traffic analyzer
5
 * By Gerald Combs <gerald@wireshark.org>
6
 * Copyright 1998 Gerald Combs
7
 *
8
 * SPDX-License-Identifier: GPL-2.0-or-later
9
 */
10
11
#include "config.h"
12
13
14
#include <epan/packet.h>
15
#include <epan/expert.h>
16
#include <epan/exceptions.h>
17
#include "packet-smb-sidsnooping.h"
18
#include "packet-windows-common.h"
19
#include <epan/tfs.h>
20
#include <wsutil/array.h>
21
#include "packet-smb.h" /* for "sid_name_snooping" */
22
23
/* The types used in [MS-DTYP] v20180912 should be interpreted as
24
 * follows (all multi-byte integer types are little endian):
25
 * typedef uint8_t MS_BYTE;
26
 * typedef uint16_t MS_WORD;
27
 * typedef uint32_t MS_DWORD;
28
 * typedef uint64_t MS_QWORD;
29
 * typedef uint64_t MS_ULONG64;
30
 * typedef uint64_t MS_DWORD64;
31
 * typedef int64_t MS_LONG64;
32
 */
33
34
enum cond_ace_token {
35
#define DEF_COND_ACE_TOKEN(VAL, VAR, STR) COND_ACE_TOKEN_ ## VAR = VAL,
36
#define DEF_COND_ACE_TOKEN_WITH_DATA DEF_COND_ACE_TOKEN
37
#include "cond_ace_token_enum.h"
38
  COND_ACE_TOKEN_UNKNOWN = -1
39
};
40
41
static const value_string ace_cond_token_vals[] = {
42
#define DEF_COND_ACE_TOKEN(VAL, VAR, STR) {VAL, STR},
43
#define DEF_COND_ACE_TOKEN_WITH_DATA DEF_COND_ACE_TOKEN
44
#include "cond_ace_token_enum.h"
45
  { 0, NULL }
46
};
47
48
static bool
49
0
ace_cond_token_has_data(uint8_t token) {
50
0
  switch (token) {
51
0
#define DEF_COND_ACE_TOKEN(VAL, VAR, STR)
52
0
#define DEF_COND_ACE_TOKEN_WITH_DATA(VAL, VAR, STR) case VAL:
53
0
#include "cond_ace_token_enum.h"
54
0
    return true;
55
0
  }
56
0
  return false;
57
0
}
58
59
static const value_string ace_cond_base_vals[] = {
60
  { 0x01, "OCT" },
61
  { 0x02, "DEC" },
62
  { 0x03, "HEX" },
63
  { 0, NULL }
64
};
65
66
static const value_string ace_cond_sign_vals[] = {
67
  { 0x01, "PLUS" },
68
  { 0x02, "MINUS" },
69
  { 0x03, "NONE" },
70
  { 0, NULL }
71
};
72
73
74
0
#define CLAIM_SECURITY_ATTRIBUTE_TYPE_INT64           0x0001
75
0
#define CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64          0x0002
76
0
#define CLAIM_SECURITY_ATTRIBUTE_TYPE_STRING          0x0003
77
0
#define CLAIM_SECURITY_ATTRIBUTE_TYPE_SID             0x0005
78
0
#define CLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN         0x0006
79
0
#define CLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING    0x0010
80
81
static const value_string ace_sra_type_vals[] = {
82
  { CLAIM_SECURITY_ATTRIBUTE_TYPE_INT64, "INT64" },
83
  { CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64, "UINT64" },
84
  { CLAIM_SECURITY_ATTRIBUTE_TYPE_STRING, "STRING" },
85
  { CLAIM_SECURITY_ATTRIBUTE_TYPE_SID, "SID"},
86
  { CLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN, "BOOLEAN" },
87
  { CLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING, "OCTET_STRING" },
88
  { 0, NULL }
89
};
90
91
static int hf_nt_sec_desc_revision;
92
static int hf_nt_sec_desc_type_owner_defaulted;
93
static int hf_nt_sec_desc_type_group_defaulted;
94
static int hf_nt_sec_desc_type_dacl_present;
95
static int hf_nt_sec_desc_type_dacl_defaulted;
96
static int hf_nt_sec_desc_type_sacl_present;
97
static int hf_nt_sec_desc_type_sacl_defaulted;
98
static int hf_nt_sec_desc_type_dacl_trusted;
99
static int hf_nt_sec_desc_type_server_security;
100
static int hf_nt_sec_desc_type_dacl_auto_inherit_req;
101
static int hf_nt_sec_desc_type_sacl_auto_inherit_req;
102
static int hf_nt_sec_desc_type_dacl_auto_inherited;
103
static int hf_nt_sec_desc_type_sacl_auto_inherited;
104
static int hf_nt_sec_desc_type_dacl_protected;
105
static int hf_nt_sec_desc_type_sacl_protected;
106
static int hf_nt_sec_desc_type_rm_control_valid;
107
static int hf_nt_sec_desc_type_self_relative;
108
static int hf_nt_sid;
109
static int hf_nt_sid_revision;
110
static int hf_nt_sid_num_auth;
111
static int hf_nt_sid_auth_dec;
112
static int hf_nt_sid_auth_hex;
113
static int hf_nt_sid_subauth;
114
static int hf_nt_sid_rid_dec;
115
static int hf_nt_sid_rid_hex;
116
static int hf_nt_sid_wkwn;
117
static int hf_nt_sid_domain;
118
static int hf_nt_acl_revision;
119
static int hf_nt_acl_size;
120
static int hf_nt_acl_num_aces;
121
static int hf_nt_ace_flags_object_inherit;
122
static int hf_nt_ace_flags_container_inherit;
123
static int hf_nt_ace_flags_non_propagate_inherit;
124
static int hf_nt_ace_flags_inherit_only;
125
static int hf_nt_ace_flags_inherited_ace;
126
static int hf_nt_ace_flags_successful_access;
127
static int hf_nt_ace_flags_failed_access;
128
static int hf_nt_ace_type;
129
static int hf_nt_ace_size;
130
static int hf_nt_ace_flags_object_type_present;
131
static int hf_nt_ace_flags_inherited_object_type_present;
132
static int hf_nt_ace_guid;
133
static int hf_nt_ace_inherited_guid;
134
135
/* Conditional ACE dissect */
136
static int hf_nt_ace_cond;
137
static int hf_nt_ace_cond_token;
138
static int hf_nt_ace_cond_sign;
139
static int hf_nt_ace_cond_base;
140
static int hf_nt_ace_cond_value_int8;
141
static int hf_nt_ace_cond_value_int16;
142
static int hf_nt_ace_cond_value_int32;
143
static int hf_nt_ace_cond_value_int64;
144
static int hf_nt_ace_cond_value_string;
145
static int hf_nt_ace_cond_value_octet_string;
146
static int hf_nt_ace_cond_local_attr;
147
static int hf_nt_ace_cond_user_attr;
148
static int hf_nt_ace_cond_resource_attr;
149
static int hf_nt_ace_cond_device_attr;
150
151
/* System Resource Attribute ACE dissect */
152
static int hf_nt_ace_sra;
153
static int hf_nt_ace_sra_name_offset;
154
static int hf_nt_ace_sra_name;
155
static int hf_nt_ace_sra_type;
156
static int hf_nt_ace_sra_reserved;
157
static int hf_nt_ace_sra_flags;
158
static int hf_nt_ace_sra_flags_manual;
159
static int hf_nt_ace_sra_flags_policy_derived;
160
static int hf_nt_ace_sra_flags_non_inheritable;
161
static int hf_nt_ace_sra_flags_case_sensitive;
162
static int hf_nt_ace_sra_flags_deny_only;
163
static int hf_nt_ace_sra_flags_disabled_by_default;
164
static int hf_nt_ace_sra_flags_disabled;
165
static int hf_nt_ace_sra_flags_mandatory;
166
static int hf_nt_ace_sra_value_count;
167
static int hf_nt_ace_sra_value_offset;
168
static int hf_nt_ace_sra_value_int64;
169
static int hf_nt_ace_sra_value_uint64;
170
static int hf_nt_ace_sra_value_string;
171
static int hf_nt_ace_sra_value_sid;
172
static int hf_nt_ace_sra_value_boolean;
173
static int hf_nt_ace_sra_value_octet_string;
174
175
static int hf_nt_security_information_sacl;
176
static int hf_nt_security_information_dacl;
177
static int hf_nt_security_information_group;
178
static int hf_nt_security_information_owner;
179
180
/* Generated from convert_proto_tree_add_text.pl */
181
static int hf_nt_security_information;
182
static int hf_nt_sec_desc_type;
183
static int hf_nt_offset_to_dacl;
184
static int hf_nt_offset_to_owner_sid;
185
static int hf_nt_ace_flags_object;
186
static int hf_nt_offset_to_group_sid;
187
static int hf_nt_ace_flags;
188
static int hf_nt_offset_to_sacl;
189
190
static int ett_nt_sec_desc;
191
static int ett_nt_sec_desc_type;
192
static int ett_nt_sid;
193
static int ett_nt_acl;
194
static int ett_nt_ace;
195
static int ett_nt_ace_flags;
196
static int ett_nt_ace_object;
197
static int ett_nt_ace_object_flags;
198
static int ett_nt_security_information;
199
static int ett_nt_ace_cond;
200
static int ett_nt_ace_cond_data;
201
static int ett_nt_ace_sra;
202
static int ett_nt_ace_sra_flags;
203
static int ett_nt_ace_sra_value_offsets;
204
static int ett_nt_ace_sra_values;
205
206
static expert_field ei_nt_owner_sid_beyond_data;
207
static expert_field ei_nt_owner_sid_beyond_reassembled_data;
208
static expert_field ei_nt_ace_extends_beyond_data;
209
static expert_field ei_nt_ace_extends_beyond_reassembled_data;
210
static expert_field ei_nt_group_sid_beyond_data;
211
static expert_field ei_nt_group_sid_beyond_reassembled_data;
212
static expert_field ei_nt_item_offs_out_of_range;
213
214
215
/* WERR error codes */
216
217
VALUE_STRING_ARRAY2(WERR_errors);
218
value_string_ext WERR_errors_ext = VALUE_STRING_EXT_INIT(WERR_errors);
219
220
/*
221
 * HRES error codes.
222
 */
223
224
VALUE_STRING_ARRAY2(HRES_errors);
225
value_string_ext HRES_errors_ext = VALUE_STRING_EXT_INIT(HRES_errors);
226
227
228
/*
229
 * DOS error codes.
230
 */
231
232
VALUE_STRING_ARRAY(DOS_errors);
233
value_string_ext DOS_errors_ext = VALUE_STRING_EXT_INIT(DOS_errors);
234
235
/*
236
 * NT error codes.
237
 *
238
 * From
239
 *
240
 *  https://web.archive.org/web/20100503121824/http://www.wildpackets.com/elements/misc/SMB_NT_Status_Codes.txt
241
 *
242
 * See also MS-ERREF section 2.3.1 "NTSTATUS Values":
243
 *
244
 *  https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
245
 */
246
static const value_string NT_errors[] = {
247
  { 0x00000000, "STATUS_SUCCESS" },
248
  /*{ 0x00000000, "STATUS_WAIT_0" }, */
249
  { 0x00000001, "STATUS_WAIT_1" },
250
  { 0x00000002, "STATUS_WAIT_2" },
251
  { 0x00000003, "STATUS_WAIT_3" },
252
  { 0x0000003F, "STATUS_WAIT_63" },
253
  { 0x00000080, "STATUS_ABANDONED" },
254
  /*{ 0x00000080, "STATUS_ABANDONED_WAIT_0" },*/
255
  { 0x000000BF, "STATUS_ABANDONED_WAIT_63" },
256
  { 0x000000C0, "STATUS_USER_APC" },
257
  { 0x00000100, "STATUS_KERNEL_APC" },
258
  { 0x00000101, "STATUS_ALERTED" },
259
  { 0x00000102, "STATUS_TIMEOUT" },
260
  { 0x00000103, "STATUS_PENDING" },
261
  { 0x00000104, "STATUS_REPARSE" },
262
  { 0x00000105, "STATUS_MORE_ENTRIES" },
263
  { 0x00000106, "STATUS_NOT_ALL_ASSIGNED" },
264
  { 0x00000107, "STATUS_SOME_NOT_MAPPED" },
265
  { 0x00000108, "STATUS_OPLOCK_BREAK_IN_PROGRESS" },
266
  { 0x00000109, "STATUS_VOLUME_MOUNTED" },
267
  { 0x0000010A, "STATUS_RXACT_COMMITTED" },
268
  { 0x0000010B, "STATUS_NOTIFY_CLEANUP" },
269
  { 0x0000010C, "STATUS_NOTIFY_ENUM_DIR" },
270
  { 0x0000010D, "STATUS_NO_QUOTAS_FOR_ACCOUNT" },
271
  { 0x0000010E, "STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED" },
272
  { 0x00000110, "STATUS_PAGE_FAULT_TRANSITION" },
273
  { 0x00000111, "STATUS_PAGE_FAULT_DEMAND_ZERO" },
274
  { 0x00000112, "STATUS_PAGE_FAULT_COPY_ON_WRITE" },
275
  { 0x00000113, "STATUS_PAGE_FAULT_GUARD_PAGE" },
276
  { 0x00000114, "STATUS_PAGE_FAULT_PAGING_FILE" },
277
  { 0x00000115, "STATUS_CACHE_PAGE_LOCKED" },
278
  { 0x00000116, "STATUS_CRASH_DUMP" },
279
  { 0x00000117, "STATUS_BUFFER_ALL_ZEROS" },
280
  { 0x00000118, "STATUS_REPARSE_OBJECT" },
281
  { 0x00000119, "STATUS_RESOURCE_REQUIREMENTS_CHANGED" },
282
  { 0x00000120, "STATUS_TRANSLATION_COMPLETE" },
283
  { 0x00000121, "STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY" },
284
  { 0x00000122, "STATUS_NOTHING_TO_TERMINATE" },
285
  { 0x00000123, "STATUS_PROCESS_NOT_IN_JOB" },
286
  { 0x00000124, "STATUS_PROCESS_IN_JOB" },
287
  { 0x00000125, "STATUS_VOLSNAP_HIBERNATE_READY" },
288
  { 0x00000126, "STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY" },
289
  { 0x00000127, "STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED" },
290
  { 0x00000128, "STATUS_INTERRUPT_STILL_CONNECTED" },
291
  { 0x00000129, "STATUS_PROCESS_CLONED" },
292
  { 0x0000012A, "STATUS_FILE_LOCKED_WITH_ONLY_READERS" },
293
  { 0x0000012B, "STATUS_FILE_LOCKED_WITH_WRITERS" },
294
  { 0x00000202, "STATUS_RESOURCEMANAGER_READ_ONLY" },
295
  { 0x00000367, "STATUS_WAIT_FOR_OPLOCK" },
296
  { 0x0000045C, "STATUS_NO_SHUTDOWN_IN_PROGRESS" },
297
  { 0x00010001, "STATUS_DBG_EXCEPTION_HANDLED" },
298
  { 0x00010002, "STATUS_DBG_CONTINUE" },
299
  { 0x001C0001, "STATUS_FLT_IO_COMPLETE" },
300
  { 0x40000000, "STATUS_OBJECT_NAME_EXISTS" },
301
  { 0x40000001, "STATUS_THREAD_WAS_SUSPENDED" },
302
  { 0x40000002, "STATUS_WORKING_SET_LIMIT_RANGE" },
303
  { 0x40000003, "STATUS_IMAGE_NOT_AT_BASE" },
304
  { 0x40000004, "STATUS_RXACT_STATE_CREATED" },
305
  { 0x40000005, "STATUS_SEGMENT_NOTIFICATION" },
306
  { 0x40000006, "STATUS_LOCAL_USER_SESSION_KEY" },
307
  { 0x40000007, "STATUS_BAD_CURRENT_DIRECTORY" },
308
  { 0x40000008, "STATUS_SERIAL_MORE_WRITES" },
309
  { 0x40000009, "STATUS_REGISTRY_RECOVERED" },
310
  { 0x4000000A, "STATUS_FT_READ_RECOVERY_FROM_BACKUP" },
311
  { 0x4000000B, "STATUS_FT_WRITE_RECOVERY" },
312
  { 0x4000000C, "STATUS_SERIAL_COUNTER_TIMEOUT" },
313
  { 0x4000000D, "STATUS_NULL_LM_PASSWORD" },
314
  { 0x4000000E, "STATUS_IMAGE_MACHINE_TYPE_MISMATCH" },
315
  { 0x4000000F, "STATUS_RECEIVE_PARTIAL" },
316
  { 0x40000010, "STATUS_RECEIVE_EXPEDITED" },
317
  { 0x40000011, "STATUS_RECEIVE_PARTIAL_EXPEDITED" },
318
  { 0x40000012, "STATUS_EVENT_DONE" },
319
  { 0x40000013, "STATUS_EVENT_PENDING" },
320
  { 0x40000014, "STATUS_CHECKING_FILE_SYSTEM" },
321
  { 0x40000015, "STATUS_FATAL_APP_EXIT" },
322
  { 0x40000016, "STATUS_PREDEFINED_HANDLE" },
323
  { 0x40000017, "STATUS_WAS_UNLOCKED" },
324
  { 0x40000018, "STATUS_SERVICE_NOTIFICATION" },
325
  { 0x40000019, "STATUS_WAS_LOCKED" },
326
  { 0x4000001A, "STATUS_LOG_HARD_ERROR" },
327
  { 0x4000001B, "STATUS_ALREADY_WIN32" },
328
  { 0x4000001C, "STATUS_WX86_UNSIMULATE" },
329
  { 0x4000001D, "STATUS_WX86_CONTINUE" },
330
  { 0x4000001E, "STATUS_WX86_SINGLE_STEP" },
331
  { 0x4000001F, "STATUS_WX86_BREAKPOINT" },
332
  { 0x40000020, "STATUS_WX86_EXCEPTION_CONTINUE" },
333
  { 0x40000021, "STATUS_WX86_EXCEPTION_LASTCHANCE" },
334
  { 0x40000022, "STATUS_WX86_EXCEPTION_CHAIN" },
335
  { 0x40000023, "STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE" },
336
  { 0x40000024, "STATUS_NO_YIELD_PERFORMED" },
337
  { 0x40000025, "STATUS_TIMER_RESUME_IGNORED" },
338
  { 0x40000026, "STATUS_ARBITRATION_UNHANDLED" },
339
  { 0x40000027, "STATUS_CARDBUS_NOT_SUPPORTED" },
340
  { 0x40000028, "STATUS_WX86_CREATEWX86TIB" },
341
  { 0x40000029, "STATUS_MP_PROCESSOR_MISMATCH" },
342
  { 0x4000002A, "STATUS_HIBERNATED" },
343
  { 0x4000002B, "STATUS_RESUME_HIBERNATION" },
344
  { 0x4000002C, "STATUS_FIRMWARE_UPDATED" },
345
  { 0x4000002D, "STATUS_DRIVERS_LEAKING_LOCKED_PAGES" },
346
  { 0x4000002E, "STATUS_MESSAGE_RETRIEVED" },
347
  { 0x4000002F, "STATUS_SYSTEM_POWERSTATE_TRANSITION" },
348
  { 0x40000030, "STATUS_ALPC_CHECK_COMPLETION_LIST" },
349
  { 0x40000031, "STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION" },
350
  { 0x40000032, "STATUS_ACCESS_AUDIT_BY_POLICY" },
351
  { 0x40000033, "STATUS_ABANDON_HIBERFILE" },
352
  { 0x40000034, "STATUS_BIZRULES_NOT_ENABLED" },
353
  { 0x40000294, "STATUS_WAKE_SYSTEM" },
354
  { 0x40000370, "STATUS_DS_SHUTTING_DOWN" },
355
  { 0x40010001, "STATUS_DBG_REPLY_LATER" },
356
  { 0x40010002, "STATUS_DBG_UNABLE_TO_PROVIDE_HANDLE" },
357
  { 0x40010003, "STATUS_DBG_TERMINATE_THREAD" },
358
  { 0x40010004, "STATUS_DBG_TERMINATE_PROCESS" },
359
  { 0x40010005, "STATUS_DBG_CONTROL_C" },
360
  { 0x40010006, "STATUS_DBG_PRINTEXCEPTION_C" },
361
  { 0x40010007, "STATUS_DBG_RIPEXCEPTION" },
362
  { 0x40010008, "STATUS_DBG_CONTROL_BREAK" },
363
  { 0x40010009, "STATUS_DBG_COMMAND_EXCEPTION" },
364
  { 0x40020056, "STATUS_RPC_UUID_LOCAL_ONLY" },
365
  { 0x400200AF, "STATUS_RPC_SEND_INCOMPLETE" },
366
  { 0x400A0004, "STATUS_CTX_CDM_CONNECT" },
367
  { 0x400A0005, "STATUS_CTX_CDM_DISCONNECT" },
368
  { 0x4015000D, "STATUS_SXS_RELEASE_ACTIVATION_CONTEXT" },
369
  { 0x40190034, "STATUS_RECOVERY_NOT_NEEDED" },
370
  { 0x40190035, "STATUS_RM_ALREADY_STARTED" },
371
  { 0x401A000C, "STATUS_LOG_NO_RESTART" },
372
  { 0x401B00EC, "STATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST" },
373
  { 0x401E000A, "STATUS_GRAPHICS_PARTIAL_DATA_POPULATED" },
374
  { 0x401E0117, "STATUS_GRAPHICS_DRIVER_MISMATCH" },
375
  { 0x401E0307, "STATUS_GRAPHICS_MODE_NOT_PINNED" },
376
  { 0x401E031E, "STATUS_GRAPHICS_NO_PREFERRED_MODE" },
377
  { 0x401E034B, "STATUS_GRAPHICS_DATASET_IS_EMPTY" },
378
  { 0x401E034C, "STATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET" },
379
  { 0x401E0351, "STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED" },
380
  { 0x401E042F, "STATUS_GRAPHICS_UNKNOWN_CHILD_STATUS" },
381
  { 0x401E0437, "STATUS_GRAPHICS_LEADLINK_START_DEFERRED" },
382
  { 0x401E0439, "STATUS_GRAPHICS_POLLING_TOO_FREQUENTLY" },
383
  { 0x401E043A, "STATUS_GRAPHICS_START_DEFERRED" },
384
  { 0x40230001, "STATUS_NDIS_INDICATION_REQUIRED" },
385
  { 0x80000001, "STATUS_GUARD_PAGE_VIOLATION" },
386
  { 0x80000002, "STATUS_DATATYPE_MISALIGNMENT" },
387
  { 0x80000003, "STATUS_BREAKPOINT" },
388
  { 0x80000004, "STATUS_SINGLE_STEP" },
389
  { 0x80000005, "STATUS_BUFFER_OVERFLOW" },
390
  { 0x80000006, "STATUS_NO_MORE_FILES" },
391
  { 0x80000007, "STATUS_WAKE_SYSTEM_DEBUGGER" },
392
  { 0x8000000A, "STATUS_HANDLES_CLOSED" },
393
  { 0x8000000B, "STATUS_NO_INHERITANCE" },
394
  { 0x8000000C, "STATUS_GUID_SUBSTITUTION_MADE" },
395
  { 0x8000000D, "STATUS_PARTIAL_COPY" },
396
  { 0x8000000E, "STATUS_DEVICE_PAPER_EMPTY" },
397
  { 0x8000000F, "STATUS_DEVICE_POWERED_OFF" },
398
  { 0x80000010, "STATUS_DEVICE_OFF_LINE" },
399
  { 0x80000011, "STATUS_DEVICE_BUSY" },
400
  { 0x80000012, "STATUS_NO_MORE_EAS" },
401
  { 0x80000013, "STATUS_INVALID_EA_NAME" },
402
  { 0x80000014, "STATUS_EA_LIST_INCONSISTENT" },
403
  { 0x80000015, "STATUS_INVALID_EA_FLAG" },
404
  { 0x80000016, "STATUS_VERIFY_REQUIRED" },
405
  { 0x80000017, "STATUS_EXTRANEOUS_INFORMATION" },
406
  { 0x80000018, "STATUS_RXACT_COMMIT_NECESSARY" },
407
  { 0x8000001A, "STATUS_NO_MORE_ENTRIES" },
408
  { 0x8000001B, "STATUS_FILEMARK_DETECTED" },
409
  { 0x8000001C, "STATUS_MEDIA_CHANGED" },
410
  { 0x8000001D, "STATUS_BUS_RESET" },
411
  { 0x8000001E, "STATUS_END_OF_MEDIA" },
412
  { 0x8000001F, "STATUS_BEGINNING_OF_MEDIA" },
413
  { 0x80000020, "STATUS_MEDIA_CHECK" },
414
  { 0x80000021, "STATUS_SETMARK_DETECTED" },
415
  { 0x80000022, "STATUS_NO_DATA_DETECTED" },
416
  { 0x80000023, "STATUS_REDIRECTOR_HAS_OPEN_HANDLES" },
417
  { 0x80000024, "STATUS_SERVER_HAS_OPEN_HANDLES" },
418
  { 0x80000025, "STATUS_ALREADY_DISCONNECTED" },
419
  { 0x80000026, "STATUS_LONGJUMP" },
420
  { 0x80000027, "STATUS_CLEANER_CARTRIDGE_INSTALLED" },
421
  { 0x80000028, "STATUS_PLUGPLAY_QUERY_VETOED" },
422
  { 0x80000029, "STATUS_UNWIND_CONSOLIDATE" },
423
  { 0x8000002A, "STATUS_REGISTRY_HIVE_RECOVERED" },
424
  { 0x8000002B, "STATUS_DLL_MIGHT_BE_INSECURE" },
425
  { 0x8000002C, "STATUS_DLL_MIGHT_BE_INCOMPATIBLE" },
426
  { 0x8000002D, "STATUS_STOPPED_ON_SYMLINK" },
427
  { 0x80000288, "STATUS_DEVICE_REQUIRES_CLEANING" },
428
  { 0x80000289, "STATUS_DEVICE_DOOR_OPEN" },
429
  { 0x80000803, "STATUS_DATA_LOST_REPAIR" },
430
  { 0x80010001, "STATUS_DBG_EXCEPTION_NOT_HANDLED" },
431
  { 0x80040111, "MAPI_E_LOGON_FAILED" },
432
  { 0x80090300, "SEC_E_INSUFFICIENT_MEMORY" },
433
  { 0x80090301, "SEC_E_INVALID_HANDLE" },
434
  { 0x80090302, "SEC_E_UNSUPPORTED_FUNCTION" },
435
  { 0x8009030B, "SEC_E_NO_IMPERSONATION" },
436
  { 0x8009030D, "SEC_E_UNKNOWN_CREDENTIALS" },
437
  { 0x8009030E, "SEC_E_NO_CREDENTIALS" },
438
  { 0x8009030F, "SEC_E_MESSAGE_ALTERED" },
439
  { 0x80090310, "SEC_E_OUT_OF_SEQUENCE" },
440
  { 0x80090311, "SEC_E_NO_AUTHENTICATING_AUTHORITY" },
441
  { 0x80130001, "STATUS_CLUSTER_NODE_ALREADY_UP" },
442
  { 0x80130002, "STATUS_CLUSTER_NODE_ALREADY_DOWN" },
443
  { 0x80130003, "STATUS_CLUSTER_NETWORK_ALREADY_ONLINE" },
444
  { 0x80130004, "STATUS_CLUSTER_NETWORK_ALREADY_OFFLINE" },
445
  { 0x80130005, "STATUS_CLUSTER_NODE_ALREADY_MEMBER" },
446
  { 0x80190009, "STATUS_COULD_NOT_RESIZE_LOG" },
447
  { 0x80190029, "STATUS_NO_TXF_METADATA" },
448
  { 0x80190031, "STATUS_CANT_RECOVER_WITH_HANDLE_OPEN" },
449
  { 0x80190041, "STATUS_TXF_METADATA_ALREADY_PRESENT" },
450
  { 0x80190042, "STATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET" },
451
  { 0x801B00EB, "STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED" },
452
  { 0x801C0001, "STATUS_FLT_BUFFER_TOO_SMALL" },
453
  { 0x80210001, "STATUS_FVE_PARTIAL_METADATA" },
454
  { 0x80210002, "STATUS_FVE_TRANSIENT_STATE" },
455
  { 0xC0000001, "STATUS_UNSUCCESSFUL" },
456
  { 0xC0000002, "STATUS_NOT_IMPLEMENTED" },
457
  { 0xC0000003, "STATUS_INVALID_INFO_CLASS" },
458
  { 0xC0000004, "STATUS_INFO_LENGTH_MISMATCH" },
459
  { 0xC0000005, "STATUS_ACCESS_VIOLATION" },
460
  { 0xC0000006, "STATUS_IN_PAGE_ERROR" },
461
  { 0xC0000007, "STATUS_PAGEFILE_QUOTA" },
462
  { 0xC0000008, "STATUS_INVALID_HANDLE" },
463
  { 0xC0000009, "STATUS_BAD_INITIAL_STACK" },
464
  { 0xC000000A, "STATUS_BAD_INITIAL_PC" },
465
  { 0xC000000B, "STATUS_INVALID_CID" },
466
  { 0xC000000C, "STATUS_TIMER_NOT_CANCELED" },
467
  { 0xC000000D, "STATUS_INVALID_PARAMETER" },
468
  { 0xC000000E, "STATUS_NO_SUCH_DEVICE" },
469
  { 0xC000000F, "STATUS_NO_SUCH_FILE" },
470
  { 0xC0000010, "STATUS_INVALID_DEVICE_REQUEST" },
471
  { 0xC0000011, "STATUS_END_OF_FILE" },
472
  { 0xC0000012, "STATUS_WRONG_VOLUME" },
473
  { 0xC0000013, "STATUS_NO_MEDIA_IN_DEVICE" },
474
  { 0xC0000014, "STATUS_UNRECOGNIZED_MEDIA" },
475
  { 0xC0000015, "STATUS_NONEXISTENT_SECTOR" },
476
  { 0xC0000016, "STATUS_MORE_PROCESSING_REQUIRED" },
477
  { 0xC0000017, "STATUS_NO_MEMORY" },
478
  { 0xC0000018, "STATUS_CONFLICTING_ADDRESSES" },
479
  { 0xC0000019, "STATUS_NOT_MAPPED_VIEW" },
480
  { 0xC000001A, "STATUS_UNABLE_TO_FREE_VM" },
481
  { 0xC000001B, "STATUS_UNABLE_TO_DELETE_SECTION" },
482
  { 0xC000001C, "STATUS_INVALID_SYSTEM_SERVICE" },
483
  { 0xC000001D, "STATUS_ILLEGAL_INSTRUCTION" },
484
  { 0xC000001E, "STATUS_INVALID_LOCK_SEQUENCE" },
485
  { 0xC000001F, "STATUS_INVALID_VIEW_SIZE" },
486
  { 0xC0000020, "STATUS_INVALID_FILE_FOR_SECTION" },
487
  { 0xC0000021, "STATUS_ALREADY_COMMITTED" },
488
  { 0xC0000022, "STATUS_ACCESS_DENIED" },
489
  { 0xC0000023, "STATUS_BUFFER_TOO_SMALL" },
490
  { 0xC0000024, "STATUS_OBJECT_TYPE_MISMATCH" },
491
  { 0xC0000025, "STATUS_NONCONTINUABLE_EXCEPTION" },
492
  { 0xC0000026, "STATUS_INVALID_DISPOSITION" },
493
  { 0xC0000027, "STATUS_UNWIND" },
494
  { 0xC0000028, "STATUS_BAD_STACK" },
495
  { 0xC0000029, "STATUS_INVALID_UNWIND_TARGET" },
496
  { 0xC000002A, "STATUS_NOT_LOCKED" },
497
  { 0xC000002B, "STATUS_PARITY_ERROR" },
498
  { 0xC000002C, "STATUS_UNABLE_TO_DECOMMIT_VM" },
499
  { 0xC000002D, "STATUS_NOT_COMMITTED" },
500
  { 0xC000002E, "STATUS_INVALID_PORT_ATTRIBUTES" },
501
  { 0xC000002F, "STATUS_PORT_MESSAGE_TOO_LONG" },
502
  { 0xC0000030, "STATUS_INVALID_PARAMETER_MIX" },
503
  { 0xC0000031, "STATUS_INVALID_QUOTA_LOWER" },
504
  { 0xC0000032, "STATUS_DISK_CORRUPT_ERROR" },
505
  { 0xC0000033, "STATUS_OBJECT_NAME_INVALID" },
506
  { 0xC0000034, "STATUS_OBJECT_NAME_NOT_FOUND" },
507
  { 0xC0000035, "STATUS_OBJECT_NAME_COLLISION" },
508
  { 0xC0000037, "STATUS_PORT_DISCONNECTED" },
509
  { 0xC0000038, "STATUS_DEVICE_ALREADY_ATTACHED" },
510
  { 0xC0000039, "STATUS_OBJECT_PATH_INVALID" },
511
  { 0xC000003A, "STATUS_OBJECT_PATH_NOT_FOUND" },
512
  { 0xC000003B, "STATUS_OBJECT_PATH_SYNTAX_BAD" },
513
  { 0xC000003C, "STATUS_DATA_OVERRUN" },
514
  { 0xC000003D, "STATUS_DATA_LATE_ERROR" },
515
  { 0xC000003E, "STATUS_DATA_ERROR" },
516
  { 0xC000003F, "STATUS_CRC_ERROR" },
517
  { 0xC0000040, "STATUS_SECTION_TOO_BIG" },
518
  { 0xC0000041, "STATUS_PORT_CONNECTION_REFUSED" },
519
  { 0xC0000042, "STATUS_INVALID_PORT_HANDLE" },
520
  { 0xC0000043, "STATUS_SHARING_VIOLATION" },
521
  { 0xC0000044, "STATUS_QUOTA_EXCEEDED" },
522
  { 0xC0000045, "STATUS_INVALID_PAGE_PROTECTION" },
523
  { 0xC0000046, "STATUS_MUTANT_NOT_OWNED" },
524
  { 0xC0000047, "STATUS_SEMAPHORE_LIMIT_EXCEEDED" },
525
  { 0xC0000048, "STATUS_PORT_ALREADY_SET" },
526
  { 0xC0000049, "STATUS_SECTION_NOT_IMAGE" },
527
  { 0xC000004A, "STATUS_SUSPEND_COUNT_EXCEEDED" },
528
  { 0xC000004B, "STATUS_THREAD_IS_TERMINATING" },
529
  { 0xC000004C, "STATUS_BAD_WORKING_SET_LIMIT" },
530
  { 0xC000004D, "STATUS_INCOMPATIBLE_FILE_MAP" },
531
  { 0xC000004E, "STATUS_SECTION_PROTECTION" },
532
  { 0xC000004F, "STATUS_EAS_NOT_SUPPORTED" },
533
  { 0xC0000050, "STATUS_EA_TOO_LARGE" },
534
  { 0xC0000051, "STATUS_NONEXISTENT_EA_ENTRY" },
535
  { 0xC0000052, "STATUS_NO_EAS_ON_FILE" },
536
  { 0xC0000053, "STATUS_EA_CORRUPT_ERROR" },
537
  { 0xC0000054, "STATUS_FILE_LOCK_CONFLICT" },
538
  { 0xC0000055, "STATUS_LOCK_NOT_GRANTED" },
539
  { 0xC0000056, "STATUS_DELETE_PENDING" },
540
  { 0xC0000057, "STATUS_CTL_FILE_NOT_SUPPORTED" },
541
  { 0xC0000058, "STATUS_UNKNOWN_REVISION" },
542
  { 0xC0000059, "STATUS_REVISION_MISMATCH" },
543
  { 0xC000005A, "STATUS_INVALID_OWNER" },
544
  { 0xC000005B, "STATUS_INVALID_PRIMARY_GROUP" },
545
  { 0xC000005C, "STATUS_NO_IMPERSONATION_TOKEN" },
546
  { 0xC000005D, "STATUS_CANT_DISABLE_MANDATORY" },
547
  { 0xC000005E, "STATUS_NO_LOGON_SERVERS" },
548
  { 0xC000005F, "STATUS_NO_SUCH_LOGON_SESSION" },
549
  { 0xC0000060, "STATUS_NO_SUCH_PRIVILEGE" },
550
  { 0xC0000061, "STATUS_PRIVILEGE_NOT_HELD" },
551
  { 0xC0000062, "STATUS_INVALID_ACCOUNT_NAME" },
552
  { 0xC0000063, "STATUS_USER_EXISTS" },
553
  { 0xC0000064, "STATUS_NO_SUCH_USER" },
554
  { 0xC0000065, "STATUS_GROUP_EXISTS" },
555
  { 0xC0000066, "STATUS_NO_SUCH_GROUP" },
556
  { 0xC0000067, "STATUS_MEMBER_IN_GROUP" },
557
  { 0xC0000068, "STATUS_MEMBER_NOT_IN_GROUP" },
558
  { 0xC0000069, "STATUS_LAST_ADMIN" },
559
  { 0xC000006A, "STATUS_WRONG_PASSWORD" },
560
  { 0xC000006B, "STATUS_ILL_FORMED_PASSWORD" },
561
  { 0xC000006C, "STATUS_PASSWORD_RESTRICTION" },
562
  { 0xC000006D, "STATUS_LOGON_FAILURE" },
563
  { 0xC000006E, "STATUS_ACCOUNT_RESTRICTION" },
564
  { 0xC000006F, "STATUS_INVALID_LOGON_HOURS" },
565
  { 0xC0000070, "STATUS_INVALID_WORKSTATION" },
566
  { 0xC0000071, "STATUS_PASSWORD_EXPIRED" },
567
  { 0xC0000072, "STATUS_ACCOUNT_DISABLED" },
568
  { 0xC0000073, "STATUS_NONE_MAPPED" },
569
  { 0xC0000074, "STATUS_TOO_MANY_LUIDS_REQUESTED" },
570
  { 0xC0000075, "STATUS_LUIDS_EXHAUSTED" },
571
  { 0xC0000076, "STATUS_INVALID_SUB_AUTHORITY" },
572
  { 0xC0000077, "STATUS_INVALID_ACL" },
573
  { 0xC0000078, "STATUS_INVALID_SID" },
574
  { 0xC0000079, "STATUS_INVALID_SECURITY_DESCR" },
575
  { 0xC000007A, "STATUS_PROCEDURE_NOT_FOUND" },
576
  { 0xC000007B, "STATUS_INVALID_IMAGE_FORMAT" },
577
  { 0xC000007C, "STATUS_NO_TOKEN" },
578
  { 0xC000007D, "STATUS_BAD_INHERITANCE_ACL" },
579
  { 0xC000007E, "STATUS_RANGE_NOT_LOCKED" },
580
  { 0xC000007F, "STATUS_DISK_FULL" },
581
  { 0xC0000080, "STATUS_SERVER_DISABLED" },
582
  { 0xC0000081, "STATUS_SERVER_NOT_DISABLED" },
583
  { 0xC0000082, "STATUS_TOO_MANY_GUIDS_REQUESTED" },
584
  { 0xC0000083, "STATUS_GUIDS_EXHAUSTED" },
585
  { 0xC0000084, "STATUS_INVALID_ID_AUTHORITY" },
586
  { 0xC0000085, "STATUS_AGENTS_EXHAUSTED" },
587
  { 0xC0000086, "STATUS_INVALID_VOLUME_LABEL" },
588
  { 0xC0000087, "STATUS_SECTION_NOT_EXTENDED" },
589
  { 0xC0000088, "STATUS_NOT_MAPPED_DATA" },
590
  { 0xC0000089, "STATUS_RESOURCE_DATA_NOT_FOUND" },
591
  { 0xC000008A, "STATUS_RESOURCE_TYPE_NOT_FOUND" },
592
  { 0xC000008B, "STATUS_RESOURCE_NAME_NOT_FOUND" },
593
  { 0xC000008C, "STATUS_ARRAY_BOUNDS_EXCEEDED" },
594
  { 0xC000008D, "STATUS_FLOAT_DENORMAL_OPERAND" },
595
  { 0xC000008E, "STATUS_FLOAT_DIVIDE_BY_ZERO" },
596
  { 0xC000008F, "STATUS_FLOAT_INEXACT_RESULT" },
597
  { 0xC0000090, "STATUS_FLOAT_INVALID_OPERATION" },
598
  { 0xC0000091, "STATUS_FLOAT_OVERFLOW" },
599
  { 0xC0000092, "STATUS_FLOAT_STACK_CHECK" },
600
  { 0xC0000093, "STATUS_FLOAT_UNDERFLOW" },
601
  { 0xC0000094, "STATUS_INTEGER_DIVIDE_BY_ZERO" },
602
  { 0xC0000095, "STATUS_INTEGER_OVERFLOW" },
603
  { 0xC0000096, "STATUS_PRIVILEGED_INSTRUCTION" },
604
  { 0xC0000097, "STATUS_TOO_MANY_PAGING_FILES" },
605
  { 0xC0000098, "STATUS_FILE_INVALID" },
606
  { 0xC0000099, "STATUS_ALLOTTED_SPACE_EXCEEDED" },
607
  { 0xC000009A, "STATUS_INSUFFICIENT_RESOURCES" },
608
  { 0xC000009B, "STATUS_DFS_EXIT_PATH_FOUND" },
609
  { 0xC000009C, "STATUS_DEVICE_DATA_ERROR" },
610
  { 0xC000009D, "STATUS_DEVICE_NOT_CONNECTED" },
611
  { 0xC000009E, "STATUS_DEVICE_POWER_FAILURE" },
612
  { 0xC000009F, "STATUS_FREE_VM_NOT_AT_BASE" },
613
  { 0xC00000A0, "STATUS_MEMORY_NOT_ALLOCATED" },
614
  { 0xC00000A1, "STATUS_WORKING_SET_QUOTA" },
615
  { 0xC00000A2, "STATUS_MEDIA_WRITE_PROTECTED" },
616
  { 0xC00000A3, "STATUS_DEVICE_NOT_READY" },
617
  { 0xC00000A4, "STATUS_INVALID_GROUP_ATTRIBUTES" },
618
  { 0xC00000A5, "STATUS_BAD_IMPERSONATION_LEVEL" },
619
  { 0xC00000A6, "STATUS_CANT_OPEN_ANONYMOUS" },
620
  { 0xC00000A7, "STATUS_BAD_VALIDATION_CLASS" },
621
  { 0xC00000A8, "STATUS_BAD_TOKEN_TYPE" },
622
  { 0xC00000A9, "STATUS_BAD_MASTER_BOOT_RECORD" },
623
  { 0xC00000AA, "STATUS_INSTRUCTION_MISALIGNMENT" },
624
  { 0xC00000AB, "STATUS_INSTANCE_NOT_AVAILABLE" },
625
  { 0xC00000AC, "STATUS_PIPE_NOT_AVAILABLE" },
626
  { 0xC00000AD, "STATUS_INVALID_PIPE_STATE" },
627
  { 0xC00000AE, "STATUS_PIPE_BUSY" },
628
  { 0xC00000AF, "STATUS_ILLEGAL_FUNCTION" },
629
  { 0xC00000B0, "STATUS_PIPE_DISCONNECTED" },
630
  { 0xC00000B1, "STATUS_PIPE_CLOSING" },
631
  { 0xC00000B2, "STATUS_PIPE_CONNECTED" },
632
  { 0xC00000B3, "STATUS_PIPE_LISTENING" },
633
  { 0xC00000B4, "STATUS_INVALID_READ_MODE" },
634
  { 0xC00000B5, "STATUS_IO_TIMEOUT" },
635
  { 0xC00000B6, "STATUS_FILE_FORCED_CLOSED" },
636
  { 0xC00000B7, "STATUS_PROFILING_NOT_STARTED" },
637
  { 0xC00000B8, "STATUS_PROFILING_NOT_STOPPED" },
638
  { 0xC00000B9, "STATUS_COULD_NOT_INTERPRET" },
639
  { 0xC00000BA, "STATUS_FILE_IS_A_DIRECTORY" },
640
  { 0xC00000BB, "STATUS_NOT_SUPPORTED" },
641
  { 0xC00000BC, "STATUS_REMOTE_NOT_LISTENING" },
642
  { 0xC00000BD, "STATUS_DUPLICATE_NAME" },
643
  { 0xC00000BE, "STATUS_BAD_NETWORK_PATH" },
644
  { 0xC00000BF, "STATUS_NETWORK_BUSY" },
645
  { 0xC00000C0, "STATUS_DEVICE_DOES_NOT_EXIST" },
646
  { 0xC00000C1, "STATUS_TOO_MANY_COMMANDS" },
647
  { 0xC00000C2, "STATUS_ADAPTER_HARDWARE_ERROR" },
648
  { 0xC00000C3, "STATUS_INVALID_NETWORK_RESPONSE" },
649
  { 0xC00000C4, "STATUS_UNEXPECTED_NETWORK_ERROR" },
650
  { 0xC00000C5, "STATUS_BAD_REMOTE_ADAPTER" },
651
  { 0xC00000C6, "STATUS_PRINT_QUEUE_FULL" },
652
  { 0xC00000C7, "STATUS_NO_SPOOL_SPACE" },
653
  { 0xC00000C8, "STATUS_PRINT_CANCELLED" },
654
  { 0xC00000C9, "STATUS_NETWORK_NAME_DELETED" },
655
  { 0xC00000CA, "STATUS_NETWORK_ACCESS_DENIED" },
656
  { 0xC00000CB, "STATUS_BAD_DEVICE_TYPE" },
657
  { 0xC00000CC, "STATUS_BAD_NETWORK_NAME" },
658
  { 0xC00000CD, "STATUS_TOO_MANY_NAMES" },
659
  { 0xC00000CE, "STATUS_TOO_MANY_SESSIONS" },
660
  { 0xC00000CF, "STATUS_SHARING_PAUSED" },
661
  { 0xC00000D0, "STATUS_REQUEST_NOT_ACCEPTED" },
662
  { 0xC00000D1, "STATUS_REDIRECTOR_PAUSED" },
663
  { 0xC00000D2, "STATUS_NET_WRITE_FAULT" },
664
  { 0xC00000D3, "STATUS_PROFILING_AT_LIMIT" },
665
  { 0xC00000D4, "STATUS_NOT_SAME_DEVICE" },
666
  { 0xC00000D5, "STATUS_FILE_RENAMED" },
667
  { 0xC00000D6, "STATUS_VIRTUAL_CIRCUIT_CLOSED" },
668
  { 0xC00000D7, "STATUS_NO_SECURITY_ON_OBJECT" },
669
  { 0xC00000D8, "STATUS_CANT_WAIT" },
670
  { 0xC00000D9, "STATUS_PIPE_EMPTY" },
671
  { 0xC00000DA, "STATUS_CANT_ACCESS_DOMAIN_INFO" },
672
  { 0xC00000DB, "STATUS_CANT_TERMINATE_SELF" },
673
  { 0xC00000DC, "STATUS_INVALID_SERVER_STATE" },
674
  { 0xC00000DD, "STATUS_INVALID_DOMAIN_STATE" },
675
  { 0xC00000DE, "STATUS_INVALID_DOMAIN_ROLE" },
676
  { 0xC00000DF, "STATUS_NO_SUCH_DOMAIN" },
677
  { 0xC00000E0, "STATUS_DOMAIN_EXISTS" },
678
  { 0xC00000E1, "STATUS_DOMAIN_LIMIT_EXCEEDED" },
679
  { 0xC00000E2, "STATUS_OPLOCK_NOT_GRANTED" },
680
  { 0xC00000E3, "STATUS_INVALID_OPLOCK_PROTOCOL" },
681
  { 0xC00000E4, "STATUS_INTERNAL_DB_CORRUPTION" },
682
  { 0xC00000E5, "STATUS_INTERNAL_ERROR" },
683
  { 0xC00000E6, "STATUS_GENERIC_NOT_MAPPED" },
684
  { 0xC00000E7, "STATUS_BAD_DESCRIPTOR_FORMAT" },
685
  { 0xC00000E8, "STATUS_INVALID_USER_BUFFER" },
686
  { 0xC00000E9, "STATUS_UNEXPECTED_IO_ERROR" },
687
  { 0xC00000EA, "STATUS_UNEXPECTED_MM_CREATE_ERR" },
688
  { 0xC00000EB, "STATUS_UNEXPECTED_MM_MAP_ERROR" },
689
  { 0xC00000EC, "STATUS_UNEXPECTED_MM_EXTEND_ERR" },
690
  { 0xC00000ED, "STATUS_NOT_LOGON_PROCESS" },
691
  { 0xC00000EE, "STATUS_LOGON_SESSION_EXISTS" },
692
  { 0xC00000EF, "STATUS_INVALID_PARAMETER_1" },
693
  { 0xC00000F0, "STATUS_INVALID_PARAMETER_2" },
694
  { 0xC00000F1, "STATUS_INVALID_PARAMETER_3" },
695
  { 0xC00000F2, "STATUS_INVALID_PARAMETER_4" },
696
  { 0xC00000F3, "STATUS_INVALID_PARAMETER_5" },
697
  { 0xC00000F4, "STATUS_INVALID_PARAMETER_6" },
698
  { 0xC00000F5, "STATUS_INVALID_PARAMETER_7" },
699
  { 0xC00000F6, "STATUS_INVALID_PARAMETER_8" },
700
  { 0xC00000F7, "STATUS_INVALID_PARAMETER_9" },
701
  { 0xC00000F8, "STATUS_INVALID_PARAMETER_10" },
702
  { 0xC00000F9, "STATUS_INVALID_PARAMETER_11" },
703
  { 0xC00000FA, "STATUS_INVALID_PARAMETER_12" },
704
  { 0xC00000FB, "STATUS_REDIRECTOR_NOT_STARTED" },
705
  { 0xC00000FC, "STATUS_REDIRECTOR_STARTED" },
706
  { 0xC00000FD, "STATUS_STACK_OVERFLOW" },
707
  { 0xC00000FE, "STATUS_NO_SUCH_PACKAGE" },
708
  { 0xC00000FF, "STATUS_BAD_FUNCTION_TABLE" },
709
  { 0xC0000100, "STATUS_VARIABLE_NOT_FOUND" },
710
  { 0xC0000101, "STATUS_DIRECTORY_NOT_EMPTY" },
711
  { 0xC0000102, "STATUS_FILE_CORRUPT_ERROR" },
712
  { 0xC0000103, "STATUS_NOT_A_DIRECTORY" },
713
  { 0xC0000104, "STATUS_BAD_LOGON_SESSION_STATE" },
714
  { 0xC0000105, "STATUS_LOGON_SESSION_COLLISION" },
715
  { 0xC0000106, "STATUS_NAME_TOO_LONG" },
716
  { 0xC0000107, "STATUS_FILES_OPEN" },
717
  { 0xC0000108, "STATUS_CONNECTION_IN_USE" },
718
  { 0xC0000109, "STATUS_MESSAGE_NOT_FOUND" },
719
  { 0xC000010A, "STATUS_PROCESS_IS_TERMINATING" },
720
  { 0xC000010B, "STATUS_INVALID_LOGON_TYPE" },
721
  { 0xC000010C, "STATUS_NO_GUID_TRANSLATION" },
722
  { 0xC000010D, "STATUS_CANNOT_IMPERSONATE" },
723
  { 0xC000010E, "STATUS_IMAGE_ALREADY_LOADED" },
724
  { 0xC000010F, "STATUS_ABIOS_NOT_PRESENT" },
725
  { 0xC0000110, "STATUS_ABIOS_LID_NOT_EXIST" },
726
  { 0xC0000111, "STATUS_ABIOS_LID_ALREADY_OWNED" },
727
  { 0xC0000112, "STATUS_ABIOS_NOT_LID_OWNER" },
728
  { 0xC0000113, "STATUS_ABIOS_INVALID_COMMAND" },
729
  { 0xC0000114, "STATUS_ABIOS_INVALID_LID" },
730
  { 0xC0000115, "STATUS_ABIOS_SELECTOR_NOT_AVAILABLE" },
731
  { 0xC0000116, "STATUS_ABIOS_INVALID_SELECTOR" },
732
  { 0xC0000117, "STATUS_NO_LDT" },
733
  { 0xC0000118, "STATUS_INVALID_LDT_SIZE" },
734
  { 0xC0000119, "STATUS_INVALID_LDT_OFFSET" },
735
  { 0xC000011A, "STATUS_INVALID_LDT_DESCRIPTOR" },
736
  { 0xC000011B, "STATUS_INVALID_IMAGE_NE_FORMAT" },
737
  { 0xC000011C, "STATUS_RXACT_INVALID_STATE" },
738
  { 0xC000011D, "STATUS_RXACT_COMMIT_FAILURE" },
739
  { 0xC000011E, "STATUS_MAPPED_FILE_SIZE_ZERO" },
740
  { 0xC000011F, "STATUS_TOO_MANY_OPENED_FILES" },
741
  { 0xC0000120, "STATUS_CANCELLED" },
742
  { 0xC0000121, "STATUS_CANNOT_DELETE" },
743
  { 0xC0000122, "STATUS_INVALID_COMPUTER_NAME" },
744
  { 0xC0000123, "STATUS_FILE_DELETED" },
745
  { 0xC0000124, "STATUS_SPECIAL_ACCOUNT" },
746
  { 0xC0000125, "STATUS_SPECIAL_GROUP" },
747
  { 0xC0000126, "STATUS_SPECIAL_USER" },
748
  { 0xC0000127, "STATUS_MEMBERS_PRIMARY_GROUP" },
749
  { 0xC0000128, "STATUS_FILE_CLOSED" },
750
  { 0xC0000129, "STATUS_TOO_MANY_THREADS" },
751
  { 0xC000012A, "STATUS_THREAD_NOT_IN_PROCESS" },
752
  { 0xC000012B, "STATUS_TOKEN_ALREADY_IN_USE" },
753
  { 0xC000012C, "STATUS_PAGEFILE_QUOTA_EXCEEDED" },
754
  { 0xC000012D, "STATUS_COMMITMENT_LIMIT" },
755
  { 0xC000012E, "STATUS_INVALID_IMAGE_LE_FORMAT" },
756
  { 0xC000012F, "STATUS_INVALID_IMAGE_NOT_MZ" },
757
  { 0xC0000130, "STATUS_INVALID_IMAGE_PROTECT" },
758
  { 0xC0000131, "STATUS_INVALID_IMAGE_WIN_16" },
759
  { 0xC0000132, "STATUS_LOGON_SERVER_CONFLICT" },
760
  { 0xC0000133, "STATUS_TIME_DIFFERENCE_AT_DC" },
761
  { 0xC0000134, "STATUS_SYNCHRONIZATION_REQUIRED" },
762
  { 0xC0000135, "STATUS_DLL_NOT_FOUND" },
763
  { 0xC0000136, "STATUS_OPEN_FAILED" },
764
  { 0xC0000137, "STATUS_IO_PRIVILEGE_FAILED" },
765
  { 0xC0000138, "STATUS_ORDINAL_NOT_FOUND" },
766
  { 0xC0000139, "STATUS_ENTRYPOINT_NOT_FOUND" },
767
  { 0xC000013A, "STATUS_CONTROL_C_EXIT" },
768
  { 0xC000013B, "STATUS_LOCAL_DISCONNECT" },
769
  { 0xC000013C, "STATUS_REMOTE_DISCONNECT" },
770
  { 0xC000013D, "STATUS_REMOTE_RESOURCES" },
771
  { 0xC000013E, "STATUS_LINK_FAILED" },
772
  { 0xC000013F, "STATUS_LINK_TIMEOUT" },
773
  { 0xC0000140, "STATUS_INVALID_CONNECTION" },
774
  { 0xC0000141, "STATUS_INVALID_ADDRESS" },
775
  { 0xC0000142, "STATUS_DLL_INIT_FAILED" },
776
  { 0xC0000143, "STATUS_MISSING_SYSTEMFILE" },
777
  { 0xC0000144, "STATUS_UNHANDLED_EXCEPTION" },
778
  { 0xC0000145, "STATUS_APP_INIT_FAILURE" },
779
  { 0xC0000146, "STATUS_PAGEFILE_CREATE_FAILED" },
780
  { 0xC0000147, "STATUS_NO_PAGEFILE" },
781
  { 0xC0000148, "STATUS_INVALID_LEVEL" },
782
  { 0xC0000149, "STATUS_WRONG_PASSWORD_CORE" },
783
  { 0xC000014A, "STATUS_ILLEGAL_FLOAT_CONTEXT" },
784
  { 0xC000014B, "STATUS_PIPE_BROKEN" },
785
  { 0xC000014C, "STATUS_REGISTRY_CORRUPT" },
786
  { 0xC000014D, "STATUS_REGISTRY_IO_FAILED" },
787
  { 0xC000014E, "STATUS_NO_EVENT_PAIR" },
788
  { 0xC000014F, "STATUS_UNRECOGNIZED_VOLUME" },
789
  { 0xC0000150, "STATUS_SERIAL_NO_DEVICE_INITED" },
790
  { 0xC0000151, "STATUS_NO_SUCH_ALIAS" },
791
  { 0xC0000152, "STATUS_MEMBER_NOT_IN_ALIAS" },
792
  { 0xC0000153, "STATUS_MEMBER_IN_ALIAS" },
793
  { 0xC0000154, "STATUS_ALIAS_EXISTS" },
794
  { 0xC0000155, "STATUS_LOGON_NOT_GRANTED" },
795
  { 0xC0000156, "STATUS_TOO_MANY_SECRETS" },
796
  { 0xC0000157, "STATUS_SECRET_TOO_LONG" },
797
  { 0xC0000158, "STATUS_INTERNAL_DB_ERROR" },
798
  { 0xC0000159, "STATUS_FULLSCREEN_MODE" },
799
  { 0xC000015A, "STATUS_TOO_MANY_CONTEXT_IDS" },
800
  { 0xC000015B, "STATUS_LOGON_TYPE_NOT_GRANTED" },
801
  { 0xC000015C, "STATUS_NOT_REGISTRY_FILE" },
802
  { 0xC000015D, "STATUS_NT_CROSS_ENCRYPTION_REQUIRED" },
803
  { 0xC000015E, "STATUS_DOMAIN_CTRLR_CONFIG_ERROR" },
804
  { 0xC000015F, "STATUS_FT_MISSING_MEMBER" },
805
  { 0xC0000160, "STATUS_ILL_FORMED_SERVICE_ENTRY" },
806
  { 0xC0000161, "STATUS_ILLEGAL_CHARACTER" },
807
  { 0xC0000162, "STATUS_UNMAPPABLE_CHARACTER" },
808
  { 0xC0000163, "STATUS_UNDEFINED_CHARACTER" },
809
  { 0xC0000164, "STATUS_FLOPPY_VOLUME" },
810
  { 0xC0000165, "STATUS_FLOPPY_ID_MARK_NOT_FOUND" },
811
  { 0xC0000166, "STATUS_FLOPPY_WRONG_CYLINDER" },
812
  { 0xC0000167, "STATUS_FLOPPY_UNKNOWN_ERROR" },
813
  { 0xC0000168, "STATUS_FLOPPY_BAD_REGISTERS" },
814
  { 0xC0000169, "STATUS_DISK_RECALIBRATE_FAILED" },
815
  { 0xC000016A, "STATUS_DISK_OPERATION_FAILED" },
816
  { 0xC000016B, "STATUS_DISK_RESET_FAILED" },
817
  { 0xC000016C, "STATUS_SHARED_IRQ_BUSY" },
818
  { 0xC000016D, "STATUS_FT_ORPHANING" },
819
  { 0xC000016E, "STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT" },
820
  { 0xC0000172, "STATUS_PARTITION_FAILURE" },
821
  { 0xC0000173, "STATUS_INVALID_BLOCK_LENGTH" },
822
  { 0xC0000174, "STATUS_DEVICE_NOT_PARTITIONED" },
823
  { 0xC0000175, "STATUS_UNABLE_TO_LOCK_MEDIA" },
824
  { 0xC0000176, "STATUS_UNABLE_TO_UNLOAD_MEDIA" },
825
  { 0xC0000177, "STATUS_EOM_OVERFLOW" },
826
  { 0xC0000178, "STATUS_NO_MEDIA" },
827
  { 0xC000017A, "STATUS_NO_SUCH_MEMBER" },
828
  { 0xC000017B, "STATUS_INVALID_MEMBER" },
829
  { 0xC000017C, "STATUS_KEY_DELETED" },
830
  { 0xC000017D, "STATUS_NO_LOG_SPACE" },
831
  { 0xC000017E, "STATUS_TOO_MANY_SIDS" },
832
  { 0xC000017F, "STATUS_LM_CROSS_ENCRYPTION_REQUIRED" },
833
  { 0xC0000180, "STATUS_KEY_HAS_CHILDREN" },
834
  { 0xC0000181, "STATUS_CHILD_MUST_BE_VOLATILE" },
835
  { 0xC0000182, "STATUS_DEVICE_CONFIGURATION_ERROR" },
836
  { 0xC0000183, "STATUS_DRIVER_INTERNAL_ERROR" },
837
  { 0xC0000184, "STATUS_INVALID_DEVICE_STATE" },
838
  { 0xC0000185, "STATUS_IO_DEVICE_ERROR" },
839
  { 0xC0000186, "STATUS_DEVICE_PROTOCOL_ERROR" },
840
  { 0xC0000187, "STATUS_BACKUP_CONTROLLER" },
841
  { 0xC0000188, "STATUS_LOG_FILE_FULL" },
842
  { 0xC0000189, "STATUS_TOO_LATE" },
843
  { 0xC000018A, "STATUS_NO_TRUST_LSA_SECRET" },
844
  { 0xC000018B, "STATUS_NO_TRUST_SAM_ACCOUNT" },
845
  { 0xC000018C, "STATUS_TRUSTED_DOMAIN_FAILURE" },
846
  { 0xC000018D, "STATUS_TRUSTED_RELATIONSHIP_FAILURE" },
847
  { 0xC000018E, "STATUS_EVENTLOG_FILE_CORRUPT" },
848
  { 0xC000018F, "STATUS_EVENTLOG_CANT_START" },
849
  { 0xC0000190, "STATUS_TRUST_FAILURE" },
850
  { 0xC0000191, "STATUS_MUTANT_LIMIT_EXCEEDED" },
851
  { 0xC0000192, "STATUS_NETLOGON_NOT_STARTED" },
852
  { 0xC0000193, "STATUS_ACCOUNT_EXPIRED" },
853
  { 0xC0000194, "STATUS_POSSIBLE_DEADLOCK" },
854
  { 0xC0000195, "STATUS_NETWORK_CREDENTIAL_CONFLICT" },
855
  { 0xC0000196, "STATUS_REMOTE_SESSION_LIMIT" },
856
  { 0xC0000197, "STATUS_EVENTLOG_FILE_CHANGED" },
857
  { 0xC0000198, "STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT" },
858
  { 0xC0000199, "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT" },
859
  { 0xC000019A, "STATUS_NOLOGON_SERVER_TRUST_ACCOUNT" },
860
  { 0xC000019B, "STATUS_DOMAIN_TRUST_INCONSISTENT" },
861
  { 0xC000019C, "STATUS_FS_DRIVER_REQUIRED" },
862
  { 0xC000019D, "STATUS_IMAGE_ALREADY_LOADED_AS_DLL" },
863
  { 0xC000019E, "STATUS_INCOMPATIBLE_WITH_GLOBAL_SHORT_NAME_REGISTRY_SETTING" },
864
  { 0xC000019F, "STATUS_SHORT_NAMES_NOT_ENABLED_ON_VOLUME" },
865
  { 0xC00001A0, "STATUS_SECURITY_STREAM_IS_INCONSISTENT" },
866
  { 0xC00001A1, "STATUS_INVALID_LOCK_RANGE" },
867
  { 0xC00001A2, "STATUS_INVALID_ACE_CONDITION" },
868
  { 0xC00001A3, "STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT" },
869
  { 0xC00001A4, "STATUS_NOTIFICATION_GUID_ALREADY_DEFINED" },
870
  { 0xC0000201, "STATUS_NETWORK_OPEN_RESTRICTION" },
871
  { 0xC0000202, "STATUS_NO_USER_SESSION_KEY" },
872
  { 0xC0000203, "STATUS_USER_SESSION_DELETED" },
873
  { 0xC0000204, "STATUS_RESOURCE_LANG_NOT_FOUND" },
874
  { 0xC0000205, "STATUS_INSUFF_SERVER_RESOURCES" },
875
  { 0xC0000206, "STATUS_INVALID_BUFFER_SIZE" },
876
  { 0xC0000207, "STATUS_INVALID_ADDRESS_COMPONENT" },
877
  { 0xC0000208, "STATUS_INVALID_ADDRESS_WILDCARD" },
878
  { 0xC0000209, "STATUS_TOO_MANY_ADDRESSES" },
879
  { 0xC000020A, "STATUS_ADDRESS_ALREADY_EXISTS" },
880
  { 0xC000020B, "STATUS_ADDRESS_CLOSED" },
881
  { 0xC000020C, "STATUS_CONNECTION_DISCONNECTED" },
882
  { 0xC000020D, "STATUS_CONNECTION_RESET" },
883
  { 0xC000020E, "STATUS_TOO_MANY_NODES" },
884
  { 0xC000020F, "STATUS_TRANSACTION_ABORTED" },
885
  { 0xC0000210, "STATUS_TRANSACTION_TIMED_OUT" },
886
  { 0xC0000211, "STATUS_TRANSACTION_NO_RELEASE" },
887
  { 0xC0000212, "STATUS_TRANSACTION_NO_MATCH" },
888
  { 0xC0000213, "STATUS_TRANSACTION_RESPONDED" },
889
  { 0xC0000214, "STATUS_TRANSACTION_INVALID_ID" },
890
  { 0xC0000215, "STATUS_TRANSACTION_INVALID_TYPE" },
891
  { 0xC0000216, "STATUS_NOT_SERVER_SESSION" },
892
  { 0xC0000217, "STATUS_NOT_CLIENT_SESSION" },
893
  { 0xC0000218, "STATUS_CANNOT_LOAD_REGISTRY_FILE" },
894
  { 0xC0000219, "STATUS_DEBUG_ATTACH_FAILED" },
895
  { 0xC000021A, "STATUS_SYSTEM_PROCESS_TERMINATED" },
896
  { 0xC000021B, "STATUS_DATA_NOT_ACCEPTED" },
897
  { 0xC000021C, "STATUS_NO_BROWSER_SERVERS_FOUND" },
898
  { 0xC000021D, "STATUS_VDM_HARD_ERROR" },
899
  { 0xC000021E, "STATUS_DRIVER_CANCEL_TIMEOUT" },
900
  { 0xC000021F, "STATUS_REPLY_MESSAGE_MISMATCH" },
901
  { 0xC0000220, "STATUS_MAPPED_ALIGNMENT" },
902
  { 0xC0000221, "STATUS_IMAGE_CHECKSUM_MISMATCH" },
903
  { 0xC0000222, "STATUS_LOST_WRITEBEHIND_DATA" },
904
  { 0xC0000223, "STATUS_CLIENT_SERVER_PARAMETERS_INVALID" },
905
  { 0xC0000224, "STATUS_PASSWORD_MUST_CHANGE" },
906
  { 0xC0000225, "STATUS_NOT_FOUND" },
907
  { 0xC0000226, "STATUS_NOT_TINY_STREAM" },
908
  { 0xC0000227, "STATUS_RECOVERY_FAILURE" },
909
  { 0xC0000228, "STATUS_STACK_OVERFLOW_READ" },
910
  { 0xC0000229, "STATUS_FAIL_CHECK" },
911
  { 0xC000022A, "STATUS_DUPLICATE_OBJECTID" },
912
  { 0xC000022B, "STATUS_OBJECTID_EXISTS" },
913
  { 0xC000022C, "STATUS_CONVERT_TO_LARGE" },
914
  { 0xC000022D, "STATUS_RETRY" },
915
  { 0xC000022E, "STATUS_FOUND_OUT_OF_SCOPE" },
916
  { 0xC000022F, "STATUS_ALLOCATE_BUCKET" },
917
  { 0xC0000230, "STATUS_PROPSET_NOT_FOUND" },
918
  { 0xC0000231, "STATUS_MARSHALL_OVERFLOW" },
919
  { 0xC0000232, "STATUS_INVALID_VARIANT" },
920
  { 0xC0000233, "STATUS_DOMAIN_CONTROLLER_NOT_FOUND" },
921
  { 0xC0000234, "STATUS_ACCOUNT_LOCKED_OUT" },
922
  { 0xC0000235, "STATUS_HANDLE_NOT_CLOSABLE" },
923
  { 0xC0000236, "STATUS_CONNECTION_REFUSED" },
924
  { 0xC0000237, "STATUS_GRACEFUL_DISCONNECT" },
925
  { 0xC0000238, "STATUS_ADDRESS_ALREADY_ASSOCIATED" },
926
  { 0xC0000239, "STATUS_ADDRESS_NOT_ASSOCIATED" },
927
  { 0xC000023A, "STATUS_CONNECTION_INVALID" },
928
  { 0xC000023B, "STATUS_CONNECTION_ACTIVE" },
929
  { 0xC000023C, "STATUS_NETWORK_UNREACHABLE" },
930
  { 0xC000023D, "STATUS_HOST_UNREACHABLE" },
931
  { 0xC000023E, "STATUS_PROTOCOL_UNREACHABLE" },
932
  { 0xC000023F, "STATUS_PORT_UNREACHABLE" },
933
  { 0xC0000240, "STATUS_REQUEST_ABORTED" },
934
  { 0xC0000241, "STATUS_CONNECTION_ABORTED" },
935
  { 0xC0000242, "STATUS_BAD_COMPRESSION_BUFFER" },
936
  { 0xC0000243, "STATUS_USER_MAPPED_FILE" },
937
  { 0xC0000244, "STATUS_AUDIT_FAILED" },
938
  { 0xC0000245, "STATUS_TIMER_RESOLUTION_NOT_SET" },
939
  { 0xC0000246, "STATUS_CONNECTION_COUNT_LIMIT" },
940
  { 0xC0000247, "STATUS_LOGIN_TIME_RESTRICTION" },
941
  { 0xC0000248, "STATUS_LOGIN_WKSTA_RESTRICTION" },
942
  { 0xC0000249, "STATUS_IMAGE_MP_UP_MISMATCH" },
943
  { 0xC0000250, "STATUS_INSUFFICIENT_LOGON_INFO" },
944
  { 0xC0000251, "STATUS_BAD_DLL_ENTRYPOINT" },
945
  { 0xC0000252, "STATUS_BAD_SERVICE_ENTRYPOINT" },
946
  { 0xC0000253, "STATUS_LPC_REPLY_LOST" },
947
  { 0xC0000254, "STATUS_IP_ADDRESS_CONFLICT1" },
948
  { 0xC0000255, "STATUS_IP_ADDRESS_CONFLICT2" },
949
  { 0xC0000256, "STATUS_REGISTRY_QUOTA_LIMIT" },
950
  { 0xC0000257, "STATUS_PATH_NOT_COVERED" },
951
  { 0xC0000258, "STATUS_NO_CALLBACK_ACTIVE" },
952
  { 0xC0000259, "STATUS_LICENSE_QUOTA_EXCEEDED" },
953
  { 0xC000025A, "STATUS_PWD_TOO_SHORT" },
954
  { 0xC000025B, "STATUS_PWD_TOO_RECENT" },
955
  { 0xC000025C, "STATUS_PWD_HISTORY_CONFLICT" },
956
  { 0xC000025E, "STATUS_PLUGPLAY_NO_DEVICE" },
957
  { 0xC000025F, "STATUS_UNSUPPORTED_COMPRESSION" },
958
  { 0xC0000260, "STATUS_INVALID_HW_PROFILE" },
959
  { 0xC0000261, "STATUS_INVALID_PLUGPLAY_DEVICE_PATH" },
960
  { 0xC0000262, "STATUS_DRIVER_ORDINAL_NOT_FOUND" },
961
  { 0xC0000263, "STATUS_DRIVER_ENTRYPOINT_NOT_FOUND" },
962
  { 0xC0000264, "STATUS_RESOURCE_NOT_OWNED" },
963
  { 0xC0000265, "STATUS_TOO_MANY_LINKS" },
964
  { 0xC0000266, "STATUS_QUOTA_LIST_INCONSISTENT" },
965
  { 0xC0000267, "STATUS_FILE_IS_OFFLINE" },
966
  { 0xC0000268, "STATUS_EVALUATION_EXPIRATION" },
967
  { 0xC0000269, "STATUS_ILLEGAL_DLL_RELOCATION" },
968
  { 0xC000026A, "STATUS_LICENSE_VIOLATION" },
969
  { 0xC000026B, "STATUS_DLL_INIT_FAILED_LOGOFF" },
970
  { 0xC000026C, "STATUS_DRIVER_UNABLE_TO_LOAD" },
971
  { 0xC000026D, "STATUS_DFS_UNAVAILABLE" },
972
  { 0xC000026E, "STATUS_VOLUME_DISMOUNTED" },
973
  { 0xC000026F, "STATUS_WX86_INTERNAL_ERROR" },
974
  { 0xC0000270, "STATUS_WX86_FLOAT_STACK_CHECK" },
975
  { 0xC0000271, "STATUS_VALIDATE_CONTINUE" },
976
  { 0xC0000272, "STATUS_NO_MATCH" },
977
  { 0xC0000273, "STATUS_NO_MORE_MATCHES" },
978
  { 0xC0000275, "STATUS_NOT_A_REPARSE_POINT" },
979
  { 0xC0000276, "STATUS_IO_REPARSE_TAG_INVALID" },
980
  { 0xC0000277, "STATUS_IO_REPARSE_TAG_MISMATCH" },
981
  { 0xC0000278, "STATUS_IO_REPARSE_DATA_INVALID" },
982
  { 0xC0000279, "STATUS_IO_REPARSE_TAG_NOT_HANDLED" },
983
  { 0xC0000280, "STATUS_REPARSE_POINT_NOT_RESOLVED" },
984
  { 0xC0000281, "STATUS_DIRECTORY_IS_A_REPARSE_POINT" },
985
  { 0xC0000282, "STATUS_RANGE_LIST_CONFLICT" },
986
  { 0xC0000283, "STATUS_SOURCE_ELEMENT_EMPTY" },
987
  { 0xC0000284, "STATUS_DESTINATION_ELEMENT_FULL" },
988
  { 0xC0000285, "STATUS_ILLEGAL_ELEMENT_ADDRESS" },
989
  { 0xC0000286, "STATUS_MAGAZINE_NOT_PRESENT" },
990
  { 0xC0000287, "STATUS_REINITIALIZATION_NEEDED" },
991
  { 0xC000028A, "STATUS_ENCRYPTION_FAILED" },
992
  { 0xC000028B, "STATUS_DECRYPTION_FAILED" },
993
  { 0xC000028C, "STATUS_RANGE_NOT_FOUND" },
994
  { 0xC000028D, "STATUS_NO_RECOVERY_POLICY" },
995
  { 0xC000028E, "STATUS_NO_EFS" },
996
  { 0xC000028F, "STATUS_WRONG_EFS" },
997
  { 0xC0000290, "STATUS_NO_USER_KEYS" },
998
  { 0xC0000291, "STATUS_FILE_NOT_ENCRYPTED" },
999
  { 0xC0000292, "STATUS_NOT_EXPORT_FORMAT" },
1000
  { 0xC0000293, "STATUS_FILE_ENCRYPTED" },
1001
  { 0xC0000295, "STATUS_WMI_GUID_NOT_FOUND" },
1002
  { 0xC0000296, "STATUS_WMI_INSTANCE_NOT_FOUND" },
1003
  { 0xC0000297, "STATUS_WMI_ITEMID_NOT_FOUND" },
1004
  { 0xC0000298, "STATUS_WMI_TRY_AGAIN" },
1005
  { 0xC0000299, "STATUS_SHARED_POLICY" },
1006
  { 0xC000029A, "STATUS_POLICY_OBJECT_NOT_FOUND" },
1007
  { 0xC000029B, "STATUS_POLICY_ONLY_IN_DS" },
1008
  { 0xC000029C, "STATUS_VOLUME_NOT_UPGRADED" },
1009
  { 0xC000029D, "STATUS_REMOTE_STORAGE_NOT_ACTIVE" },
1010
  { 0xC000029E, "STATUS_REMOTE_STORAGE_MEDIA_ERROR" },
1011
  { 0xC000029F, "STATUS_NO_TRACKING_SERVICE" },
1012
  { 0xC00002A0, "STATUS_SERVER_SID_MISMATCH" },
1013
  { 0xC00002A1, "STATUS_DS_NO_ATTRIBUTE_OR_VALUE" },
1014
  { 0xC00002A2, "STATUS_DS_INVALID_ATTRIBUTE_SYNTAX" },
1015
  { 0xC00002A3, "STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED" },
1016
  { 0xC00002A4, "STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS" },
1017
  { 0xC00002A5, "STATUS_DS_BUSY" },
1018
  { 0xC00002A6, "STATUS_DS_UNAVAILABLE" },
1019
  { 0xC00002A7, "STATUS_DS_NO_RIDS_ALLOCATED" },
1020
  { 0xC00002A8, "STATUS_DS_NO_MORE_RIDS" },
1021
  { 0xC00002A9, "STATUS_DS_INCORRECT_ROLE_OWNER" },
1022
  { 0xC00002AA, "STATUS_DS_RIDMGR_INIT_ERROR" },
1023
  { 0xC00002AB, "STATUS_DS_OBJ_CLASS_VIOLATION" },
1024
  { 0xC00002AC, "STATUS_DS_CANT_ON_NON_LEAF" },
1025
  { 0xC00002AD, "STATUS_DS_CANT_ON_RDN" },
1026
  { 0xC00002AE, "STATUS_DS_CANT_MOD_OBJ_CLASS" },
1027
  { 0xC00002AF, "STATUS_DS_CROSS_DOM_MOVE_FAILED" },
1028
  { 0xC00002B0, "STATUS_DS_GC_NOT_AVAILABLE" },
1029
  { 0xC00002B1, "STATUS_DIRECTORY_SERVICE_REQUIRED" },
1030
  { 0xC00002B2, "STATUS_REPARSE_ATTRIBUTE_CONFLICT" },
1031
  { 0xC00002B3, "STATUS_CANT_ENABLE_DENY_ONLY" },
1032
  { 0xC00002B4, "STATUS_FLOAT_MULTIPLE_FAULTS" },
1033
  { 0xC00002B5, "STATUS_FLOAT_MULTIPLE_TRAPS" },
1034
  { 0xC00002B6, "STATUS_DEVICE_REMOVED" },
1035
  { 0xC00002B7, "STATUS_JOURNAL_DELETE_IN_PROGRESS" },
1036
  { 0xC00002B8, "STATUS_JOURNAL_NOT_ACTIVE" },
1037
  { 0xC00002B9, "STATUS_NOINTERFACE" },
1038
  { 0xC00002C1, "STATUS_DS_ADMIN_LIMIT_EXCEEDED" },
1039
  { 0xC00002C2, "STATUS_DRIVER_FAILED_SLEEP" },
1040
  { 0xC00002C3, "STATUS_MUTUAL_AUTHENTICATION_FAILED" },
1041
  { 0xC00002C4, "STATUS_CORRUPT_SYSTEM_FILE" },
1042
  { 0xC00002C5, "STATUS_DATATYPE_MISALIGNMENT_ERROR" },
1043
  { 0xC00002C6, "STATUS_WMI_READ_ONLY" },
1044
  { 0xC00002C7, "STATUS_WMI_SET_FAILURE" },
1045
  { 0xC00002C8, "STATUS_COMMITMENT_MINIMUM" },
1046
  { 0xC00002C9, "STATUS_REG_NAT_CONSUMPTION" },
1047
  { 0xC00002CA, "STATUS_TRANSPORT_FULL" },
1048
  { 0xC00002CB, "STATUS_DS_SAM_INIT_FAILURE" },
1049
  { 0xC00002CC, "STATUS_ONLY_IF_CONNECTED" },
1050
  { 0xC00002CD, "STATUS_DS_SENSITIVE_GROUP_VIOLATION" },
1051
  { 0xC00002CE, "STATUS_PNP_RESTART_ENUMERATION" },
1052
  { 0xC00002CF, "STATUS_JOURNAL_ENTRY_DELETED" },
1053
  { 0xC00002D0, "STATUS_DS_CANT_MOD_PRIMARYGROUPID" },
1054
  { 0xC00002D1, "STATUS_SYSTEM_IMAGE_BAD_SIGNATURE" },
1055
  { 0xC00002D2, "STATUS_PNP_REBOOT_REQUIRED" },
1056
  { 0xC00002D3, "STATUS_POWER_STATE_INVALID" },
1057
  { 0xC00002D4, "STATUS_DS_INVALID_GROUP_TYPE" },
1058
  { 0xC00002D5, "STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN" },
1059
  { 0xC00002D6, "STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN" },
1060
  { 0xC00002D7, "STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER" },
1061
  { 0xC00002D8, "STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER" },
1062
  { 0xC00002D9, "STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER" },
1063
  { 0xC00002DA, "STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER" },
1064
  { 0xC00002DB, "STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER" },
1065
  { 0xC00002DC, "STATUS_DS_HAVE_PRIMARY_MEMBERS" },
1066
  { 0xC00002DD, "STATUS_WMI_NOT_SUPPORTED" },
1067
  { 0xC00002DE, "STATUS_INSUFFICIENT_POWER" },
1068
  { 0xC00002DF, "STATUS_SAM_NEED_BOOTKEY_PASSWORD" },
1069
  { 0xC00002E0, "STATUS_SAM_NEED_BOOTKEY_FLOPPY" },
1070
  { 0xC00002E1, "STATUS_DS_CANT_START" },
1071
  { 0xC00002E2, "STATUS_DS_INIT_FAILURE" },
1072
  { 0xC00002E3, "STATUS_SAM_INIT_FAILURE" },
1073
  { 0xC00002E4, "STATUS_DS_GC_REQUIRED" },
1074
  { 0xC00002E5, "STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY" },
1075
  { 0xC00002E6, "STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS" },
1076
  { 0xC00002E7, "STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED" },
1077
  { 0xC00002E8, "STATUS_MULTIPLE_FAULT_VIOLATION" },
1078
  { 0xC00002E9, "STATUS_CURRENT_DOMAIN_NOT_ALLOWED" },
1079
  { 0xC00002EA, "STATUS_CANNOT_MAKE" },
1080
  { 0xC00002EB, "STATUS_SYSTEM_SHUTDOWN" },
1081
  { 0xC00002EC, "STATUS_DS_INIT_FAILURE_CONSOLE" },
1082
  { 0xC00002ED, "STATUS_DS_SAM_INIT_FAILURE_CONSOLE" },
1083
  { 0xC00002EE, "STATUS_UNFINISHED_CONTEXT_DELETED" },
1084
  { 0xC00002EF, "STATUS_NO_TGT_REPLY" },
1085
  { 0xC00002F0, "STATUS_OBJECTID_NOT_FOUND" },
1086
  { 0xC00002F1, "STATUS_NO_IP_ADDRESSES" },
1087
  { 0xC00002F2, "STATUS_WRONG_CREDENTIAL_HANDLE" },
1088
  { 0xC00002F3, "STATUS_CRYPTO_SYSTEM_INVALID" },
1089
  { 0xC00002F4, "STATUS_MAX_REFERRALS_EXCEEDED" },
1090
  { 0xC00002F5, "STATUS_MUST_BE_KDC" },
1091
  { 0xC00002F6, "STATUS_STRONG_CRYPTO_NOT_SUPPORTED" },
1092
  { 0xC00002F7, "STATUS_TOO_MANY_PRINCIPALS" },
1093
  { 0xC00002F8, "STATUS_NO_PA_DATA" },
1094
  { 0xC00002F9, "STATUS_PKINIT_NAME_MISMATCH" },
1095
  { 0xC00002FA, "STATUS_SMARTCARD_LOGON_REQUIRED" },
1096
  { 0xC00002FB, "STATUS_KDC_INVALID_REQUEST" },
1097
  { 0xC00002FC, "STATUS_KDC_UNABLE_TO_REFER" },
1098
  { 0xC00002FD, "STATUS_KDC_UNKNOWN_ETYPE" },
1099
  { 0xC00002FE, "STATUS_SHUTDOWN_IN_PROGRESS" },
1100
  { 0xC00002FF, "STATUS_SERVER_SHUTDOWN_IN_PROGRESS" },
1101
  { 0xC0000300, "STATUS_NOT_SUPPORTED_ON_SBS" },
1102
  { 0xC0000301, "STATUS_WMI_GUID_DISCONNECTED" },
1103
  { 0xC0000302, "STATUS_WMI_ALREADY_DISABLED" },
1104
  { 0xC0000303, "STATUS_WMI_ALREADY_ENABLED" },
1105
  { 0xC0000304, "STATUS_MFT_TOO_FRAGMENTED" },
1106
  { 0xC0000305, "STATUS_COPY_PROTECTION_FAILURE" },
1107
  { 0xC0000306, "STATUS_CSS_AUTHENTICATION_FAILURE" },
1108
  { 0xC0000307, "STATUS_CSS_KEY_NOT_PRESENT" },
1109
  { 0xC0000308, "STATUS_CSS_KEY_NOT_ESTABLISHED" },
1110
  { 0xC0000309, "STATUS_CSS_SCRAMBLED_SECTOR" },
1111
  { 0xC000030A, "STATUS_CSS_REGION_MISMATCH" },
1112
  { 0xC000030B, "STATUS_CSS_RESETS_EXHAUSTED" },
1113
  { 0xC0000320, "STATUS_PKINIT_FAILURE" },
1114
  { 0xC0000321, "STATUS_SMARTCARD_SUBSYSTEM_FAILURE" },
1115
  { 0xC0000322, "STATUS_NO_KERB_KEY" },
1116
  { 0xC0000350, "STATUS_HOST_DOWN" },
1117
  { 0xC0000351, "STATUS_UNSUPPORTED_PREAUTH" },
1118
  { 0xC0000352, "STATUS_EFS_ALG_BLOB_TOO_BIG" },
1119
  { 0xC0000353, "STATUS_PORT_NOT_SET" },
1120
  { 0xC0000354, "STATUS_DEBUGGER_INACTIVE" },
1121
  { 0xC0000355, "STATUS_DS_VERSION_CHECK_FAILURE" },
1122
  { 0xC0000356, "STATUS_AUDITING_DISABLED" },
1123
  { 0xC0000357, "STATUS_PRENT4_MACHINE_ACCOUNT" },
1124
  { 0xC0000358, "STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER" },
1125
  { 0xC0000359, "STATUS_INVALID_IMAGE_WIN_32" },
1126
  { 0xC000035A, "STATUS_INVALID_IMAGE_WIN_64" },
1127
  { 0xC000035B, "STATUS_BAD_BINDINGS" },
1128
  { 0xC000035C, "STATUS_NETWORK_SESSION_EXPIRED" },
1129
  { 0xC000035D, "STATUS_APPHELP_BLOCK" },
1130
  { 0xC000035E, "STATUS_ALL_SIDS_FILTERED" },
1131
  { 0xC000035F, "STATUS_NOT_SAFE_MODE_DRIVER" },
1132
  { 0xC0000361, "STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT" },
1133
  { 0xC0000362, "STATUS_ACCESS_DISABLED_BY_POLICY_PATH" },
1134
  { 0xC0000363, "STATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER" },
1135
  { 0xC0000364, "STATUS_ACCESS_DISABLED_BY_POLICY_OTHER" },
1136
  { 0xC0000365, "STATUS_FAILED_DRIVER_ENTRY" },
1137
  { 0xC0000366, "STATUS_DEVICE_ENUMERATION_ERROR" },
1138
  { 0xC0000368, "STATUS_MOUNT_POINT_NOT_RESOLVED" },
1139
  { 0xC0000369, "STATUS_INVALID_DEVICE_OBJECT_PARAMETER" },
1140
  { 0xC000036A, "STATUS_MCA_OCCURED" },
1141
  { 0xC000036B, "STATUS_DRIVER_BLOCKED_CRITICAL" },
1142
  { 0xC000036C, "STATUS_DRIVER_BLOCKED" },
1143
  { 0xC000036D, "STATUS_DRIVER_DATABASE_ERROR" },
1144
  { 0xC000036E, "STATUS_SYSTEM_HIVE_TOO_LARGE" },
1145
  { 0xC000036F, "STATUS_INVALID_IMPORT_OF_NON_DLL" },
1146
  { 0xC0000371, "STATUS_NO_SECRETS" },
1147
  { 0xC0000372, "STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY" },
1148
  { 0xC0000373, "STATUS_FAILED_STACK_SWITCH" },
1149
  { 0xC0000374, "STATUS_HEAP_CORRUPTION" },
1150
  { 0xC0000380, "STATUS_SMARTCARD_WRONG_PIN" },
1151
  { 0xC0000381, "STATUS_SMARTCARD_CARD_BLOCKED" },
1152
  { 0xC0000382, "STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED" },
1153
  { 0xC0000383, "STATUS_SMARTCARD_NO_CARD" },
1154
  { 0xC0000384, "STATUS_SMARTCARD_NO_KEY_CONTAINER" },
1155
  { 0xC0000385, "STATUS_SMARTCARD_NO_CERTIFICATE" },
1156
  { 0xC0000386, "STATUS_SMARTCARD_NO_KEYSET" },
1157
  { 0xC0000387, "STATUS_SMARTCARD_IO_ERROR" },
1158
  { 0xC0000388, "STATUS_DOWNGRADE_DETECTED" },
1159
  { 0xC0000389, "STATUS_SMARTCARD_CERT_REVOKED" },
1160
  { 0xC000038A, "STATUS_ISSUING_CA_UNTRUSTED" },
1161
  { 0xC000038B, "STATUS_REVOCATION_OFFLINE_C" },
1162
  { 0xC000038C, "STATUS_PKINIT_CLIENT_FAILURE" },
1163
  { 0xC000038D, "STATUS_SMARTCARD_CERT_EXPIRED" },
1164
  { 0xC000038E, "STATUS_DRIVER_FAILED_PRIOR_UNLOAD" },
1165
  { 0xC000038F, "STATUS_SMARTCARD_SILENT_CONTEXT" },
1166
  { 0xC0000401, "STATUS_PER_USER_TRUST_QUOTA_EXCEEDED" },
1167
  { 0xC0000402, "STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED" },
1168
  { 0xC0000403, "STATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED" },
1169
  { 0xC0000404, "STATUS_DS_NAME_NOT_UNIQUE" },
1170
  { 0xC0000405, "STATUS_DS_DUPLICATE_ID_FOUND" },
1171
  { 0xC0000406, "STATUS_DS_GROUP_CONVERSION_ERROR" },
1172
  { 0xC0000407, "STATUS_VOLSNAP_PREPARE_HIBERNATE" },
1173
  { 0xC0000408, "STATUS_USER2USER_REQUIRED" },
1174
  { 0xC0000409, "STATUS_STACK_BUFFER_OVERRUN" },
1175
  { 0xC000040A, "STATUS_NO_S4U_PROT_SUPPORT" },
1176
  { 0xC000040B, "STATUS_CROSSREALM_DELEGATION_FAILURE" },
1177
  { 0xC000040C, "STATUS_REVOCATION_OFFLINE_KDC" },
1178
  { 0xC000040D, "STATUS_ISSUING_CA_UNTRUSTED_KDC" },
1179
  { 0xC000040E, "STATUS_KDC_CERT_EXPIRED" },
1180
  { 0xC000040F, "STATUS_KDC_CERT_REVOKED" },
1181
  { 0xC0000410, "STATUS_PARAMETER_QUOTA_EXCEEDED" },
1182
  { 0xC0000411, "STATUS_HIBERNATION_FAILURE" },
1183
  { 0xC0000412, "STATUS_DELAY_LOAD_FAILED" },
1184
  { 0xC0000413, "STATUS_AUTHENTICATION_FIREWALL_FAILED" },
1185
  { 0xC0000414, "STATUS_VDM_DISALLOWED" },
1186
  { 0xC0000415, "STATUS_HUNG_DISPLAY_DRIVER_THREAD" },
1187
  { 0xC0000416, "STATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE" },
1188
  { 0xC0000417, "STATUS_INVALID_CRUNTIME_PARAMETER" },
1189
  { 0xC0000418, "STATUS_NTLM_BLOCKED" },
1190
  { 0xC0000419, "STATUS_DS_SRC_SID_EXISTS_IN_FOREST" },
1191
  { 0xC000041A, "STATUS_DS_DOMAIN_NAME_EXISTS_IN_FOREST" },
1192
  { 0xC000041B, "STATUS_DS_FLAT_NAME_EXISTS_IN_FOREST" },
1193
  { 0xC000041C, "STATUS_INVALID_USER_PRINCIPAL_NAME" },
1194
  { 0xC0000420, "STATUS_ASSERTION_FAILURE" },
1195
  { 0xC0000421, "STATUS_VERIFIER_STOP" },
1196
  { 0xC0000423, "STATUS_CALLBACK_POP_STACK" },
1197
  { 0xC0000424, "STATUS_INCOMPATIBLE_DRIVER_BLOCKED" },
1198
  { 0xC0000425, "STATUS_HIVE_UNLOADED" },
1199
  { 0xC0000426, "STATUS_COMPRESSION_DISABLED" },
1200
  { 0xC0000427, "STATUS_FILE_SYSTEM_LIMITATION" },
1201
  { 0xC0000428, "STATUS_INVALID_IMAGE_HASH" },
1202
  { 0xC0000429, "STATUS_NOT_CAPABLE" },
1203
  { 0xC000042A, "STATUS_REQUEST_OUT_OF_SEQUENCE" },
1204
  { 0xC000042B, "STATUS_IMPLEMENTATION_LIMIT" },
1205
  { 0xC000042C, "STATUS_ELEVATION_REQUIRED" },
1206
  { 0xC000042D, "STATUS_NO_SECURITY_CONTEXT" },
1207
  { 0xC000042E, "STATUS_PKU2U_CERT_FAILURE" },
1208
  { 0xC0000432, "STATUS_BEYOND_VDL" },
1209
  { 0xC0000433, "STATUS_ENCOUNTERED_WRITE_IN_PROGRESS" },
1210
  { 0xC0000434, "STATUS_PTE_CHANGED" },
1211
  { 0xC0000435, "STATUS_PURGE_FAILED" },
1212
  { 0xC0000440, "STATUS_CRED_REQUIRES_CONFIRMATION" },
1213
  { 0xC0000441, "STATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE" },
1214
  { 0xC0000442, "STATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER" },
1215
  { 0xC0000443, "STATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE" },
1216
  { 0xC0000444, "STATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE" },
1217
  { 0xC0000445, "STATUS_CS_ENCRYPTION_FILE_NOT_CSE" },
1218
  { 0xC0000446, "STATUS_INVALID_LABEL" },
1219
  { 0xC0000450, "STATUS_DRIVER_PROCESS_TERMINATED" },
1220
  { 0xC0000451, "STATUS_AMBIGUOUS_SYSTEM_DEVICE" },
1221
  { 0xC0000452, "STATUS_SYSTEM_DEVICE_NOT_FOUND" },
1222
  { 0xC0000453, "STATUS_RESTART_BOOT_APPLICATION" },
1223
  { 0xC0000454, "STATUS_INSUFFICIENT_NVRAM_RESOURCES" },
1224
  { 0xC0000460, "STATUS_NO_RANGES_PROCESSED" },
1225
  { 0xC0000463, "STATUS_DEVICE_FEATURE_NOT_SUPPORTED" },
1226
  { 0xC0000464, "STATUS_DEVICE_UNREACHABLE" },
1227
  { 0xC0000465, "STATUS_INVALID_TOKEN" },
1228
  { 0xC0000466, "STATUS_SERVER_UNAVAILABLE" },
1229
  { 0xc0000467, "STATUS_FILE_NOT_AVAILABLE" },
1230
  { 0xc0000480, "STATUS_SHARE_UNAVAILABLE" },
1231
  { 0xC0000500, "STATUS_INVALID_TASK_NAME" },
1232
  { 0xC0000501, "STATUS_INVALID_TASK_INDEX" },
1233
  { 0xC0000502, "STATUS_THREAD_ALREADY_IN_TASK" },
1234
  { 0xC0000503, "STATUS_CALLBACK_BYPASS" },
1235
  { 0xC0000602, "STATUS_FAIL_FAST_EXCEPTION" },
1236
  { 0xC0000603, "STATUS_IMAGE_CERT_REVOKED" },
1237
  { 0xC0000700, "STATUS_PORT_CLOSED" },
1238
  { 0xC0000701, "STATUS_MESSAGE_LOST" },
1239
  { 0xC0000702, "STATUS_INVALID_MESSAGE" },
1240
  { 0xC0000703, "STATUS_REQUEST_CANCELED" },
1241
  { 0xC0000704, "STATUS_RECURSIVE_DISPATCH" },
1242
  { 0xC0000705, "STATUS_LPC_RECEIVE_BUFFER_EXPECTED" },
1243
  { 0xC0000706, "STATUS_LPC_INVALID_CONNECTION_USAGE" },
1244
  { 0xC0000707, "STATUS_LPC_REQUESTS_NOT_ALLOWED" },
1245
  { 0xC0000708, "STATUS_RESOURCE_IN_USE" },
1246
  { 0xC0000709, "STATUS_HARDWARE_MEMORY_ERROR" },
1247
  { 0xC000070A, "STATUS_THREADPOOL_HANDLE_EXCEPTION" },
1248
  { 0xC000070B, "STATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED" },
1249
  { 0xC000070C, "STATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED" },
1250
  { 0xC000070D, "STATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED" },
1251
  { 0xC000070E, "STATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED" },
1252
  { 0xC000070F, "STATUS_THREADPOOL_RELEASED_DURING_OPERATION" },
1253
  { 0xC0000710, "STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING" },
1254
  { 0xC0000711, "STATUS_APC_RETURNED_WHILE_IMPERSONATING" },
1255
  { 0xC0000712, "STATUS_PROCESS_IS_PROTECTED" },
1256
  { 0xC0000713, "STATUS_MCA_EXCEPTION" },
1257
  { 0xC0000714, "STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE" },
1258
  { 0xC0000715, "STATUS_SYMLINK_CLASS_DISABLED" },
1259
  { 0xC0000716, "STATUS_INVALID_IDN_NORMALIZATION" },
1260
  { 0xC0000717, "STATUS_NO_UNICODE_TRANSLATION" },
1261
  { 0xC0000718, "STATUS_ALREADY_REGISTERED" },
1262
  { 0xC0000719, "STATUS_CONTEXT_MISMATCH" },
1263
  { 0xC000071A, "STATUS_PORT_ALREADY_HAS_COMPLETION_LIST" },
1264
  { 0xC000071B, "STATUS_CALLBACK_RETURNED_THREAD_PRIORITY" },
1265
  { 0xC000071C, "STATUS_INVALID_THREAD" },
1266
  { 0xC000071D, "STATUS_CALLBACK_RETURNED_TRANSACTION" },
1267
  { 0xC000071E, "STATUS_CALLBACK_RETURNED_LDR_LOCK" },
1268
  { 0xC000071F, "STATUS_CALLBACK_RETURNED_LANG" },
1269
  { 0xC0000720, "STATUS_CALLBACK_RETURNED_PRI_BACK" },
1270
  { 0xC0000800, "STATUS_DISK_REPAIR_DISABLED" },
1271
  { 0xC0000801, "STATUS_DS_DOMAIN_RENAME_IN_PROGRESS" },
1272
  { 0xC0000802, "STATUS_DISK_QUOTA_EXCEEDED" },
1273
  { 0xC0000804, "STATUS_CONTENT_BLOCKED" },
1274
  { 0xC0000805, "STATUS_BAD_CLUSTERS" },
1275
  { 0xC0000806, "STATUS_VOLUME_DIRTY" },
1276
  { 0xC0000901, "STATUS_FILE_CHECKED_OUT" },
1277
  { 0xC0000902, "STATUS_CHECKOUT_REQUIRED" },
1278
  { 0xC0000903, "STATUS_BAD_FILE_TYPE" },
1279
  { 0xC0000904, "STATUS_FILE_TOO_LARGE" },
1280
  { 0xC0000905, "STATUS_FORMS_AUTH_REQUIRED" },
1281
  { 0xC0000906, "STATUS_VIRUS_INFECTED" },
1282
  { 0xC0000907, "STATUS_VIRUS_DELETED" },
1283
  { 0xC0000908, "STATUS_BAD_MCFG_TABLE" },
1284
  { 0xC0000909, "STATUS_CANNOT_BREAK_OPLOCK" },
1285
  { 0xC0009898, "STATUS_WOW_ASSERTION" },
1286
  { 0xC000A000, "STATUS_INVALID_SIGNATURE" },
1287
  { 0xC000A001, "STATUS_HMAC_NOT_SUPPORTED" },
1288
  { 0xC000A010, "STATUS_IPSEC_QUEUE_OVERFLOW" },
1289
  { 0xC000A011, "STATUS_ND_QUEUE_OVERFLOW" },
1290
  { 0xC000A012, "STATUS_HOPLIMIT_EXCEEDED" },
1291
  { 0xC000A013, "STATUS_PROTOCOL_NOT_SUPPORTED" },
1292
  { 0xC000A080, "STATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED" },
1293
  { 0xC000A081, "STATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR" },
1294
  { 0xC000A082, "STATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR" },
1295
  { 0xC000A083, "STATUS_XML_PARSE_ERROR" },
1296
  { 0xC000A084, "STATUS_XMLDSIG_ERROR" },
1297
  { 0xC000A085, "STATUS_WRONG_COMPARTMENT" },
1298
  { 0xC000A086, "STATUS_AUTHIP_FAILURE" },
1299
  { 0xC000A087, "STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS" },
1300
  { 0xC000A088, "STATUS_DS_OID_NOT_FOUND" },
1301
  { 0xC000A100, "STATUS_HASH_NOT_SUPPORTED" },
1302
  { 0xC000A101, "STATUS_HASH_NOT_PRESENT" },
1303
  { 0xC000A2A1, "STATUS_OFFLOAD_READ_FLT_NOT_SUPPORTED" },
1304
  { 0xC000A2A2, "STATUS_OFFLOAD_WRITE_FLT_NOT_SUPPORTED" },
1305
  { 0xC000A2A3, "STATUS_OFFLOAD_READ_FILE_NOT_SUPPORTED" },
1306
  { 0xC000A2A4, "STATUS_OFFLOAD_WRITE_FILE_NOT_SUPPORTED" },
1307
  { 0xC0010001, "STATUS_DBG_NO_STATE_CHANGE" },
1308
  { 0xC0010002, "STATUS_DBG_APP_NOT_IDLE" },
1309
  { 0xC0020001, "STATUS_RPC_INVALID_STRING_BINDING" },
1310
  { 0xC0020002, "STATUS_RPC_WRONG_KIND_OF_BINDING" },
1311
  { 0xC0020003, "STATUS_RPC_INVALID_BINDING" },
1312
  { 0xC0020004, "STATUS_RPC_PROTSEQ_NOT_SUPPORTED" },
1313
  { 0xC0020005, "STATUS_RPC_INVALID_RPC_PROTSEQ" },
1314
  { 0xC0020006, "STATUS_RPC_INVALID_STRING_UUID" },
1315
  { 0xC0020007, "STATUS_RPC_INVALID_ENDPOINT_FORMAT" },
1316
  { 0xC0020008, "STATUS_RPC_INVALID_NET_ADDR" },
1317
  { 0xC0020009, "STATUS_RPC_NO_ENDPOINT_FOUND" },
1318
  { 0xC002000A, "STATUS_RPC_INVALID_TIMEOUT" },
1319
  { 0xC002000B, "STATUS_RPC_OBJECT_NOT_FOUND" },
1320
  { 0xC002000C, "STATUS_RPC_ALREADY_REGISTERED" },
1321
  { 0xC002000D, "STATUS_RPC_TYPE_ALREADY_REGISTERED" },
1322
  { 0xC002000E, "STATUS_RPC_ALREADY_LISTENING" },
1323
  { 0xC002000F, "STATUS_RPC_NO_PROTSEQS_REGISTERED" },
1324
  { 0xC0020010, "STATUS_RPC_NOT_LISTENING" },
1325
  { 0xC0020011, "STATUS_RPC_UNKNOWN_MGR_TYPE" },
1326
  { 0xC0020012, "STATUS_RPC_UNKNOWN_IF" },
1327
  { 0xC0020013, "STATUS_RPC_NO_BINDINGS" },
1328
  { 0xC0020014, "STATUS_RPC_NO_PROTSEQS" },
1329
  { 0xC0020015, "STATUS_RPC_CANT_CREATE_ENDPOINT" },
1330
  { 0xC0020016, "STATUS_RPC_OUT_OF_RESOURCES" },
1331
  { 0xC0020017, "STATUS_RPC_SERVER_UNAVAILABLE" },
1332
  { 0xC0020018, "STATUS_RPC_SERVER_TOO_BUSY" },
1333
  { 0xC0020019, "STATUS_RPC_INVALID_NETWORK_OPTIONS" },
1334
  { 0xC002001A, "STATUS_RPC_NO_CALL_ACTIVE" },
1335
  { 0xC002001B, "STATUS_RPC_CALL_FAILED" },
1336
  { 0xC002001C, "STATUS_RPC_CALL_FAILED_DNE" },
1337
  { 0xC002001D, "STATUS_RPC_PROTOCOL_ERROR" },
1338
  { 0xC002001F, "STATUS_RPC_UNSUPPORTED_TRANS_SYN" },
1339
  { 0xC0020021, "STATUS_RPC_UNSUPPORTED_TYPE" },
1340
  { 0xC0020022, "STATUS_RPC_INVALID_TAG" },
1341
  { 0xC0020023, "STATUS_RPC_INVALID_BOUND" },
1342
  { 0xC0020024, "STATUS_RPC_NO_ENTRY_NAME" },
1343
  { 0xC0020025, "STATUS_RPC_INVALID_NAME_SYNTAX" },
1344
  { 0xC0020026, "STATUS_RPC_UNSUPPORTED_NAME_SYNTAX" },
1345
  { 0xC0020028, "STATUS_RPC_UUID_NO_ADDRESS" },
1346
  { 0xC0020029, "STATUS_RPC_DUPLICATE_ENDPOINT" },
1347
  { 0xC002002A, "STATUS_RPC_UNKNOWN_AUTHN_TYPE" },
1348
  { 0xC002002B, "STATUS_RPC_MAX_CALLS_TOO_SMALL" },
1349
  { 0xC002002C, "STATUS_RPC_STRING_TOO_LONG" },
1350
  { 0xC002002D, "STATUS_RPC_PROTSEQ_NOT_FOUND" },
1351
  { 0xC002002E, "STATUS_RPC_PROCNUM_OUT_OF_RANGE" },
1352
  { 0xC002002F, "STATUS_RPC_BINDING_HAS_NO_AUTH" },
1353
  { 0xC0020030, "STATUS_RPC_UNKNOWN_AUTHN_SERVICE" },
1354
  { 0xC0020031, "STATUS_RPC_UNKNOWN_AUTHN_LEVEL" },
1355
  { 0xC0020032, "STATUS_RPC_INVALID_AUTH_IDENTITY" },
1356
  { 0xC0020033, "STATUS_RPC_UNKNOWN_AUTHZ_SERVICE" },
1357
  { 0xC0020034, "STATUS_EPT_INVALID_ENTRY" },
1358
  { 0xC0020035, "STATUS_EPT_CANT_PERFORM_OP" },
1359
  { 0xC0020036, "STATUS_EPT_NOT_REGISTERED" },
1360
  { 0xC0020037, "STATUS_RPC_NOTHING_TO_EXPORT" },
1361
  { 0xC0020038, "STATUS_RPC_INCOMPLETE_NAME" },
1362
  { 0xC0020039, "STATUS_RPC_INVALID_VERS_OPTION" },
1363
  { 0xC002003A, "STATUS_RPC_NO_MORE_MEMBERS" },
1364
  { 0xC002003B, "STATUS_RPC_NOT_ALL_OBJS_UNEXPORTED" },
1365
  { 0xC002003C, "STATUS_RPC_INTERFACE_NOT_FOUND" },
1366
  { 0xC002003D, "STATUS_RPC_ENTRY_ALREADY_EXISTS" },
1367
  { 0xC002003E, "STATUS_RPC_ENTRY_NOT_FOUND" },
1368
  { 0xC002003F, "STATUS_RPC_NAME_SERVICE_UNAVAILABLE" },
1369
  { 0xC0020040, "STATUS_RPC_INVALID_NAF_ID" },
1370
  { 0xC0020041, "STATUS_RPC_CANNOT_SUPPORT" },
1371
  { 0xC0020042, "STATUS_RPC_NO_CONTEXT_AVAILABLE" },
1372
  { 0xC0020043, "STATUS_RPC_INTERNAL_ERROR" },
1373
  { 0xC0020044, "STATUS_RPC_ZERO_DIVIDE" },
1374
  { 0xC0020045, "STATUS_RPC_ADDRESS_ERROR" },
1375
  { 0xC0020046, "STATUS_RPC_FP_DIV_ZERO" },
1376
  { 0xC0020047, "STATUS_RPC_FP_UNDERFLOW" },
1377
  { 0xC0020048, "STATUS_RPC_FP_OVERFLOW" },
1378
  { 0xC0020049, "STATUS_RPC_CALL_IN_PROGRESS" },
1379
  { 0xC002004A, "STATUS_RPC_NO_MORE_BINDINGS" },
1380
  { 0xC002004B, "STATUS_RPC_GROUP_MEMBER_NOT_FOUND" },
1381
  { 0xC002004C, "STATUS_EPT_CANT_CREATE" },
1382
  { 0xC002004D, "STATUS_RPC_INVALID_OBJECT" },
1383
  { 0xC002004F, "STATUS_RPC_NO_INTERFACES" },
1384
  { 0xC0020050, "STATUS_RPC_CALL_CANCELLED" },
1385
  { 0xC0020051, "STATUS_RPC_BINDING_INCOMPLETE" },
1386
  { 0xC0020052, "STATUS_RPC_COMM_FAILURE" },
1387
  { 0xC0020053, "STATUS_RPC_UNSUPPORTED_AUTHN_LEVEL" },
1388
  { 0xC0020054, "STATUS_RPC_NO_PRINC_NAME" },
1389
  { 0xC0020055, "STATUS_RPC_NOT_RPC_ERROR" },
1390
  { 0xC0020057, "STATUS_RPC_SEC_PKG_ERROR" },
1391
  { 0xC0020058, "STATUS_RPC_NOT_CANCELLED" },
1392
  { 0xC0020062, "STATUS_RPC_INVALID_ASYNC_HANDLE" },
1393
  { 0xC0020063, "STATUS_RPC_INVALID_ASYNC_CALL" },
1394
  { 0xC0020064, "STATUS_RPC_PROXY_ACCESS_DENIED" },
1395
  { 0xC0021007, "RPC_P_RECEIVE_ALERTED" },
1396
  { 0xC0021008, "RPC_P_CONNECTION_CLOSED" },
1397
  { 0xC0021009, "RPC_P_RECEIVE_FAILED" },
1398
  { 0xC002100A, "RPC_P_SEND_FAILED" },
1399
  { 0xC002100B, "RPC_P_TIMEOUT" },
1400
  { 0xC002100C, "RPC_P_SERVER_TRANSPORT_ERROR" },
1401
  { 0xC002100E, "RPC_P_EXCEPTION_OCCURRED" },
1402
  { 0xC0021012, "RPC_P_CONNECTION_SHUTDOWN" },
1403
  { 0xC0021015, "RPC_P_THREAD_LISTENING" },
1404
  { 0xC0030001, "STATUS_RPC_NO_MORE_ENTRIES" },
1405
  { 0xC0030002, "STATUS_RPC_SS_CHAR_TRANS_OPEN_FAIL" },
1406
  { 0xC0030003, "STATUS_RPC_SS_CHAR_TRANS_SHORT_FILE" },
1407
  { 0xC0030004, "STATUS_RPC_SS_IN_NULL_CONTEXT" },
1408
  { 0xC0030005, "STATUS_RPC_SS_CONTEXT_MISMATCH" },
1409
  { 0xC0030006, "STATUS_RPC_SS_CONTEXT_DAMAGED" },
1410
  { 0xC0030007, "STATUS_RPC_SS_HANDLES_MISMATCH" },
1411
  { 0xC0030008, "STATUS_RPC_SS_CANNOT_GET_CALL_HANDLE" },
1412
  { 0xC0030009, "STATUS_RPC_NULL_REF_POINTER" },
1413
  { 0xC003000A, "STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE" },
1414
  { 0xC003000B, "STATUS_RPC_BYTE_COUNT_TOO_SMALL" },
1415
  { 0xC003000C, "STATUS_RPC_BAD_STUB_DATA" },
1416
  { 0xC0030059, "STATUS_RPC_INVALID_ES_ACTION" },
1417
  { 0xC003005A, "STATUS_RPC_WRONG_ES_VERSION" },
1418
  { 0xC003005B, "STATUS_RPC_WRONG_STUB_VERSION" },
1419
  { 0xC003005C, "STATUS_RPC_INVALID_PIPE_OBJECT" },
1420
  { 0xC003005D, "STATUS_RPC_INVALID_PIPE_OPERATION" },
1421
  { 0xC003005E, "STATUS_RPC_WRONG_PIPE_VERSION" },
1422
  { 0xC003005F, "STATUS_RPC_PIPE_CLOSED" },
1423
  { 0xC0030060, "STATUS_RPC_PIPE_DISCIPLINE_ERROR" },
1424
  { 0xC0030061, "STATUS_RPC_PIPE_EMPTY" },
1425
  { 0xC0040035, "STATUS_PNP_BAD_MPS_TABLE" },
1426
  { 0xC0040036, "STATUS_PNP_TRANSLATION_FAILED" },
1427
  { 0xC0040037, "STATUS_PNP_IRQ_TRANSLATION_FAILED" },
1428
  { 0xC0040038, "STATUS_PNP_INVALID_ID" },
1429
  { 0xC0040039, "STATUS_IO_REISSUE_AS_CACHED" },
1430
  { 0xC00A0001, "STATUS_CTX_WINSTATION_NAME_INVALID" },
1431
  { 0xC00A0002, "STATUS_CTX_INVALID_PD" },
1432
  { 0xC00A0003, "STATUS_CTX_PD_NOT_FOUND" },
1433
  { 0xC00A0006, "STATUS_CTX_CLOSE_PENDING" },
1434
  { 0xC00A0007, "STATUS_CTX_NO_OUTBUF" },
1435
  { 0xC00A0008, "STATUS_CTX_MODEM_INF_NOT_FOUND" },
1436
  { 0xC00A0009, "STATUS_CTX_INVALID_MODEMNAME" },
1437
  { 0xC00A000A, "STATUS_CTX_RESPONSE_ERROR" },
1438
  { 0xC00A000B, "STATUS_CTX_MODEM_RESPONSE_TIMEOUT" },
1439
  { 0xC00A000C, "STATUS_CTX_MODEM_RESPONSE_NO_CARRIER" },
1440
  { 0xC00A000D, "STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE" },
1441
  { 0xC00A000E, "STATUS_CTX_MODEM_RESPONSE_BUSY" },
1442
  { 0xC00A000F, "STATUS_CTX_MODEM_RESPONSE_VOICE" },
1443
  { 0xC00A0010, "STATUS_CTX_TD_ERROR" },
1444
  { 0xC00A0012, "STATUS_CTX_LICENSE_CLIENT_INVALID" },
1445
  { 0xC00A0013, "STATUS_CTX_LICENSE_NOT_AVAILABLE" },
1446
  { 0xC00A0014, "STATUS_CTX_LICENSE_EXPIRED" },
1447
  { 0xC00A0015, "STATUS_CTX_WINSTATION_NOT_FOUND" },
1448
  { 0xC00A0016, "STATUS_CTX_WINSTATION_NAME_COLLISION" },
1449
  { 0xC00A0017, "STATUS_CTX_WINSTATION_BUSY" },
1450
  { 0xC00A0018, "STATUS_CTX_BAD_VIDEO_MODE" },
1451
  { 0xC00A0022, "STATUS_CTX_GRAPHICS_INVALID" },
1452
  { 0xC00A0024, "STATUS_CTX_NOT_CONSOLE" },
1453
  { 0xC00A0026, "STATUS_CTX_CLIENT_QUERY_TIMEOUT" },
1454
  { 0xC00A0027, "STATUS_CTX_CONSOLE_DISCONNECT" },
1455
  { 0xC00A0028, "STATUS_CTX_CONSOLE_CONNECT" },
1456
  { 0xC00A002A, "STATUS_CTX_SHADOW_DENIED" },
1457
  { 0xC00A002B, "STATUS_CTX_WINSTATION_ACCESS_DENIED" },
1458
  { 0xC00A002E, "STATUS_CTX_INVALID_WD" },
1459
  { 0xC00A002F, "STATUS_CTX_WD_NOT_FOUND" },
1460
  { 0xC00A0030, "STATUS_CTX_SHADOW_INVALID" },
1461
  { 0xC00A0031, "STATUS_CTX_SHADOW_DISABLED" },
1462
  { 0xC00A0032, "STATUS_RDP_PROTOCOL_ERROR" },
1463
  { 0xC00A0033, "STATUS_CTX_CLIENT_LICENSE_NOT_SET" },
1464
  { 0xC00A0034, "STATUS_CTX_CLIENT_LICENSE_IN_USE" },
1465
  { 0xC00A0035, "STATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE" },
1466
  { 0xC00A0036, "STATUS_CTX_SHADOW_NOT_RUNNING" },
1467
  { 0xC00A0037, "STATUS_CTX_LOGON_DISABLED" },
1468
  { 0xC00A0038, "STATUS_CTX_SECURITY_LAYER_ERROR" },
1469
  { 0xC00A0039, "STATUS_TS_INCOMPATIBLE_SESSIONS" },
1470
  { 0xC00B0001, "STATUS_MUI_FILE_NOT_FOUND" },
1471
  { 0xC00B0002, "STATUS_MUI_INVALID_FILE" },
1472
  { 0xC00B0003, "STATUS_MUI_INVALID_RC_CONFIG" },
1473
  { 0xC00B0004, "STATUS_MUI_INVALID_LOCALE_NAME" },
1474
  { 0xC00B0005, "STATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME" },
1475
  { 0xC00B0006, "STATUS_MUI_FILE_NOT_LOADED" },
1476
  { 0xC00B0007, "STATUS_RESOURCE_ENUM_USER_STOP" },
1477
  { 0xC0130001, "STATUS_CLUSTER_INVALID_NODE" },
1478
  { 0xC0130002, "STATUS_CLUSTER_NODE_EXISTS" },
1479
  { 0xC0130003, "STATUS_CLUSTER_JOIN_IN_PROGRESS" },
1480
  { 0xC0130004, "STATUS_CLUSTER_NODE_NOT_FOUND" },
1481
  { 0xC0130005, "STATUS_CLUSTER_LOCAL_NODE_NOT_FOUND" },
1482
  { 0xC0130006, "STATUS_CLUSTER_NETWORK_EXISTS" },
1483
  { 0xC0130007, "STATUS_CLUSTER_NETWORK_NOT_FOUND" },
1484
  { 0xC0130008, "STATUS_CLUSTER_NETINTERFACE_EXISTS" },
1485
  { 0xC0130009, "STATUS_CLUSTER_NETINTERFACE_NOT_FOUND" },
1486
  { 0xC013000A, "STATUS_CLUSTER_INVALID_REQUEST" },
1487
  { 0xC013000B, "STATUS_CLUSTER_INVALID_NETWORK_PROVIDER" },
1488
  { 0xC013000C, "STATUS_CLUSTER_NODE_DOWN" },
1489
  { 0xC013000D, "STATUS_CLUSTER_NODE_UNREACHABLE" },
1490
  { 0xC013000E, "STATUS_CLUSTER_NODE_NOT_MEMBER" },
1491
  { 0xC013000F, "STATUS_CLUSTER_JOIN_NOT_IN_PROGRESS" },
1492
  { 0xC0130010, "STATUS_CLUSTER_INVALID_NETWORK" },
1493
  { 0xC0130011, "STATUS_CLUSTER_NO_NET_ADAPTERS" },
1494
  { 0xC0130012, "STATUS_CLUSTER_NODE_UP" },
1495
  { 0xC0130013, "STATUS_CLUSTER_NODE_PAUSED" },
1496
  { 0xC0130014, "STATUS_CLUSTER_NODE_NOT_PAUSED" },
1497
  { 0xC0130015, "STATUS_CLUSTER_NO_SECURITY_CONTEXT" },
1498
  { 0xC0130016, "STATUS_CLUSTER_NETWORK_NOT_INTERNAL" },
1499
  { 0xC0130017, "STATUS_CLUSTER_POISONED" },
1500
  { 0xC0140001, "STATUS_ACPI_INVALID_OPCODE" },
1501
  { 0xC0140002, "STATUS_ACPI_STACK_OVERFLOW" },
1502
  { 0xC0140003, "STATUS_ACPI_ASSERT_FAILED" },
1503
  { 0xC0140004, "STATUS_ACPI_INVALID_INDEX" },
1504
  { 0xC0140005, "STATUS_ACPI_INVALID_ARGUMENT" },
1505
  { 0xC0140006, "STATUS_ACPI_FATAL" },
1506
  { 0xC0140007, "STATUS_ACPI_INVALID_SUPERNAME" },
1507
  { 0xC0140008, "STATUS_ACPI_INVALID_ARGTYPE" },
1508
  { 0xC0140009, "STATUS_ACPI_INVALID_OBJTYPE" },
1509
  { 0xC014000A, "STATUS_ACPI_INVALID_TARGETTYPE" },
1510
  { 0xC014000B, "STATUS_ACPI_INCORRECT_ARGUMENT_COUNT" },
1511
  { 0xC014000C, "STATUS_ACPI_ADDRESS_NOT_MAPPED" },
1512
  { 0xC014000D, "STATUS_ACPI_INVALID_EVENTTYPE" },
1513
  { 0xC014000E, "STATUS_ACPI_HANDLER_COLLISION" },
1514
  { 0xC014000F, "STATUS_ACPI_INVALID_DATA" },
1515
  { 0xC0140010, "STATUS_ACPI_INVALID_REGION" },
1516
  { 0xC0140011, "STATUS_ACPI_INVALID_ACCESS_SIZE" },
1517
  { 0xC0140012, "STATUS_ACPI_ACQUIRE_GLOBAL_LOCK" },
1518
  { 0xC0140013, "STATUS_ACPI_ALREADY_INITIALIZED" },
1519
  { 0xC0140014, "STATUS_ACPI_NOT_INITIALIZED" },
1520
  { 0xC0140015, "STATUS_ACPI_INVALID_MUTEX_LEVEL" },
1521
  { 0xC0140016, "STATUS_ACPI_MUTEX_NOT_OWNED" },
1522
  { 0xC0140017, "STATUS_ACPI_MUTEX_NOT_OWNER" },
1523
  { 0xC0140018, "STATUS_ACPI_RS_ACCESS" },
1524
  { 0xC0140019, "STATUS_ACPI_INVALID_TABLE" },
1525
  { 0xC0140020, "STATUS_ACPI_REG_HANDLER_FAILED" },
1526
  { 0xC0140021, "STATUS_ACPI_POWER_REQUEST_FAILED" },
1527
  { 0xC0150001, "STATUS_SXS_SECTION_NOT_FOUND" },
1528
  { 0xC0150002, "STATUS_SXS_CANT_GEN_ACTCTX" },
1529
  { 0xC0150003, "STATUS_SXS_INVALID_ACTCTXDATA_FORMAT" },
1530
  { 0xC0150004, "STATUS_SXS_ASSEMBLY_NOT_FOUND" },
1531
  { 0xC0150005, "STATUS_SXS_MANIFEST_FORMAT_ERROR" },
1532
  { 0xC0150006, "STATUS_SXS_MANIFEST_PARSE_ERROR" },
1533
  { 0xC0150007, "STATUS_SXS_ACTIVATION_CONTEXT_DISABLED" },
1534
  { 0xC0150008, "STATUS_SXS_KEY_NOT_FOUND" },
1535
  { 0xC0150009, "STATUS_SXS_VERSION_CONFLICT" },
1536
  { 0xC015000A, "STATUS_SXS_WRONG_SECTION_TYPE" },
1537
  { 0xC015000B, "STATUS_SXS_THREAD_QUERIES_DISABLED" },
1538
  { 0xC015000C, "STATUS_SXS_ASSEMBLY_MISSING" },
1539
  { 0xC015000E, "STATUS_SXS_PROCESS_DEFAULT_ALREADY_SET" },
1540
  { 0xC015000F, "STATUS_SXS_EARLY_DEACTIVATION" },
1541
  { 0xC0150010, "STATUS_SXS_INVALID_DEACTIVATION" },
1542
  { 0xC0150011, "STATUS_SXS_MULTIPLE_DEACTIVATION" },
1543
  { 0xC0150012, "STATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY" },
1544
  { 0xC0150013, "STATUS_SXS_PROCESS_TERMINATION_REQUESTED" },
1545
  { 0xC0150014, "STATUS_SXS_CORRUPT_ACTIVATION_STACK" },
1546
  { 0xC0150015, "STATUS_SXS_CORRUPTION" },
1547
  { 0xC0150016, "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE" },
1548
  { 0xC0150017, "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME" },
1549
  { 0xC0150018, "STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE" },
1550
  { 0xC0150019, "STATUS_SXS_IDENTITY_PARSE_ERROR" },
1551
  { 0xC015001A, "STATUS_SXS_COMPONENT_STORE_CORRUPT" },
1552
  { 0xC015001B, "STATUS_SXS_FILE_HASH_MISMATCH" },
1553
  { 0xC015001C, "STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT" },
1554
  { 0xC015001D, "STATUS_SXS_IDENTITIES_DIFFERENT" },
1555
  { 0xC015001E, "STATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT" },
1556
  { 0xC015001F, "STATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY" },
1557
  { 0xC0150020, "STATUS_ADVANCED_INSTALLER_FAILED" },
1558
  { 0xC0150021, "STATUS_XML_ENCODING_MISMATCH" },
1559
  { 0xC0150022, "STATUS_SXS_MANIFEST_TOO_BIG" },
1560
  { 0xC0150023, "STATUS_SXS_SETTING_NOT_REGISTERED" },
1561
  { 0xC0150024, "STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE" },
1562
  { 0xC0150025, "STATUS_SMI_PRIMITIVE_INSTALLER_FAILED" },
1563
  { 0xC0150026, "STATUS_GENERIC_COMMAND_FAILED" },
1564
  { 0xC0150027, "STATUS_SXS_FILE_HASH_MISSING" },
1565
  { 0xC0190001, "STATUS_TRANSACTIONAL_CONFLICT" },
1566
  { 0xC0190002, "STATUS_INVALID_TRANSACTION" },
1567
  { 0xC0190003, "STATUS_TRANSACTION_NOT_ACTIVE" },
1568
  { 0xC0190004, "STATUS_TM_INITIALIZATION_FAILED" },
1569
  { 0xC0190005, "STATUS_RM_NOT_ACTIVE" },
1570
  { 0xC0190006, "STATUS_RM_METADATA_CORRUPT" },
1571
  { 0xC0190007, "STATUS_TRANSACTION_NOT_JOINED" },
1572
  { 0xC0190008, "STATUS_DIRECTORY_NOT_RM" },
1573
  { 0xC019000A, "STATUS_TRANSACTIONS_UNSUPPORTED_REMOTE" },
1574
  { 0xC019000B, "STATUS_LOG_RESIZE_INVALID_SIZE" },
1575
  { 0xC019000C, "STATUS_REMOTE_FILE_VERSION_MISMATCH" },
1576
  { 0xC019000F, "STATUS_CRM_PROTOCOL_ALREADY_EXISTS" },
1577
  { 0xC0190010, "STATUS_TRANSACTION_PROPAGATION_FAILED" },
1578
  { 0xC0190011, "STATUS_CRM_PROTOCOL_NOT_FOUND" },
1579
  { 0xC0190012, "STATUS_TRANSACTION_SUPERIOR_EXISTS" },
1580
  { 0xC0190013, "STATUS_TRANSACTION_REQUEST_NOT_VALID" },
1581
  { 0xC0190014, "STATUS_TRANSACTION_NOT_REQUESTED" },
1582
  { 0xC0190015, "STATUS_TRANSACTION_ALREADY_ABORTED" },
1583
  { 0xC0190016, "STATUS_TRANSACTION_ALREADY_COMMITTED" },
1584
  { 0xC0190017, "STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER" },
1585
  { 0xC0190018, "STATUS_CURRENT_TRANSACTION_NOT_VALID" },
1586
  { 0xC0190019, "STATUS_LOG_GROWTH_FAILED" },
1587
  { 0xC0190021, "STATUS_OBJECT_NO_LONGER_EXISTS" },
1588
  { 0xC0190022, "STATUS_STREAM_MINIVERSION_NOT_FOUND" },
1589
  { 0xC0190023, "STATUS_STREAM_MINIVERSION_NOT_VALID" },
1590
  { 0xC0190024, "STATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION" },
1591
  { 0xC0190025, "STATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT" },
1592
  { 0xC0190026, "STATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS" },
1593
  { 0xC0190028, "STATUS_HANDLE_NO_LONGER_VALID" },
1594
  { 0xC0190030, "STATUS_LOG_CORRUPTION_DETECTED" },
1595
  { 0xC0190032, "STATUS_RM_DISCONNECTED" },
1596
  { 0xC0190033, "STATUS_ENLISTMENT_NOT_SUPERIOR" },
1597
  { 0xC0190036, "STATUS_FILE_IDENTITY_NOT_PERSISTENT" },
1598
  { 0xC0190037, "STATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY" },
1599
  { 0xC0190038, "STATUS_CANT_CROSS_RM_BOUNDARY" },
1600
  { 0xC0190039, "STATUS_TXF_DIR_NOT_EMPTY" },
1601
  { 0xC019003A, "STATUS_INDOUBT_TRANSACTIONS_EXIST" },
1602
  { 0xC019003B, "STATUS_TM_VOLATILE" },
1603
  { 0xC019003C, "STATUS_ROLLBACK_TIMER_EXPIRED" },
1604
  { 0xC019003D, "STATUS_TXF_ATTRIBUTE_CORRUPT" },
1605
  { 0xC019003E, "STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION" },
1606
  { 0xC019003F, "STATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED" },
1607
  { 0xC0190040, "STATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE" },
1608
  { 0xC0190043, "STATUS_TRANSACTION_REQUIRED_PROMOTION" },
1609
  { 0xC0190044, "STATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION" },
1610
  { 0xC0190045, "STATUS_TRANSACTIONS_NOT_FROZEN" },
1611
  { 0xC0190046, "STATUS_TRANSACTION_FREEZE_IN_PROGRESS" },
1612
  { 0xC0190047, "STATUS_NOT_SNAPSHOT_VOLUME" },
1613
  { 0xC0190048, "STATUS_NO_SAVEPOINT_WITH_OPEN_FILES" },
1614
  { 0xC0190049, "STATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION" },
1615
  { 0xC019004A, "STATUS_TM_IDENTITY_MISMATCH" },
1616
  { 0xC019004B, "STATUS_FLOATED_SECTION" },
1617
  { 0xC019004C, "STATUS_CANNOT_ACCEPT_TRANSACTED_WORK" },
1618
  { 0xC019004D, "STATUS_CANNOT_ABORT_TRANSACTIONS" },
1619
  { 0xC019004E, "STATUS_TRANSACTION_NOT_FOUND" },
1620
  { 0xC019004F, "STATUS_RESOURCEMANAGER_NOT_FOUND" },
1621
  { 0xC0190050, "STATUS_ENLISTMENT_NOT_FOUND" },
1622
  { 0xC0190051, "STATUS_TRANSACTIONMANAGER_NOT_FOUND" },
1623
  { 0xC0190052, "STATUS_TRANSACTIONMANAGER_NOT_ONLINE" },
1624
  { 0xC0190053, "STATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION" },
1625
  { 0xC0190054, "STATUS_TRANSACTION_NOT_ROOT" },
1626
  { 0xC0190055, "STATUS_TRANSACTION_OBJECT_EXPIRED" },
1627
  { 0xC0190056, "STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION" },
1628
  { 0xC0190057, "STATUS_TRANSACTION_RESPONSE_NOT_ENLISTED" },
1629
  { 0xC0190058, "STATUS_TRANSACTION_RECORD_TOO_LONG" },
1630
  { 0xC0190059, "STATUS_NO_LINK_TRACKING_IN_TRANSACTION" },
1631
  { 0xC019005A, "STATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION" },
1632
  { 0xC019005B, "STATUS_TRANSACTION_INTEGRITY_VIOLATED" },
1633
  { 0xC0190060, "STATUS_EXPIRED_HANDLE" },
1634
  { 0xC0190061, "STATUS_TRANSACTION_NOT_ENLISTED" },
1635
  { 0xC01A0001, "STATUS_LOG_SECTOR_INVALID" },
1636
  { 0xC01A0002, "STATUS_LOG_SECTOR_PARITY_INVALID" },
1637
  { 0xC01A0003, "STATUS_LOG_SECTOR_REMAPPED" },
1638
  { 0xC01A0004, "STATUS_LOG_BLOCK_INCOMPLETE" },
1639
  { 0xC01A0005, "STATUS_LOG_INVALID_RANGE" },
1640
  { 0xC01A0006, "STATUS_LOG_BLOCKS_EXHAUSTED" },
1641
  { 0xC01A0007, "STATUS_LOG_READ_CONTEXT_INVALID" },
1642
  { 0xC01A0008, "STATUS_LOG_RESTART_INVALID" },
1643
  { 0xC01A0009, "STATUS_LOG_BLOCK_VERSION" },
1644
  { 0xC01A000A, "STATUS_LOG_BLOCK_INVALID" },
1645
  { 0xC01A000B, "STATUS_LOG_READ_MODE_INVALID" },
1646
  { 0xC01A000D, "STATUS_LOG_METADATA_CORRUPT" },
1647
  { 0xC01A000E, "STATUS_LOG_METADATA_INVALID" },
1648
  { 0xC01A000F, "STATUS_LOG_METADATA_INCONSISTENT" },
1649
  { 0xC01A0010, "STATUS_LOG_RESERVATION_INVALID" },
1650
  { 0xC01A0011, "STATUS_LOG_CANT_DELETE" },
1651
  { 0xC01A0012, "STATUS_LOG_CONTAINER_LIMIT_EXCEEDED" },
1652
  { 0xC01A0013, "STATUS_LOG_START_OF_LOG" },
1653
  { 0xC01A0014, "STATUS_LOG_POLICY_ALREADY_INSTALLED" },
1654
  { 0xC01A0015, "STATUS_LOG_POLICY_NOT_INSTALLED" },
1655
  { 0xC01A0016, "STATUS_LOG_POLICY_INVALID" },
1656
  { 0xC01A0017, "STATUS_LOG_POLICY_CONFLICT" },
1657
  { 0xC01A0018, "STATUS_LOG_PINNED_ARCHIVE_TAIL" },
1658
  { 0xC01A0019, "STATUS_LOG_RECORD_NONEXISTENT" },
1659
  { 0xC01A001A, "STATUS_LOG_RECORDS_RESERVED_INVALID" },
1660
  { 0xC01A001B, "STATUS_LOG_SPACE_RESERVED_INVALID" },
1661
  { 0xC01A001C, "STATUS_LOG_TAIL_INVALID" },
1662
  { 0xC01A001D, "STATUS_LOG_FULL" },
1663
  { 0xC01A001E, "STATUS_LOG_MULTIPLEXED" },
1664
  { 0xC01A001F, "STATUS_LOG_DEDICATED" },
1665
  { 0xC01A0020, "STATUS_LOG_ARCHIVE_NOT_IN_PROGRESS" },
1666
  { 0xC01A0021, "STATUS_LOG_ARCHIVE_IN_PROGRESS" },
1667
  { 0xC01A0022, "STATUS_LOG_EPHEMERAL" },
1668
  { 0xC01A0023, "STATUS_LOG_NOT_ENOUGH_CONTAINERS" },
1669
  { 0xC01A0024, "STATUS_LOG_CLIENT_ALREADY_REGISTERED" },
1670
  { 0xC01A0025, "STATUS_LOG_CLIENT_NOT_REGISTERED" },
1671
  { 0xC01A0026, "STATUS_LOG_FULL_HANDLER_IN_PROGRESS" },
1672
  { 0xC01A0027, "STATUS_LOG_CONTAINER_READ_FAILED" },
1673
  { 0xC01A0028, "STATUS_LOG_CONTAINER_WRITE_FAILED" },
1674
  { 0xC01A0029, "STATUS_LOG_CONTAINER_OPEN_FAILED" },
1675
  { 0xC01A002A, "STATUS_LOG_CONTAINER_STATE_INVALID" },
1676
  { 0xC01A002B, "STATUS_LOG_STATE_INVALID" },
1677
  { 0xC01A002C, "STATUS_LOG_PINNED" },
1678
  { 0xC01A002D, "STATUS_LOG_METADATA_FLUSH_FAILED" },
1679
  { 0xC01A002E, "STATUS_LOG_INCONSISTENT_SECURITY" },
1680
  { 0xC01A002F, "STATUS_LOG_APPENDED_FLUSH_FAILED" },
1681
  { 0xC01A0030, "STATUS_LOG_PINNED_RESERVATION" },
1682
  { 0xC01B00EA, "STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD" },
1683
  { 0xC01C0001, "STATUS_FLT_NO_HANDLER_DEFINED" },
1684
  { 0xC01C0002, "STATUS_FLT_CONTEXT_ALREADY_DEFINED" },
1685
  { 0xC01C0003, "STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST" },
1686
  { 0xC01C0004, "STATUS_FLT_DISALLOW_FAST_IO" },
1687
  { 0xC01C0005, "STATUS_FLT_INVALID_NAME_REQUEST" },
1688
  { 0xC01C0006, "STATUS_FLT_NOT_SAFE_TO_POST_OPERATION" },
1689
  { 0xC01C0007, "STATUS_FLT_NOT_INITIALIZED" },
1690
  { 0xC01C0008, "STATUS_FLT_FILTER_NOT_READY" },
1691
  { 0xC01C0009, "STATUS_FLT_POST_OPERATION_CLEANUP" },
1692
  { 0xC01C000A, "STATUS_FLT_INTERNAL_ERROR" },
1693
  { 0xC01C000B, "STATUS_FLT_DELETING_OBJECT" },
1694
  { 0xC01C000C, "STATUS_FLT_MUST_BE_NONPAGED_POOL" },
1695
  { 0xC01C000D, "STATUS_FLT_DUPLICATE_ENTRY" },
1696
  { 0xC01C000E, "STATUS_FLT_CBDQ_DISABLED" },
1697
  { 0xC01C000F, "STATUS_FLT_DO_NOT_ATTACH" },
1698
  { 0xC01C0010, "STATUS_FLT_DO_NOT_DETACH" },
1699
  { 0xC01C0011, "STATUS_FLT_INSTANCE_ALTITUDE_COLLISION" },
1700
  { 0xC01C0012, "STATUS_FLT_INSTANCE_NAME_COLLISION" },
1701
  { 0xC01C0013, "STATUS_FLT_FILTER_NOT_FOUND" },
1702
  { 0xC01C0014, "STATUS_FLT_VOLUME_NOT_FOUND" },
1703
  { 0xC01C0015, "STATUS_FLT_INSTANCE_NOT_FOUND" },
1704
  { 0xC01C0016, "STATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND" },
1705
  { 0xC01C0017, "STATUS_FLT_INVALID_CONTEXT_REGISTRATION" },
1706
  { 0xC01C0018, "STATUS_FLT_NAME_CACHE_MISS" },
1707
  { 0xC01C0019, "STATUS_FLT_NO_DEVICE_OBJECT" },
1708
  { 0xC01C001A, "STATUS_FLT_VOLUME_ALREADY_MOUNTED" },
1709
  { 0xC01C001B, "STATUS_FLT_ALREADY_ENLISTED" },
1710
  { 0xC01C001C, "STATUS_FLT_CONTEXT_ALREADY_LINKED" },
1711
  { 0xC01C0020, "STATUS_FLT_NO_WAITER_FOR_REPLY" },
1712
  { 0xC01D0001, "STATUS_MONITOR_NO_DESCRIPTOR" },
1713
  { 0xC01D0002, "STATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT" },
1714
  { 0xC01D0003, "STATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM" },
1715
  { 0xC01D0004, "STATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK" },
1716
  { 0xC01D0005, "STATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED" },
1717
  { 0xC01D0006, "STATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK" },
1718
  { 0xC01D0007, "STATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK" },
1719
  { 0xC01D0008, "STATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA" },
1720
  { 0xC01D0009, "STATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK" },
1721
  { 0xC01D000A, "STATUS_MONITOR_INVALID_MANUFACTURE_DATE" },
1722
  { 0xC01E0000, "STATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER" },
1723
  { 0xC01E0001, "STATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER" },
1724
  { 0xC01E0002, "STATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER" },
1725
  { 0xC01E0003, "STATUS_GRAPHICS_ADAPTER_WAS_RESET" },
1726
  { 0xC01E0004, "STATUS_GRAPHICS_INVALID_DRIVER_MODEL" },
1727
  { 0xC01E0005, "STATUS_GRAPHICS_PRESENT_MODE_CHANGED" },
1728
  { 0xC01E0006, "STATUS_GRAPHICS_PRESENT_OCCLUDED" },
1729
  { 0xC01E0007, "STATUS_GRAPHICS_PRESENT_DENIED" },
1730
  { 0xC01E0008, "STATUS_GRAPHICS_CANNOTCOLORCONVERT" },
1731
  { 0xC01E000B, "STATUS_GRAPHICS_PRESENT_REDIRECTION_DISABLED" },
1732
  { 0xC01E000C, "STATUS_GRAPHICS_PRESENT_UNOCCLUDED" },
1733
  { 0xC01E0100, "STATUS_GRAPHICS_NO_VIDEO_MEMORY" },
1734
  { 0xC01E0101, "STATUS_GRAPHICS_CANT_LOCK_MEMORY" },
1735
  { 0xC01E0102, "STATUS_GRAPHICS_ALLOCATION_BUSY" },
1736
  { 0xC01E0103, "STATUS_GRAPHICS_TOO_MANY_REFERENCES" },
1737
  { 0xC01E0104, "STATUS_GRAPHICS_TRY_AGAIN_LATER" },
1738
  { 0xC01E0105, "STATUS_GRAPHICS_TRY_AGAIN_NOW" },
1739
  { 0xC01E0106, "STATUS_GRAPHICS_ALLOCATION_INVALID" },
1740
  { 0xC01E0107, "STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE" },
1741
  { 0xC01E0108, "STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED" },
1742
  { 0xC01E0109, "STATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION" },
1743
  { 0xC01E0110, "STATUS_GRAPHICS_INVALID_ALLOCATION_USAGE" },
1744
  { 0xC01E0111, "STATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION" },
1745
  { 0xC01E0112, "STATUS_GRAPHICS_ALLOCATION_CLOSED" },
1746
  { 0xC01E0113, "STATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE" },
1747
  { 0xC01E0114, "STATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE" },
1748
  { 0xC01E0115, "STATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE" },
1749
  { 0xC01E0116, "STATUS_GRAPHICS_ALLOCATION_CONTENT_LOST" },
1750
  { 0xC01E0200, "STATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE" },
1751
  { 0xC01E0300, "STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY" },
1752
  { 0xC01E0301, "STATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED" },
1753
  { 0xC01E0302, "STATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED" },
1754
  { 0xC01E0303, "STATUS_GRAPHICS_INVALID_VIDPN" },
1755
  { 0xC01E0304, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE" },
1756
  { 0xC01E0305, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET" },
1757
  { 0xC01E0306, "STATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED" },
1758
  { 0xC01E0308, "STATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET" },
1759
  { 0xC01E0309, "STATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET" },
1760
  { 0xC01E030A, "STATUS_GRAPHICS_INVALID_FREQUENCY" },
1761
  { 0xC01E030B, "STATUS_GRAPHICS_INVALID_ACTIVE_REGION" },
1762
  { 0xC01E030C, "STATUS_GRAPHICS_INVALID_TOTAL_REGION" },
1763
  { 0xC01E0310, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE" },
1764
  { 0xC01E0311, "STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE" },
1765
  { 0xC01E0312, "STATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET" },
1766
  { 0xC01E0313, "STATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY" },
1767
  { 0xC01E0314, "STATUS_GRAPHICS_MODE_ALREADY_IN_MODESET" },
1768
  { 0xC01E0315, "STATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET" },
1769
  { 0xC01E0316, "STATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET" },
1770
  { 0xC01E0317, "STATUS_GRAPHICS_SOURCE_ALREADY_IN_SET" },
1771
  { 0xC01E0318, "STATUS_GRAPHICS_TARGET_ALREADY_IN_SET" },
1772
  { 0xC01E0319, "STATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH" },
1773
  { 0xC01E031A, "STATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY" },
1774
  { 0xC01E031B, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET" },
1775
  { 0xC01E031C, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE" },
1776
  { 0xC01E031D, "STATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET" },
1777
  { 0xC01E031F, "STATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET" },
1778
  { 0xC01E0320, "STATUS_GRAPHICS_STALE_MODESET" },
1779
  { 0xC01E0321, "STATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET" },
1780
  { 0xC01E0322, "STATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE" },
1781
  { 0xC01E0323, "STATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN" },
1782
  { 0xC01E0324, "STATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE" },
1783
  { 0xC01E0325, "STATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION" },
1784
  { 0xC01E0326, "STATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES" },
1785
  { 0xC01E0327, "STATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY" },
1786
  { 0xC01E0328, "STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE" },
1787
  { 0xC01E0329, "STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET" },
1788
  { 0xC01E032A, "STATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET" },
1789
  { 0xC01E032B, "STATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR" },
1790
  { 0xC01E032C, "STATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET" },
1791
  { 0xC01E032D, "STATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET" },
1792
  { 0xC01E032E, "STATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE" },
1793
  { 0xC01E032F, "STATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE" },
1794
  { 0xC01E0330, "STATUS_GRAPHICS_RESOURCES_NOT_RELATED" },
1795
  { 0xC01E0331, "STATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE" },
1796
  { 0xC01E0332, "STATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE" },
1797
  { 0xC01E0333, "STATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET" },
1798
  { 0xC01E0334, "STATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER" },
1799
  { 0xC01E0335, "STATUS_GRAPHICS_NO_VIDPNMGR" },
1800
  { 0xC01E0336, "STATUS_GRAPHICS_NO_ACTIVE_VIDPN" },
1801
  { 0xC01E0337, "STATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY" },
1802
  { 0xC01E0338, "STATUS_GRAPHICS_MONITOR_NOT_CONNECTED" },
1803
  { 0xC01E0339, "STATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY" },
1804
  { 0xC01E033A, "STATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE" },
1805
  { 0xC01E033B, "STATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE" },
1806
  { 0xC01E033C, "STATUS_GRAPHICS_INVALID_STRIDE" },
1807
  { 0xC01E033D, "STATUS_GRAPHICS_INVALID_PIXELFORMAT" },
1808
  { 0xC01E033E, "STATUS_GRAPHICS_INVALID_COLORBASIS" },
1809
  { 0xC01E033F, "STATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE" },
1810
  { 0xC01E0340, "STATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY" },
1811
  { 0xC01E0341, "STATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT" },
1812
  { 0xC01E0342, "STATUS_GRAPHICS_VIDPN_SOURCE_IN_USE" },
1813
  { 0xC01E0343, "STATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN" },
1814
  { 0xC01E0344, "STATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL" },
1815
  { 0xC01E0345, "STATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION" },
1816
  { 0xC01E0346, "STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED" },
1817
  { 0xC01E0347, "STATUS_GRAPHICS_INVALID_GAMMA_RAMP" },
1818
  { 0xC01E0348, "STATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED" },
1819
  { 0xC01E0349, "STATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED" },
1820
  { 0xC01E034A, "STATUS_GRAPHICS_MODE_NOT_IN_MODESET" },
1821
  { 0xC01E034D, "STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON" },
1822
  { 0xC01E034E, "STATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE" },
1823
  { 0xC01E034F, "STATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE" },
1824
  { 0xC01E0350, "STATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS" },
1825
  { 0xC01E0352, "STATUS_GRAPHICS_INVALID_SCANLINE_ORDERING" },
1826
  { 0xC01E0353, "STATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED" },
1827
  { 0xC01E0354, "STATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS" },
1828
  { 0xC01E0355, "STATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT" },
1829
  { 0xC01E0356, "STATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM" },
1830
  { 0xC01E0357, "STATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN" },
1831
  { 0xC01E0358, "STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT" },
1832
  { 0xC01E0359, "STATUS_GRAPHICS_MAX_NUM_PATHS_REACHED" },
1833
  { 0xC01E035A, "STATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION" },
1834
  { 0xC01E035B, "STATUS_GRAPHICS_INVALID_CLIENT_TYPE" },
1835
  { 0xC01E035C, "STATUS_GRAPHICS_CLIENTVIDPN_NOT_SET" },
1836
  { 0xC01E0400, "STATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED" },
1837
  { 0xC01E0401, "STATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED" },
1838
  { 0xC01E0430, "STATUS_GRAPHICS_NOT_A_LINKED_ADAPTER" },
1839
  { 0xC01E0431, "STATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED" },
1840
  { 0xC01E0432, "STATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED" },
1841
  { 0xC01E0433, "STATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY" },
1842
  { 0xC01E0434, "STATUS_GRAPHICS_CHAINLINKS_NOT_STARTED" },
1843
  { 0xC01E0435, "STATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON" },
1844
  { 0xC01E0436, "STATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE" },
1845
  { 0xC01E0438, "STATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER" },
1846
  { 0xC01E043B, "STATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED" },
1847
  { 0xC01E0500, "STATUS_GRAPHICS_OPM_NOT_SUPPORTED" },
1848
  { 0xC01E0501, "STATUS_GRAPHICS_COPP_NOT_SUPPORTED" },
1849
  { 0xC01E0502, "STATUS_GRAPHICS_UAB_NOT_SUPPORTED" },
1850
  { 0xC01E0503, "STATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS" },
1851
  { 0xC01E0504, "STATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL" },
1852
  { 0xC01E0505, "STATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST" },
1853
  { 0xC01E0506, "STATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME" },
1854
  { 0xC01E0507, "STATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP" },
1855
  { 0xC01E0508, "STATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED" },
1856
  { 0xC01E050A, "STATUS_GRAPHICS_OPM_INVALID_POINTER" },
1857
  { 0xC01E050B, "STATUS_GRAPHICS_OPM_INTERNAL_ERROR" },
1858
  { 0xC01E050C, "STATUS_GRAPHICS_OPM_INVALID_HANDLE" },
1859
  { 0xC01E050D, "STATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE" },
1860
  { 0xC01E050E, "STATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH" },
1861
  { 0xC01E050F, "STATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED" },
1862
  { 0xC01E0510, "STATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED" },
1863
  { 0xC01E0511, "STATUS_GRAPHICS_PVP_HFS_FAILED" },
1864
  { 0xC01E0512, "STATUS_GRAPHICS_OPM_INVALID_SRM" },
1865
  { 0xC01E0513, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP" },
1866
  { 0xC01E0514, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP" },
1867
  { 0xC01E0515, "STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA" },
1868
  { 0xC01E0516, "STATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET" },
1869
  { 0xC01E0517, "STATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH" },
1870
  { 0xC01E0518, "STATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE" },
1871
  { 0xC01E051A, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS" },
1872
  { 0xC01E051B, "STATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS" },
1873
  { 0xC01E051C, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS" },
1874
  { 0xC01E051D, "STATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST" },
1875
  { 0xC01E051E, "STATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR" },
1876
  { 0xC01E051F, "STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS" },
1877
  { 0xC01E0520, "STATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED" },
1878
  { 0xC01E0521, "STATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST" },
1879
  { 0xC01E0580, "STATUS_GRAPHICS_I2C_NOT_SUPPORTED" },
1880
  { 0xC01E0581, "STATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST" },
1881
  { 0xC01E0582, "STATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA" },
1882
  { 0xC01E0583, "STATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA" },
1883
  { 0xC01E0584, "STATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED" },
1884
  { 0xC01E0585, "STATUS_GRAPHICS_DDCCI_INVALID_DATA" },
1885
  { 0xC01E0586, "STATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE" },
1886
  { 0xC01E0587, "STATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING" },
1887
  { 0xC01E0588, "STATUS_GRAPHICS_MCA_INTERNAL_ERROR" },
1888
  { 0xC01E0589, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND" },
1889
  { 0xC01E058A, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH" },
1890
  { 0xC01E058B, "STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM" },
1891
  { 0xC01E058C, "STATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE" },
1892
  { 0xC01E058D, "STATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS" },
1893
  { 0xC01E05E0, "STATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED" },
1894
  { 0xC01E05E1, "STATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME" },
1895
  { 0xC01E05E2, "STATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP" },
1896
  { 0xC01E05E3, "STATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED" },
1897
  { 0xC01E05E4, "STATUS_GRAPHICS_INVALID_POINTER" },
1898
  { 0xC01E05E5, "STATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE" },
1899
  { 0xC01E05E6, "STATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL" },
1900
  { 0xC01E05E7, "STATUS_GRAPHICS_INTERNAL_ERROR" },
1901
  { 0xC01E05E8, "STATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS" },
1902
  { 0xC0210000, "STATUS_FVE_LOCKED_VOLUME" },
1903
  { 0xC0210001, "STATUS_FVE_NOT_ENCRYPTED" },
1904
  { 0xC0210002, "STATUS_FVE_BAD_INFORMATION" },
1905
  { 0xC0210003, "STATUS_FVE_TOO_SMALL" },
1906
  { 0xC0210004, "STATUS_FVE_FAILED_WRONG_FS" },
1907
  { 0xC0210005, "STATUS_FVE_FAILED_BAD_FS" },
1908
  { 0xC0210006, "STATUS_FVE_FS_NOT_EXTENDED" },
1909
  { 0xC0210007, "STATUS_FVE_FS_MOUNTED" },
1910
  { 0xC0210008, "STATUS_FVE_NO_LICENSE" },
1911
  { 0xC0210009, "STATUS_FVE_ACTION_NOT_ALLOWED" },
1912
  { 0xC021000A, "STATUS_FVE_BAD_DATA" },
1913
  { 0xC021000B, "STATUS_FVE_VOLUME_NOT_BOUND" },
1914
  { 0xC021000C, "STATUS_FVE_NOT_DATA_VOLUME" },
1915
  { 0xC021000D, "STATUS_FVE_CONV_READ_ERROR" },
1916
  { 0xC021000E, "STATUS_FVE_CONV_WRITE_ERROR" },
1917
  { 0xC021000F, "STATUS_FVE_OVERLAPPED_UPDATE" },
1918
  { 0xC0210010, "STATUS_FVE_FAILED_SECTOR_SIZE" },
1919
  { 0xC0210011, "STATUS_FVE_FAILED_AUTHENTICATION" },
1920
  { 0xC0210012, "STATUS_FVE_NOT_OS_VOLUME" },
1921
  { 0xC0210013, "STATUS_FVE_KEYFILE_NOT_FOUND" },
1922
  { 0xC0210014, "STATUS_FVE_KEYFILE_INVALID" },
1923
  { 0xC0210015, "STATUS_FVE_KEYFILE_NO_VMK" },
1924
  { 0xC0210016, "STATUS_FVE_TPM_DISABLED" },
1925
  { 0xC0210017, "STATUS_FVE_TPM_SRK_AUTH_NOT_ZERO" },
1926
  { 0xC0210018, "STATUS_FVE_TPM_INVALID_PCR" },
1927
  { 0xC0210019, "STATUS_FVE_TPM_NO_VMK" },
1928
  { 0xC021001A, "STATUS_FVE_PIN_INVALID" },
1929
  { 0xC021001B, "STATUS_FVE_AUTH_INVALID_APPLICATION" },
1930
  { 0xC021001C, "STATUS_FVE_AUTH_INVALID_CONFIG" },
1931
  { 0xC021001D, "STATUS_FVE_DEBUGGER_ENABLED" },
1932
  { 0xC021001E, "STATUS_FVE_DRY_RUN_FAILED" },
1933
  { 0xC021001F, "STATUS_FVE_BAD_METADATA_POINTER" },
1934
  { 0xC0210020, "STATUS_FVE_OLD_METADATA_COPY" },
1935
  { 0xC0210021, "STATUS_FVE_REBOOT_REQUIRED" },
1936
  { 0xC0210022, "STATUS_FVE_RAW_ACCESS" },
1937
  { 0xC0210023, "STATUS_FVE_RAW_BLOCKED" },
1938
  { 0xC0210026, "STATUS_FVE_NO_FEATURE_LICENSE" },
1939
  { 0xC0210027, "STATUS_FVE_POLICY_USER_DISABLE_RDV_NOT_ALLOWED" },
1940
  { 0xC0210028, "STATUS_FVE_CONV_RECOVERY_FAILED" },
1941
  { 0xC0210029, "STATUS_FVE_VIRTUALIZED_SPACE_TOO_BIG" },
1942
  { 0xC0210030, "STATUS_FVE_VOLUME_TOO_SMALL" },
1943
  { 0xC0220001, "STATUS_FWP_CALLOUT_NOT_FOUND" },
1944
  { 0xC0220002, "STATUS_FWP_CONDITION_NOT_FOUND" },
1945
  { 0xC0220003, "STATUS_FWP_FILTER_NOT_FOUND" },
1946
  { 0xC0220004, "STATUS_FWP_LAYER_NOT_FOUND" },
1947
  { 0xC0220005, "STATUS_FWP_PROVIDER_NOT_FOUND" },
1948
  { 0xC0220006, "STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND" },
1949
  { 0xC0220007, "STATUS_FWP_SUBLAYER_NOT_FOUND" },
1950
  { 0xC0220008, "STATUS_FWP_NOT_FOUND" },
1951
  { 0xC0220009, "STATUS_FWP_ALREADY_EXISTS" },
1952
  { 0xC022000A, "STATUS_FWP_IN_USE" },
1953
  { 0xC022000B, "STATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS" },
1954
  { 0xC022000C, "STATUS_FWP_WRONG_SESSION" },
1955
  { 0xC022000D, "STATUS_FWP_NO_TXN_IN_PROGRESS" },
1956
  { 0xC022000E, "STATUS_FWP_TXN_IN_PROGRESS" },
1957
  { 0xC022000F, "STATUS_FWP_TXN_ABORTED" },
1958
  { 0xC0220010, "STATUS_FWP_SESSION_ABORTED" },
1959
  { 0xC0220011, "STATUS_FWP_INCOMPATIBLE_TXN" },
1960
  { 0xC0220012, "STATUS_FWP_TIMEOUT" },
1961
  { 0xC0220013, "STATUS_FWP_NET_EVENTS_DISABLED" },
1962
  { 0xC0220014, "STATUS_FWP_INCOMPATIBLE_LAYER" },
1963
  { 0xC0220015, "STATUS_FWP_KM_CLIENTS_ONLY" },
1964
  { 0xC0220016, "STATUS_FWP_LIFETIME_MISMATCH" },
1965
  { 0xC0220017, "STATUS_FWP_BUILTIN_OBJECT" },
1966
#if 0
1967
  /* MS-ERREF defines this one status code to have two values */
1968
  https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
1969
  { 0xC0220018, "STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS" },
1970
  { 0xC0220018, "STATUS_FWP_TOO_MANY_CALLOUTS" },
1971
#endif
1972
  { 0xC0220018, "STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS_OR_CALLOUTS" },
1973
  { 0xC0220019, "STATUS_FWP_NOTIFICATION_DROPPED" },
1974
  { 0xC022001A, "STATUS_FWP_TRAFFIC_MISMATCH" },
1975
  { 0xC022001B, "STATUS_FWP_INCOMPATIBLE_SA_STATE" },
1976
  { 0xC022001C, "STATUS_FWP_NULL_POINTER" },
1977
  { 0xC022001D, "STATUS_FWP_INVALID_ENUMERATOR" },
1978
  { 0xC022001E, "STATUS_FWP_INVALID_FLAGS" },
1979
  { 0xC022001F, "STATUS_FWP_INVALID_NET_MASK" },
1980
  { 0xC0220020, "STATUS_FWP_INVALID_RANGE" },
1981
  { 0xC0220021, "STATUS_FWP_INVALID_INTERVAL" },
1982
  { 0xC0220022, "STATUS_FWP_ZERO_LENGTH_ARRAY" },
1983
  { 0xC0220023, "STATUS_FWP_NULL_DISPLAY_NAME" },
1984
  { 0xC0220024, "STATUS_FWP_INVALID_ACTION_TYPE" },
1985
  { 0xC0220025, "STATUS_FWP_INVALID_WEIGHT" },
1986
  { 0xC0220026, "STATUS_FWP_MATCH_TYPE_MISMATCH" },
1987
  { 0xC0220027, "STATUS_FWP_TYPE_MISMATCH" },
1988
  { 0xC0220028, "STATUS_FWP_OUT_OF_BOUNDS" },
1989
  { 0xC0220029, "STATUS_FWP_RESERVED" },
1990
  { 0xC022002A, "STATUS_FWP_DUPLICATE_CONDITION" },
1991
  { 0xC022002B, "STATUS_FWP_DUPLICATE_KEYMOD" },
1992
  { 0xC022002C, "STATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER" },
1993
  { 0xC022002D, "STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER" },
1994
  { 0xC022002E, "STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER" },
1995
  { 0xC022002F, "STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT" },
1996
  { 0xC0220030, "STATUS_FWP_INCOMPATIBLE_AUTH_METHOD" },
1997
  { 0xC0220031, "STATUS_FWP_INCOMPATIBLE_DH_GROUP" },
1998
  { 0xC0220032, "STATUS_FWP_EM_NOT_SUPPORTED" },
1999
  { 0xC0220033, "STATUS_FWP_NEVER_MATCH" },
2000
  { 0xC0220034, "STATUS_FWP_PROVIDER_CONTEXT_MISMATCH" },
2001
  { 0xC0220035, "STATUS_FWP_INVALID_PARAMETER" },
2002
  { 0xC0220036, "STATUS_FWP_TOO_MANY_SUBLAYERS" },
2003
  { 0xC0220037, "STATUS_FWP_CALLOUT_NOTIFICATION_FAILED" },
2004
  { 0xC0220038, "STATUS_FWP_INCOMPATIBLE_AUTH_CONFIG" },
2005
  { 0xC0220039, "STATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG" },
2006
  { 0xC022003C, "STATUS_FWP_DUPLICATE_AUTH_METHOD" },
2007
  { 0xC0220100, "STATUS_FWP_TCPIP_NOT_READY" },
2008
  { 0xC0220101, "STATUS_FWP_INJECT_HANDLE_CLOSING" },
2009
  { 0xC0220102, "STATUS_FWP_INJECT_HANDLE_STALE" },
2010
  { 0xC0220103, "STATUS_FWP_CANNOT_PEND" },
2011
  { 0xC0230002, "STATUS_NDIS_CLOSING" },
2012
  { 0xC0230004, "STATUS_NDIS_BAD_VERSION" },
2013
  { 0xC0230005, "STATUS_NDIS_BAD_CHARACTERISTICS" },
2014
  { 0xC0230006, "STATUS_NDIS_ADAPTER_NOT_FOUND" },
2015
  { 0xC0230007, "STATUS_NDIS_OPEN_FAILED" },
2016
  { 0xC0230008, "STATUS_NDIS_DEVICE_FAILED" },
2017
  { 0xC0230009, "STATUS_NDIS_MULTICAST_FULL" },
2018
  { 0xC023000A, "STATUS_NDIS_MULTICAST_EXISTS" },
2019
  { 0xC023000B, "STATUS_NDIS_MULTICAST_NOT_FOUND" },
2020
  { 0xC023000C, "STATUS_NDIS_REQUEST_ABORTED" },
2021
  { 0xC023000D, "STATUS_NDIS_RESET_IN_PROGRESS" },
2022
  { 0xC023000F, "STATUS_NDIS_INVALID_PACKET" },
2023
  { 0xC0230010, "STATUS_NDIS_INVALID_DEVICE_REQUEST" },
2024
  { 0xC0230011, "STATUS_NDIS_ADAPTER_NOT_READY" },
2025
  { 0xC0230014, "STATUS_NDIS_INVALID_LENGTH" },
2026
  { 0xC0230015, "STATUS_NDIS_INVALID_DATA" },
2027
  { 0xC0230016, "STATUS_NDIS_BUFFER_TOO_SHORT" },
2028
  { 0xC0230017, "STATUS_NDIS_INVALID_OID" },
2029
  { 0xC0230018, "STATUS_NDIS_ADAPTER_REMOVED" },
2030
  { 0xC0230019, "STATUS_NDIS_UNSUPPORTED_MEDIA" },
2031
  { 0xC023001A, "STATUS_NDIS_GROUP_ADDRESS_IN_USE" },
2032
  { 0xC023001B, "STATUS_NDIS_FILE_NOT_FOUND" },
2033
  { 0xC023001C, "STATUS_NDIS_ERROR_READING_FILE" },
2034
  { 0xC023001D, "STATUS_NDIS_ALREADY_MAPPED" },
2035
  { 0xC023001E, "STATUS_NDIS_RESOURCE_CONFLICT" },
2036
  { 0xC023001F, "STATUS_NDIS_MEDIA_DISCONNECTED" },
2037
  { 0xC0230022, "STATUS_NDIS_INVALID_ADDRESS" },
2038
  { 0xC023002A, "STATUS_NDIS_PAUSED" },
2039
  { 0xC023002B, "STATUS_NDIS_INTERFACE_NOT_FOUND" },
2040
  { 0xC023002C, "STATUS_NDIS_UNSUPPORTED_REVISION" },
2041
  { 0xC023002D, "STATUS_NDIS_INVALID_PORT" },
2042
  { 0xC023002E, "STATUS_NDIS_INVALID_PORT_STATE" },
2043
  { 0xC023002F, "STATUS_NDIS_LOW_POWER_STATE" },
2044
  { 0xC02300BB, "STATUS_NDIS_NOT_SUPPORTED" },
2045
  { 0xC023100F, "STATUS_NDIS_OFFLOAD_POLICY" },
2046
  { 0xC0231012, "STATUS_NDIS_OFFLOAD_CONNECTION_REJECTED" },
2047
  { 0xC0231013, "STATUS_NDIS_OFFLOAD_PATH_REJECTED" },
2048
  { 0xC0232000, "STATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED" },
2049
  { 0xC0232001, "STATUS_NDIS_DOT11_MEDIA_IN_USE" },
2050
  { 0xC0232002, "STATUS_NDIS_DOT11_POWER_STATE_INVALID" },
2051
  { 0xC0232003, "STATUS_NDIS_PM_WOL_PATTERN_LIST_FULL" },
2052
  { 0xC0232004, "STATUS_NDIS_PM_PROTOCOL_OFFLOAD_LIST_FULL" },
2053
  { 0xC0360001, "STATUS_IPSEC_BAD_SPI" },
2054
  { 0xC0360002, "STATUS_IPSEC_SA_LIFETIME_EXPIRED" },
2055
  { 0xC0360003, "STATUS_IPSEC_WRONG_SA" },
2056
  { 0xC0360004, "STATUS_IPSEC_REPLAY_CHECK_FAILED" },
2057
  { 0xC0360005, "STATUS_IPSEC_INVALID_PACKET" },
2058
  { 0xC0360006, "STATUS_IPSEC_INTEGRITY_CHECK_FAILED" },
2059
  { 0xC0360007, "STATUS_IPSEC_CLEAR_TEXT_DROP" },
2060
  { 0xC0360008, "STATUS_IPSEC_AUTH_FIREWALL_DROP" },
2061
  { 0xC0360009, "STATUS_IPSEC_THROTTLE_DROP" },
2062
  { 0xC0368000, "STATUS_IPSEC_DOSP_BLOCK" },
2063
  { 0xC0368001, "STATUS_IPSEC_DOSP_RECEIVED_MULTICAST" },
2064
  { 0xC0368002, "STATUS_IPSEC_DOSP_INVALID_PACKET" },
2065
  { 0xC0368003, "STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED" },
2066
  { 0xC0368004, "STATUS_IPSEC_DOSP_MAX_ENTRIES" },
2067
  { 0xC0368005, "STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED" },
2068
  { 0xC0368006, "STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES" },
2069
  { 0xC038005B, "STATUS_VOLMGR_MIRROR_NOT_SUPPORTED" },
2070
  { 0xC038005C, "STATUS_VOLMGR_RAID5_NOT_SUPPORTED" },
2071
  { 0xC03A0014, "STATUS_VIRTDISK_PROVIDER_NOT_FOUND" },
2072
  { 0xC03A0015, "STATUS_VIRTDISK_NOT_VIRTUAL_DISK" },
2073
  { 0xC03A0016, "STATUS_VHD_PARENT_VHD_ACCESS_DENIED" },
2074
  { 0xC03A0017, "STATUS_VHD_CHILD_PARENT_SIZE_MISMATCH" },
2075
  { 0xC03A0018, "STATUS_VHD_DIFFERENCING_CHAIN_CYCLE_DETECTED" },
2076
  { 0xC03A0019, "STATUS_VHD_DIFFERENCING_CHAIN_ERROR_IN_PARENT" },
2077
  { 0xC05C0000, "STATUS_SVHDX_ERROR_STORED" },
2078
  { 0xC05CFF00, "STATUS_SVHDX_ERROR_NOT_AVAILABLE" },
2079
  { 0xC05CFF01, "STATUS_SVHDX_UNIT_ATTENTION_AVAILABLE" },
2080
  { 0xC05CFF02, "STATUS_SVHDX_UNIT_ATTENTION_CAPACITY_DATA_CHANGED" },
2081
  { 0xC05CFF03, "STATUS_SVHDX_UNIT_ATTENTION_RESERVATIONS_PREEMPTED" },
2082
  { 0xC05CFF04, "STATUS_SVHDX_UNIT_ATTENTION_RESERVATIONS_RELEASED" },
2083
  { 0xC05CFF05, "STATUS_SVHDX_UNIT_ATTENTION_REGISTRATIONS_PREEMPTED" },
2084
  { 0xC05CFF06, "STATUS_SVHDX_UNIT_ATTENTION_OPERATING_DEFINITION_CHANGED" },
2085
  { 0xC05CFF07, "STATUS_SVHDX_RESERVATION_CONFLICT" },
2086
  { 0xC05CFF08, "STATUS_SVHDX_WRONG_FILE_TYPE" },
2087
  { 0xC05CFF09, "STATUS_SVHDX_VERSION_MISMATCH" },
2088
  { 0xC05CFF0A, "STATUS_VHD_SHARED" },
2089
  { 0xC05D0000, "STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP" },
2090
  { 0xC05D0001, "STATUS_SMB_BAD_CLUSTER_DIALECT" },
2091
  { 0,          NULL }
2092
};
2093
value_string_ext NT_errors_ext = VALUE_STRING_EXT_INIT(NT_errors);
2094
2095
/* These are the MS country codes from
2096
2097
  https://web.archive.org/web/20081224015707/http://www.unicode.org/unicode/onlinedat/countries.html
2098
2099
   For countries that share the same number, I choose to use only the
2100
   name of the largest country. Apologies for this. If this offends you,
2101
   here is the table to change that.
2102
2103
   This also includes the code of 0 for "Default", which isn't in
2104
   that list, but is in Microsoft's SDKs and the Cygnus "winnls.h"
2105
   header file.  Presumably it means "don't override the setting
2106
   on the user's machine".
2107
2108
   Future versions of Microsoft's "winnls.h" header file might include
2109
   additional codes; the current version matches the Unicode Consortium's
2110
   table.
2111
*/
2112
static const value_string ms_country_codes[] = {
2113
  {  0, "Default"},
2114
  {  1, "USA"},
2115
  {  2, "Canada"},
2116
  {  7, "Russia"},
2117
  { 20, "Egypt"},
2118
  { 27, "South Africa"},
2119
  { 30, "Greece"},
2120
  { 31, "Netherlands"},
2121
  { 32, "Belgium"},
2122
  { 33, "France"},
2123
  { 34, "Spain"},
2124
  { 36, "Hungary"},
2125
  { 39, "Italy"},
2126
  { 40, "Romania"},
2127
  { 41, "Switzerland"},
2128
  { 43, "Austria"},
2129
  { 44, "United Kingdom"},
2130
  { 45, "Denmark"},
2131
  { 46, "Sweden"},
2132
  { 47, "Norway"},
2133
  { 48, "Poland"},
2134
  { 49, "Germany"},
2135
  { 51, "Peru"},
2136
  { 52, "Mexico"},
2137
  { 54, "Argentina"},
2138
  { 55, "Brazil"},
2139
  { 56, "Chile"},
2140
  { 57, "Colombia"},
2141
  { 58, "Venezuela"},
2142
  { 60, "Malaysia"},
2143
  { 61, "Australia"},
2144
  { 62, "Indonesia"},
2145
  { 63, "Philippines"},
2146
  { 64, "New Zealand"},
2147
  { 65, "Singapore"},
2148
  { 66, "Thailand"},
2149
  { 81, "Japan"},
2150
  { 82, "South Korea"},
2151
  { 84, "Viet Nam"},
2152
  { 86, "China"},
2153
  { 90, "Turkey"},
2154
  { 91, "India"},
2155
  { 92, "Pakistan"},
2156
  {212, "Morocco"},
2157
  {213, "Algeria"},
2158
  {216, "Tunisia"},
2159
  {218, "Libya"},
2160
  {254, "Kenya"},
2161
  {263, "Zimbabwe"},
2162
  {298, "Faroe Islands"},
2163
  {351, "Portugal"},
2164
  {352, "Luxembourg"},
2165
  {353, "Ireland"},
2166
  {354, "Iceland"},
2167
  {355, "Albania"},
2168
  {358, "Finland"},
2169
  {359, "Bulgaria"},
2170
  {370, "Lithuania"},
2171
  {371, "Latvia"},
2172
  {372, "Estonia"},
2173
  {374, "Armenia"},
2174
  {375, "Belarus"},
2175
  {380, "Ukraine"},
2176
  {381, "Serbia"},
2177
  {385, "Croatia"},
2178
  {386, "Slovenia"},
2179
  {389, "Macedonia"},
2180
  {420, "Czech Republic"},
2181
  {421, "Slovak Republic"},
2182
  {501, "Belize"},
2183
  {502, "Guatemala"},
2184
  {503, "El Salvador"},
2185
  {504, "Honduras"},
2186
  {505, "Nicaragua"},
2187
  {506, "Costa Rica"},
2188
  {507, "Panama"},
2189
  {591, "Bolivia"},
2190
  {593, "Ecuador"},
2191
  {595, "Paraguay"},
2192
  {598, "Uruguay"},
2193
  {673, "Brunei Darussalam"},
2194
  {852, "Hong Kong"},
2195
  {853, "Macau"},
2196
  {886, "Taiwan"},
2197
  {960, "Maldives"},
2198
  {961, "Lebanon"},
2199
  {962, "Jordan"},
2200
  {963, "Syria"},
2201
  {964, "Iraq"},
2202
  {965, "Kuwait"},
2203
  {966, "Saudi Arabia"},
2204
  {967, "Yemen"},
2205
  {968, "Oman"},
2206
  {971, "United Arab Emirates"},
2207
  {972, "Israel"},
2208
  {973, "Bahrain"},
2209
  {974, "Qatar"},
2210
  {976, "Mongolia"},
2211
  {981, "Iran"},
2212
  {994, "Azerbaijan"},
2213
  {995, "Georgia"},
2214
  {996, "Kyrgyzstan"},
2215
2216
  {0, NULL}
2217
};
2218
value_string_ext ms_country_codes_ext = VALUE_STRING_EXT_INIT(ms_country_codes);
2219
2220
 /*module_t* module;*/
2221
 /*pref_t* sid_display_hex;*/
2222
2223
static proto_item *
2224
add_nttime(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date,
2225
     uint64_t filetime)
2226
2.14k
{
2227
2.14k
  proto_item *item;
2228
2.14k
  nstime_t ts;
2229
2230
2.14k
  if (filetime == 0) {
2231
213
    ts.secs = 0;
2232
213
    ts.nsecs = 0;
2233
213
    item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2234
213
        &ts, "No time specified (0)");
2235
1.93k
  } else if (filetime == UINT64_C(0x8000000000000000)) {
2236
68
    ts.secs = 0;
2237
68
    ts.nsecs = 0x80000000;
2238
68
    item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2239
68
        &ts, "Infinity (relative time)");
2240
1.86k
  } else if (filetime == UINT64_C(0x7fffffffffffffff)) {
2241
116
    ts.secs = 0xffffffff;
2242
116
    ts.nsecs = 0x7fffffff;
2243
116
    item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2244
116
        &ts, "Infinity (absolute time)");
2245
1.75k
  } else {
2246
1.75k
    if (filetime_to_nstime(&ts, filetime)) {
2247
1.75k
      item = proto_tree_add_time(tree, hf_date, tvb,
2248
1.75k
          offset, 8, &ts);
2249
1.75k
    } else {
2250
0
      item = proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2251
0
          &ts, "Time can't be converted");
2252
0
    }
2253
1.75k
  }
2254
2.14k
  return item;
2255
2.14k
}
2256
2257
proto_item *
2258
dissect_nttime(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date, const unsigned encoding)
2259
2.34k
{
2260
2.34k
  if (tree) {
2261
2.34k
    uint32_t filetime_high, filetime_low;
2262
2.34k
    uint64_t filetime;
2263
2264
2.34k
    filetime_low = tvb_get_uint32(tvb, offset, encoding);
2265
2.34k
    filetime_high = tvb_get_uint32(tvb, offset + 4, encoding);
2266
2.34k
    filetime =  ((uint64_t)filetime_high << 32) | filetime_low;
2267
2.34k
    return add_nttime(tvb, tree, offset, hf_date, filetime);
2268
2.34k
  }
2269
0
  return NULL;
2270
2.34k
}
2271
2272
proto_item *
2273
dissect_nttime_hyper(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date, const unsigned encoding)
2274
0
{
2275
0
  if (tree) {
2276
0
    uint64_t filetime;
2277
2278
0
    filetime = tvb_get_uint64(tvb, offset, encoding);
2279
0
    return add_nttime(tvb, tree, offset, hf_date, filetime);
2280
0
  }
2281
0
  return NULL;
2282
0
}
2283
2284
proto_item *
2285
dissect_nttime_hyper_1sec(tvbuff_t *tvb, proto_tree *tree, int offset, int hf_date, const unsigned encoding)
2286
0
{
2287
0
  if (tree) {
2288
0
    uint64_t ftsecs;
2289
0
    nstime_t ts;
2290
2291
0
    ftsecs = tvb_get_uint64(tvb, offset, encoding);
2292
0
    if (filetime_1sec_to_nstime(&ts, ftsecs)) {
2293
0
      return proto_tree_add_time(tree, hf_date, tvb,
2294
0
          offset, 8, &ts);
2295
0
    } else {
2296
0
      ts.secs = ftsecs;
2297
0
      ts.nsecs = 0;
2298
0
      return proto_tree_add_time_format_value(tree, hf_date, tvb, offset, 8,
2299
0
          &ts, "Time can't be converted");
2300
0
    }
2301
0
  }
2302
0
  return NULL;
2303
0
}
2304
2305
/* Well-known SIDs defined in
2306
2307
     https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
2308
*/
2309
static const sid_strings well_known_sids[] = {
2310
  {"S-1-0",          "Null Authority"},
2311
  {"S-1-0-0",        "Nobody"},
2312
  {"S-1-1",          "World Authority"},
2313
  {"S-1-1-0",        "Everyone"},
2314
  {"S-1-2",          "Local Authority"},
2315
  {"S-1-2-0",        "Local"},
2316
  {"S-1-2-1",        "Console Logon"},
2317
  {"S-1-3",          "Creator Authority"},
2318
  {"S-1-3-0",        "Creator Owner"},
2319
  {"S-1-3-1",        "Creator Group"},
2320
  {"S-1-3-2",        "Creator Owner Server"},
2321
  {"S-1-3-3",        "Creator Group Server"},
2322
  {"S-1-3-4",        "Owner Rights"},
2323
  {"S-1-4",          "Non-unique Authority"},
2324
2325
  {"S-1-5",          "NT Authority"},
2326
  {"S-1-5-1",        "Dialup"},
2327
  {"S-1-5-2",        "Network"},
2328
  {"S-1-5-3",        "Batch"},
2329
  {"S-1-5-4",        "Interactive"},
2330
  {"S-1-5-5",        "Logon Session"}, /* S-1-5-5-X-Y has 6 fields */
2331
  {"S-1-5-6",        "Service"},
2332
  {"S-1-5-7",        "Anonymous"},
2333
  {"S-1-5-8",        "Proxy"},
2334
  {"S-1-5-9",        "Enterprise Domain Controllers"},
2335
  {"S-1-5-10",       "Principal Self"},
2336
  {"S-1-5-11",       "Authenticated Users"},
2337
  {"S-1-5-12",       "Restricted Code"},
2338
  {"S-1-5-13",       "Terminal Server Users"},
2339
  {"S-1-5-14",       "Remote Interactive Logon"},
2340
  {"S-1-5-15",       "All users in this organization"},
2341
  {"S-1-5-17",       "Default IIS user account"},
2342
  {"S-1-5-18",       "Local System"},
2343
  {"S-1-5-19",       "Local Service"},
2344
  {"S-1-5-20",       "Network Service"},
2345
2346
  {"S-1-5-21-0-0-0-496", "Compounded Authentication"},
2347
  {"S-1-5-21-0-0-0-497", "Claims Valid"},
2348
2349
  /*
2350
   * S-1-5-21-<d1>-<d2>-<d3>-<RID> where "<d1>-<d2>-<d3>" is the NT domain
2351
   *          RIDs are defined in 'wkwn_S_1_5_21_rids' */
2352
  {"S-1-5-21",       "Domain SID"},
2353
2354
  /* S-1-5-32-<RID>: Builtin local group SIDs  */
2355
  {"S-1-5-32",       "Local Group"},
2356
  {"S-1-5-32-544",   "Administrators"},
2357
  {"S-1-5-32-545",   "Users"},
2358
  {"S-1-5-32-546",   "Guests"},
2359
  {"S-1-5-32-547",   "Power Users"},
2360
  {"S-1-5-32-548",   "Account Operators"},
2361
  {"S-1-5-32-549",   "Server Operators"},
2362
  {"S-1-5-32-550",   "Print Operators"},
2363
  {"S-1-5-32-551",   "Backup Operators"},
2364
  {"S-1-5-32-552",   "Replicators"},
2365
  {"S-1-5-32-554",   "Pre-Windows 2000 Compatible Access"},
2366
  {"S-1-5-32-555",   "Remote Desktop Users"},
2367
  {"S-1-5-32-556",   "Network Configuration Operators"},
2368
  {"S-1-5-32-557",   "Incoming Forest Trust Builders"},
2369
  {"S-1-5-32-558",   "Performance Monitor Users"},
2370
  {"S-1-5-32-559",   "Performance Log Users"},
2371
  {"S-1-5-32-560",   "Windows Authorization Access Group"},
2372
  {"S-1-5-32-561",   "Terminal Server License Servers"},
2373
  {"S-1-5-32-562",   "Distributed COM Users"},
2374
  {"S-1-5-32-568",   "IIS Users"},
2375
  {"S-1-5-32-569",   "Cryptographic Operators"},
2376
  {"S-1-5-32-573",   "Event Log Readers"},
2377
  {"S-1-5-32-574",   "Certificate Service DCOM Access"},
2378
  {"S-1-5-32-575",   "RDS Remote Access Servers"},
2379
  {"S-1-5-32-576",   "RDS Endpoint Servers"},
2380
  {"S-1-5-32-577",   "RDS Management Servers"},
2381
  {"S-1-5-32-578",   "Hyper-V Admins"},
2382
  {"S-1-5-32-579",   "Access Control Assistance Operators"},
2383
  {"S-1-5-32-580",   "Remote Management Users"},
2384
2385
  {"S-1-5-33",       "Write Restricted Code"},
2386
2387
  {"S-1-5-64",       "Authentication"},
2388
  {"S-1-5-64-10",    "NTLM"},
2389
  {"S-1-5-64-14",    "SChannel"},
2390
  {"S-1-5-64-21",    "Digest"},
2391
2392
  {"S-1-5-80",       "NT Service"},
2393
2394
  {"S-1-5-84-0-0-0-0-0", "User Mode Drivers"},
2395
2396
  {"S-1-5-113",      "Local Account"},
2397
  {"S-1-5-114",      "Local Administrator Account"},
2398
2399
  {"S-1-5-1000",     "Other Organisation"},
2400
2401
  {"S-1-15-2-1",     "All App Packages"},
2402
2403
  {"S-1-16",         "Mandatory Level"},
2404
  {"S-1-16-0",       "Untrusted"},
2405
  {"S-1-16-4096",    "Low"},
2406
  {"S-1-16-8192",    "Medium"},
2407
  {"S-1-16-8448",    "Medium Plus"},
2408
  {"S-1-16-12288",   "High"},
2409
  {"S-1-16-16384",   "System"},
2410
  {"S-1-16-20480",   "Protected Process"},
2411
  {"S-1-16-28672",   "Secure Process"},
2412
2413
  {"S-1-18-1",       "Authentication Authority Asserted Identity"},
2414
  {"S-1-18-2",       "Service Asserted Identity"},
2415
  {"S-1-18-3",       "Fresh Public Key Identity"},
2416
  {"S-1-18-4",       "Key Trust Identity"},
2417
  {"S-1-18-5",       "Key Property Multifactor Authentication"},
2418
  {"S-1-18-6",       "Key Property Attestation"},
2419
2420
  {NULL, NULL}
2421
};
2422
2423
static const char*
2424
0
match_wkwn_sids(const char* sid) {
2425
0
  int i = 0;
2426
0
  while (well_known_sids[i].name) {
2427
0
    if (strcmp(well_known_sids[i].sid, sid)==0) {
2428
0
      return well_known_sids[i].name;
2429
0
    }
2430
0
    i++;
2431
0
  }
2432
0
  return NULL;
2433
0
}
2434
2435
/* For SIDs in the form 'S-1-5-21-X-Y-Z-<RID>', '21-X-Y-Z' is referred to
2436
   as the "domain SID" (NT domain) or "machine SID" (local machine).
2437
   The following are well-known RIDs which are appended to domain/machine SIDs
2438
   as defined in
2439
2440
     https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
2441
*/
2442
static const value_string wkwn_S_1_5_21_rids[] = {
2443
  {496, "Compounded Authentication"},
2444
  {497, "Claims Valid"},
2445
  {498,   "Enterprise Read-only Domain Controllers"},
2446
  {500, "Administrator"},
2447
  {501, "Guest"},
2448
  {502, "KRBTGT"},
2449
  {512, "Domain Admins"},
2450
  {513, "Domain Users"},
2451
  {514, "Domain Guests"},
2452
  {515, "Domain Computers"},
2453
  {516, "Domain Controllers"},
2454
  {517, "Cert Publishers"},
2455
  {518, "Schema Administrators"},
2456
  {519, "Enterprise Admins"},
2457
  {520, "Group Policy Creator Owners"},
2458
  {521, "Read-only Domain Controllers"},
2459
  {522, "Cloneable Controllers"},
2460
  {525, "Protected Users"},
2461
  {526, "Key Admins"},
2462
  {527, "Enterprise Key Admins"},
2463
  {553, "RAS and IAS Servers"},
2464
  {571, "Allowed RODC Password Replication Group"},
2465
  {572, "Denied RODC Password Replication Group"},
2466
  {0, NULL}
2467
};
2468
static value_string_ext wkwn_S_1_5_21_rids_ext = VALUE_STRING_EXT_INIT(wkwn_S_1_5_21_rids);
2469
2470
/* Dissect an NT SID.  Label it with 'name' and return a string version
2471
 * of the SID in the 'sid_str' parameter which has a packet lifetime
2472
 * scope and should NOT be freed by the caller. hf_sid can be -1 if
2473
 * the caller doesn't care what name is used and then "nt.sid" will be
2474
 * the default instead. If the caller wants a more appropriate hf
2475
 * field, it will just pass a FT_STRING hf field here
2476
 */
2477
int
2478
dissect_nt_sid(tvbuff_t *tvb, packet_info* pinfo, int offset, proto_tree *parent_tree,
2479
         const char *name, char **sid_str, int hf_sid)
2480
0
{
2481
0
  int offset_sid_start = offset, sa_offset, rid_offset=0, wkwn_sid1_len=0,
2482
0
    wkwn_sid2_len = 0, i;
2483
0
  uint8_t revision, num_auth;
2484
0
  uint32_t sa_field, rid=0;
2485
0
  uint64_t authority=0;
2486
0
  wmem_strbuf_t *sa_str = NULL, *sid_in_dec_str = NULL, *sid_in_hex_str = NULL, *label_str = NULL,
2487
0
          *domain_str = NULL, *wkwn_sid1_str = NULL, *wkwn_sid2_str = NULL;
2488
0
  const char *mapped_name = NULL, *mapped_rid = NULL;
2489
0
  bool domain_sid = false, s_1_5_32 = false, s_1_5_64 = false, locally_defined = false,
2490
0
    S_1_16 = false;
2491
0
  proto_item *item = NULL, *hidden_item;
2492
0
  proto_tree *subtree = NULL;
2493
2494
  /* Revision of SID */
2495
0
  revision = tvb_get_uint8(tvb, offset);
2496
0
  offset++;
2497
2498
  /* Number of subauthority fields */
2499
0
  num_auth = tvb_get_uint8(tvb, offset);
2500
0
  offset++;
2501
2502
0
  if(sid_str)
2503
0
    *sid_str=NULL;
2504
2505
0
  if(hf_sid <= 0){
2506
    /* if no tree, just return the offset of the end_of_SID+1 */
2507
0
    if (!parent_tree)
2508
0
      return offset+(6+(num_auth*4));
2509
2510
0
    hf_sid=hf_nt_sid;
2511
0
  }
2512
2513
  /* Identifier Authority */
2514
0
  for(i=0; i<6; i++){
2515
0
    authority = (authority << 8) + tvb_get_uint8(tvb, offset);
2516
0
    offset++;
2517
0
  }
2518
2519
0
  sid_in_dec_str = wmem_strbuf_create(pinfo->pool);
2520
0
  wmem_strbuf_append_printf (sid_in_dec_str, "S-%u-%" PRIu64, revision, authority);
2521
2522
  /*  If sid_display_hex is set, sid_in_dec_str is still needed for
2523
    looking up well-known SIDs*/
2524
0
  if (sid_display_hex) {
2525
0
    sid_in_hex_str = wmem_strbuf_create(pinfo->pool);
2526
0
    wmem_strbuf_append_printf (sid_in_hex_str, "S-%x-%" PRIx64, revision, authority);
2527
0
  }
2528
2529
0
  wkwn_sid1_str = wmem_strbuf_create(pinfo->pool);
2530
0
  label_str = wmem_strbuf_create(pinfo->pool);
2531
2532
0
  if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-16")==0)
2533
0
    S_1_16 = true;
2534
2535
  /* Check for Scoped Policy ID (S-1-17-<subauth1>...) */
2536
0
  if (authority == 17) {
2537
0
    mapped_name = "Central Access Policy";
2538
0
  }
2539
2540
  /* Look for well-known SIDs in format 'S-1-<Identifier Authority>' (i.e., exactly 3 fields) */
2541
0
  if (num_auth==0 || S_1_16 || mapped_name) {
2542
0
    if (!mapped_name)
2543
0
      mapped_name = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2544
2545
0
    if (mapped_name) {
2546
0
      wmem_strbuf_append(label_str, mapped_name);
2547
0
      wmem_strbuf_append(wkwn_sid1_str,
2548
0
        (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2549
0
      wkwn_sid1_len = 8;
2550
0
    }
2551
0
  }
2552
2553
2554
0
  sa_offset = offset;
2555
0
  sa_str = wmem_strbuf_create(pinfo->pool);
2556
0
  wkwn_sid2_str = wmem_strbuf_create(pinfo->pool);
2557
0
  domain_str = wmem_strbuf_create(pinfo->pool);
2558
2559
  /* Build the sub-authorities and full SID strings */
2560
0
  for(i=1; i<num_auth+1; i++) {
2561
     /*
2562
    * XXX should not be letohl but native byteorder according to
2563
    * Samba header files.
2564
    *
2565
    * However, considering that there were never any NT ports
2566
    * to big-endian platforms (PowerPC and MIPS ran little-endian,
2567
    * and IA-64 runs little-endian, as does x86-64), we can (?)
2568
    * assume that non le byte encodings will be "uncommon"?
2569
    */
2570
0
    sa_field = tvb_get_letohl(tvb, offset);
2571
0
    wmem_strbuf_append_printf(sid_in_dec_str, "-%u", sa_field);
2572
0
    wmem_strbuf_append_printf(sa_str,
2573
0
      (i==1 ? (sid_display_hex ? "%x" : "%u") : (sid_display_hex ? "-%x" : "-%u")),
2574
0
      sa_field);
2575
0
    if (sid_display_hex)
2576
0
      wmem_strbuf_append_printf(sid_in_hex_str, "-%x", sa_field);
2577
2578
0
    if (i==1) {
2579
      /* Look for well-known SIDs at level one ("S-1-<authority>-<value>") */
2580
0
      if (S_1_16) {
2581
        /* Mandatory Level (S-1-16) */
2582
0
        mapped_rid = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2583
0
        if (mapped_rid) {
2584
          /* Get the RID */
2585
0
          wmem_strbuf_append_printf(label_str, "%s-%s", mapped_name, mapped_rid);
2586
0
          rid = sa_field;
2587
0
          rid_offset = offset;
2588
0
          wmem_strbuf_append(wkwn_sid2_str,
2589
0
            (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2590
0
          wkwn_sid1_len=12;       }
2591
0
      } else {
2592
0
        mapped_name = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2593
0
        if (mapped_name) {
2594
0
          wmem_strbuf_append(label_str, mapped_name);
2595
0
          wmem_strbuf_append(wkwn_sid1_str,
2596
0
            (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2597
0
          wkwn_sid1_len = 12;
2598
0
        }
2599
        /* The following three SID types have (unique) RIDs */
2600
0
        if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-5-21")==0) {
2601
          /* Domain SID */
2602
0
          domain_sid = true;
2603
0
        } else if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-5-32")==0) {
2604
          /* Local Group (S-1-5-32) SID */
2605
0
          s_1_5_32 = true;
2606
0
        } else if (strcmp(wmem_strbuf_get_str(sid_in_dec_str), "S-1-5-64")==0) {
2607
          /* Authentication (S-1-5-64) SID */
2608
0
          s_1_5_64 = true;
2609
0
        }
2610
0
      }
2611
0
    } else if (i==2  && !domain_sid) {
2612
      /* The only well-known SIDS with two subauthority fields ("level 2 SIDs") are
2613
         Local Group (S-1-5-32), and Authentication (S-1-5-64). */
2614
0
      if (s_1_5_32 || s_1_5_64) {
2615
0
        mapped_rid = match_wkwn_sids(wmem_strbuf_get_str(sid_in_dec_str));
2616
0
        if (mapped_rid) {
2617
          /* Get the RID */
2618
0
          wmem_strbuf_append_printf(label_str, "-%s", mapped_rid);
2619
0
          rid = sa_field;
2620
0
          rid_offset = offset;
2621
0
          wmem_strbuf_append(wkwn_sid2_str,
2622
0
            (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)));
2623
0
          wkwn_sid2_len=16;
2624
0
        } else {
2625
          /* The RID not well-known. */
2626
0
          locally_defined = true;
2627
0
        }
2628
0
      } else {
2629
0
        if (mapped_name) {
2630
          /* A level 1 well-known SID appended with locally defined value */
2631
0
          locally_defined = true;
2632
0
        }
2633
0
      }
2634
0
    } else {
2635
      /* 3 or more sub-auth fields - NOTE: Except for domain SIDs, there are no wkwn SIDs with 3 or more
2636
         sub-auth fields so we don't lookup SIDs here. Logon Session SIDs have 3 sub-auth fields but the
2637
         last two are locally defined. */
2638
0
      if (domain_sid) {
2639
0
        if (num_auth >= 4) {
2640
0
          if (i >= 2 && i <=4 ) {
2641
            /* Add the field to the domain string (d1-d2-d3) */
2642
0
            wmem_strbuf_append_printf(domain_str,
2643
0
              (i==2 ? (sid_display_hex ? "%x" : "%u") : (sid_display_hex ? "-%x" : "-%u")), sa_field);
2644
2645
0
          } else if (i==5) {
2646
0
            rid = sa_field;
2647
0
            rid_offset = offset;
2648
0
            mapped_rid = val_to_str_ext_const(rid, &wkwn_S_1_5_21_rids_ext, "Domain RID");
2649
0
            wmem_strbuf_append_printf(label_str, "-%s", mapped_rid);
2650
2651
0
          } else {
2652
0
            locally_defined = true;
2653
0
          }
2654
0
        } else {
2655
0
          mapped_name = "Corrupt domain SID";
2656
0
        }
2657
0
      } else {
2658
0
        if (mapped_name) {
2659
          /* A locally defined value appended to a level 2 well-known SID*/
2660
0
          locally_defined = true;
2661
0
        }
2662
0
      }
2663
0
    }
2664
0
    offset+=4;
2665
0
  } /* End of for loop */
2666
2667
0
  if ( !(mapped_name || domain_sid || s_1_5_32 || s_1_5_64) ) {
2668
      /* If requested, try to map the NON-well-known SID to an object name discovered in this capture  */
2669
0
    if (sid_name_snooping) {
2670
0
      mapped_name = find_sid_name(wmem_strbuf_get_str(sid_in_dec_str));
2671
0
    } else {
2672
0
      mapped_name = "<Unknown SID type>";
2673
0
    }
2674
0
  }
2675
2676
0
  if (locally_defined) {
2677
0
    wmem_strbuf_append_printf(label_str, "-<locally defined>");
2678
0
  }
2679
2680
  /* It's tree time
2681
     Display the full SID string in hex or dec */
2682
0
  item = proto_tree_add_string_format(
2683
0
    parent_tree, hf_sid, tvb, offset_sid_start, (offset - offset_sid_start),
2684
0
    (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)),
2685
0
    "%s: %s", name, (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str))
2686
0
  );
2687
2688
0
  if (wmem_strbuf_get_len(label_str) > 0) {
2689
0
    proto_item_append_text(item, "  (%s)", wmem_strbuf_get_str(label_str));
2690
0
  }
2691
2692
0
  subtree = proto_item_add_subtree(item, ett_nt_sid);
2693
2694
  /* Add revision, num_auth, and authority */
2695
0
  proto_tree_add_item(subtree, hf_nt_sid_revision, tvb, offset_sid_start, 1, ENC_LITTLE_ENDIAN);
2696
0
  proto_tree_add_item(subtree, hf_nt_sid_num_auth, tvb, offset_sid_start+1, 1, ENC_LITTLE_ENDIAN);
2697
0
  proto_tree_add_uint64(subtree,
2698
0
    (sid_display_hex ? hf_nt_sid_auth_hex : hf_nt_sid_auth_dec),
2699
0
    tvb, offset_sid_start+2, 6, authority);
2700
2701
  /* Add subauthorities */
2702
0
  proto_tree_add_string_format_value(subtree, hf_nt_sid_subauth, tvb, sa_offset,
2703
0
    num_auth*4, wmem_strbuf_get_str(sa_str), "%s", wmem_strbuf_get_str(sa_str));
2704
2705
0
  if (rid) {
2706
0
    item = proto_tree_add_item (subtree,
2707
0
      (sid_display_hex ? hf_nt_sid_rid_hex : hf_nt_sid_rid_dec), tvb, rid_offset, 4, ENC_LITTLE_ENDIAN);
2708
2709
0
    if (mapped_rid)
2710
0
      proto_item_append_text(item, "  (%s)", mapped_rid);
2711
0
  }
2712
2713
  /* Add well-known SID and domain strings if present */
2714
0
  if (wmem_strbuf_get_len(wkwn_sid1_str) > 0) {
2715
0
    hidden_item = proto_tree_add_string_format_value(
2716
0
      subtree, hf_nt_sid_wkwn, tvb, offset_sid_start, wkwn_sid1_len,
2717
0
      wmem_strbuf_get_str(wkwn_sid1_str), "%s", wmem_strbuf_get_str(wkwn_sid1_str));
2718
2719
0
    if (mapped_name) {
2720
0
      proto_item_append_text(hidden_item, "  (%s)", mapped_name);
2721
0
    }
2722
0
    proto_item_set_hidden(hidden_item);
2723
0
  }
2724
0
  if (wmem_strbuf_get_len(wkwn_sid2_str) > 0) {
2725
0
    hidden_item = proto_tree_add_string_format_value(
2726
0
      subtree, hf_nt_sid_wkwn, tvb, offset_sid_start, wkwn_sid2_len,
2727
0
      wmem_strbuf_get_str(wkwn_sid2_str), "%s", wmem_strbuf_get_str(wkwn_sid2_str));
2728
0
    if (wmem_strbuf_get_len(label_str) > 0) {
2729
0
      proto_item_append_text(hidden_item, "  (%s)", wmem_strbuf_get_str(label_str));
2730
0
    }
2731
0
    proto_item_set_hidden(hidden_item);
2732
0
  }
2733
0
  if (domain_sid && wmem_strbuf_get_len(domain_str) > 0) {
2734
0
    hidden_item = proto_tree_add_string_format_value(
2735
0
      subtree, hf_nt_sid_domain, tvb, offset_sid_start + 12, 12,
2736
0
      wmem_strbuf_get_str(domain_str), "%s", wmem_strbuf_get_str(domain_str));
2737
0
    proto_item_set_hidden(hidden_item);
2738
0
  }
2739
2740
  /* If requested, return SID string with mapped name */
2741
0
  if(sid_str){
2742
0
    if(wmem_strbuf_get_len(label_str) > 0){
2743
0
      *sid_str = wmem_strdup_printf(pinfo->pool, "%s  (%s)",
2744
0
        (sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str)), wmem_strbuf_get_str(label_str));
2745
0
    } else {
2746
0
      *sid_str = wmem_strdup(pinfo->pool, sid_display_hex ? wmem_strbuf_get_str(sid_in_hex_str) : wmem_strbuf_get_str(sid_in_dec_str));
2747
0
    }
2748
0
    if(!(*sid_str)){
2749
0
      *sid_str=wmem_strdup(pinfo->pool, "corrupted SID");
2750
0
    }
2751
0
  }
2752
0
  return offset;
2753
0
}
2754
2755
/* Dissect SYSTEM_RESOURCE_ATTRIBUTE_ACE Value, see [MS-DTYP] v20180912 section 2.4.4.15 */
2756
static int
2757
dissect_nt_ace_system_resource_attribute_value(tvbuff_t *tvb, packet_info* pinfo, int value_offset, proto_tree *tree,
2758
                 uint16_t value_type, proto_item *sra_item)
2759
0
{
2760
0
  unsigned value_len;
2761
0
  uint32_t blob_len;
2762
0
  proto_item *value_item = NULL;
2763
0
  char *value_str = NULL; /* packet scope, do not free */
2764
0
  bool quote = false;
2765
0
  switch (value_type) {
2766
0
      case CLAIM_SECURITY_ATTRIBUTE_TYPE_INT64:
2767
0
    value_len = sizeof(int64_t);
2768
0
    value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_int64,
2769
0
             tvb, value_offset, value_len,
2770
0
             ENC_LITTLE_ENDIAN);
2771
0
    value_offset += value_len;
2772
0
    break;
2773
2774
0
      case CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64:
2775
0
    value_len = sizeof(uint64_t);
2776
0
    value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_uint64,
2777
0
             tvb, value_offset, value_len,
2778
0
             ENC_LITTLE_ENDIAN);
2779
0
    value_offset += value_len;
2780
0
    break;
2781
2782
0
      case CLAIM_SECURITY_ATTRIBUTE_TYPE_STRING:
2783
0
    value_len = tvb_unicode_strsize(tvb, value_offset);
2784
0
    value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_string,
2785
0
             tvb, value_offset, value_len,
2786
0
             ENC_UTF_16 | ENC_LITTLE_ENDIAN);
2787
0
    quote = true;
2788
0
    value_offset += value_len;
2789
0
    break;
2790
2791
0
      case CLAIM_SECURITY_ATTRIBUTE_TYPE_SID:
2792
0
    value_offset = dissect_nt_sid(tvb, pinfo, value_offset, tree,
2793
0
                "SID", &value_str, hf_nt_ace_sra_value_sid);
2794
0
    break;
2795
2796
0
      case CLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN:
2797
0
    value_len = sizeof(uint64_t);
2798
0
    value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_boolean,
2799
0
             tvb, value_offset, value_len,
2800
0
             ENC_LITTLE_ENDIAN);
2801
0
    value_offset += value_len;
2802
0
    break;
2803
2804
0
      case CLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING:
2805
0
    blob_len = tvb_get_letohl(tvb, value_offset);
2806
0
    value_offset += sizeof(blob_len);
2807
0
    value_item = proto_tree_add_item(tree, hf_nt_ace_sra_value_octet_string,
2808
0
             tvb, value_offset, blob_len, ENC_NA);
2809
    /* do not append binary to sra_item */
2810
0
    value_str = "<bin>";
2811
0
    value_offset += blob_len;
2812
0
    break;
2813
2814
0
      default:
2815
0
    break;
2816
0
  }
2817
2818
0
  if (sra_item) {
2819
0
    if ((value_str == NULL) && value_item) {
2820
0
      value_str = proto_item_get_display_repr(pinfo->pool, value_item);
2821
0
    }
2822
2823
0
    if (value_str == NULL) {
2824
      /* missing system resource attribute value */
2825
0
      value_str = "???";
2826
0
    }
2827
2828
0
    if (value_str) {
2829
0
      proto_item_append_text(sra_item,
2830
0
                 (quote) ? "\"%s\"" : "%s",
2831
0
                 value_str);
2832
0
    }
2833
0
  }
2834
2835
0
  return value_offset;
2836
0
}
2837
2838
/* Dissect SYSTEM_RESOURCE_ATTRIBUTE_ACE, see [MS-DTYP] v20180912 section 2.4.4.15 */
2839
static int
2840
dissect_nt_ace_system_resource_attribute(tvbuff_t *tvb, packet_info* pinfo, int offset, uint16_t size, proto_tree *parent_tree)
2841
0
{
2842
  /* The caller has already dissected Header, Mask and Sid. Therefore
2843
     this function only dissects Attribute Data. This data takes
2844
     the form of a CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1. The
2845
     following code dissects the structure piecemeal */
2846
0
  int start_offset = offset;
2847
0
  uint32_t name; /* offset, relative to start_offset */
2848
0
  uint16_t value_type;
2849
0
  uint32_t value_count;
2850
2851
  /* Add a subtree to hold the system resource attribute details */
2852
0
  proto_item *sra_item;
2853
0
  proto_tree *sra_tree;
2854
0
  sra_item = proto_tree_add_item(parent_tree, hf_nt_ace_sra, tvb, offset, size, ENC_NA);
2855
0
  sra_tree = proto_item_add_subtree(sra_item, ett_nt_ace_sra);
2856
2857
  /* Name offset */
2858
0
  name = tvb_get_letohl(tvb, offset);
2859
0
  proto_tree_add_uint(sra_tree, hf_nt_ace_sra_name_offset,
2860
0
          tvb, offset, sizeof(name), name);
2861
2862
0
  int name_offset = (start_offset + name);
2863
0
  unsigned name_len = tvb_unicode_strsize(tvb, name_offset);
2864
0
  proto_item *name_item;
2865
0
  name_item = proto_tree_add_item(sra_tree, hf_nt_ace_sra_name,
2866
0
          tvb, name_offset, name_len,
2867
0
          ENC_UTF_16 | ENC_LITTLE_ENDIAN);
2868
0
  proto_item_append_text(sra_item, ": %s=",
2869
0
             proto_item_get_display_repr(pinfo->pool, name_item));
2870
0
  offset += sizeof(name);
2871
2872
  /* ValueType */
2873
0
  value_type = tvb_get_letohs(tvb, offset);
2874
0
  proto_tree_add_uint(sra_tree, hf_nt_ace_sra_type,
2875
0
          tvb, offset, sizeof(value_type), value_type);
2876
0
  offset += sizeof(value_type);
2877
2878
  /* Reserved */
2879
0
  proto_tree_add_item(sra_tree, hf_nt_ace_sra_reserved,
2880
0
          tvb, offset, sizeof(uint16_t),
2881
0
          ENC_LITTLE_ENDIAN);
2882
0
  offset += sizeof(uint16_t);
2883
2884
  /* Flags */
2885
0
  static int * const flags[] = {
2886
0
    &hf_nt_ace_sra_flags_policy_derived,
2887
0
    &hf_nt_ace_sra_flags_manual,
2888
0
    &hf_nt_ace_sra_flags_mandatory,
2889
0
    &hf_nt_ace_sra_flags_disabled,
2890
0
    &hf_nt_ace_sra_flags_disabled_by_default,
2891
0
    &hf_nt_ace_sra_flags_deny_only,
2892
0
    &hf_nt_ace_sra_flags_case_sensitive,
2893
0
    &hf_nt_ace_sra_flags_non_inheritable,
2894
0
    NULL
2895
0
  };
2896
2897
0
  proto_tree_add_bitmask(sra_tree, tvb, offset, hf_nt_ace_sra_flags,
2898
0
             ett_nt_ace_sra_flags, flags, ENC_LITTLE_ENDIAN);
2899
0
  offset += sizeof(uint32_t);
2900
2901
  /* ValueCount */
2902
0
  value_count = tvb_get_letohl(tvb, offset);
2903
0
  proto_tree_add_uint(sra_tree, hf_nt_ace_sra_value_count,
2904
0
          tvb, offset, sizeof(value_count), value_count);
2905
0
  offset += sizeof(value_count);
2906
2907
  /* Value Offsets and Values */
2908
0
  uint32_t value_offset;
2909
0
  proto_tree *value_offset_tree = sra_tree;
2910
0
  proto_tree *value_tree = sra_tree;
2911
0
  if (value_count > 1) {
2912
    /* Use independent value offset and value trees when
2913
       there are multiple values. */
2914
0
    int value_offset_tree_offset = offset;
2915
0
    int value_offset_tree_len = value_count * sizeof(value_offset);
2916
0
    value_offset_tree = proto_tree_add_subtree(sra_tree, tvb,
2917
0
                 value_offset_tree_offset,
2918
0
                 value_offset_tree_len,
2919
0
                 ett_nt_ace_sra_value_offsets,
2920
0
                 NULL, "Value Offsets");
2921
2922
    /* The range associated with the value tree will
2923
       include some non-value data (but that's fine as the
2924
       value items it contains will have accurate ranges) */
2925
0
    int value_tree_offset = value_offset_tree_offset + value_offset_tree_len;
2926
0
    int value_tree_len = (start_offset + size) - value_tree_offset;
2927
0
    value_tree = proto_tree_add_subtree(sra_tree, tvb,
2928
0
                value_tree_offset,
2929
0
                value_tree_len,
2930
0
                ett_nt_ace_sra_values,
2931
0
                NULL, "Values");
2932
0
  }
2933
2934
0
  proto_item_append_text(sra_item, "{");
2935
0
  for (uint32_t i = 0; i < value_count; ++i) {
2936
0
    if (i) {
2937
0
      proto_item_append_text(sra_item, ", ");
2938
0
    }
2939
0
    value_offset = tvb_get_letohl(tvb, offset);
2940
0
    proto_tree_add_uint(value_offset_tree, hf_nt_ace_sra_value_offset,
2941
0
            tvb, offset, sizeof(value_offset), value_offset);
2942
0
    dissect_nt_ace_system_resource_attribute_value(tvb, pinfo, start_offset + value_offset,
2943
0
                     value_tree, value_type, sra_item);
2944
0
    offset += sizeof(value_offset);
2945
0
  }
2946
0
  proto_item_append_text(sra_item, "}");
2947
2948
0
  return start_offset + size;
2949
0
}
2950
2951
/* Dissect Condition ACE token, see [MS-DTYP] v20180912 section 2.4.4.17.4 */
2952
static int
2953
// NOLINTNEXTLINE(misc-no-recursion)
2954
dissect_nt_conditional_ace_token(tvbuff_t *tvb, packet_info *pinfo, int offset, uint16_t size, proto_tree *parent_tree)
2955
0
{
2956
0
  int start_offset = offset;
2957
0
  proto_tree *tree = parent_tree;
2958
0
  proto_item *item = NULL;
2959
0
  uint8_t token = tvb_get_uint8(tvb, offset);
2960
0
  uint32_t len;
2961
2962
0
  item = proto_tree_add_uint(tree, hf_nt_ace_cond_token,
2963
0
           tvb, offset, sizeof(token), token);
2964
2965
0
  if (ace_cond_token_has_data(token)) {
2966
0
    tree = proto_item_add_subtree(item, ett_nt_ace_cond_data);
2967
0
  }
2968
0
  offset += sizeof(token);
2969
2970
0
  switch (token) {
2971
0
      case COND_ACE_TOKEN_INT8:
2972
0
    proto_tree_add_item(tree, hf_nt_ace_cond_value_int8,
2973
0
            tvb, offset, sizeof(uint64_t),
2974
0
            ENC_LITTLE_ENDIAN);
2975
0
    offset += sizeof(uint64_t);
2976
2977
0
    proto_tree_add_item(tree, hf_nt_ace_cond_sign,
2978
0
            tvb, offset, sizeof(uint8_t),
2979
0
            ENC_LITTLE_ENDIAN);
2980
0
    offset += sizeof(uint8_t);
2981
2982
0
    proto_tree_add_item(tree, hf_nt_ace_cond_base,
2983
0
            tvb, offset, sizeof(uint8_t),
2984
0
            ENC_LITTLE_ENDIAN);
2985
0
    offset += sizeof(uint8_t);
2986
0
    break;
2987
2988
0
      case COND_ACE_TOKEN_INT16:
2989
0
    proto_tree_add_item(tree, hf_nt_ace_cond_value_int16,
2990
0
            tvb, offset, sizeof(uint64_t),
2991
0
            ENC_LITTLE_ENDIAN);
2992
0
    offset += sizeof(uint64_t);
2993
2994
0
    proto_tree_add_item(tree, hf_nt_ace_cond_sign,
2995
0
            tvb, offset, sizeof(uint8_t),
2996
0
            ENC_LITTLE_ENDIAN);
2997
0
    offset += sizeof(uint8_t);
2998
2999
0
    proto_tree_add_item(tree, hf_nt_ace_cond_base,
3000
0
            tvb, offset, sizeof(uint8_t),
3001
0
            ENC_LITTLE_ENDIAN);
3002
0
    offset += sizeof(uint8_t);
3003
0
    break;
3004
3005
0
      case COND_ACE_TOKEN_INT32:
3006
0
    proto_tree_add_item(tree, hf_nt_ace_cond_value_int32,
3007
0
            tvb, offset, sizeof(uint64_t),
3008
0
            ENC_LITTLE_ENDIAN);
3009
0
    offset += sizeof(uint64_t);
3010
3011
0
    proto_tree_add_item(tree, hf_nt_ace_cond_sign,
3012
0
            tvb, offset, sizeof(uint8_t),
3013
0
            ENC_LITTLE_ENDIAN);
3014
0
    offset += sizeof(uint8_t);
3015
3016
0
    proto_tree_add_item(tree, hf_nt_ace_cond_base,
3017
0
            tvb, offset, sizeof(uint8_t),
3018
0
            ENC_LITTLE_ENDIAN);
3019
0
    offset += sizeof(uint8_t);
3020
0
    break;
3021
3022
0
      case COND_ACE_TOKEN_INT64:
3023
0
    proto_tree_add_item(tree, hf_nt_ace_cond_value_int64,
3024
0
            tvb, offset, sizeof(uint64_t),
3025
0
            ENC_LITTLE_ENDIAN);
3026
0
    offset += sizeof(uint64_t);
3027
3028
0
    proto_tree_add_item(tree, hf_nt_ace_cond_sign,
3029
0
            tvb, offset, sizeof(uint8_t),
3030
0
            ENC_LITTLE_ENDIAN);
3031
0
    offset += sizeof(uint8_t);
3032
3033
0
    proto_tree_add_item(tree, hf_nt_ace_cond_base,
3034
0
            tvb, offset, sizeof(uint8_t),
3035
0
            ENC_LITTLE_ENDIAN);
3036
0
    offset += sizeof(uint8_t);
3037
0
    break;
3038
3039
0
      case COND_ACE_TOKEN_UNICODE_STRING:
3040
0
    len = tvb_get_letohl(tvb, offset); /* in bytes */
3041
0
    offset += sizeof(len);
3042
3043
0
    proto_tree_add_item(tree, hf_nt_ace_cond_value_string,
3044
0
            tvb, offset, len,
3045
0
            ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3046
0
    offset += len;
3047
0
    break;
3048
3049
0
      case COND_ACE_TOKEN_OCTET_STRING:
3050
0
    len = tvb_get_letohl(tvb, offset); /* in bytes */
3051
0
    offset += sizeof(len);
3052
3053
0
    proto_tree_add_item(tree, hf_nt_ace_cond_value_octet_string,
3054
0
            tvb, offset, len, ENC_NA);
3055
0
    offset += len;
3056
0
    break;
3057
3058
0
      case COND_ACE_TOKEN_COMPOSITE:
3059
    /* Create another tree for composite */
3060
0
    len = tvb_get_letohl(tvb, offset); /* in bytes */
3061
0
    offset += sizeof(len);
3062
0
    if (len) {
3063
0
      int remaining = size - (offset - start_offset);
3064
0
      if (remaining >= (int)len) {
3065
0
        int end_offset = offset + len;
3066
0
        increment_dissection_depth(pinfo);
3067
0
        while (offset < end_offset) {
3068
0
          offset = dissect_nt_conditional_ace_token(tvb, pinfo, offset, remaining, tree);
3069
0
        }
3070
0
        decrement_dissection_depth(pinfo);
3071
0
      } else {
3072
        /* malformed: composite len is longer
3073
         * than the remaining data in the ace
3074
         */
3075
0
        offset += remaining;
3076
0
      }
3077
0
    }
3078
0
    break;
3079
3080
0
      case COND_ACE_TOKEN_SID:
3081
0
    offset += sizeof(len);
3082
3083
0
    offset = dissect_nt_sid(tvb, pinfo, offset, tree, "SID", NULL, -1);
3084
0
    break;
3085
3086
0
      case COND_ACE_TOKEN_LOCAL_ATTRIBUTE:
3087
0
    len = tvb_get_letohl(tvb, offset); /* in bytes */
3088
0
    offset += sizeof(len);
3089
3090
0
    proto_tree_add_item(tree, hf_nt_ace_cond_local_attr,
3091
0
            tvb, offset, len,
3092
0
            ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3093
0
    offset += len;
3094
0
    break;
3095
3096
0
      case COND_ACE_TOKEN_USER_ATTRIBUTE:
3097
0
    len = tvb_get_letohl(tvb, offset); /* in bytes */
3098
0
    offset += sizeof(len);
3099
3100
0
    proto_tree_add_item(tree, hf_nt_ace_cond_user_attr,
3101
0
            tvb, offset, len,
3102
0
            ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3103
0
    offset += len;
3104
0
    break;
3105
3106
0
      case COND_ACE_TOKEN_RESOURCE_ATTRIBUTE:
3107
0
    len = tvb_get_letohl(tvb, offset); /* in bytes */
3108
0
    offset += sizeof(len);
3109
3110
0
    proto_tree_add_item(tree, hf_nt_ace_cond_resource_attr,
3111
0
            tvb, offset, len,
3112
0
            ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3113
0
    offset += len;
3114
0
    break;
3115
3116
0
      case COND_ACE_TOKEN_DEVICE_ATTRIBUTE:
3117
0
    len = tvb_get_letohl(tvb, offset); /* in bytes */
3118
0
    offset += sizeof(len);
3119
3120
0
    proto_tree_add_item(tree, hf_nt_ace_cond_device_attr,
3121
0
            tvb, offset, len,
3122
0
            ENC_UTF_16 | ENC_LITTLE_ENDIAN);
3123
0
    offset += len;
3124
0
    break;
3125
3126
0
      default:
3127
0
    DISSECTOR_ASSERT(!ace_cond_token_has_data(token));
3128
0
    break;
3129
0
  }
3130
3131
0
  proto_item_set_len(item, offset - start_offset);
3132
0
  return offset;
3133
0
}
3134
3135
3136
/* Dissect Conditional ACE (if present), see [MS-DTYP] v20180912 section 2.4.4.17.4 */
3137
static int
3138
dissect_nt_conditional_ace(tvbuff_t *tvb, packet_info *pinfo, int offset, uint16_t size, proto_tree *parent_tree)
3139
0
{
3140
0
  int start_offset = offset;
3141
3142
  /* Conditional ACE Application Data starts with "artx" */
3143
0
  if (size >= 4) {
3144
0
    const uint32_t artx = 0x78747261; /* "xtra" (LE) */
3145
0
    uint32_t prefix = tvb_get_letohl(tvb, offset);
3146
0
    offset += sizeof(prefix);
3147
3148
0
    if (prefix == artx) {
3149
      /* Add a subtree to hold the condition expression tokens */
3150
0
      proto_item *item = NULL;
3151
0
      item = proto_tree_add_item(parent_tree, hf_nt_ace_cond, tvb, start_offset, size, ENC_NA);
3152
0
      parent_tree = proto_item_add_subtree(item, ett_nt_ace_cond);
3153
3154
      /* Add the tokens to the subtree */
3155
0
      int remaining;
3156
0
      while (true) {
3157
0
        remaining = size - (offset - start_offset);
3158
0
        if (remaining <= 0)
3159
0
          break;
3160
0
        offset = dissect_nt_conditional_ace_token(tvb, pinfo, offset, remaining, parent_tree);
3161
0
      }
3162
0
    }
3163
0
  }
3164
0
  return start_offset + size;
3165
0
}
3166
3167
/* Dissect an access mask.  All this stuff is kind of explained at
3168
3169
     https://docs.microsoft.com/en-us/windows/win32/secauthz/access-mask-format
3170
3171
*/
3172
static int ett_nt_access_mask;
3173
static int ett_nt_access_mask_generic;
3174
static int ett_nt_access_mask_other;
3175
static int ett_nt_access_mask_standard;
3176
static int ett_nt_access_mask_specific;
3177
3178
static int hf_access_maximum_allowed;
3179
static int hf_access_generic_read;
3180
static int hf_access_generic_write;
3181
static int hf_access_generic_execute;
3182
static int hf_access_generic_all;
3183
static int hf_access_other_3;
3184
static int hf_access_other_2;
3185
static int hf_access_system_security;
3186
static int hf_access_standard_7;
3187
static int hf_access_standard_6;
3188
static int hf_access_standard_5;
3189
static int hf_access_standard_delete;
3190
static int hf_access_standard_read_control;
3191
static int hf_access_standard_synchronise;
3192
static int hf_access_standard_write_dac;
3193
static int hf_access_standard_write_owner;
3194
static int hf_access_specific_15;
3195
static int hf_access_specific_14;
3196
static int hf_access_specific_13;
3197
static int hf_access_specific_12;
3198
static int hf_access_specific_11;
3199
static int hf_access_specific_10;
3200
static int hf_access_specific_9;
3201
static int hf_access_specific_8;
3202
static int hf_access_specific_7;
3203
static int hf_access_specific_6;
3204
static int hf_access_specific_5;
3205
static int hf_access_specific_4;
3206
static int hf_access_specific_3;
3207
static int hf_access_specific_2;
3208
static int hf_access_specific_1;
3209
static int hf_access_specific_0;
3210
3211
/* Map generic permissions to specific permissions */
3212
3213
static void map_generic_access(uint32_t *access_mask,
3214
             struct generic_mapping *mapping)
3215
0
{
3216
0
  if (*access_mask & GENERIC_READ_ACCESS) {
3217
0
    *access_mask &= ~GENERIC_READ_ACCESS;
3218
0
    *access_mask |= mapping->generic_read;
3219
0
  }
3220
3221
0
  if (*access_mask & GENERIC_WRITE_ACCESS) {
3222
0
    *access_mask &= ~GENERIC_WRITE_ACCESS;
3223
0
    *access_mask |= mapping->generic_write;
3224
0
  }
3225
3226
0
  if (*access_mask & GENERIC_EXECUTE_ACCESS) {
3227
0
    *access_mask &= ~GENERIC_EXECUTE_ACCESS;
3228
0
    *access_mask |= mapping->generic_execute;
3229
0
  }
3230
3231
0
  if (*access_mask & GENERIC_ALL_ACCESS) {
3232
0
    *access_mask &= ~GENERIC_ALL_ACCESS;
3233
0
    *access_mask |= mapping->generic_all;
3234
0
  }
3235
0
}
3236
3237
/* Map standard permissions to specific permissions */
3238
3239
static void map_standard_access(uint32_t *access_mask,
3240
        struct standard_mapping *mapping)
3241
0
{
3242
0
  if (*access_mask & READ_CONTROL_ACCESS) {
3243
0
    *access_mask &= ~READ_CONTROL_ACCESS;
3244
0
    *access_mask |= mapping->std_read;
3245
0
  }
3246
3247
0
  if (*access_mask & (DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|
3248
0
          SYNCHRONIZE_ACCESS)) {
3249
0
    *access_mask &= ~(DELETE_ACCESS|WRITE_DAC_ACCESS|
3250
0
          WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS);
3251
0
    *access_mask |= mapping->std_all;
3252
0
  }
3253
3254
0
}
3255
3256
int
3257
dissect_nt_access_mask(tvbuff_t *tvb, int offset, packet_info *pinfo,
3258
           proto_tree *tree, dcerpc_info *di, uint8_t *drep, int hfindex,
3259
           struct access_mask_info *ami, uint32_t *perms)
3260
0
{
3261
0
  proto_item *item;
3262
0
  proto_tree *subtree, *generic_tree, *other_tree, *standard_tree, *specific_tree;
3263
0
  uint32_t access;
3264
3265
0
  static int * const generic_access_flags[] = {
3266
0
    &hf_access_generic_read,
3267
0
    &hf_access_generic_write,
3268
0
    &hf_access_generic_execute,
3269
0
    &hf_access_generic_all,
3270
0
    NULL
3271
0
  };
3272
3273
0
  static int * const other_access_flags[] = {
3274
0
    &hf_access_other_3,
3275
0
    &hf_access_other_2,
3276
0
    &hf_access_maximum_allowed,
3277
0
    &hf_access_system_security,
3278
0
    NULL
3279
0
  };
3280
3281
0
  static int * const standard_access_flags[] = {
3282
0
    &hf_access_standard_7,
3283
0
    &hf_access_standard_6,
3284
0
    &hf_access_standard_5,
3285
0
    &hf_access_standard_synchronise,
3286
0
    &hf_access_standard_write_owner,
3287
0
    &hf_access_standard_write_dac,
3288
0
    &hf_access_standard_read_control,
3289
0
    &hf_access_standard_delete,
3290
0
    NULL
3291
0
  };
3292
3293
0
  static int * const access_specific_flags[] = {
3294
0
    &hf_access_specific_15,
3295
0
    &hf_access_specific_14,
3296
0
    &hf_access_specific_13,
3297
0
    &hf_access_specific_12,
3298
0
    &hf_access_specific_11,
3299
0
    &hf_access_specific_10,
3300
0
    &hf_access_specific_9,
3301
0
    &hf_access_specific_8,
3302
0
    &hf_access_specific_7,
3303
0
    &hf_access_specific_6,
3304
0
    &hf_access_specific_5,
3305
0
    &hf_access_specific_4,
3306
0
    &hf_access_specific_3,
3307
0
    &hf_access_specific_2,
3308
0
    &hf_access_specific_1,
3309
0
    &hf_access_specific_0,
3310
0
    NULL
3311
0
  };
3312
3313
0
  if (drep != NULL) {
3314
    /*
3315
     * Called from a DCE RPC protocol dissector, for a
3316
     * protocol where a 32-bit NDR integer contains
3317
     * an NT access mask; extract the access mask
3318
     * with an NDR call.
3319
     */
3320
0
    offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep,
3321
0
              hfindex, &access);
3322
0
  } else {
3323
    /*
3324
     * Called from SMB, where the access mask is just a
3325
     * 4-byte little-endian quantity with no special
3326
     * NDR alignment requirement; extract it with
3327
     * "tvb_get_letohl()".
3328
     */
3329
0
    access = tvb_get_letohl(tvb, offset);
3330
0
    offset += 4;
3331
0
  }
3332
3333
0
  if (perms) {
3334
0
    *perms = access;
3335
0
  }
3336
3337
0
  item = proto_tree_add_uint(tree, hfindex, tvb, offset - 4, 4, access);
3338
3339
0
  subtree = proto_item_add_subtree(item, ett_nt_access_mask);
3340
3341
  /* Generic access rights */
3342
3343
0
  generic_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3344
0
           ett_nt_access_mask_generic, NULL, "Generic rights: 0x%08x",
3345
0
           access & GENERIC_RIGHTS_MASK);
3346
3347
0
  proto_tree_add_bitmask_list_value(generic_tree, tvb, offset - 4, 4, generic_access_flags, access);
3348
3349
  /* Other access rights */
3350
3351
0
  other_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3352
0
           ett_nt_access_mask_other, NULL, "Other rights: 0x%08x",
3353
0
           access & 0x0F000000);
3354
3355
0
  proto_tree_add_bitmask_list_value(other_tree, tvb, offset - 4, 4, other_access_flags, access);
3356
3357
  /* Standard access rights */
3358
3359
0
  standard_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3360
0
           ett_nt_access_mask_standard, NULL, "Standard rights: 0x%08x",
3361
0
           access & STANDARD_RIGHTS_MASK);
3362
3363
0
  proto_tree_add_bitmask_list_value(standard_tree, tvb, offset - 4, 4, standard_access_flags, access);
3364
3365
  /* Specific access rights.  Call the specific_rights_fn
3366
     pointer if we have one, otherwise just display bits 0-15 in
3367
     boring fashion. */
3368
3369
0
  if (ami && ami->specific_rights_name)
3370
0
    specific_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3371
0
             ett_nt_access_mask_specific, &item, "%s specific rights: 0x%08x",
3372
0
             ami->specific_rights_name,
3373
0
             access & SPECIFIC_RIGHTS_MASK);
3374
0
  else
3375
0
    specific_tree = proto_tree_add_subtree_format(subtree, tvb, offset - 4, 4,
3376
0
             ett_nt_access_mask_specific, &item, "Specific rights: 0x%08x",
3377
0
             access & SPECIFIC_RIGHTS_MASK);
3378
3379
0
  if (ami && ami->specific_rights_fn) {
3380
0
    uint32_t mapped_access = access;
3381
0
    proto_tree *specific_mapped;
3382
3383
0
    specific_mapped = proto_item_add_subtree(
3384
0
      item, ett_nt_access_mask_specific);
3385
3386
0
    ami->specific_rights_fn(
3387
0
      tvb, offset - 4, specific_tree, access);
3388
3389
0
    if (ami->generic_mapping)
3390
0
      map_generic_access(&access, ami->generic_mapping);
3391
3392
0
    if (ami->standard_mapping)
3393
0
      map_standard_access(&access, ami->standard_mapping);
3394
3395
0
    if (access != mapped_access) {
3396
0
      ami->specific_rights_fn(
3397
0
        tvb, offset - 4, specific_mapped,
3398
0
        mapped_access);
3399
0
    }
3400
3401
0
    return offset;
3402
0
  }
3403
3404
0
  proto_tree_add_bitmask_list_value(specific_tree, tvb, offset - 4, 4, access_specific_flags, access);
3405
3406
0
  return offset;
3407
0
}
3408
3409
static int hf_nt_access_mask;
3410
3411
0
#define ACL_REVISION_NT4    2
3412
0
#define ACL_REVISION_ADS    4
3413
static const value_string acl_revision_vals[] = {
3414
  { ACL_REVISION_NT4, "NT4"},
3415
  { ACL_REVISION_ADS, "AD"},
3416
  {0,NULL}
3417
};
3418
3419
0
#define ACE_TYPE_ACCESS_ALLOWED   0
3420
0
#define ACE_TYPE_ACCESS_DENIED    1
3421
0
#define ACE_TYPE_SYSTEM_AUDIT   2
3422
0
#define ACE_TYPE_SYSTEM_ALARM   3
3423
0
#define ACE_TYPE_ALLOWED_COMPOUND 4
3424
0
#define ACE_TYPE_ACCESS_ALLOWED_OBJECT  5
3425
0
#define ACE_TYPE_ACCESS_DENIED_OBJECT 6
3426
0
#define ACE_TYPE_SYSTEM_AUDIT_OBJECT  7
3427
0
#define ACE_TYPE_SYSTEM_ALARM_OBJECT  8
3428
0
#define ACE_TYPE_ACCESS_ALLOWED_CALLBACK         9
3429
0
#define ACE_TYPE_ACCESS_DENIED_CALLBACK         10
3430
0
#define ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT 11
3431
0
#define ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT  12
3432
0
#define ACE_TYPE_SYSTEM_AUDIT_CALLBACK          13
3433
0
#define ACE_TYPE_SYSTEM_ALARM_CALLBACK          14
3434
0
#define ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT   15
3435
0
#define ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT   16
3436
0
#define ACE_TYPE_SYSTEM_MANDATORY_LABEL         17
3437
0
#define ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE      18
3438
0
#define ACE_TYPE_SYSTEM_SCOPED_POLICY_ID        19
3439
3440
static const value_string ace_type_vals[] = {
3441
  { ACE_TYPE_ACCESS_ALLOWED,       "Access Allowed"},
3442
  { ACE_TYPE_ACCESS_DENIED,      "Access Denied"},
3443
  { ACE_TYPE_SYSTEM_AUDIT,       "System Audit"},
3444
  { ACE_TYPE_SYSTEM_ALARM,       "System Alarm"},
3445
  { ACE_TYPE_ALLOWED_COMPOUND,       "Allowed Compound"},
3446
  { ACE_TYPE_ACCESS_ALLOWED_OBJECT,    "Allowed Object"},
3447
  { ACE_TYPE_ACCESS_DENIED_OBJECT,     "Denied Object"},
3448
  { ACE_TYPE_SYSTEM_AUDIT_OBJECT,      "Audit Object"},
3449
  { ACE_TYPE_SYSTEM_ALARM_OBJECT,      "Alarm Object"},
3450
  { ACE_TYPE_ACCESS_ALLOWED_CALLBACK,        "Allowed Callback"},
3451
  { ACE_TYPE_ACCESS_DENIED_CALLBACK,         "Denied Callback"},
3452
  { ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT, "Allowed Callback Object"},
3453
  { ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT,  "Denied Callback Object"},
3454
  { ACE_TYPE_SYSTEM_AUDIT_CALLBACK,          "Audit Callback"},
3455
  { ACE_TYPE_SYSTEM_ALARM_CALLBACK,          "Alarm Callback"},
3456
  { ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT,   "Audit Callback Object"},
3457
  { ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT,   "Alarm Callback Object"},
3458
  { ACE_TYPE_SYSTEM_MANDATORY_LABEL,         "Mandatory label"},
3459
  { ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE,      "Resource Attribute"},
3460
  { ACE_TYPE_SYSTEM_SCOPED_POLICY_ID,        "Scoped Policy ID" },
3461
  { 0, NULL}
3462
};
3463
static const true_false_string tfs_ace_flags_object_inherit = {
3464
  "Subordinate files will inherit this ACE",
3465
  "Subordinate files will not inherit this ACE"
3466
};
3467
static const true_false_string tfs_ace_flags_container_inherit = {
3468
  "Subordinate containers will inherit this ACE",
3469
  "Subordinate containers will not inherit this ACE"
3470
};
3471
static const true_false_string tfs_ace_flags_non_propagate_inherit = {
3472
  "Subordinate object will not propagate the inherited ACE further",
3473
  "Subordinate object will propagate the inherited ACE further"
3474
};
3475
static const true_false_string tfs_ace_flags_inherit_only = {
3476
  "This ACE does not apply to the current object",
3477
  "This ACE applies to the current object"
3478
};
3479
static const true_false_string tfs_ace_flags_inherited_ace = {
3480
  "This ACE was inherited from its parent object",
3481
  "This ACE was not inherited from its parent object"
3482
};
3483
static const true_false_string tfs_ace_flags_successful_access = {
3484
  "Successful accesses will be audited",
3485
  "Successful accesses will not be audited"
3486
};
3487
static const true_false_string tfs_ace_flags_failed_access = {
3488
  "Failed accesses will be audited",
3489
  "Failed accesses will not be audited"
3490
};
3491
3492
static const true_false_string flags_sec_info_sacl = {
3493
  "Request SACL",
3494
  "Do NOT request SACL"
3495
};
3496
static const true_false_string flags_sec_info_dacl = {
3497
  "Request DACL",
3498
  "Do NOT request DACL"
3499
};
3500
static const true_false_string flags_sec_info_group = {
3501
  "Request GROUP",
3502
  "Do NOT request group"
3503
};
3504
static const true_false_string flags_sec_info_owner = {
3505
  "Request OWNER",
3506
  "Do NOT request owner"
3507
};
3508
3509
static const true_false_string flags_ace_sra_info_manual = {
3510
  "Manually Assigned",
3511
  "NOT Manually Assigned"
3512
};
3513
3514
3515
static const true_false_string flags_ace_sra_info_policy_derived = {
3516
  "Policy Derived",
3517
  "NOT Policy Derived"
3518
};
3519
3520
static const true_false_string flags_ace_sra_info_non_inheritable = {
3521
  "Non-Inheritable",
3522
  "Inheritable"
3523
};
3524
3525
static const true_false_string flags_ace_sra_info_case_sensitive = {
3526
  "Case Sensitive",
3527
  "NOT Case Sensitive"
3528
};
3529
3530
static const true_false_string flags_ace_sra_info_deny_only = {
3531
  "Deny Only",
3532
  "NOT Deny Only"
3533
};
3534
3535
static const true_false_string flags_ace_sra_info_disabled_by_default = {
3536
  "Disabled By Default",
3537
  "NOT Disabled By Default"
3538
};
3539
3540
static const true_false_string flags_ace_sra_info_disabled = {
3541
  "Disabled",
3542
  "NOT Disabled"
3543
};
3544
3545
static const true_false_string flags_ace_sra_info_mandatory = {
3546
  "Mandatory",
3547
  "NOT Mandatory"
3548
};
3549
3550
#define APPEND_ACE_TEXT(flag, item, string) \
3551
0
  if(flag){             \
3552
0
    if(item)           \
3553
0
      proto_item_append_text(item, string, sep); \
3554
0
    sep = ", ";           \
3555
0
  }
3556
3557
3558
static int
3559
dissect_nt_ace_object(tvbuff_t *tvb, int offset, proto_tree *parent_tree)
3560
0
{
3561
0
  proto_item *item;
3562
0
  proto_tree *tree;
3563
0
  proto_item *flags_item;
3564
0
  uint32_t flags;
3565
0
  int old_offset=offset;
3566
0
  const char *sep = " ";
3567
0
  static int * const ace_flags[] = {
3568
0
    &hf_nt_ace_flags_object_type_present,
3569
0
    &hf_nt_ace_flags_inherited_object_type_present,
3570
0
    NULL
3571
0
  };
3572
3573
0
  tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0,
3574
0
             ett_nt_ace_object, &item, "ACE Object");
3575
3576
  /* flags */
3577
0
  flags=tvb_get_letohl(tvb, offset);
3578
0
  flags_item = proto_tree_add_bitmask(tree, tvb, offset, hf_nt_ace_flags_object,
3579
0
             ett_nt_ace_object_flags, ace_flags, ENC_LITTLE_ENDIAN);
3580
3581
0
  APPEND_ACE_TEXT(flags&0x00000001, flags_item, "%sObject Type Present");
3582
0
  APPEND_ACE_TEXT(flags&0x00000002, flags_item, "%sInherited Object Type Present");
3583
0
  offset+=4;
3584
3585
3586
  /* is there a GUID ? */
3587
0
  if(flags&0x00000001){
3588
0
    proto_tree_add_item(tree, hf_nt_ace_guid, tvb, offset, 16, ENC_LITTLE_ENDIAN);
3589
0
    offset+=16;
3590
0
  }
3591
3592
  /* is there an inherited GUID ? */
3593
0
  if(flags&0x00000002){
3594
0
    proto_tree_add_item(tree, hf_nt_ace_inherited_guid, tvb, offset, 16, ENC_LITTLE_ENDIAN);
3595
0
    offset+=16;
3596
0
  }
3597
3598
0
  proto_item_set_len(item, offset-old_offset);
3599
0
  return offset;
3600
0
}
3601
3602
static int
3603
dissect_nt_v2_ace_flags(tvbuff_t *tvb, int offset, proto_tree *parent_tree,
3604
      uint8_t *data)
3605
0
{
3606
0
  proto_item *item = NULL;
3607
0
  uint8_t mask;
3608
0
  const char *sep = " ";
3609
0
  static int * const ace_flags[] = {
3610
0
    &hf_nt_ace_flags_failed_access,
3611
0
    &hf_nt_ace_flags_successful_access,
3612
0
    &hf_nt_ace_flags_inherited_ace,
3613
0
    &hf_nt_ace_flags_inherit_only,
3614
0
    &hf_nt_ace_flags_non_propagate_inherit,
3615
0
    &hf_nt_ace_flags_container_inherit,
3616
0
    &hf_nt_ace_flags_object_inherit,
3617
0
    NULL
3618
0
  };
3619
3620
0
  mask = tvb_get_uint8(tvb, offset);
3621
3622
0
  if (data)
3623
0
    *data = mask;
3624
3625
0
  item = proto_tree_add_bitmask(parent_tree, tvb, offset, hf_nt_ace_flags,
3626
0
             ett_nt_ace_flags, ace_flags, ENC_NA);
3627
3628
0
  APPEND_ACE_TEXT(mask&0x80, item, "%sFailed Access");
3629
0
  APPEND_ACE_TEXT(mask&0x40, item, "%sSuccessful Access");
3630
0
  APPEND_ACE_TEXT(mask&0x10, item, "%sInherited ACE");
3631
0
  APPEND_ACE_TEXT(mask&0x08, item, "%sInherit Only");
3632
0
  APPEND_ACE_TEXT(mask&0x04, item, "%sNo Propagate Inherit");
3633
0
  APPEND_ACE_TEXT(mask&0x02, item, "%sContainer Inherit");
3634
0
  APPEND_ACE_TEXT(mask&0x01, item, "%sObject Inherit");
3635
3636
3637
0
  offset += 1;
3638
0
  return offset;
3639
0
}
3640
3641
static int
3642
dissect_nt_v2_ace(tvbuff_t *tvb, int offset, packet_info *pinfo,
3643
      proto_tree *parent_tree, uint8_t *drep,
3644
      struct access_mask_info *ami)
3645
0
{
3646
0
  proto_item *item;
3647
0
  proto_tree *tree;
3648
0
  int old_offset = offset;
3649
0
  char *sid_str = NULL;
3650
0
  uint16_t size;
3651
0
  uint16_t data_size;
3652
0
  uint8_t type;
3653
0
  uint8_t flags;
3654
0
  uint32_t perms = 0;
3655
3656
0
  tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1,
3657
0
             ett_nt_ace, &item, "NT ACE: ");
3658
3659
  /* type */
3660
0
  type = tvb_get_uint8(tvb, offset);
3661
0
  proto_tree_add_uint(tree, hf_nt_ace_type, tvb, offset, 1, type);
3662
0
  offset += 1;
3663
3664
  /* flags */
3665
0
  offset = dissect_nt_v2_ace_flags(tvb, offset, tree, &flags);
3666
3667
  /* size */
3668
0
  size = tvb_get_letohs(tvb, offset);
3669
0
  if (size < 4) {
3670
    /*
3671
     * BOGUS - the size includes the ACE header length,
3672
     * which is 4.
3673
     */
3674
0
    proto_tree_add_uint_format_value(tree, hf_nt_ace_size, tvb, offset, 2,
3675
0
        size, "%u (bogus, must be >= 4)", size);
3676
0
    return old_offset;  /* our caller quits in this case */
3677
0
  }
3678
0
  proto_tree_add_uint(tree, hf_nt_ace_size, tvb, offset, 2, size);
3679
0
  offset += 2;
3680
3681
  /* some ACE types we not yet handle store other things than access mask
3682
   * and SID in here.
3683
   * sometimes things that are not related at all to access control.
3684
   *    naughty naughty.    -- ronnie
3685
   */
3686
0
  switch(type){
3687
0
  case ACE_TYPE_ACCESS_ALLOWED:
3688
0
  case ACE_TYPE_ACCESS_DENIED:
3689
0
  case ACE_TYPE_SYSTEM_AUDIT:
3690
0
  case ACE_TYPE_SYSTEM_ALARM:
3691
0
  case ACE_TYPE_ALLOWED_COMPOUND:
3692
0
  case ACE_TYPE_ACCESS_ALLOWED_OBJECT:
3693
0
  case ACE_TYPE_ACCESS_DENIED_OBJECT:
3694
0
  case ACE_TYPE_SYSTEM_AUDIT_OBJECT:
3695
0
  case ACE_TYPE_SYSTEM_ALARM_OBJECT:
3696
0
  case ACE_TYPE_ACCESS_ALLOWED_CALLBACK:
3697
0
  case ACE_TYPE_ACCESS_DENIED_CALLBACK:
3698
0
  case ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
3699
0
  case ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
3700
0
  case ACE_TYPE_SYSTEM_AUDIT_CALLBACK:
3701
0
  case ACE_TYPE_SYSTEM_ALARM_CALLBACK:
3702
0
  case ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
3703
0
  case ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT:
3704
0
  case ACE_TYPE_SYSTEM_MANDATORY_LABEL:
3705
0
  case ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE:
3706
0
  case ACE_TYPE_SYSTEM_SCOPED_POLICY_ID:
3707
    /* access mask */
3708
0
    offset = dissect_nt_access_mask(
3709
0
      tvb, offset, pinfo, tree, NULL, drep,
3710
0
      hf_nt_access_mask, ami, &perms);
3711
3712
    /* these aces contain an extra object */
3713
0
    switch(type){
3714
0
    case ACE_TYPE_ACCESS_ALLOWED_OBJECT:
3715
0
    case ACE_TYPE_ACCESS_DENIED_OBJECT:
3716
0
    case ACE_TYPE_SYSTEM_AUDIT_OBJECT:
3717
0
    case ACE_TYPE_SYSTEM_ALARM_OBJECT:
3718
0
    case ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
3719
0
    case ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
3720
0
    case ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
3721
0
    case ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT:
3722
0
      offset=dissect_nt_ace_object(tvb, offset, tree);
3723
0
    }
3724
3725
    /* SID */
3726
0
    offset = dissect_nt_sid(tvb, pinfo, offset, tree, "SID", &sid_str, -1);
3727
3728
0
    if (item)
3729
0
      proto_item_append_text(
3730
0
        item, "%s, flags 0x%02x, %s, mask 0x%08x", sid_str, flags,
3731
0
        val_to_str(pinfo->pool, type, ace_type_vals, "Unknown ACE type (0x%02x)"),
3732
0
        perms);
3733
3734
0
    data_size = size - (offset - old_offset);
3735
3736
    /* Dissect Dynamic Access Control related ACE types
3737
       (if present). That is, Conditional ACE and Resource
3738
       Attributes. See [MS-DTYP] v20180912 section 2.4.4.17 */
3739
0
    switch (type) {
3740
0
        case ACE_TYPE_ACCESS_ALLOWED_CALLBACK:
3741
0
        case ACE_TYPE_ACCESS_DENIED_CALLBACK:
3742
0
        case ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
3743
0
        case ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
3744
0
        case ACE_TYPE_SYSTEM_AUDIT_CALLBACK:
3745
0
        case ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
3746
0
      dissect_nt_conditional_ace(tvb, pinfo, offset, data_size, tree);
3747
0
      break;
3748
3749
0
        case ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE:
3750
0
      dissect_nt_ace_system_resource_attribute(tvb, pinfo, offset, data_size, tree);
3751
0
      break;
3752
0
    }
3753
0
    break;
3754
0
  };
3755
3756
0
  proto_item_set_len(item, offset-old_offset);
3757
3758
  /* Sometimes there is some spare space at the end of the ACE so use
3759
     the size field to work out where the end is. */
3760
3761
0
  return old_offset + size;
3762
0
}
3763
3764
static int
3765
dissect_nt_acl(tvbuff_t *tvb, int offset_a, packet_info *pinfo,
3766
         proto_tree *parent_tree, uint8_t *drep, const char *name,
3767
         struct access_mask_info *ami)
3768
0
{
3769
0
  proto_item *item;
3770
0
  proto_tree *tree;
3771
0
  int old_offset = offset_a;
3772
0
  int pre_ace_offset;
3773
0
  uint16_t revision;
3774
0
  uint32_t num_aces;
3775
0
  volatile int offset_v = offset_a;
3776
0
  volatile bool missing_data = false;
3777
0
  volatile bool bad_ace = false;
3778
3779
0
  tree = proto_tree_add_subtree_format(parent_tree, tvb, offset_v, -1,
3780
0
             ett_nt_acl, &item, "NT %s ACL", name);
3781
3782
  /* revision */
3783
  /*
3784
   * XXX - is this *really* 2 bytes?  The page at
3785
   *
3786
   *  https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-_acl
3787
   *
3788
   * indicates that it's one byte of revision and one byte of
3789
   * zero padding, which means the code that used to be here
3790
   * was correct - and this code would give the same results
3791
   * as long as the padding is zero, so if this dissects it
3792
   * correctly when the padding is zero, and the padding is
3793
   * always zero, the old code would dissect it correctly
3794
   * also.
3795
   */
3796
0
  revision = tvb_get_letohs(tvb, offset_v);
3797
0
  proto_tree_add_uint(tree, hf_nt_acl_revision,
3798
0
    tvb, offset_v, 2, revision);
3799
0
  offset_v += 2;
3800
3801
0
  switch(revision){
3802
0
  case ACL_REVISION_NT4:
3803
0
  case ACL_REVISION_ADS:
3804
0
  case 3:  /* weirdo type */
3805
    /* size */
3806
0
    proto_tree_add_item(tree, hf_nt_acl_size, tvb, offset_v, 2, ENC_LITTLE_ENDIAN);
3807
0
    offset_v += 2;
3808
3809
    /* number of ace structures */
3810
    /*
3811
     * XXX - is this *really* 4 bytes?  The page referred to above
3812
     * says it's 2 bytes of count followed by two bytes of
3813
     * zero padding.
3814
     */
3815
0
    num_aces = tvb_get_letohl(tvb, offset_v);
3816
0
    proto_tree_add_uint(tree, hf_nt_acl_num_aces,
3817
0
            tvb, offset_v, 4, num_aces);
3818
0
    offset_v += 4;
3819
3820
0
    while(num_aces-- && !missing_data && !bad_ace) {
3821
0
    pre_ace_offset = offset_v;
3822
3823
    /*
3824
     * These are at an offset_v later in the packet; don't
3825
     * fail if we can't fetch them, just note the problem
3826
     * and dissect the stuff before it.
3827
     */
3828
0
    TRY {
3829
0
      offset_v = dissect_nt_v2_ace(tvb, offset_v, pinfo, tree, drep, ami);
3830
0
      if (pre_ace_offset == offset_v) {
3831
      /*
3832
       * Bogus ACE, with a length < 4.
3833
       */
3834
0
      bad_ace = true;
3835
0
      }
3836
0
    }
3837
3838
0
    CATCH(ContainedBoundsError) {
3839
0
      proto_tree_add_expert(tree, pinfo, &ei_nt_ace_extends_beyond_data, tvb, offset_v, 0);
3840
0
      missing_data = true;
3841
0
    }
3842
3843
0
    CATCH(ReportedBoundsError) {
3844
0
      proto_tree_add_expert(tree, pinfo, &ei_nt_ace_extends_beyond_reassembled_data, tvb, offset_v, 0);
3845
0
      missing_data = true;
3846
0
    }
3847
3848
0
    ENDTRY;
3849
0
    }
3850
0
  }
3851
3852
0
  proto_item_set_len(item, offset_v-old_offset);
3853
0
  return offset_v;
3854
0
}
3855
3856
static const true_false_string tfs_sec_desc_type_owner_defaulted = {
3857
  "OWNER is DEFAULTED",
3858
  "Owner is NOT defaulted"
3859
};
3860
static const true_false_string tfs_sec_desc_type_group_defaulted = {
3861
  "GROUP is DEFAULTED",
3862
  "Group is NOT defaulted"
3863
};
3864
static const true_false_string tfs_sec_desc_type_dacl_present = {
3865
  "DACL is PRESENT",
3866
  "DACL is NOT present"
3867
};
3868
static const true_false_string tfs_sec_desc_type_dacl_defaulted = {
3869
  "DACL is DEFAULTED",
3870
  "DACL is NOT defaulted"
3871
};
3872
static const true_false_string tfs_sec_desc_type_sacl_present = {
3873
  "SACL is PRESENT",
3874
  "SACL is NOT present"
3875
};
3876
static const true_false_string tfs_sec_desc_type_sacl_defaulted = {
3877
  "SACL is DEFAULTED",
3878
  "SACL is NOT defaulted"
3879
};
3880
static const true_false_string tfs_sec_desc_type_dacl_trusted = {
3881
  "DACL TRUSTED is TRUE",
3882
  "Dacl trusted is FALSE"
3883
};
3884
static const true_false_string tfs_sec_desc_type_server_security = {
3885
  "DACL SERVER SECURITY is TRUE",
3886
  "DACL server security is FALSE"
3887
};
3888
static const true_false_string tfs_sec_desc_type_dacl_auto_inherit_req = {
3889
  "DACL has AUTO INHERIT REQUIRED",
3890
  "DACL does NOT require auto inherit"
3891
};
3892
static const true_false_string tfs_sec_desc_type_sacl_auto_inherit_req = {
3893
  "SACL has AUTO INHERIT REQUIRED",
3894
  "SACL does NOT require auto inherit"
3895
};
3896
static const true_false_string tfs_sec_desc_type_dacl_auto_inherited = {
3897
  "DACL is AUTO INHERITED",
3898
  "DACL is NOT auto inherited"
3899
};
3900
static const true_false_string tfs_sec_desc_type_sacl_auto_inherited = {
3901
  "SACL is AUTO INHERITED",
3902
  "SACL is NOT auto inherited"
3903
};
3904
static const true_false_string tfs_sec_desc_type_dacl_protected = {
3905
  "The DACL is PROTECTED",
3906
  "The DACL is NOT protected"
3907
};
3908
static const true_false_string tfs_sec_desc_type_sacl_protected = {
3909
  "The SACL is PROTECTED",
3910
  "The SACL is NOT protected"
3911
};
3912
static const true_false_string tfs_sec_desc_type_rm_control_valid = {
3913
  "Rm control valid is TRUE",
3914
  "Rm control valid is FALSE"
3915
};
3916
static const true_false_string tfs_sec_desc_type_self_relative = {
3917
  "This SecDesc is SELF RELATIVE",
3918
  "This SecDesc is NOT self relative"
3919
};
3920
3921
3922
static int
3923
dissect_nt_sec_desc_type(tvbuff_t *tvb, int offset, proto_tree *parent_tree)
3924
0
{
3925
0
  static int * const flags[] = {
3926
0
    &hf_nt_sec_desc_type_self_relative,
3927
0
    &hf_nt_sec_desc_type_rm_control_valid,
3928
0
    &hf_nt_sec_desc_type_sacl_protected,
3929
0
    &hf_nt_sec_desc_type_dacl_protected,
3930
0
    &hf_nt_sec_desc_type_sacl_auto_inherited,
3931
0
    &hf_nt_sec_desc_type_dacl_auto_inherited,
3932
0
    &hf_nt_sec_desc_type_sacl_auto_inherit_req,
3933
0
    &hf_nt_sec_desc_type_dacl_auto_inherit_req,
3934
0
    &hf_nt_sec_desc_type_server_security,
3935
0
    &hf_nt_sec_desc_type_dacl_trusted,
3936
0
    &hf_nt_sec_desc_type_sacl_defaulted,
3937
0
    &hf_nt_sec_desc_type_sacl_present,
3938
0
    &hf_nt_sec_desc_type_dacl_defaulted,
3939
0
    &hf_nt_sec_desc_type_dacl_present,
3940
0
    &hf_nt_sec_desc_type_group_defaulted,
3941
0
    &hf_nt_sec_desc_type_owner_defaulted,
3942
0
    NULL
3943
0
  };
3944
3945
0
  proto_tree_add_bitmask(parent_tree, tvb, offset, hf_nt_sec_desc_type,
3946
0
             ett_nt_sec_desc_type, flags, ENC_LITTLE_ENDIAN);
3947
3948
0
  offset += 2;
3949
0
  return offset;
3950
0
}
3951
3952
int
3953
dissect_nt_security_information(tvbuff_t *tvb, int offset, proto_tree *parent_tree)
3954
0
{
3955
0
  proto_item *item = NULL;
3956
0
  uint32_t mask;
3957
0
  static int * const flags[] = {
3958
0
    &hf_nt_security_information_sacl,
3959
0
    &hf_nt_security_information_dacl,
3960
0
    &hf_nt_security_information_group,
3961
0
    &hf_nt_security_information_owner,
3962
0
    NULL
3963
0
  };
3964
3965
0
  mask = tvb_get_letohl(tvb, offset);
3966
0
  item = proto_tree_add_bitmask(parent_tree, tvb, offset, hf_nt_security_information,
3967
0
             ett_nt_security_information, flags, ENC_LITTLE_ENDIAN);
3968
3969
0
  if (mask & 0x00000008) {
3970
0
    proto_item_append_text(item, " SACL");
3971
0
  }
3972
0
  if (mask & 0x00000004) {
3973
0
    proto_item_append_text(item, " DACL");
3974
0
  }
3975
0
  if (mask & 0x00000002) {
3976
0
    proto_item_append_text(item, " GROUP");
3977
0
  }
3978
0
  if (mask & 0x00000001) {
3979
0
    proto_item_append_text(item, " OWNER");
3980
0
  }
3981
3982
0
  offset += 4;
3983
3984
0
  return offset;
3985
0
}
3986
3987
int
3988
dissect_nt_sec_desc(tvbuff_t *tvb, int offset_a, packet_info *pinfo,
3989
        proto_tree *parent_tree, uint8_t *drep,
3990
        bool len_supplied _U_, int len,
3991
        struct access_mask_info *ami)
3992
0
{
3993
0
  proto_item *item = NULL;
3994
0
  proto_tree * volatile tree = NULL;
3995
0
  uint16_t revision;
3996
0
  int start_offset = offset_a;
3997
0
  volatile int offset_v=offset_a;
3998
0
  volatile int end_offset;
3999
0
  volatile int item_offset;
4000
0
  uint32_t owner_sid_offset;
4001
0
  proto_item *it_owner_sid_offs = NULL;
4002
0
  volatile uint32_t group_sid_offset;
4003
0
  proto_item * volatile it_gr_sid_offs = NULL;
4004
0
  volatile uint32_t sacl_offset;
4005
0
  proto_item * volatile it_sacl_offs = NULL;
4006
0
  volatile uint32_t dacl_offset;
4007
0
  proto_item * volatile it_dacl_offs = NULL;
4008
4009
0
  tree = proto_tree_add_subtree(parent_tree, tvb, offset_v, -1,
4010
0
           ett_nt_sec_desc, &item, "NT Security Descriptor");
4011
4012
  /* revision */
4013
0
  revision = tvb_get_letohs(tvb, offset_v);
4014
0
  proto_tree_add_uint(tree, hf_nt_sec_desc_revision,
4015
0
    tvb, offset_v, 2, revision);
4016
0
  offset_v += 2;
4017
4018
0
  switch(revision){
4019
0
  case 1:  /* only version we will ever see of this structure?*/
4020
    /* type */
4021
0
    offset_v = dissect_nt_sec_desc_type(tvb, offset_v, tree);
4022
4023
    /* offset_v to owner sid */
4024
0
    owner_sid_offset = tvb_get_letohl(tvb, offset_v);
4025
0
    if(owner_sid_offset != 0 && owner_sid_offset < 20){
4026
      /* Bogus value - points into fixed portion of descriptor */
4027
0
      proto_tree_add_uint_format_value(tree, hf_nt_offset_to_owner_sid, tvb, offset_v, 4, owner_sid_offset, "%u (bogus, must be >= 20)", owner_sid_offset);
4028
0
      owner_sid_offset = 0;
4029
0
    } else
4030
0
      it_owner_sid_offs = proto_tree_add_item(tree, hf_nt_offset_to_owner_sid, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4031
0
    offset_v += 4;
4032
4033
    /* offset to group sid */
4034
0
    group_sid_offset = tvb_get_letohl(tvb, offset_v);
4035
0
    if(group_sid_offset != 0 && group_sid_offset < 20){
4036
      /* Bogus value - points into fixed portion of descriptor */
4037
0
      proto_tree_add_uint_format_value(tree, hf_nt_offset_to_group_sid, tvb, offset_v, 4, group_sid_offset, "%u (bogus, must be >= 20)", group_sid_offset);
4038
0
      group_sid_offset = 0;
4039
0
    } else
4040
0
      it_gr_sid_offs = proto_tree_add_item(tree, hf_nt_offset_to_group_sid, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4041
0
    offset_v += 4;
4042
4043
    /* offset to sacl */
4044
0
    sacl_offset = tvb_get_letohl(tvb, offset_v);
4045
0
    if(sacl_offset != 0 && sacl_offset < 20){
4046
      /* Bogus value - points into fixed portion of descriptor */
4047
0
      proto_tree_add_uint_format_value(tree, hf_nt_offset_to_sacl, tvb, offset_v, 4, sacl_offset, "%u (bogus, must be >= 20)", sacl_offset);
4048
0
      sacl_offset = 0;
4049
0
    } else
4050
0
      it_sacl_offs = proto_tree_add_item(tree, hf_nt_offset_to_sacl, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4051
0
    offset_v += 4;
4052
4053
    /* offset to dacl */
4054
0
    dacl_offset = tvb_get_letohl(tvb, offset_v);
4055
0
    if(dacl_offset != 0 && dacl_offset < 20){
4056
      /* Bogus value - points into fixed portion of descriptor */
4057
0
      proto_tree_add_uint_format_value(tree, hf_nt_offset_to_dacl, tvb, offset_v, 4, dacl_offset, "%u (bogus, must be >= 20)", dacl_offset);
4058
0
      dacl_offset = 0;
4059
0
    } else
4060
0
      it_dacl_offs = proto_tree_add_item(tree, hf_nt_offset_to_dacl, tvb, offset_v, 4, ENC_LITTLE_ENDIAN);
4061
0
    offset_v += 4;
4062
4063
0
    end_offset = offset_v;
4064
4065
    /*owner SID*/
4066
0
    if(owner_sid_offset){
4067
0
      item_offset = start_offset+owner_sid_offset;
4068
0
      if (item_offset < start_offset) {
4069
0
        expert_add_info(pinfo, it_owner_sid_offs,
4070
0
            &ei_nt_item_offs_out_of_range);
4071
0
        break;
4072
0
      }
4073
0
      TRY{
4074
0
        offset_v = dissect_nt_sid(tvb, pinfo, item_offset, tree, "Owner", NULL, -1);
4075
0
        if (offset_v > end_offset)
4076
0
          end_offset = offset_v;
4077
0
      }
4078
4079
0
      CATCH(ContainedBoundsError) {
4080
0
        proto_tree_add_expert(tree, pinfo, &ei_nt_owner_sid_beyond_data, tvb, item_offset, 0);
4081
0
      }
4082
4083
0
      CATCH(ReportedBoundsError) {
4084
0
        proto_tree_add_expert(tree, pinfo, &ei_nt_owner_sid_beyond_reassembled_data, tvb, item_offset, 0);
4085
0
      }
4086
4087
0
      ENDTRY;
4088
0
    }
4089
4090
    /*group SID*/
4091
0
    if(group_sid_offset){
4092
0
      item_offset = start_offset+group_sid_offset;
4093
0
      if (item_offset < start_offset) {
4094
0
        expert_add_info(pinfo, it_gr_sid_offs,
4095
0
            &ei_nt_item_offs_out_of_range);
4096
0
        break;
4097
0
      }
4098
0
      TRY {
4099
0
        offset_v = dissect_nt_sid(tvb, pinfo, item_offset, tree, "Group", NULL, -1);
4100
0
        if (offset_v > end_offset)
4101
0
          end_offset = offset_v;
4102
0
      }
4103
4104
0
      CATCH(ContainedBoundsError) {
4105
0
        proto_tree_add_expert(tree, pinfo, &ei_nt_group_sid_beyond_data, tvb, item_offset, 0);
4106
0
      }
4107
4108
0
      CATCH(ReportedBoundsError) {
4109
0
        proto_tree_add_expert(tree, pinfo, &ei_nt_group_sid_beyond_reassembled_data, tvb, item_offset, 0);
4110
0
      }
4111
4112
0
      ENDTRY;
4113
0
    }
4114
4115
    /* sacl */
4116
0
    if(sacl_offset){
4117
0
      item_offset = start_offset+sacl_offset;
4118
0
      if (item_offset < start_offset) {
4119
0
        expert_add_info(pinfo, it_sacl_offs,
4120
0
            &ei_nt_item_offs_out_of_range);
4121
0
        break;
4122
0
      }
4123
0
      offset_v = dissect_nt_acl(tvb, item_offset, pinfo, tree,
4124
0
            drep, "System (SACL)", ami);
4125
0
      if (offset_v > end_offset)
4126
0
        end_offset = offset_v;
4127
0
    }
4128
4129
    /* dacl */
4130
0
    if(dacl_offset){
4131
0
      item_offset = start_offset+dacl_offset;
4132
0
      if (item_offset < start_offset) {
4133
0
        expert_add_info(pinfo, it_dacl_offs,
4134
0
            &ei_nt_item_offs_out_of_range);
4135
0
        break;
4136
0
      }
4137
0
      offset_v = dissect_nt_acl(tvb, item_offset, pinfo, tree,
4138
0
            drep, "User (DACL)", ami);
4139
0
      if (offset_v > end_offset)
4140
0
        end_offset = offset_v;
4141
0
    }
4142
4143
0
    break;
4144
4145
0
  default:
4146
0
    end_offset = offset_v;
4147
0
    break;
4148
0
  }
4149
4150
0
  len = end_offset - start_offset;
4151
0
  proto_item_set_len(item, len);
4152
4153
0
  return offset_v;
4154
0
}
4155
4156
/*
4157
 * XXX - we should have a way to register fields not associated with a
4158
 * protocol.
4159
 *
4160
 * XXX - make-reg-dotc.py doesn't check for an argument list of "(void)",
4161
 * so we have to give this a name other than "proto_register_..." so that
4162
 * it doesn't end up being called from "register.c".
4163
 */
4164
void
4165
proto_do_register_windows_common(int proto_smb)
4166
16
{
4167
16
  static hf_register_info hf[] = {
4168
    /* Security descriptors */
4169
4170
16
    { &hf_nt_sec_desc_revision,
4171
16
      { "Revision", "nt.sec_desc.revision", FT_UINT16, BASE_DEC,
4172
16
        NULL, 0, "Version of NT Security Descriptor structure", HFILL }},
4173
4174
16
    { &hf_nt_sec_desc_type_owner_defaulted,
4175
16
      { "Owner Defaulted", "nt.sec_desc.type.owner_defaulted", FT_BOOLEAN, 16,
4176
16
        TFS(&tfs_sec_desc_type_owner_defaulted), 0x0001, "Is Owner Defaulted set?", HFILL }},
4177
4178
16
    { &hf_nt_sec_desc_type_group_defaulted,
4179
16
      { "Group Defaulted", "nt.sec_desc.type.group_defaulted", FT_BOOLEAN, 16,
4180
16
        TFS(&tfs_sec_desc_type_group_defaulted), 0x0002, "Is Group Defaulted?", HFILL }},
4181
4182
16
    { &hf_nt_sec_desc_type_dacl_present,
4183
16
      { "DACL Present", "nt.sec_desc.type.dacl_present", FT_BOOLEAN, 16,
4184
16
        TFS(&tfs_sec_desc_type_dacl_present), 0x0004, "Does this SecDesc have DACL present?", HFILL }},
4185
4186
16
    { &hf_nt_sec_desc_type_dacl_defaulted,
4187
16
      { "DACL Defaulted", "nt.sec_desc.type.dacl_defaulted", FT_BOOLEAN, 16,
4188
16
        TFS(&tfs_sec_desc_type_dacl_defaulted), 0x0008, "Does this SecDesc have DACL Defaulted?", HFILL }},
4189
4190
16
    { &hf_nt_sec_desc_type_sacl_present,
4191
16
      { "SACL Present", "nt.sec_desc.type.sacl_present", FT_BOOLEAN, 16,
4192
16
        TFS(&tfs_sec_desc_type_sacl_present), 0x0010, "Is the SACL present?", HFILL }},
4193
4194
16
    { &hf_nt_sec_desc_type_sacl_defaulted,
4195
16
      { "SACL Defaulted", "nt.sec_desc.type.sacl_defaulted", FT_BOOLEAN, 16,
4196
16
        TFS(&tfs_sec_desc_type_sacl_defaulted), 0x0020, "Does this SecDesc have SACL Defaulted?", HFILL }},
4197
4198
16
    { &hf_nt_sec_desc_type_dacl_auto_inherit_req,
4199
16
      { "DACL Auto Inherit Required", "nt.sec_desc.type.dacl_auto_inherit_req", FT_BOOLEAN, 16,
4200
16
        TFS(&tfs_sec_desc_type_dacl_auto_inherit_req), 0x0100, "Does this SecDesc have DACL Auto Inherit Required set?", HFILL }},
4201
4202
16
    { &hf_nt_sec_desc_type_dacl_trusted,
4203
16
      { "DACL Trusted", "nt.sec_desc.type.dacl_trusted", FT_BOOLEAN, 16,
4204
16
        TFS(&tfs_sec_desc_type_dacl_trusted), 0x0040, "Does this SecDesc have DACL TRUSTED set?", HFILL }},
4205
4206
16
    { &hf_nt_sec_desc_type_server_security,
4207
16
      { "DACL Server Security", "nt.sec_desc.type.server_security", FT_BOOLEAN, 16,
4208
16
        TFS(&tfs_sec_desc_type_server_security), 0x0080, "Does this SecDesc have DACL SERVER SECURITY set?", HFILL }},
4209
4210
16
    { &hf_nt_sec_desc_type_sacl_auto_inherit_req,
4211
16
      { "SACL Auto Inherit Required", "nt.sec_desc.type.sacl_auto_inherit_req", FT_BOOLEAN, 16,
4212
16
        TFS(&tfs_sec_desc_type_sacl_auto_inherit_req), 0x0200, "Does this SecDesc have SACL Auto Inherit Required set?", HFILL }},
4213
4214
16
    { &hf_nt_sec_desc_type_dacl_auto_inherited,
4215
16
      { "DACL Auto Inherited", "nt.sec_desc.type.dacl_auto_inherited", FT_BOOLEAN, 16,
4216
16
        TFS(&tfs_sec_desc_type_dacl_auto_inherited), 0x0400, "Is this DACL auto inherited", HFILL }},
4217
4218
16
    { &hf_nt_sec_desc_type_sacl_auto_inherited,
4219
16
      { "SACL Auto Inherited", "nt.sec_desc.type.sacl_auto_inherited", FT_BOOLEAN, 16,
4220
16
        TFS(&tfs_sec_desc_type_sacl_auto_inherited), 0x0800, "Is this SACL auto inherited", HFILL }},
4221
4222
16
    { &hf_nt_sec_desc_type_dacl_protected,
4223
16
      { "DACL Protected", "nt.sec_desc.type.dacl_protected", FT_BOOLEAN, 16,
4224
16
        TFS(&tfs_sec_desc_type_dacl_protected), 0x1000, "Is the DACL structure protected?", HFILL }},
4225
4226
16
    { &hf_nt_sec_desc_type_sacl_protected,
4227
16
      { "SACL Protected", "nt.sec_desc.type.sacl_protected", FT_BOOLEAN, 16,
4228
16
        TFS(&tfs_sec_desc_type_sacl_protected), 0x2000, "Is the SACL structure protected?", HFILL }},
4229
4230
16
    { &hf_nt_sec_desc_type_self_relative,
4231
16
      { "Self Relative", "nt.sec_desc.type.self_relative", FT_BOOLEAN, 16,
4232
16
        TFS(&tfs_sec_desc_type_self_relative), 0x8000, "Is this SecDesc self relative?", HFILL }},
4233
4234
16
    { &hf_nt_sec_desc_type_rm_control_valid,
4235
16
      { "RM Control Valid", "nt.sec_desc.type.rm_control_valid", FT_BOOLEAN, 16,
4236
16
        TFS(&tfs_sec_desc_type_rm_control_valid), 0x4000, "Is RM Control Valid set?", HFILL }},
4237
4238
    /* SIDs */
4239
4240
16
    { &hf_nt_sid,
4241
16
      { "SID", "nt.sid", FT_STRING, BASE_NONE,
4242
16
        NULL, 0, "SID: Security Identifier", HFILL }},
4243
4244
16
    { &hf_nt_sid_revision,
4245
16
      { "Revision", "nt.sid.revision", FT_UINT8, BASE_DEC,
4246
16
        NULL, 0, "Version of SID structure", HFILL }},
4247
4248
16
    { &hf_nt_sid_num_auth,
4249
16
      { "Num Auth", "nt.sid.num_auth", FT_UINT8, BASE_DEC,
4250
16
        NULL, 0, "Number of authorities for this SID", HFILL }},
4251
4252
16
    { &hf_nt_sid_auth_dec,
4253
16
      { "Authority", "nt.sid.auth", FT_UINT64, BASE_DEC,
4254
16
        NULL, 0, "Identifier Authority", HFILL }},
4255
4256
16
    { &hf_nt_sid_auth_hex,
4257
16
      { "Authority", "nt.sid.auth", FT_UINT64, BASE_HEX,
4258
16
        NULL, 0, "Identifier Authority", HFILL }},
4259
4260
16
    { &hf_nt_sid_subauth,
4261
16
      { "Subauthorities", "nt.sid.subauth", FT_STRING, BASE_NONE,
4262
16
      NULL, 0, "Subauthorities fields", HFILL }},
4263
4264
16
    { &hf_nt_sid_rid_dec,
4265
16
      { "RID", "nt.sid.rid", FT_UINT32, BASE_DEC,
4266
16
      NULL, 0, "Relative IDentifier: identifies a user or group", HFILL }},
4267
4268
16
    { &hf_nt_sid_rid_hex,
4269
16
      { "RID", "nt.sid.rid", FT_UINT32, BASE_HEX,
4270
16
      NULL, 0, "Relative IDentifier: identifies a user or group", HFILL }},
4271
4272
16
    { &hf_nt_sid_wkwn,
4273
16
      { "Well-known SID", "nt.sid.wkwn", FT_STRING, BASE_NONE,
4274
16
      NULL, 0, NULL, HFILL }},
4275
4276
16
    { &hf_nt_sid_domain,
4277
16
      { "Domain", "nt.sid.domain", FT_STRING, BASE_NONE,
4278
16
      NULL, 0, NULL, HFILL }},
4279
4280
    /* ACLs */
4281
4282
16
    { &hf_nt_acl_revision,
4283
16
      { "Revision", "nt.acl.revision", FT_UINT16, BASE_DEC,
4284
16
        VALS(acl_revision_vals), 0, "Version of NT ACL structure", HFILL }},
4285
4286
16
    { &hf_nt_acl_size,
4287
16
      { "Size", "nt.acl.size", FT_UINT16, BASE_DEC,
4288
16
        NULL, 0, "Size of NT ACL structure", HFILL }},
4289
4290
16
    { &hf_nt_acl_num_aces,
4291
16
      { "Num ACEs", "nt.acl.num_aces", FT_UINT32, BASE_DEC,
4292
16
        NULL, 0, "Number of ACE structures for this ACL", HFILL }},
4293
4294
    /* ACEs */
4295
4296
16
    { &hf_nt_ace_type,
4297
16
      { "Type", "nt.ace.type",
4298
16
        FT_UINT8, BASE_DEC, VALS(ace_type_vals), 0, "Type of ACE",
4299
16
        HFILL }},
4300
4301
16
    { &hf_nt_ace_size,
4302
16
      { "Size", "nt.ace.size", FT_UINT16, BASE_DEC, NULL, 0,
4303
16
        "Size of this ACE", HFILL }},
4304
4305
16
    { &hf_nt_ace_flags_object_inherit,
4306
16
      { "Object Inherit", "nt.ace.flags.object_inherit", FT_BOOLEAN, 8,
4307
16
        TFS(&tfs_ace_flags_object_inherit), 0x01, "Will subordinate files inherit this ACE?", HFILL }},
4308
4309
16
    { &hf_nt_ace_flags_container_inherit,
4310
16
      { "Container Inherit", "nt.ace.flags.container_inherit", FT_BOOLEAN, 8,
4311
16
        TFS(&tfs_ace_flags_container_inherit), 0x02, "Will subordinate containers inherit this ACE?", HFILL }},
4312
4313
16
    { &hf_nt_ace_flags_non_propagate_inherit,
4314
16
      { "Non-Propagate Inherit", "nt.ace.flags.non_propagate_inherit", FT_BOOLEAN, 8,
4315
16
        TFS(&tfs_ace_flags_non_propagate_inherit), 0x04, "Will subordinate object propagate this ACE further?", HFILL }},
4316
4317
16
    { &hf_nt_ace_flags_inherit_only,
4318
16
      { "Inherit Only", "nt.ace.flags.inherit_only", FT_BOOLEAN, 8,
4319
16
        TFS(&tfs_ace_flags_inherit_only), 0x08, "Does this ACE apply to the current object?", HFILL }},
4320
4321
16
    { &hf_nt_ace_flags_inherited_ace,
4322
16
      { "Inherited ACE", "nt.ace.flags.inherited_ace", FT_BOOLEAN, 8,
4323
16
        TFS(&tfs_ace_flags_inherited_ace), 0x10, "Was this ACE inherited from its parent object?", HFILL }},
4324
4325
16
    { &hf_nt_ace_flags_successful_access,
4326
16
      { "Audit Successful Accesses", "nt.ace.flags.successful_access", FT_BOOLEAN, 8,
4327
16
        TFS(&tfs_ace_flags_successful_access), 0x40, "Should successful accesses be audited?", HFILL }},
4328
4329
16
    { &hf_nt_ace_flags_failed_access,
4330
16
      { "Audit Failed Accesses", "nt.ace.flags.failed_access", FT_BOOLEAN, 8,
4331
16
        TFS(&tfs_ace_flags_failed_access), 0x80, "Should failed accesses be audited?", HFILL }},
4332
4333
    /* Access masks */
4334
4335
16
    { &hf_nt_access_mask,
4336
16
      { "Access required", "nt.access_mask",
4337
16
        FT_UINT32, BASE_HEX, NULL, 0x0, "Access mask",
4338
16
        HFILL }},
4339
4340
16
    { &hf_access_generic_read,
4341
16
      { "Generic read", "nt.access_mask.generic_read",
4342
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4343
16
        GENERIC_READ_ACCESS, NULL, HFILL }},
4344
4345
16
    { &hf_access_generic_write,
4346
16
      { "Generic write", "nt.access_mask.generic_write",
4347
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4348
16
        GENERIC_WRITE_ACCESS, NULL, HFILL }},
4349
4350
16
    { &hf_access_generic_execute,
4351
16
      { "Generic execute", "nt.access_mask.generic_execute",
4352
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4353
16
        GENERIC_EXECUTE_ACCESS, NULL, HFILL }},
4354
4355
16
    { &hf_access_generic_all,
4356
16
      { "Generic all", "nt.access_mask.generic_all",
4357
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4358
16
        GENERIC_ALL_ACCESS, NULL, HFILL }},
4359
4360
16
    { &hf_access_other_3,
4361
16
      { "Other access, bit 3", "nt.access_mask.other_3",
4362
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4363
16
        0x08000000, NULL, HFILL }},
4364
4365
16
    { &hf_access_other_2,
4366
16
      { "Other access, bit 2", "nt.access_mask.other_2",
4367
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4368
16
        0x04000000, NULL, HFILL }},
4369
4370
16
    { &hf_access_maximum_allowed,
4371
16
      { "Maximum allowed", "nt.access_mask.maximum_allowed",
4372
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4373
16
        MAXIMUM_ALLOWED_ACCESS, NULL, HFILL }},
4374
4375
16
    { &hf_access_system_security,
4376
16
      { "System security", "nt.access_mask.system_security",
4377
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4378
16
        SYSTEM_SECURITY_ACCESS, NULL, HFILL }},
4379
4380
16
    { &hf_access_standard_7,
4381
16
      { "Standard access, bit 7", "nt.access_mask.standard_7",
4382
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4383
16
        0x00800000, NULL, HFILL }},
4384
4385
16
    { &hf_access_standard_6,
4386
16
      { "Standard access, bit 6", "nt.access_mask.standard_6",
4387
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4388
16
        0x00400000, NULL, HFILL }},
4389
4390
16
    { &hf_access_standard_5,
4391
16
      { "Standard access, bit 5", "nt.access_mask.standard_5",
4392
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4393
16
        0x00200000, NULL, HFILL }},
4394
4395
16
    { &hf_access_standard_read_control,
4396
16
      { "Read control", "nt.access_mask.read_control",
4397
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4398
16
        READ_CONTROL_ACCESS, NULL, HFILL }},
4399
4400
16
    { &hf_access_standard_delete,
4401
16
      { "Delete", "nt.access_mask.delete",
4402
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4403
16
        DELETE_ACCESS, NULL, HFILL }},
4404
4405
16
    { &hf_access_standard_synchronise,
4406
16
      { "Synchronise", "nt.access_mask.synchronise",
4407
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4408
16
        SYNCHRONIZE_ACCESS, NULL, HFILL }},
4409
4410
16
    { &hf_access_standard_write_dac,
4411
16
      { "Write DAC", "nt.access_mask.write_dac",
4412
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4413
16
        WRITE_DAC_ACCESS, NULL, HFILL }},
4414
4415
16
    { &hf_access_standard_write_owner,
4416
16
      { "Write owner", "nt.access_mask.write_owner",
4417
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4418
16
        WRITE_OWNER_ACCESS, NULL, HFILL }},
4419
4420
16
    { &hf_access_specific_15,
4421
16
      { "Specific access, bit 15", "nt.access_mask.specific_15",
4422
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4423
16
        0x00008000, NULL, HFILL }},
4424
4425
16
    { &hf_access_specific_14,
4426
16
      { "Specific access, bit 14", "nt.access_mask.specific_14",
4427
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4428
16
        0x00004000, NULL, HFILL }},
4429
4430
16
    { &hf_access_specific_13,
4431
16
      { "Specific access, bit 13", "nt.access_mask.specific_13",
4432
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4433
16
        0x00002000, NULL, HFILL }},
4434
4435
16
    { &hf_access_specific_12,
4436
16
      { "Specific access, bit 12", "nt.access_mask.specific_12",
4437
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4438
16
        0x00001000, NULL, HFILL }},
4439
4440
16
    { &hf_access_specific_11,
4441
16
      { "Specific access, bit 11", "nt.access_mask.specific_11",
4442
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4443
16
        0x00000800, NULL, HFILL }},
4444
4445
16
    { &hf_access_specific_10,
4446
16
      { "Specific access, bit 10", "nt.access_mask.specific_10",
4447
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4448
16
        0x00000400, NULL, HFILL }},
4449
4450
16
    { &hf_access_specific_9,
4451
16
      { "Specific access, bit 9", "nt.access_mask.specific_9",
4452
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4453
16
        0x00000200, NULL, HFILL }},
4454
4455
16
    { &hf_access_specific_8,
4456
16
      { "Write attributes", "nt.access_mask.specific_8",
4457
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4458
16
        0x00000100, NULL, HFILL }},
4459
4460
16
    { &hf_access_specific_7,
4461
16
      { "Read attributes", "nt.access_mask.specific_7",
4462
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4463
16
        0x00000080, NULL, HFILL }},
4464
4465
16
    { &hf_access_specific_6,
4466
16
      { "Delete child", "nt.access_mask.specific_6",
4467
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4468
16
      0x00000040, NULL, HFILL }},
4469
4470
16
    { &hf_access_specific_5,
4471
16
      { "Execute file / Traverse directory", "nt.access_mask.specific_5",
4472
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4473
16
        0x00000020, NULL, HFILL }},
4474
4475
16
    { &hf_access_specific_4,
4476
16
      { "Write extended attributes", "nt.access_mask.specific_4",
4477
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4478
16
        0x00000010, NULL, HFILL }},
4479
4480
16
    { &hf_access_specific_3,
4481
16
      { "Read extended attributes", "nt.access_mask.specific_3",
4482
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4483
16
        0x00000008, NULL, HFILL }},
4484
4485
16
    { &hf_access_specific_2,
4486
16
      { "Append data to file / Add subdirectory / Create pipe instance", "nt.access_mask.specific_2",
4487
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4488
16
        0x00000004, NULL, HFILL }},
4489
4490
16
    { &hf_access_specific_1,
4491
16
      { "Write data to file / Add file to directory", "nt.access_mask.specific_1",
4492
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4493
16
        0x00000002, NULL, HFILL }},
4494
4495
16
    { &hf_access_specific_0,
4496
16
      { "Read data file / List directory", "nt.access_mask.specific_0",
4497
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4498
16
        0x00000001, NULL, HFILL }},
4499
4500
16
    { &hf_nt_ace_flags_object_type_present,
4501
16
      { "Object Type Present", "nt.ace.object.flags.object_type_present",
4502
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4503
16
        0x00000001, NULL, HFILL }},
4504
4505
16
    { &hf_nt_ace_flags_inherited_object_type_present,
4506
16
      { "Inherited Object Type Present", "nt.ace.object.flags.inherited_object_type_present",
4507
16
        FT_BOOLEAN, 32, TFS(&tfs_set_notset),
4508
16
        0x00000002, NULL, HFILL }},
4509
4510
16
          { &hf_nt_ace_guid,
4511
16
      { "GUID", "nt.ace.object.guid", FT_GUID, BASE_NONE,
4512
16
        NULL, 0, NULL, HFILL }},
4513
4514
16
          { &hf_nt_ace_inherited_guid,
4515
16
      { "Inherited GUID", "nt.ace.object.inherited_guid", FT_GUID, BASE_NONE,
4516
16
        NULL, 0, NULL, HFILL }},
4517
4518
16
    { &hf_nt_ace_cond,
4519
16
      { "Conditional Expression", "nt.ace.cond", FT_NONE, BASE_NONE,
4520
16
        NULL, 0, NULL, HFILL }},
4521
4522
16
    { &hf_nt_ace_cond_token,
4523
16
      { "Token", "nt.ace.cond.token",
4524
16
        FT_UINT8, BASE_HEX, VALS(ace_cond_token_vals), 0, "Type of Token",
4525
16
        HFILL }},
4526
4527
16
    { &hf_nt_ace_cond_sign,
4528
16
      { "SIGN", "nt.ace.cond.sign",
4529
16
        FT_UINT8, BASE_HEX, VALS(ace_cond_sign_vals), 0,
4530
16
        NULL, HFILL }},
4531
4532
16
    { &hf_nt_ace_cond_base,
4533
16
      { "BASE", "nt.ace.cond.base",
4534
16
        FT_UINT8, BASE_HEX, VALS(ace_cond_base_vals), 0,
4535
16
        NULL, HFILL }},
4536
4537
16
    { &hf_nt_ace_cond_value_int8,
4538
16
      { "INT8", "nt.ace.cond.value_int8", FT_INT8, BASE_DEC,
4539
16
        NULL, 0, NULL, HFILL }},
4540
4541
16
    { &hf_nt_ace_cond_value_int16,
4542
16
      { "INT16", "nt.ace.cond.value_int16", FT_INT16, BASE_DEC,
4543
16
        NULL, 0, NULL, HFILL }},
4544
4545
16
    { &hf_nt_ace_cond_value_int32,
4546
16
      { "INT32", "nt.ace.cond.value_int32", FT_INT32, BASE_DEC,
4547
16
        NULL, 0, NULL, HFILL }},
4548
4549
16
    { &hf_nt_ace_cond_value_int64,
4550
16
      { "INT64", "nt.ace.cond.value_int64", FT_INT64, BASE_DEC,
4551
16
        NULL, 0, NULL, HFILL }},
4552
4553
16
    { &hf_nt_ace_cond_value_string,
4554
16
      { "UNICODE_STRING", "nt.ace.cond.value_string", FT_STRING, BASE_NONE,
4555
16
        NULL, 0, NULL, HFILL }},
4556
4557
16
    { &hf_nt_ace_cond_value_octet_string,
4558
16
      { "OCTET_STRING", "nt.ace.cond.value_octet_string", FT_BYTES, BASE_NONE,
4559
16
        NULL, 0x0, NULL, HFILL }},
4560
4561
16
    { &hf_nt_ace_cond_local_attr,
4562
16
      { "LOCAL_ATTRIBUTE", "nt.ace.cond.local_attr", FT_STRING, BASE_NONE,
4563
16
        NULL, 0, NULL, HFILL }},
4564
4565
16
    { &hf_nt_ace_cond_user_attr,
4566
16
      { "USER_ATTRIBUTE", "nt.ace.cond.user_attr", FT_STRING, BASE_NONE,
4567
16
        NULL, 0, NULL, HFILL }},
4568
4569
16
    { &hf_nt_ace_cond_resource_attr,
4570
16
      { "RESOURCE_ATTRIBUTE", "nt.ace.cond.resource_attr", FT_STRING, BASE_NONE,
4571
16
        NULL, 0, NULL, HFILL }},
4572
4573
16
    { &hf_nt_ace_cond_device_attr,
4574
16
      { "DEVICE_ATTRIBUTE", "nt.ace.cond.device_attr", FT_STRING, BASE_NONE,
4575
16
        NULL, 0, NULL, HFILL }},
4576
4577
16
    { &hf_nt_ace_sra,
4578
16
      { "Resource Attribute", "nt.ace.sra", FT_NONE, BASE_NONE,
4579
16
        NULL, 0, NULL, HFILL }},
4580
4581
16
    { &hf_nt_ace_sra_name_offset,
4582
16
      { "Name Offset", "nt.ace.sra.name_offset", FT_UINT32, BASE_DEC, NULL, 0,
4583
16
        "Offset to Name of Resource Attribute", HFILL }},
4584
4585
16
    { &hf_nt_ace_sra_name,
4586
16
      { "Name", "nt.ace.sra.name", FT_STRING, BASE_NONE, NULL, 0,
4587
16
        "Name of Resource Attribute", HFILL }},
4588
4589
16
    { &hf_nt_ace_sra_type,
4590
16
      { "Type", "nt.ace.sra.type",
4591
16
        FT_UINT16, BASE_DEC, VALS(ace_sra_type_vals), 0,
4592
16
        "Type of Resource Attribute", HFILL }},
4593
4594
16
    { &hf_nt_ace_sra_reserved,
4595
16
      { "Reserved", "nt.ace.sra.reserved", FT_UINT16, BASE_HEX, NULL, 0,
4596
16
        "Reserved of Resource Attribute", HFILL }},
4597
4598
16
    { &hf_nt_ace_sra_flags,
4599
16
      { "Flags", "nt.ace.sra.flags", FT_UINT32, BASE_HEX, NULL, 0,
4600
16
        "Flags of Resource Attribute", HFILL }},
4601
4602
16
    { &hf_nt_ace_sra_flags_manual,
4603
16
      { "Manual", "nt.ace.sra.flags.manual", FT_BOOLEAN, 32,
4604
16
        TFS(&flags_ace_sra_info_manual), 0x00010000, NULL, HFILL }},
4605
4606
16
    { &hf_nt_ace_sra_flags_policy_derived,
4607
16
      { "Policy Derived", "nt.ace.sra.flags.policy_derived", FT_BOOLEAN, 32,
4608
16
        TFS(&flags_ace_sra_info_policy_derived), 0x00020000, NULL, HFILL }},
4609
4610
16
    { &hf_nt_ace_sra_flags_non_inheritable,
4611
16
      { "Non-Inheritable", "nt.ace.sra.flags.non_inheritable", FT_BOOLEAN, 32,
4612
16
        TFS(&flags_ace_sra_info_non_inheritable), 0x00000001, NULL, HFILL }},
4613
4614
16
    { &hf_nt_ace_sra_flags_case_sensitive,
4615
16
      { "Case Sensitive", "nt.ace.sra.flags.case_sensitive", FT_BOOLEAN, 32,
4616
16
        TFS(&flags_ace_sra_info_case_sensitive), 0x00000002, NULL, HFILL }},
4617
4618
16
    { &hf_nt_ace_sra_flags_deny_only,
4619
16
      { "Deny Only", "nt.ace.sra.flags.deny_only", FT_BOOLEAN, 32,
4620
16
        TFS(&flags_ace_sra_info_deny_only), 0x00000004, NULL, HFILL }},
4621
4622
16
    { &hf_nt_ace_sra_flags_disabled_by_default,
4623
16
      { "Disabled By Default", "nt.ace.sra.flags.disabled_by_default", FT_BOOLEAN, 32,
4624
16
        TFS(&flags_ace_sra_info_disabled_by_default), 0x00000008, NULL, HFILL }},
4625
4626
16
    { &hf_nt_ace_sra_flags_disabled,
4627
16
      { "Disabled", "nt.ace.sra.flags.disabled", FT_BOOLEAN, 32,
4628
16
        TFS(&flags_ace_sra_info_disabled), 0x00000010, NULL, HFILL }},
4629
4630
16
    { &hf_nt_ace_sra_flags_mandatory,
4631
16
      { "Mandatory", "nt.ace.sra.flags.mandatory", FT_BOOLEAN, 32,
4632
16
        TFS(&flags_ace_sra_info_mandatory), 0x00000020, NULL, HFILL }},
4633
4634
16
    { &hf_nt_ace_sra_value_count,
4635
16
      { "Value Count", "nt.ace.sra.value_count", FT_UINT32, BASE_DEC, NULL, 0,
4636
16
        "Value Count of Resource Attribute", HFILL }},
4637
4638
16
    { &hf_nt_ace_sra_value_offset,
4639
16
      { "Value Offset", "nt.ace.sra.name_offset", FT_UINT32, BASE_DEC, NULL, 0,
4640
16
        "Offset to a Resource Attribute Value", HFILL }},
4641
4642
16
    { &hf_nt_ace_sra_value_int64,
4643
16
      { "INT64", "nt.ace.sra.value_int64", FT_INT64, BASE_DEC, NULL, 0,
4644
16
        NULL, HFILL }},
4645
4646
16
    { &hf_nt_ace_sra_value_uint64,
4647
16
      { "UINT64", "nt.ace.sra.value_uint64", FT_UINT64, BASE_DEC, NULL, 0,
4648
16
        NULL, HFILL }},
4649
4650
16
    { &hf_nt_ace_sra_value_string,
4651
16
      { "STRING", "nt.ace.sra.value_string", FT_STRING, BASE_NONE,
4652
16
        NULL, 0, NULL, HFILL }},
4653
4654
16
    { &hf_nt_ace_sra_value_sid,
4655
16
      { "SID", "nt.ace.sra.value_sid", FT_STRING, BASE_NONE,
4656
16
        NULL, 0, NULL, HFILL }},
4657
4658
16
    { &hf_nt_ace_sra_value_boolean,
4659
16
      { "BOOLEAN", "nt.ace.sra.value_boolean", FT_UINT64, BASE_DEC,
4660
16
        NULL, 0, NULL, HFILL }},
4661
4662
16
    { &hf_nt_ace_sra_value_octet_string,
4663
16
      { "OCTET_STRING", "nt.ace.sra.value_octet_string", FT_BYTES, BASE_NONE,
4664
16
        NULL, 0x0, NULL, HFILL }},
4665
4666
16
    { &hf_nt_security_information_sacl,
4667
16
      { "SACL", "nt.sec_info.sacl", FT_BOOLEAN, 32,
4668
16
        TFS(&flags_sec_info_sacl), 0x00000008, NULL, HFILL }},
4669
4670
16
    { &hf_nt_security_information_dacl,
4671
16
      { "DACL", "nt.sec_info.dacl", FT_BOOLEAN, 32,
4672
16
        TFS(&flags_sec_info_dacl), 0x00000004, NULL, HFILL }},
4673
4674
16
    { &hf_nt_security_information_group,
4675
16
      { "Group", "nt.sec_info.group", FT_BOOLEAN, 32,
4676
16
        TFS(&flags_sec_info_group), 0x00000002, NULL, HFILL }},
4677
4678
16
    { &hf_nt_security_information_owner,
4679
16
      { "Owner", "nt.sec_info.owner", FT_BOOLEAN, 32,
4680
16
        TFS(&flags_sec_info_owner), 0x00000001, NULL, HFILL }},
4681
4682
    /* Generated from convert_proto_tree_add_text.pl */
4683
16
    { &hf_nt_ace_flags_object, { "ACE Object Flags", "nt.ace.object.flags", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4684
16
    { &hf_nt_ace_flags, { "NT ACE Flags", "nt.ace.flags", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4685
16
    { &hf_nt_sec_desc_type, { "Type", "nt.sec_desc.type", FT_UINT16, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4686
16
    { &hf_nt_security_information, { "SEC INFO", "nt.sec_info", FT_UINT32, BASE_HEX, NULL, 0x0, NULL, HFILL }},
4687
16
    { &hf_nt_offset_to_owner_sid, { "Offset to owner SID", "nt.offset_to_owner_sid", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4688
16
    { &hf_nt_offset_to_group_sid, { "Offset to group SID", "nt.offset_to_group_sid", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4689
16
    { &hf_nt_offset_to_sacl, { "Offset to SACL", "nt.offset_to_sacl", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4690
16
    { &hf_nt_offset_to_dacl, { "Offset to DACL", "nt.offset_to_dacl", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL }},
4691
16
  };
4692
4693
16
  static int *ett[] = {
4694
16
    &ett_nt_sec_desc,
4695
16
    &ett_nt_sec_desc_type,
4696
16
    &ett_nt_sid,
4697
16
    &ett_nt_acl,
4698
16
    &ett_nt_ace,
4699
16
    &ett_nt_ace_flags,
4700
16
    &ett_nt_ace_object,
4701
16
    &ett_nt_ace_object_flags,
4702
16
    &ett_nt_access_mask,
4703
16
    &ett_nt_access_mask_generic,
4704
16
    &ett_nt_access_mask_other,
4705
16
    &ett_nt_access_mask_standard,
4706
16
    &ett_nt_access_mask_specific,
4707
16
    &ett_nt_security_information,
4708
16
    &ett_nt_ace_cond,
4709
16
    &ett_nt_ace_cond_data,
4710
16
    &ett_nt_ace_sra,
4711
16
    &ett_nt_ace_sra_flags,
4712
16
    &ett_nt_ace_sra_value_offsets,
4713
16
    &ett_nt_ace_sra_values,
4714
16
  };
4715
4716
16
  static ei_register_info ei[] = {
4717
16
    { &ei_nt_ace_extends_beyond_data, { "nt.ace_extends_beyond_data", PI_MALFORMED, PI_ERROR, "ACE Extends beyond end of data", EXPFILL }},
4718
16
    { &ei_nt_ace_extends_beyond_reassembled_data, { "nt.ace_extends_beyond_reassembled_data", PI_MALFORMED, PI_ERROR, "ACE Extends beyond end of reassembled data", EXPFILL }},
4719
16
    { &ei_nt_owner_sid_beyond_data, { "nt.owner_sid.beyond_data", PI_MALFORMED, PI_ERROR, "Owner SID beyond end of data", EXPFILL }},
4720
16
    { &ei_nt_owner_sid_beyond_reassembled_data, { "nt.owner_sid.beyond_reassembled_data", PI_MALFORMED, PI_ERROR, "Owner SID beyond end of reassembled data", EXPFILL }},
4721
16
    { &ei_nt_group_sid_beyond_data, { "nt.group_sid.beyond_data", PI_MALFORMED, PI_ERROR, "Group SID beyond end of data", EXPFILL }},
4722
16
    { &ei_nt_group_sid_beyond_reassembled_data, { "nt.group_sid.beyond_reassembled_data", PI_MALFORMED, PI_ERROR, "Group SID beyond end of reassembled data", EXPFILL }},
4723
16
    { &ei_nt_item_offs_out_of_range, { "nt.item_offset.out_of_range", PI_MALFORMED, PI_ERROR, "Item offset is out of range", EXPFILL }},
4724
16
  };
4725
4726
16
  expert_module_t* expert_nt;
4727
4728
16
  proto_register_subtree_array(ett, array_length(ett));
4729
16
  proto_register_field_array(proto_smb, hf, array_length(hf));
4730
16
  expert_nt = expert_register_protocol(proto_smb);
4731
16
  expert_register_field_array(expert_nt, ei, array_length(ei));
4732
16
}
4733
4734
/*
4735
 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
4736
 *
4737
 * Local variables:
4738
 * c-basic-offset: 8
4739
 * tab-width: 8
4740
 * indent-tabs-mode: t
4741
 * End:
4742
 *
4743
 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
4744
 * :indentSize=8:tabSize=8:noTabs=false:
4745
 */