Skip to content

Commit

Permalink
dcerpc: Add multi transaction support
Browse files Browse the repository at this point in the history
DCERPC parser so far provided support for single transactions only.
Extend that to support multiple transactions.

In order for multiple transactions to work, there is always a
transaction identifier for any protocol in its header that lets a
response match the request. In DCERPC, for TCP, that param is call_id in
the header which is a 32 bit field. For UDP, however since it uses
different version of RPC (4.x), this is defined by serial number field
defined in the header. This field however is not contiguous and needs to
be assembled by the provided serial_low and serial_hi fields.
  • Loading branch information
inashivb committed Jul 15, 2020
1 parent 9831839 commit bab497a
Show file tree
Hide file tree
Showing 6 changed files with 434 additions and 259 deletions.

0 comments on commit bab497a

Please sign in to comment.