suricata/src/app-layer-dcerpc.c

/* Copyright (c) 2009,2010 Open Information Security Foundation */

/**
 * \file
 *
 * \author Kirby Kuehl <kkuehl@gmail.com>
 */

#include "suricata-common.h"
#include "suricata.h"

#include "debug.h"
#include "decode.h"
#include "threads.h"

#include "util-print.h"
#include "util-pool.h"
#include "util-debug.h"

#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"

#include "app-layer-protos.h"
#include "app-layer-parser.h"

#include "util-spm.h"
#include "util-unittest.h"

#include "app-layer-dcerpc.h"

enum {
    DCERPC_FIELD_NONE = 0,
    DCERPC_PARSE_DCERPC_HEADER,
    DCERPC_PARSE_DCERPC_BIND,
    DCERPC_PARSE_DCERPC_BIND_ACK,
    DCERPC_PARSE_DCERPC_REQUEST,
    /* must be last */
    DCERPC_FIELD_MAX,
};

/* \brief hexdump function from libdnet, used for debugging only */
void hexdump(const void *buf, size_t len) {
    /* dumps len bytes of *buf to stdout. Looks like:
     * [0000] 75 6E 6B 6E 6F 77 6E 20
     *                  30 FF 00 00 00 00 39 00 unknown 0.....9.
     * (in a single line of course)
     */

    const unsigned char *p = buf;
    unsigned char c;
    size_t n;
    char bytestr[4] = { 0 };
    char addrstr[10] = { 0 };
    char hexstr[16 * 3 + 5] = { 0 };
    char charstr[16 * 1 + 5] = { 0 };
    for (n = 1; n <= len; n++) {
        if (n % 16 == 1) {
            /* store address for this line */
#if __WORDSIZE == 64
            snprintf(addrstr, sizeof(addrstr), "%.4lx",
                    ((uint64_t)p-(uint64_t)buf) );
#else
            snprintf(addrstr, sizeof(addrstr), "%.4x", ((uint32_t) p
                        - (uint32_t) buf));
#endif
        }

        c = *p;
        if (isalnum(c) == 0) {
            c = '.';
        }

        /* store hex str (for left side) */
        snprintf(bytestr, sizeof(bytestr), "%02X ", *p);
        strlcat(hexstr, bytestr, sizeof(hexstr) - strlen(hexstr) - 1);

        /* store char str (for right side) */
        snprintf(bytestr, sizeof(bytestr), "%c", c);
        strlcat(charstr, bytestr, sizeof(charstr) - strlen(charstr) - 1);

        if (n % 16 == 0) {
            /* line completed */
            printf("[%4.4s]   %-50.50s  %s\n", addrstr, hexstr, charstr);
            hexstr[0] = 0;
            charstr[0] = 0;
        } else if (n % 8 == 0) {
            /* half line: add whitespaces */
            strlcat(hexstr, "  ", sizeof(hexstr) - strlen(hexstr) - 1);
            strlcat(charstr, " ", sizeof(charstr) - strlen(charstr) - 1);
        }
        p++; /* next byte */
    }

    if (strlen(hexstr) > 0) {
        /* print rest of buffer if not empty */
        printf("[%4.4s]   %-50.50s  %s\n", addrstr, hexstr, charstr);
    }
}

/**
 * \brief printUUID function used to print UUID, Major and Minor Version Number
 * and if it was Accepted or Rejected in the BIND_ACK.
 */
void printUUID(char *type, struct uuid_entry *uuid) {
    uint8_t i = 0;
    if (uuid == NULL) {
        return;
    }
    printf("%s UUID [%2u] %s ", type, uuid->ctxid,
            (uuid->result == 0) ? "Accepted" : "Rejected");
    for (i = 0; i < 16; i++) {
        printf("%02x", uuid->uuid[i]);
    }
    printf(" Major Version 0x%04x Minor Version 0x%04x\n", uuid->version,
            uuid->versionminor);
}

/**
 * \brief DCERPCParseSecondaryAddr reads secondaryaddrlen bytes from the BIND_ACK
 * DCERPC call.
 */
static uint32_t DCERPCParseSecondaryAddr(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;
    while (dcerpc->dcerpcbindbindack.secondaryaddrlenleft-- && input_len--) {
        SCLogDebug("0x%02x ", *p);
        p++;
    }
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t PaddingParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;
    while (dcerpc->padleft-- && input_len--) {
        SCLogDebug("0x%02x ", *p);
        p++;
    }
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t DCERPCGetCTXItems(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;
    if (input_len) {
        switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) {
            case 0:
                if (input_len >= 4) {
                    dcerpc->dcerpcbindbindack.numctxitems = *p;
                    dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems;
                    dcerpc->dcerpcbindbindack.ctxbytesprocessed += 4;
                    dcerpc->bytesprocessed += 4;
                    SCReturnUInt(4U);
                } else {
                    dcerpc->dcerpcbindbindack.numctxitems = *(p++);
                    dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems;
                    if (!(--input_len))
                        break;
                }
            case 1:
                p++;
                if (!(--input_len))
                    break;
            case 2:
                p++;
                if (!(--input_len))
                    break;
            case 3:
                p++;
                input_len--;
                break;
        }
    }
    dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input);
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * \brief DCERPCParseBINDCTXItem is called for each CTXItem found the DCERPC BIND call.
 * each UUID is added to a TAILQ.
 */

static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;

    if (input_len) {
        switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) {
            case 0:
                if (input_len >= 44) {
                    dcerpc->dcerpcbindbindack.ctxid = *(p);
                    dcerpc->dcerpcbindbindack.ctxid |= *(p + 1) << 8;
                    dcerpc->dcerpcbindbindack.uuid[3] = *(p + 4);
                    dcerpc->dcerpcbindbindack.uuid[2] = *(p + 5);
                    dcerpc->dcerpcbindbindack.uuid[1] = *(p + 6);
                    dcerpc->dcerpcbindbindack.uuid[0] = *(p + 7);
                    dcerpc->dcerpcbindbindack.uuid[5] = *(p + 8);
                    dcerpc->dcerpcbindbindack.uuid[4] = *(p + 9);
                    dcerpc->dcerpcbindbindack.uuid[7] = *(p + 10);
                    dcerpc->dcerpcbindbindack.uuid[6] = *(p + 11);
                    dcerpc->dcerpcbindbindack.uuid[8] = *(p + 12);
                    dcerpc->dcerpcbindbindack.uuid[9] = *(p + 13);
                    dcerpc->dcerpcbindbindack.uuid[10] = *(p + 14);
                    dcerpc->dcerpcbindbindack.uuid[11] = *(p + 15);
                    dcerpc->dcerpcbindbindack.uuid[12] = *(p + 16);
                    dcerpc->dcerpcbindbindack.uuid[13] = *(p + 17);
                    dcerpc->dcerpcbindbindack.uuid[14] = *(p + 18);
                    dcerpc->dcerpcbindbindack.uuid[15] = *(p + 19);
                    dcerpc->dcerpcbindbindack.version = *(p + 20);
                    dcerpc->dcerpcbindbindack.version |= *(p + 21) << 8;
                    dcerpc->dcerpcbindbindack.versionminor = *(p + 22);
                    dcerpc->dcerpcbindbindack.versionminor |= *(p + 23) << 8;
                    if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems
                            - dcerpc->dcerpcbindbindack.numctxitemsleft) {
                        dcerpc->dcerpcbindbindack.uuid_entry = (struct uuid_entry *) SCCalloc(1,
                                sizeof(struct uuid_entry));
                        if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
                            SCReturnUInt(0);
                        } else {
                            memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid,
                                    sizeof(dcerpc->dcerpcbindbindack.uuid));
                            dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid;
                            dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version;
                            dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor;
                            TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, dcerpc->dcerpcbindbindack.uuid_entry,
                                    next);
#ifdef UNITTESTS
                            if (RunmodeIsUnittests()) {
                                printUUID("BIND", dcerpc->dcerpcbindbindack.uuid_entry);
                            }
#endif
                            dcerpc->dcerpcbindbindack.numctxitemsleft--;
                            dcerpc->bytesprocessed += (44);
                            dcerpc->dcerpcbindbindack.ctxbytesprocessed += (44);
                            SCReturnUInt(44U);
                        }
                    } else {
                        SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
                                dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
                        SCReturnUInt(0);
                    }
                } else {
                    dcerpc->dcerpcbindbindack.ctxid = *(p++);
                    if (!(--input_len))
                        break;
                }
            case 1:
                dcerpc->dcerpcbindbindack.ctxid |= *(p++) << 8;
                if (!(--input_len))
                    break;
            case 2:
                /* num transact items */
                p++;
                if (!(--input_len))
                    break;
            case 3:
                /* reserved */
                p++;
                if (!(--input_len))
                    break;
            case 4:
                dcerpc->dcerpcbindbindack.uuid[3] = *(p++);
                if (!(--input_len))
                    break;
            case 5:
                dcerpc->dcerpcbindbindack.uuid[2] = *(p++);
                if (!(--input_len))
                    break;
            case 6:
                dcerpc->dcerpcbindbindack.uuid[1] = *(p++);
                if (!(--input_len))
                    break;
            case 7:
                dcerpc->dcerpcbindbindack.uuid[0] = *(p++);
                if (!(--input_len))
                    break;
            case 8:
                dcerpc->dcerpcbindbindack.uuid[5] = *(p++);
                if (!(--input_len))
                    break;
            case 9:
                dcerpc->dcerpcbindbindack.uuid[4] = *(p++);
                if (!(--input_len))
                    break;
            case 10:
                dcerpc->dcerpcbindbindack.uuid[7] = *(p++);
                if (!(--input_len))
                    break;
            case 11:
                dcerpc->dcerpcbindbindack.uuid[6] = *(p++);
                if (!(--input_len))
                    break;
            case 12:
                dcerpc->dcerpcbindbindack.uuid[8] = *(p++);
                if (!(--input_len))
                    break;
            case 13:
                dcerpc->dcerpcbindbindack.uuid[9] = *(p++);
                if (!(--input_len))
                    break;
            case 14:
                dcerpc->dcerpcbindbindack.uuid[10] = *(p++);
                if (!(--input_len))
                    break;
            case 15:
                dcerpc->dcerpcbindbindack.uuid[11] = *(p++);
                if (!(--input_len))
                    break;
            case 16:
                dcerpc->dcerpcbindbindack.uuid[12] = *(p++);
                if (!(--input_len))
                    break;
            case 17:
                dcerpc->dcerpcbindbindack.uuid[13] = *(p++);
                if (!(--input_len))
                    break;
            case 18:
                dcerpc->dcerpcbindbindack.uuid[14] = *(p++);
                if (!(--input_len))
                    break;
            case 19:
                dcerpc->dcerpcbindbindack.uuid[15] = *(p++);
                if (!(--input_len))
                    break;
            case 20:
                dcerpc->dcerpcbindbindack.version = *(p++);
                if (!(--input_len))
                    break;
            case 21:
                dcerpc->dcerpcbindbindack.version |= *(p++);
                if (!(--input_len))
                    break;
            case 22:
                dcerpc->dcerpcbindbindack.versionminor = *(p++);
                if (!(--input_len))
                    break;
            case 23:
                dcerpc->dcerpcbindbindack.versionminor |= *(p++);
                if (!(--input_len))
                    break;
            case 24:
                p++;
                if (!(--input_len))
                    break;
            case 25:
                p++;
                if (!(--input_len))
                    break;
            case 26:
                p++;
                if (!(--input_len))
                    break;
            case 27:
                p++;
                if (!(--input_len))
                    break;
            case 28:
                p++;
                if (!(--input_len))
                    break;
            case 29:
                p++;
                if (!(--input_len))
                    break;
            case 30:
                p++;
                if (!(--input_len))
                    break;
            case 31:
                p++;
                if (!(--input_len))
                    break;
            case 32:
                p++;
                if (!(--input_len))
                    break;
            case 33:
                p++;
                if (!(--input_len))
                    break;
            case 34:
                p++;
                if (!(--input_len))
                    break;
            case 35:
                p++;
                if (!(--input_len))
                    break;
            case 36:
                p++;
                if (!(--input_len))
                    break;
            case 37:
                p++;
                if (!(--input_len))
                    break;
            case 38:
                p++;
                if (!(--input_len))
                    break;
            case 39:
                p++;
                if (!(--input_len))
                    break;
            case 40:
                p++;
                if (!(--input_len))
                    break;
            case 41:
                p++;
                if (!(--input_len))
                    break;
            case 42:
                p++;
                if (!(--input_len))
                    break;
            case 43:
                p++;
                --input_len;
                if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft) {
                    dcerpc->dcerpcbindbindack.uuid_entry = (struct uuid_entry *) SCCalloc(1,
                            sizeof(struct uuid_entry));
                    if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) {
                        SCReturnUInt(0);
                    } else {
                        memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid,
                                sizeof(dcerpc->dcerpcbindbindack.uuid));
                        dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid;
                        dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version;
                        dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor;
                        TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, dcerpc->dcerpcbindbindack.uuid_entry,
                                next);
#ifdef UNITTESTS
                        if (RunmodeIsUnittests()) {
                            printUUID("BIND", dcerpc->dcerpcbindbindack.uuid_entry);
                        }
#endif
                        dcerpc->dcerpcbindbindack.numctxitemsleft--;
                        dcerpc->bytesprocessed += (44);
                        dcerpc->dcerpcbindbindack.ctxbytesprocessed += (44);
                        SCReturnUInt(44U);
                    }
                } else {
                    SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid,
                            dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft);
                    SCReturnUInt(0);
                }
                break;
        }
    }
    dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input);
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * \brief DCERPCParseBINDACKCTXItem is called for each CTXItem found in
 * the BIND_ACK call. The result (Accepted or Rejected) is added to the
 * correct UUID from the BIND call.
 */
static uint32_t DCERPCParseBINDACKCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;
    struct uuid_entry *uuid_entry;

    if (input_len) {
        switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) {
            case 0:
                if (input_len >= 24) {
                    dcerpc->dcerpcbindbindack.result = *p;
                    dcerpc->dcerpcbindbindack.result |= *(p + 1) << 8;
                    TAILQ_FOREACH(uuid_entry, &dcerpc->dcerpcbindbindack.uuid_list, next) {
                        if (uuid_entry->ctxid == dcerpc->dcerpcbindbindack.numctxitems
                                - dcerpc->dcerpcbindbindack.numctxitemsleft) {
                            uuid_entry->result = dcerpc->dcerpcbindbindack.result;
#ifdef UNITTESTS
                            if (RunmodeIsUnittests()) {
                                printUUID("BIND_ACK", uuid_entry);
                            }
#endif
                            break;
                        }
                    }
                    dcerpc->dcerpcbindbindack.numctxitemsleft--;
                    dcerpc->bytesprocessed += (24);
                    dcerpc->dcerpcbindbindack.ctxbytesprocessed += (24);
                    SCReturnUInt(24U);
                } else {
                    dcerpc->dcerpcbindbindack.result = *(p++);
                    if (!(--input_len))
                        break;
                }
            case 1:
                dcerpc->dcerpcbindbindack.result |= *(p++) << 8;
                if (!(--input_len))
                    break;
            case 2:
                /* num transact items */
                p++;
                if (!(--input_len))
                    break;
            case 3:
                /* reserved */
                p++;
                if (!(--input_len))
                    break;
            case 4:
                p++;
                if (!(--input_len))
                    break;
            case 5:
                p++;
                if (!(--input_len))
                    break;
            case 6:
                p++;
                if (!(--input_len))
                    break;
            case 7:
                p++;
                if (!(--input_len))
                    break;
            case 8:
                p++;
                if (!(--input_len))
                    break;
            case 9:
                p++;
                if (!(--input_len))
                    break;
            case 10:
                p++;
                if (!(--input_len))
                    break;
            case 11:
                p++;
                if (!(--input_len))
                    break;
            case 12:
                p++;
                if (!(--input_len))
                    break;
            case 13:
                p++;
                if (!(--input_len))
                    break;
            case 14:
                p++;
                if (!(--input_len))
                    break;
            case 15:
                p++;
                if (!(--input_len))
                    break;
            case 16:
                p++;
                if (!(--input_len))
                    break;
            case 17:
                p++;
                if (!(--input_len))
                    break;
            case 18:
                p++;
                if (!(--input_len))
                    break;
            case 19:
                p++;
                if (!(--input_len))
                    break;
            case 20:
                p++;
                if (!(--input_len))
                    break;
            case 21:
                p++;
                if (!(--input_len))
                    break;
            case 22:
                p++;
                if (!(--input_len))
                    break;
            case 23:
                TAILQ_FOREACH(uuid_entry, &dcerpc->dcerpcbindbindack.uuid_list, next) {
                    if (uuid_entry->ctxid == dcerpc->dcerpcbindbindack.numctxitems
                            - dcerpc->dcerpcbindbindack.numctxitemsleft) {
                        uuid_entry->result = dcerpc->dcerpcbindbindack.result;
#ifdef UNITTESTS
                        if (RunmodeIsUnittests()) {
                            printUUID("BIND_ACK", uuid_entry);
                        }
#endif
                        break;
                    }
                }
                dcerpc->dcerpcbindbindack.numctxitemsleft--;
                p++;
                --input_len;
                break;

        }
    }
    dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input);
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t DCERPCParseBIND(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;
    if (input_len) {
        switch (dcerpc->bytesprocessed) {
            case 16:
                dcerpc->dcerpcbindbindack.numctxitems = 0;
                if (input_len >= 12) {
                    TAILQ_INIT(&dcerpc->dcerpcbindbindack.uuid_list);
                    dcerpc->dcerpcbindbindack.numctxitems = *(p + 8);
                    dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems;
                    dcerpc->bytesprocessed += 12;
                    SCReturnUInt(12U);
                } else {
                    /* max_xmit_frag */
                    p++;
                    if (!(--input_len))
                        break;
                }
            case 17:
                /* max_xmit_frag */
                p++;
                if (!(--input_len))
                    break;
            case 18:
                /* max_recv_frag */
                p++;
                if (!(--input_len))
                    break;
            case 19:
                /* max_recv_frag */
                p++;
                if (!(--input_len))
                    break;
            case 20:
                /* assoc_group_id */
                p++;
                if (!(--input_len))
                    break;
            case 21:
                /* assoc_group_id */
                p++;
                if (!(--input_len))
                    break;
            case 22:
                /* assoc_group_id */
                p++;
                if (!(--input_len))
                    break;
            case 23:
                /* assoc_group_id */
                p++;
                if (!(--input_len))
                    break;
            case 24:
                dcerpc->dcerpcbindbindack.numctxitems = *(p++);
                dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems;
                TAILQ_INIT(&dcerpc->dcerpcbindbindack.uuid_list);
                if (!(--input_len))
                    break;
            case 25:
                /* pad byte 1 */
                p++;
                if (!(--input_len))
                    break;
            case 26:
                /* pad byte 2 */
                p++;
                if (!(--input_len))
                    break;
            case 27:
                /* pad byte 3 */
                p++;
                --input_len;
                break;
        }
    }
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t DCERPCParseBINDACK(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;

    switch (dcerpc->bytesprocessed) {
        case 16:
            dcerpc->dcerpcbindbindack.numctxitems = 0;
            if (input_len >= 10) {
                if (dcerpc->dcerpchdr.packed_drep[0] == 0x10) {
                    dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p + 8);
                    dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p + 9) << 8;
                } else {
                    dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p + 8) << 8;
                    dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p + 9);
                }
                dcerpc->dcerpcbindbindack.secondaryaddrlenleft = dcerpc->dcerpcbindbindack.secondaryaddrlen;
                dcerpc->bytesprocessed += 10;
                SCReturnUInt(10U);
            } else {
                /* max_xmit_frag */
                p++;
                if (!(--input_len))
                    break;
            }
        case 17:
            /* max_xmit_frag */
            p++;
            if (!(--input_len))
                break;
        case 18:
            /* max_recv_frag */
            p++;
            if (!(--input_len))
                break;
        case 19:
            /* max_recv_frag */
            p++;
            if (!(--input_len))
                break;
        case 20:
            /* assoc_group_id */
            p++;
            if (!(--input_len))
                break;
        case 21:
            /* assoc_group_id */
            p++;
            if (!(--input_len))
                break;
        case 22:
            /* assoc_group_id */
            p++;
            if (!(--input_len))
                break;
        case 23:
            /* assoc_group_id */
            p++;
            if (!(--input_len))
                break;
        case 24:
            dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p++);
            if (!(--input_len))
                break;
        case 25:
            dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p++) << 8;
            if (dcerpc->dcerpchdr.packed_drep[0] == 0x01) {
                SCByteSwap16(dcerpc->dcerpcbindbindack.secondaryaddrlen);
            }
            dcerpc->dcerpcbindbindack.secondaryaddrlenleft = dcerpc->dcerpcbindbindack.secondaryaddrlen;
            SCLogDebug("secondaryaddrlen %u 0x%04x\n", dcerpc->dcerpcbindbindack.secondaryaddrlen,
                    dcerpc->dcerpcbindbindack.secondaryaddrlen);
            --input_len;
            break;
    }
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t DCERPCParseREQUEST(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;

    switch (dcerpc->bytesprocessed) {
        case 16:
            dcerpc->dcerpcbindbindack.numctxitems = 0;
            if (input_len >= 8) {
                if (dcerpc->dcerpchdr.type == REQUEST) {
                    if (dcerpc->dcerpchdr.packed_drep[0] == 0x10) {
                        dcerpc->dcerpcrequest.opnum = *(p + 6);
                        dcerpc->dcerpcrequest.opnum |= *(p + 7) << 8;
                    } else {
                        dcerpc->dcerpcrequest.opnum = *(p + 6) << 8;
                        dcerpc->dcerpcrequest.opnum |= *(p + 7);
                    }
                }
                dcerpc->bytesprocessed += 8;
                SCReturnUInt(8U);
            } else {
                /* alloc hint 1 */
                p++;
                if (!(--input_len))
                    break;
            }
        case 17:
            /* alloc hint 2 */
            p++;
            if (!(--input_len))
                break;
        case 18:
            /* alloc hint 3 */
            p++;
            if (!(--input_len))
                break;
        case 19:
            /* alloc hint 4 */
            p++;
            if (!(--input_len))
                break;
        case 20:
            /* context id 1 */
            p++;
            if (!(--input_len))
                break;
        case 21:
            /* context id 2 */
            p++;
            if (!(--input_len))
                break;
        case 22:
            if (dcerpc->dcerpchdr.type == REQUEST) {
                dcerpc->dcerpcrequest.opnum = *(p++);
            } else {
                p++;
            }
            if (!(--input_len))
                break;
        case 23:
            if (dcerpc->dcerpchdr.type == REQUEST) {
                dcerpc->dcerpcrequest.opnum |= *(p++) << 8;
                if (dcerpc->dcerpchdr.packed_drep[0] == 0x01) {
                    SCByteSwap16(dcerpc->dcerpcrequest.opnum);
                }
            } else {
                p++;
            }
            --input_len;
            break;
    }
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

static uint32_t StubDataParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;
    dcerpc->dcerpcrequest.stub_data = input;
    while (dcerpc->padleft-- && input_len--) {
        SCLogDebug("0x%02x ", *p);
        p++;
    }
    dcerpc->bytesprocessed += (p - input);
    SCReturnUInt((uint32_t)(p - input));
}

/**
 * \brief DCERPCParseHeader parses the 16 byte DCERPC header
 * A fast path for normal decoding is used when there is enough bytes
 * present to parse the entire header. A slow path is used to parse
 * fragmented packets.
 * \retval -1 if DCEPRC Header does not validate
 * \retval Number of bytes processed
 */
static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint8_t *p = input;
    if (input_len) {
        switch (dcerpc->bytesprocessed) {
            case 0:
                if (input_len >= DCERPC_HDR_LEN) {
                    dcerpc->dcerpchdr.rpc_vers = *p;
                    dcerpc->dcerpchdr.rpc_vers_minor = *(p + 1);
                    if ((dcerpc->dcerpchdr.rpc_vers != 5) ||
                       ((dcerpc->dcerpchdr.rpc_vers_minor != 0) &&
                       (dcerpc->dcerpchdr.rpc_vers_minor != 1))) {
			SCLogDebug("DCERPC Header did not validate");
			SCReturnInt(-1);
                    }
                    dcerpc->dcerpchdr.type = *(p + 2);
                    dcerpc->dcerpchdr.pfc_flags = *(p + 3);
                    dcerpc->dcerpchdr.packed_drep[0] = *(p + 4);
                    dcerpc->dcerpchdr.packed_drep[1] = *(p + 5);
                    dcerpc->dcerpchdr.packed_drep[2] = *(p + 6);
                    dcerpc->dcerpchdr.packed_drep[3] = *(p + 7);
                    if (dcerpc->dcerpchdr.packed_drep[0] == 0x10) {
                        dcerpc->dcerpchdr.frag_length = *(p + 8);
                        dcerpc->dcerpchdr.frag_length |= *(p + 9) << 8;
                        dcerpc->dcerpchdr.auth_length = *(p + 10);
                        dcerpc->dcerpchdr.auth_length |= *(p + 11) << 8;
                        dcerpc->dcerpchdr.call_id = *(p + 12) << 24;
                        dcerpc->dcerpchdr.call_id |= *(p + 13) << 16;
                        dcerpc->dcerpchdr.call_id |= *(p + 14) << 8;
                        dcerpc->dcerpchdr.call_id |= *(p + 15);
                    } else {
                        dcerpc->dcerpchdr.frag_length = *(p + 8) << 8;
                        dcerpc->dcerpchdr.frag_length |= *(p + 9);
                        dcerpc->dcerpchdr.auth_length = *(p + 10) << 8;
                        dcerpc->dcerpchdr.auth_length |= *(p + 11);
                        dcerpc->dcerpchdr.call_id = *(p + 12);
                        dcerpc->dcerpchdr.call_id |= *(p + 13) << 8;
                        dcerpc->dcerpchdr.call_id |= *(p + 14) << 16;
                        dcerpc->dcerpchdr.call_id |= *(p + 15) << 24;
                    }
                    dcerpc->bytesprocessed = DCERPC_HDR_LEN;
                    SCReturnInt(16);
                    break;
                } else {
                    dcerpc->dcerpchdr.rpc_vers = *(p++);
                    if (!(--input_len))
                        break;
                }
            case 1:
                dcerpc->dcerpchdr.rpc_vers_minor = *(p++);
                if ((dcerpc->dcerpchdr.rpc_vers != 5) ||
                    ((dcerpc->dcerpchdr.rpc_vers_minor != 0) &&
                    (dcerpc->dcerpchdr.rpc_vers_minor != 1))) {
			SCLogDebug("DCERPC Header did not validate");
			SCReturnInt(-1);
                }
                if (!(--input_len))
                    break;
            case 2:
                dcerpc->dcerpchdr.type = *(p++);
                if (!(--input_len))
                    break;
            case 3:
                dcerpc->dcerpchdr.pfc_flags = *(p++);
                if (!(--input_len))
                    break;
            case 4:
                dcerpc->dcerpchdr.packed_drep[0] = *(p++);
                if (!(--input_len))
                    break;
            case 5:
                dcerpc->dcerpchdr.packed_drep[1] = *(p++);
                if (!(--input_len))
                    break;
            case 6:
                dcerpc->dcerpchdr.packed_drep[2] = *(p++);
                if (!(--input_len))
                    break;
            case 7:
                dcerpc->dcerpchdr.packed_drep[3] = *(p++);
                if (!(--input_len))
                    break;
            case 8:
                dcerpc->dcerpchdr.frag_length = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 9:
                dcerpc->dcerpchdr.frag_length |= *(p++);
                if (!(--input_len))
                    break;
            case 10:
                dcerpc->dcerpchdr.auth_length = *(p++) << 8;
                if (!(--input_len))
                    break;
            case 11:
                dcerpc->dcerpchdr.auth_length |= *(p++);
                if (!(--input_len))
                    break;
            case 12:
                dcerpc->dcerpchdr.call_id = *(p++) << 24;
                if (!(--input_len))
                    break;
            case 13:
                dcerpc->dcerpchdr.call_id |= *(p++) << 16;
                if (!(--input_len))
                    break;
            case 14:
                dcerpc->dcerpchdr.call_id |= *(p++) << 8;
                if (!(--input_len))
                    break;
            case 15:
                dcerpc->dcerpchdr.call_id |= *(p++);
                if (dcerpc->dcerpchdr.packed_drep[0] == 0x01) {
                    SCByteSwap16(dcerpc->dcerpchdr.frag_length);
                    SCByteSwap16(dcerpc->dcerpchdr.auth_length);
                    SCByteSwap32(dcerpc->dcerpchdr.call_id);
                }
                --input_len;
                break;
        }
    }
    dcerpc->bytesprocessed += (p - input);
    SCReturnInt((p - input));
}

int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
    SCEnter();
    uint32_t retval = 0;
    uint32_t parsed = 0;
    int hdrretval = 0;

    while (dcerpc->bytesprocessed < DCERPC_HDR_LEN && input_len) {
        hdrretval = DCERPCParseHeader(dcerpc, input, input_len);
        if (hdrretval == -1) {
		dcerpc->bytesprocessed = 0;
		SCReturnInt(hdrretval);
        } else {
		parsed += hdrretval;
		input_len -= hdrretval;
        }
    }
    SCLogDebug("Done with DCERPCParseHeader bytesprocessed %u/%u left %u\n",
            dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len);
#if 0
    printf("Done with DCERPCParseHeader bytesprocessed %u/%u left %u\n",
            dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len);
    printf("\nDCERPC Version:\t%u\n", dcerpc->dcerpchdr.rpc_vers);
    printf("DCERPC Version Minor:\t%u\n", dcerpc->dcerpchdr.rpc_vers_minor);
    printf("DCERPC Type:\t%u\n", dcerpc->dcerpchdr.type);
    printf("DCERPC Flags:\t0x%02x\n", dcerpc->dcerpchdr.pfc_flags);
    printf("DCERPC Packed Drep:\t%02x %02x %02x %02x\n",
            dcerpc->dcerpchdr.packed_drep[0], dcerpc->dcerpchdr.packed_drep[1],
            dcerpc->dcerpchdr.packed_drep[2], dcerpc->dcerpchdr.packed_drep[3]);
    printf("DCERPC Frag Length:\t0x%04x %u\n",
            dcerpc->dcerpchdr.frag_length, dcerpc->dcerpchdr.frag_length);
    printf("DCERPC Auth Length:\t0x%04x\n", dcerpc->dcerpchdr.auth_length);
    printf("DCERPC Call Id:\t0x%08x\n", dcerpc->dcerpchdr.call_id);
#endif

    switch (dcerpc->dcerpchdr.type) {
        case BIND:
        case ALTER_CONTEXT:
            while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 12
                    && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
                    && input_len) {
                retval = DCERPCParseBIND(dcerpc, input + parsed, input_len);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                } else if (input_len) {
                    SCLogDebug("Error Parsing DCERPC BIND");
                    parsed -= input_len;
                    input_len = 0;
                }
            }
            SCLogDebug(
                    "Done with DCERPCParseBIND bytesprocessed %u/%u numctxitems %u\n",
                    dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length,
                    dcerpc->dcerpcbindbindack.numctxitems);
            while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed
                    < dcerpc->dcerpchdr.frag_length && input_len) {
                retval = DCERPCParseBINDCTXItem(dcerpc, input + parsed, input_len);
                if (retval) {
                    if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 44) {
                        dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
                    }
                    parsed += retval;
                    input_len -= retval;
                    SCLogDebug("BIND processed %u/%u ctxitems %u/%u\n",
                            dcerpc->bytesprocessed,
                            dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitemsleft,
                            dcerpc->dcerpcbindbindack.numctxitems);
                } else if (input_len) {
                    SCLogDebug("Error Parsing CTX Item");
                    parsed -= input_len;
                    input_len = 0;
                    dcerpc->dcerpcbindbindack.numctxitemsleft = 0;
                }
            }
            if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
                dcerpc->bytesprocessed = 0;
                dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
            }
            break;
        case BIND_ACK:
        case ALTER_CONTEXT_RESP:
            while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 9
                    && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
                    && input_len) {
                retval = DCERPCParseBINDACK(dcerpc, input + parsed, input_len);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                    SCLogDebug("DCERPCParseBINDACK processed %u/%u left %u\n",
                            dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len);
                } else if (input_len) {
                    SCLogDebug("Error parsing BIND_ACK");
                    parsed -= input_len;
                    input_len = 0;
                }
            }

            while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 10
                    + dcerpc->dcerpcbindbindack.secondaryaddrlen
                    && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) {
                retval = DCERPCParseSecondaryAddr(dcerpc, input + parsed, input_len);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                    SCLogDebug(
                            "DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)\n",
                            dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len,
                            dcerpc->dcerpcbindbindack.secondaryaddrlen);
                } else if (input_len) {
                    SCLogDebug("Error parsing Secondary Address");
                    parsed -= input_len;
                    input_len = 0;
                }
            }

            if (dcerpc->bytesprocessed == DCERPC_HDR_LEN + 10
                    + dcerpc->dcerpcbindbindack.secondaryaddrlen) {
                if (dcerpc->bytesprocessed % 4) {
                    dcerpc->pad = (4 - dcerpc->bytesprocessed % 4);
                    dcerpc->padleft = dcerpc->pad;
                }
            }

            while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 10
                    + dcerpc->dcerpcbindbindack.secondaryaddrlen + dcerpc->pad
                    && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) {
                retval = PaddingParser(dcerpc, input + parsed, input_len);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                    SCLogDebug("PaddingParser %u/%u left %u pad(%u)\n",
                            dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len,
                            dcerpc->pad);
                } else if (input_len) {
                    SCLogDebug("Error parsing DCERPC Padding");
                    parsed -= input_len;
                    input_len = 0;
                }
            }

            while (dcerpc->bytesprocessed >= DCERPC_HDR_LEN + 10 + dcerpc->pad
                    + dcerpc->dcerpcbindbindack.secondaryaddrlen && dcerpc->bytesprocessed
                    < DCERPC_HDR_LEN + 14 + dcerpc->pad + dcerpc->dcerpcbindbindack.secondaryaddrlen
                    && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) {
                retval = DCERPCGetCTXItems(dcerpc, input + parsed, input_len);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                    SCLogDebug("DCERPCGetCTXItems %u/%u (%u)\n", dcerpc->bytesprocessed,
                            dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitems);
                } else if (input_len) {
                    SCLogDebug("Error parsing CTX Items");
                    parsed -= input_len;
                    input_len = 0;
                }
            }

            if (dcerpc->bytesprocessed == DCERPC_HDR_LEN + 14 + dcerpc->pad
                    + dcerpc->dcerpcbindbindack.secondaryaddrlen) {
                dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
            }

            while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed
                    < dcerpc->dcerpchdr.frag_length && input_len) {
                retval = DCERPCParseBINDACKCTXItem(dcerpc, input + parsed, input_len);
                if (retval) {
                    if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 24) {
                        dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
                    }
                    parsed += retval;
                    input_len -= retval;
                } else if (input_len) {
                    SCLogDebug("Error parsing CTX Items");
                    parsed -= input_len;
                    input_len = 0;
                    dcerpc->dcerpcbindbindack.numctxitemsleft = 0;

                }
            }
            SCLogDebug("BINDACK processed %u/%u\n", dcerpc->bytesprocessed,
                    dcerpc->dcerpchdr.frag_length);
            if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
                dcerpc->bytesprocessed = 0;
                dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0;
            }
            break;
        case REQUEST:
        case RESPONSE:
            while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 8
                    && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
                    && input_len) {
                retval = DCERPCParseREQUEST(dcerpc, input + parsed, input_len);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                    dcerpc->padleft = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed;
                } else if (input_len) {
                    SCLogDebug("Error parsing DCERPC Request");
                    parsed -= input_len;
                    dcerpc->padleft = 0;
                    input_len = 0;
                }
            }
            while (dcerpc->bytesprocessed >= DCERPC_HDR_LEN + 8
                    && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length
                    && dcerpc->padleft && input_len) {
                retval = StubDataParser(dcerpc, input + parsed, input_len);
                if (retval) {
                    parsed += retval;
                    input_len -= retval;
                } else if (input_len) {
                    SCLogDebug("Error parsing DCERPC Stub Data");
                    parsed -= input_len;
                    input_len = 0;
                    dcerpc->bytesprocessed = 0;
                }
            }
            SCLogDebug("REQUEST processed %u frag length %u opnum %u input_len %u\n", dcerpc->bytesprocessed,
                    dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcrequest.opnum, input_len);

            if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
                dcerpc->bytesprocessed = 0;
            }
            break;
        default:
            SCLogDebug("DCERPC Type 0x%02x not implemented yet\n", dcerpc->dcerpchdr.type);
            dcerpc->bytesprocessed = 0;
            break;
    }
    SCReturnInt(parsed);
}

static int DCERPCParse(Flow *f, void *dcerpc_state,
        AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
        AppLayerParserResult *output) {
    SCEnter();
    int32_t retval = 0;
    DCERPCState *sstate = (DCERPCState *) dcerpc_state;

    retval = DCERPCParser(&sstate->dcerpc, input, input_len);
    if (retval == -1) {
	SCReturnInt(-1);
    }
    if (pstate == NULL)
        SCReturnInt(-1);

    pstate->parse_field = 0;

    SCReturnInt(1);
}

static void *DCERPCStateAlloc(void) {
    void *s = SCMalloc(sizeof(DCERPCState));
    if (s == NULL)
        return NULL;

    memset(s, 0, sizeof(DCERPCState));
    return s;
}

static void DCERPCStateFree(void *s) {
    DCERPCState *sstate = (DCERPCState *) s;

    struct uuid_entry *item;

    while ((item = TAILQ_FIRST(&sstate->dcerpc.dcerpcbindbindack.uuid_list))) {
        //printUUID("Free", item);
        TAILQ_REMOVE(&sstate->dcerpc.dcerpcbindbindack.uuid_list, item, next);
        SCFree(item);
    }

    if (s) {
        SCFree(s);
        s = NULL;
    }
}

void RegisterDCERPCParsers(void) {
    AppLayerRegisterProto("dcerpc", ALPROTO_DCERPC, STREAM_TOSERVER,
            DCERPCParse);
    AppLayerRegisterProto("dcerpc", ALPROTO_DCERPC, STREAM_TOCLIENT,
            DCERPCParse);
    AppLayerRegisterStateFuncs(ALPROTO_DCERPC, DCERPCStateAlloc,
            DCERPCStateFree);
}

/* UNITTESTS */
#ifdef UNITTESTS
/** \test DCERPC Header Parsing and  BIND / BIND_ACK multiple UUID handling
*/

/* set this to 1 to see problem */

int DCERPCParserTest01(void) {
    int result = 1;
    Flow f;
    uint8_t dcerpcbind[] = {
        0x05, 0x00,
        0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x3c, 0x04,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16,
        0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x2c, 0xd0,
        0x28, 0xda, 0x76, 0x91, 0xf6, 0x6e, 0xcb, 0x0f,
        0xbf, 0x85, 0xcd, 0x9b, 0xf6, 0x39, 0x01, 0x00,
        0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00,
        0x01, 0x00, 0x2c, 0x75, 0xce, 0x7e, 0x82, 0x3b,
        0x06, 0xac, 0x1b, 0xf0, 0xf5, 0xb7, 0xa7, 0xf7,
        0x28, 0xaf, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0xe3, 0xb2,
        0x10, 0xd1, 0xd0, 0x0c, 0xcc, 0x3d, 0x2f, 0x80,
        0x20, 0x7c, 0xef, 0xe7, 0x09, 0xe0, 0x04, 0x00,
        0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00,
        0x01, 0x00, 0xde, 0x85, 0x70, 0xc4, 0x02, 0x7c,
        0x60, 0x23, 0x67, 0x0c, 0x22, 0xbf, 0x18, 0x36,
        0x79, 0x17, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x41, 0x65,
        0x29, 0x51, 0xaa, 0xe7, 0x7b, 0xa8, 0xf2, 0x37,
        0x0b, 0xd0, 0x3f, 0xb3, 0x36, 0xed, 0x05, 0x00,
        0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00,
        0x01, 0x00, 0x14, 0x96, 0x80, 0x01, 0x2e, 0x78,
        0xfb, 0x5d, 0xb4, 0x3c, 0x14, 0xb3, 0x3d, 0xaa,
        0x02, 0xfb, 0x06, 0x00, 0x00, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x3b, 0x04,
        0x68, 0x3e, 0x63, 0xfe, 0x9f, 0xd8, 0x64, 0x55,
        0xcd, 0xe7, 0x39, 0xaf, 0x98, 0x9f, 0x03, 0x00,
        0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00,
        0x01, 0x00, 0x16, 0x7a, 0x4f, 0x1b, 0xdb, 0x25,
        0x92, 0x55, 0xdd, 0xae, 0x9e, 0x5b, 0x3e, 0x93,
        0x66, 0x93, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xe8, 0xa4,
        0x8a, 0xcf, 0x95, 0x6c, 0xc7, 0x8f, 0x14, 0xcc,
        0x56, 0xfc, 0x7b, 0x5f, 0x4f, 0xe8, 0x04, 0x00,
        0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00,
        0x01, 0x00, 0xd8, 0xda, 0xfb, 0xbc, 0xa2, 0x55,
        0x6f, 0x5d, 0xc0, 0x2d, 0x88, 0x6f, 0x00, 0x17,
        0x52, 0x8d, 0x06, 0x00, 0x03, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x3f, 0x17,
        0x55, 0x0c, 0xf4, 0x23, 0x3c, 0xca, 0xe6, 0xa0,
        0xaa, 0xcc, 0xb5, 0xe3, 0xf9, 0xce, 0x04, 0x00,
        0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00,
        0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1,
        0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9,
        0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xc9, 0x9f,
        0x3e, 0x6e, 0x82, 0x0a, 0x2b, 0x28, 0x37, 0x78,
        0xe1, 0x13, 0x70, 0x05, 0x38, 0x4d, 0x01, 0x00,
        0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00,
        0x01, 0x00, 0x11, 0xaa, 0x4b, 0x15, 0xdf, 0xa6,
        0x86, 0x3f, 0xfb, 0xe0, 0x09, 0xb7, 0xf8, 0x56,
        0xd2, 0x3f, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, 0xee, 0x99,
        0xc4, 0x25, 0x11, 0xe4, 0x95, 0x62, 0x29, 0xfa,
        0xfd, 0x26, 0x57, 0x02, 0xf1, 0xce, 0x03, 0x00,
        0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00,
        0x01, 0x00, 0xba, 0x81, 0x9e, 0x1a, 0xdf, 0x2b,
        0xba, 0xe4, 0xd3, 0x17, 0x41, 0x60, 0x6d, 0x2d,
        0x9e, 0x28, 0x03, 0x00, 0x03, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x10, 0x00, 0x01, 0x00, 0xa0, 0x24,
        0x03, 0x9a, 0xa9, 0x99, 0xfb, 0xbe, 0x49, 0x11,
        0xad, 0x77, 0x30, 0xaa, 0xbc, 0xb6, 0x02, 0x00,
        0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x11, 0x00,
        0x01, 0x00, 0x32, 0x04, 0x7e, 0xae, 0xec, 0x28,
        0xd1, 0x55, 0x83, 0x4e, 0xc3, 0x47, 0x5d, 0x1d,
        0xc6, 0x65, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x12, 0x00, 0x01, 0x00, 0xc6, 0xa4,
        0x81, 0x48, 0x66, 0x2a, 0x74, 0x7d, 0x56, 0x6e,
        0xc5, 0x1d, 0x19, 0xf2, 0xb5, 0xb6, 0x03, 0x00,
        0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x13, 0x00,
        0x01, 0x00, 0xcb, 0xae, 0xb3, 0xc0, 0x0c, 0xf4,
        0xa4, 0x5e, 0x91, 0x72, 0xdd, 0x53, 0x24, 0x70,
        0x89, 0x02, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x14, 0x00, 0x01, 0x00, 0xb8, 0xd0,
        0xa0, 0x1a, 0x5e, 0x7a, 0x2d, 0xfe, 0x35, 0xc6,
        0x7d, 0x08, 0x0d, 0x33, 0x73, 0x18, 0x02, 0x00,
        0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x15, 0x00,
        0x01, 0x00, 0x21, 0xd3, 0xaa, 0x09, 0x03, 0xa7,
        0x0b, 0xc2, 0x06, 0x45, 0xd9, 0x6c, 0x75, 0xc2,
        0x15, 0xa8, 0x01, 0x00, 0x03, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00, 0x16, 0x00, 0x01, 0x00, 0xe1, 0xbd,
        0x59, 0xfc, 0xbc, 0xa9, 0x95, 0xc2, 0x68, 0x79,
        0xf3, 0x75, 0xe0, 0xae, 0x6c, 0xe5, 0x04, 0x00,
        0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
        0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
        0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x17, 0x00,
        0x01, 0x00, 0x06, 0x52, 0xb4, 0x71, 0x70, 0x15,
        0x4e, 0xf5, 0x7f, 0x08, 0x86, 0x14, 0xe6, 0x17,
        0xd5, 0x97, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d,
        0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8,
        0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00,
        0x00, 0x00};

    uint8_t dcerpcbindack[] = {
        0x05, 0x00, 0x0c, 0x03,
        0x10, 0x00, 0x00, 0x00, 0x6c, 0x02, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10,
        0xce, 0x47, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50,
        0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73,
        0x73, 0x00, 0xf6, 0x6e, 0x18, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
        0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
        0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

    uint8_t dcerpcrequest[] = {
        0x05, 0x00, 0x00, 0x00, 0x10,
        0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b,
        0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00, 0x4d,
        0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a,
        0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58,
        0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41,
        0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48,
        0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60,
        0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b,
        0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24,
        0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68,
        0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c,
        0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61,
        0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d,
        0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67,
        0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45,
        0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c,
        0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e,
        0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73,
        0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e,
        0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41,
        0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71,
        0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35,
        0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37,
        0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37,
        0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69,
        0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72,
        0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e,
        0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31,
        0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b,
        0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e,
        0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f,
        0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59,
        0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e,
        0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79,
        0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49,
        0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72,
        0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24,
        0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27,
        0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e,
        0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28,
        0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64,
        0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30,
        0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e,
        0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52,
        0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56,
        0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30,
        0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38,
        0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42,
        0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c,
        0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f,
        0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41,
        0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27,
        0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30,
        0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e,
        0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72,
        0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b,
        0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b,
        0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56,
        0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61,
        0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58,
        0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b,
        0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52,
        0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65,
        0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74,
        0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61,
        0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a,
        0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68,
        0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f,
        0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32,
        0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f,
        0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51,
        0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48,
        0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25,
        0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32,
        0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40,
        0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50,
        0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38,
        0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c,
        0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a,
        0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76,
        0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75,
        0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33,
        0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71,
        0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67,
        0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b,
        0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23,
        0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51,
        0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b,
        0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65,
        0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f,
        0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a,
        0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f,
        0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59,
        0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46,
        0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e,
        0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45,
        0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e,
        0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75,
        0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29,
        0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78,
        0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b,
        0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f,
        0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68,
        0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53,
        0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36,
        0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75,
        0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55,
        0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73,
        0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e,
        0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d,
        0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f,
        0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63,
        0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61,
        0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c,
        0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b,
        0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37,
        0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a,
        0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a,
        0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a,
        0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b,
        0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c,
        0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b,
        0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22,
        0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44,
        0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c,
        0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70,
        0x00, 0x69, 0x00};
    uint32_t requestlen = sizeof(dcerpcrequest);

    uint32_t bindlen = sizeof(dcerpcbind);
    uint32_t bindacklen = sizeof(dcerpcbindack);
    TcpSession ssn;
    struct uuid_entry *uuid_entry;

    memset(&f, 0, sizeof(f));
    memset(&ssn, 0, sizeof(ssn));
    f.protoctx = (void *)&ssn;

    StreamTcpInitConfig(TRUE);
    StreamL7DataPtrInit(&ssn);

    int r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START, dcerpcbind, bindlen);
    if (r != 0) {
        printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
        result = 0;
        goto end;
    }

    DCERPCState *dcerpc_state = ssn.aldata[AlpGetStateIdx(ALPROTO_DCERPC)];
    if (dcerpc_state == NULL) {
        printf("no dcerpc state: ");
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.rpc_vers != 5) {
        printf("expected dcerpc version 0x05, got 0x%02x : ",
                dcerpc_state->dcerpc.dcerpchdr.rpc_vers);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.type != BIND) {
        printf("expected dcerpc type 0x%02x , got 0x%02x : ", BIND, dcerpc_state->dcerpc.dcerpchdr.type);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1084) {
        printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1084, dcerpc_state->dcerpc.dcerpchdr.frag_length);
        result = 0;
        goto end;
    }

    r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpcbindack, bindacklen);
    if (r != 0) {
        printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
        result = 0;
        goto end;
    }
    if (dcerpc_state->dcerpc.dcerpchdr.type != BIND_ACK) {
        printf("expected dcerpc type 0x%02x , got 0x%02x : ", BIND_ACK, dcerpc_state->dcerpc.dcerpchdr.type);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 620) {
        printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 620, dcerpc_state->dcerpc.dcerpchdr.frag_length);
        result = 0;
        goto end;
    }
    TAILQ_FOREACH(uuid_entry, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) {
        printUUID("BIND_ACK", uuid_entry);
    }

    r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_EOF, dcerpcrequest, requestlen);
    if (r != 0) {
        printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
        result = 0;
        goto end;
    }
    if (dcerpc_state->dcerpc.dcerpchdr.type != REQUEST) {
        printf("expected dcerpc type 0x%02x , got 0x%02x : ", REQUEST, dcerpc_state->dcerpc.dcerpchdr.type);
        result = 0;
        goto end;
    }
end:
    StreamL7DataPtrFree(&ssn);
    StreamTcpFreeConfig(TRUE);
    return result;
}

/** \test DCERPC Request decoding and opnum parsing.
*/
int DCERPCParserTest02(void) {
    int result = 1;
    Flow f;
    uint8_t dcerpcrequest[] = {
        0x05, 0x00, 0x00, 0x00, 0x10,
        0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b,
        0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00, 0x4d,
        0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a,
        0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58,
        0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41,
        0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48,
        0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60,
        0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b,
        0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24,
        0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68,
        0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c,
        0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61,
        0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d,
        0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67,
        0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45,
        0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c,
        0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e,
        0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73,
        0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e,
        0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41,
        0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71,
        0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35,
        0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37,
        0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37,
        0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69,
        0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72,
        0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e,
        0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31,
        0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b,
        0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e,
        0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f,
        0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59,
        0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e,
        0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79,
        0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49,
        0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72,
        0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24,
        0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27,
        0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e,
        0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28,
        0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64,
        0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30,
        0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e,
        0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52,
        0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56,
        0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30,
        0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38,
        0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42,
        0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c,
        0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f,
        0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41,
        0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27,
        0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30,
        0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e,
        0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72,
        0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b,
        0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b,
        0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56,
        0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61,
        0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58,
        0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b,
        0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52,
        0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65,
        0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74,
        0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61,
        0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a,
        0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68,
        0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f,
        0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32,
        0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f,
        0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51,
        0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48,
        0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25,
        0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32,
        0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40,
        0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50,
        0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38,
        0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c,
        0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a,
        0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76,
        0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75,
        0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33,
        0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71,
        0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67,
        0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b,
        0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23,
        0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51,
        0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b,
        0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65,
        0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f,
        0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a,
        0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f,
        0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59,
        0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46,
        0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e,
        0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45,
        0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e,
        0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75,
        0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29,
        0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78,
        0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b,
        0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f,
        0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68,
        0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53,
        0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36,
        0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75,
        0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55,
        0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73,
        0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e,
        0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d,
        0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f,
        0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63,
        0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61,
        0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c,
        0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b,
        0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37,
        0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a,
        0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a,
        0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a,
        0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b,
        0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c,
        0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b,
        0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22,
        0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44,
        0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c,
        0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70,
        0x00, 0x69, 0x00};
    uint32_t requestlen = sizeof(dcerpcrequest);

    TcpSession ssn;

    memset(&f, 0, sizeof(f));
    memset(&ssn, 0, sizeof(ssn));
    f.protoctx = (void *)&ssn;

    StreamTcpInitConfig(TRUE);
    StreamL7DataPtrInit(&ssn);

    int r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START, dcerpcrequest, requestlen);
    if (r != 0) {
        printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
        result = 0;
        goto end;
    }

    DCERPCState *dcerpc_state = ssn.aldata[AlpGetStateIdx(ALPROTO_DCERPC)];
    if (dcerpc_state == NULL) {
        printf("no dcerpc state: ");
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.rpc_vers != 5) {
        printf("expected dcerpc version 0x05, got 0x%02x : ",
                dcerpc_state->dcerpc.dcerpchdr.rpc_vers);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.type != REQUEST) {
        printf("expected dcerpc type 0x%02x , got 0x%02x : ", REQUEST, dcerpc_state->dcerpc.dcerpchdr.type);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1024) {
        printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1024, dcerpc_state->dcerpc.dcerpchdr.frag_length);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 9) {
        printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 9, dcerpc_state->dcerpc.dcerpcrequest.opnum);
        result = 0;
        goto end;
    }

end:
    StreamL7DataPtrFree(&ssn);
    StreamTcpFreeConfig(TRUE);
    return result;
}

/** \test Test endianness handling
*/
int DCERPCParserTest03(void) {
    int result = 1;
    Flow f;
    uint8_t dcerpcrequest[] = {
        0x05, 0x00, 0x00, 0x00, 0x01,
        0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x00,
        0x0b, 0x00, 0x09, 0x45, 0x00, 0x2c, 0x00, 0x4d,
        0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a,
        0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58,
        0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41,
        0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48,
        0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60,
        0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b,
        0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24,
        0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68,
        0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c,
        0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61,
        0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d,
        0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67,
        0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45,
        0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c,
        0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e,
        0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73,
        0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e,
        0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41,
        0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71,
        0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35,
        0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37,
        0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37,
        0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69,
        0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72,
        0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e,
        0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31,
        0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b,
        0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e,
        0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f,
        0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59,
        0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e,
        0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79,
        0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49,
        0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72,
        0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24,
        0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27,
        0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e,
        0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28,
        0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64,
        0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30,
        0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e,
        0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52,
        0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56,
        0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30,
        0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38,
        0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42,
        0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c,
        0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f,
        0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41,
        0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27,
        0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30,
        0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e,
        0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72,
        0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b,
        0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b,
        0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56,
        0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61,
        0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58,
        0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b,
        0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52,
        0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65,
        0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74,
        0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61,
        0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a,
        0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68,
        0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f,
        0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32,
        0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f,
        0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51,
        0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48,
        0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25,
        0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32,
        0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40,
        0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50,
        0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38,
        0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c,
        0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a,
        0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76,
        0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75,
        0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33,
        0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71,
        0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67,
        0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b,
        0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23,
        0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51,
        0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b,
        0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65,
        0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f,
        0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a,
        0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f,
        0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59,
        0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46,
        0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e,
        0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45,
        0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e,
        0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75,
        0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29,
        0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78,
        0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b,
        0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f,
        0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68,
        0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53,
        0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36,
        0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75,
        0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55,
        0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73,
        0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e,
        0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d,
        0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f,
        0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63,
        0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61,
        0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c,
        0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b,
        0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37,
        0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a,
        0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a,
        0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a,
        0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b,
        0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c,
        0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b,
        0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22,
        0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44,
        0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c,
        0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70,
        0x00, 0x69, 0x00};
    uint32_t requestlen = sizeof(dcerpcrequest);

    TcpSession ssn;

    memset(&f, 0, sizeof(f));
    memset(&ssn, 0, sizeof(ssn));
    f.protoctx = (void *)&ssn;

    StreamTcpInitConfig(TRUE);
    StreamL7DataPtrInit(&ssn);

    int r = AppLayerParse(&f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START, dcerpcrequest, requestlen);
    if (r != 0) {
        printf("dcerpc header check returned %" PRId32 ", expected 0: ", r);
        result = 0;
        goto end;
    }

    DCERPCState *dcerpc_state = ssn.aldata[AlpGetStateIdx(ALPROTO_DCERPC)];
    if (dcerpc_state == NULL) {
        printf("no dcerpc state: ");
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] != 0x01) {
        printf("expected dcerpc data representation 0x01, got 0x%02x : ",
                dcerpc_state->dcerpc.dcerpchdr.packed_drep[0]);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1024) {
        printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1024, dcerpc_state->dcerpc.dcerpchdr.frag_length);
        result = 0;
        goto end;
    }

    if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 9) {
        printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 9, dcerpc_state->dcerpc.dcerpcrequest.opnum);
        result = 0;
        goto end;
    }
end:
    StreamL7DataPtrFree(&ssn);
    StreamTcpFreeConfig(TRUE);
    return result;
}

void DCERPCParserRegisterTests(void) {
    printf("DCERPCParserRegisterTests\n");
    UtRegisterTest("DCERPCParserTest01", DCERPCParserTest01, 1);
    UtRegisterTest("DCERPCParserTest02", DCERPCParserTest02, 1);
    UtRegisterTest("DCERPCParserTest03", DCERPCParserTest03, 1);
}
#endif