Chapter 22. The Talk on the Street

You are a cornflakes-vert.

Something my friend Kathy said to me in High School (and I still don't get it)

Enough descriptive hyperbole. Let's get to work.

SMBtrans is an SMB message with the SMB_COM_TRANSACTION command byte specified in the header. It is also the transport for all Browse Service messages. The on-the-wire layout of the body of the SMBtrans, in C-style notation, is as follows :

 typedef struct   {   uchar WordCount;            /* SetupCount + 14             */   struct                      /* SMB-layer parameters        */     {     ushort TotalParamCount;     /* Total param bytes to send */     ushort TotalDataCount;      /* Total data bytes to send  */     ushort MaxParameterCount;   /* Max param bytes to return */     ushort MaxDataCount;        /* Max data bytes to return  */     ushort MaxSetupCount;       /* Max setup words to return */     ushort Flags;               /* Explained below           */     ulong  Timeout;             /* Operation timeout         */     ushort Reserved;            /* Unused word               */     ushort ParameterCount;      /* Param bytes in this msg   */     ushort ParameterOffset;     /* Param offset within SMB   */     ushort DataCount;           /* Data bytes in this msg    */     ushort DataOffset;          /* Data offset within SMB    */     ushort SetupCount;          /* Setup word count          */     ushort Setup[];             /* Setup words               */     } Words;   ushort ByteCount;           /* Number of SMB data bytes    */   struct                      /* SMB-layer data              */     {     uchar Name[];               /* Transaction service name  */     uchar Pad[];                /* Pad to word boundary      */     uchar Parameters[];         /* Parameter bytes           */     uchar Pad1[];               /* Pad to word boundary      */     uchar Data[];               /* Data bytes                */     } Bytes;   } smb_Trans_Req; 

We can, in fact, make some sense of all that... really we can.