Snort mailing list archives

[PATCH 4/5]: dcerpc2: Add bitmasking support for calculated bytes (byte_extract, byte_jump), and bitwise OR (byte_test)


From: <Joshua.Kinard () us-cert gov>
Date: Thu, 28 Apr 2011 23:44:16 -0500


Since dcerpc2 overrides the three byte-frobbing options with its own
versions if the 'dce' parameter is specified, I have tried to match the
changes introduced in the first three patches to the variants defined in
dcerpc2.  However, I do not have a very good testcase to actually verify
the logic.  It does compile, but this may need a second pair of eyeballs
to make sure I touched all the right places.

Cheers!

--J

Attachment: snort-2905-dcerpc2-bitmasking.patch
Description: snort-2905-dcerpc2-bitmasking.patch

------------------------------------------------------------------------------
WhatsUp Gold - Download Free Network Management Software
The most intuitive, comprehensive, and cost-effective network 
management toolset available today.  Delivers lowest initial 
acquisition cost and overall TCO of any competing solution.
http://p.sf.net/sfu/whatsupgold-sd
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Current thread: