Snort mailing list archives
[PATCH 4/5]: dcerpc2: Add bitmasking support for calculated bytes (byte_extract, byte_jump), and bitwise OR (byte_test)
From: <Joshua.Kinard () us-cert gov>
Date: Thu, 28 Apr 2011 23:44:16 -0500
Since dcerpc2 overrides the three byte-frobbing options with its own versions if the 'dce' parameter is specified, I have tried to match the changes introduced in the first three patches to the variants defined in dcerpc2. However, I do not have a very good testcase to actually verify the logic. It does compile, but this may need a second pair of eyeballs to make sure I touched all the right places. Cheers! --J
Attachment:
snort-2905-dcerpc2-bitmasking.patch
Description: snort-2905-dcerpc2-bitmasking.patch
------------------------------------------------------------------------------ WhatsUp Gold - Download Free Network Management Software The most intuitive, comprehensive, and cost-effective network management toolset available today. Delivers lowest initial acquisition cost and overall TCO of any competing solution. http://p.sf.net/sfu/whatsupgold-sd
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel
Current thread:
- [PATCH 4/5]: dcerpc2: Add bitmasking support for calculated bytes (byte_extract, byte_jump), and bitwise OR (byte_test) Joshua.Kinard (Apr 28)