Monday, July 12, 2010

Server Message Block (SMB) Protocol Dissection

Primary goal of SMB is File Transfer within LAN.

SMB Header Structure:
SMB_Header
{
UCHAR Protocol[4];
UCHAR Command;
SMB_ERROR Status;
UCHAR Flags;
USHORT Flags2;
USHORT PIDHigh;
UCHAR SecurityFeatures[8];
USHORT Reserved;
USHORT TID;
USHORT PIDLow;
USHORT UID;
USHORT MID;
}

SMB Parameter Block:

SMB_Parameters
{
UCHAR WordCount;
USHORT Words[WordCount] (variable);
}


SMB Data Block:
SMB_Data
{
USHORT ByteCount;
UCHAR Bytes[ByteCount] (variable);
}


For further details
http://msdn.microsoft.com/en-us/library/ee441466%28v=PROT.13%29.aspx
http://www.hsc.fr/ressources/articles/win_net_srv/