aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dcerpc: add interface-service name data

Browse Source 
This data directly comes from Zeek @d11a8750. It was scriptually
converted to NDJSON ingestible to Suricata using serde and serde_json.
The script used for this conversion lives in
scripts/extract_dce_rpc_interfaces.py.

Part of this data within Zeek codebase comes from the MITRE BZAR
project. Hence, the LICENSE file alongwith this data consists of both
the licenses: Zeek and BZAR.

Feature 2727
Feature 8523
pull/16017/head
Shivani Bhardwaj 1 month ago committed by Victor Julien
parent cee102c76d
commit 35d28272b2
3 changed files with 354 additions and 0 deletions
Show Stats Download Patch File Download Diff File

64
rust/src/dcerpc/data/LICENSE
Unescape Escape View File

@ -0,0 +1,64 @@
Copyright (c) 1995-now, The Regents of the University of California
through the Lawrence Berkeley National Laboratory and the
International Computer Science Institute. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
(1) Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
(2) Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
(3) Neither the name of the University of California, Lawrence Berkeley
National Laboratory, U.S. Dept. of Energy, International Computer
Science Institute, nor the names of contributors may be used to endorse
or promote products derived from this software without specific prior
written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
Note that some files in the distribution may carry their own copyright
notices.
-----------------------------------------------------------------------------
Copyright 2018 The MITRE Corporation. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
(1) Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
(2) Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
(3) Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

224
rust/src/dcerpc/data/dcerpc_interfaces.json
Unescape Escape View File

@ -0,0 +1,224 @@
{"uuid": "00000000-0000-0000-c000-000000000046", "service": "IUnknown", "opcodes": {"0": "Opnum0NotUsedOnWire", "1": "Opnum1NotUsedOnWire", "2": "Opnum2NotUsedOnWire"}}
{"uuid": "00000131-0000-0000-c000-000000000046", "service": "IRemUnknown", "opcodes": {"3": "RemQueryInterface", "4": "RemAddRef", "5": "RemRelease"}}
{"uuid": "00000143-0000-0000-c000-000000000046", "service": "IRemUnknown2", "opcodes": {"0": "QueryInterface", "1": "AddRef", "2": "Release", "3": "RemQueryInterface", "4": "RemAddRef", "5": "RemRelease", "6": "RemQueryInterface2"}}
{"uuid": "000001a0-0000-0000-c000-000000000046", "service": "IRemoteSCMActivator", "opcodes": {"0": "QueryInterfaceIRemoteSCMActivator", "1": "AddRefIRemoteISCMActivator", "2": "ReleaseIRemoteISCMActivator", "3": "RemoteGetClassObject", "4": "RemoteCreateInstance"}}
{"uuid": "00020400-0000-0000-c000-000000000046", "service": "IDispatch", "opcodes": {"3": "GetTypeInfoCount", "4": "GetTypeInfo", "5": "GetIDsOfNames", "6": "Invoke"}}
{"uuid": "00020401-0000-0000-c000-000000000046", "service": "ITypeInfo", "opcodes": {"3": "GetTypeAttr", "4": "GetTypeComp", "5": "GetFuncDesc", "6": "GetVarDesc", "7": "GetNames", "8": "GetRefTypeOfImplType", "9": "GetImplTypeFlags", "12": "GetDocumentation", "13": "GetDllEntry", "14": "GetRefTypeInfo", "16": "CreateInstance", "17": "GetMops", "18": "GetContainingTypeLib"}}
{"uuid": "00020402-0000-0000-c000-000000000046", "service": "ITypeLib"}
{"uuid": "00020403-0000-0000-c000-000000000046", "service": "ITypeComp"}
{"uuid": "00020404-0000-0000-c000-000000000046", "service": "IEnumVARIANT"}
{"uuid": "00020411-0000-0000-c000-000000000046", "service": "ITypeLib2"}
{"uuid": "00020412-0000-0000-c000-000000000046", "service": "ITypeInfo2"}
{"uuid": "01954e6b-9254-4e6e-808c-c9e05d007696", "service": "IVssEnumMgmtObject", "opcodes": {"3": "Next", "4": "Skip", "5": "Reset", "6": "Clone"}}
{"uuid": "027947e1-d731-11ce-a357-000000000001", "service": "IEnumWbemClassObject interface", "opcodes": {"3": "Reset", "4": "Next", "5": "NextAsync", "6": "Clone", "7": "Skip"}}
{"uuid": "034634fd-ba3f-11d1-856a-00a0c944138c", "service": "IManageTelnetSessions", "opcodes": {"7": "GetTelnetSessions", "8": "TerminateSession", "9": "SendMsgToASession"}}
{"uuid": "038374ff-098b-11d8-9414-505054503030", "service": "IDataCollector"}
{"uuid": "03837502-098b-11d8-9414-505054503030", "service": "IDataCollectorCollection"}
{"uuid": "03837506-098b-11d8-9414-505054503030", "service": "IPerformanceCounterDataCollector"}
{"uuid": "0383750b-098b-11d8-9414-505054503030", "service": "ITraceDataCollector"}
{"uuid": "03837510-098b-11d8-9414-505054503030", "service": "ITraceDataProviderCollection"}
{"uuid": "03837512-098b-11d8-9414-505054503030", "service": "ITraceDataProvider"}
{"uuid": "03837514-098b-11d8-9414-505054503030", "service": "IConfigurationDataCollector"}
{"uuid": "03837516-098b-11d8-9414-505054503030", "service": "IAlertDataCollector"}
{"uuid": "0383751a-098b-11d8-9414-505054503030", "service": "IApiTracingDataCollector"}
{"uuid": "03837520-098b-11d8-9414-505054503030", "service": "IDataCollectorSet"}
{"uuid": "03837524-098b-11d8-9414-505054503030", "service": "IDataCollectorSetCollection"}
{"uuid": "03837533-098b-11d8-9414-505054503030", "service": "IValueMapItem"}
{"uuid": "03837534-098b-11d8-9414-505054503030", "service": "IValueMap"}
{"uuid": "0383753a-098b-11d8-9414-505054503030", "service": "ISchedule"}
{"uuid": "0383753d-098b-11d8-9414-505054503030", "service": "IScheduleCollection"}
{"uuid": "03837541-098b-11d8-9414-505054503030", "service": "IDataManager"}
{"uuid": "03837543-098b-11d8-9414-505054503030", "service": "IFolderAction"}
{"uuid": "03837544-098b-11d8-9414-505054503030", "service": "IFolderActionCollection"}
{"uuid": "081e7188-c080-4ff3-9238-29f66d6cabfd", "service": "IMessenger"}
{"uuid": "0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53", "service": "idletask", "opcodes": {"0": "ItSrvRegisterIdleTask", "1": "ItSrvUnregisterIdleTask", "2": "ItSrvProcessIdleTasks", "3": "ItSrvSetDetectionParameters"}}
{"uuid": "0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7", "service": "authzr", "opcodes": {"0": "AuthzrFreeContext", "1": "AuthzrInitializeContextFromSid", "2": "AuthrzInitializeCompoundContext", "3": "AuthrzAccessCheck", "4": "AuthrzGetInformationFromContext", "5": "AuthrzModifyClaims", "6": "AuthrzModifySids"}}
{"uuid": "0b6edbfa-4a24-4fc6-8a23-942b1eca65d1", "service": "IRPCAsyncNotify"}
{"uuid": "0d72a7d4-6148-11d1-b4aa-00c04fb66ea0", "service": "ICertProtect", "opcodes": {"0": "SSCertProtectFunction"}}
{"uuid": "1088a980-eae5-11d0-8d9b-00a02453c337", "service": "qm2qm"}
{"uuid": "112b1dff-d9dc-41f7-869f-d67fee7cb591", "service": "ITpmVirtualSmartCardManager", "opcodes": {"3": "CreateVirtualSmartCard", "4": "DestroyVirtualSmartCard"}}
{"uuid": "11899a43-2b68-4a76-92e3-a3d6ad8c26ce", "service": "TermServNotification", "opcodes": {"0": "RpcWaitForSessionState", "1": "RpcRegisterAsyncNotification", "2": "RpcWaitAsyncNotification", "3": "RpcUnRegisterAsyncNotification"}}
{"uuid": "12345678-1234-abcd-ef00-0123456789ab", "service": "spoolss", "opcodes": {"0": "RpcEnumPrinters", "1": "RpcOpenPrinter", "2": "RpcSetJob", "3": "RpcGetJob", "4": "RpcEnumJobs", "5": "RpcAddPrinter", "6": "RpcDeletePrinter", "7": "RpcSetPrinter", "8": "RpcGetPrinter", "9": "RpcAddPrinterDriver", "10": "RpcEnumPrinterDrivers", "11": "RpcGetPrinterDriver", "12": "RpcGetPrinterDriverDirectory", "13": "RpcDeletePrinterDriver", "14": "RpcAddPrintProcessor", "15": "RpcEnumPrintProcessors", "16": "RpcGetPrintProcessorDirectory", "17": "RpcStartDocPrinter", "18": "RpcStartPagePrinter", "19": "RpcWritePrinter", "20": "RpcEndPagePrinter", "21": "RpcAbortPrinter", "22": "RpcReadPrinter", "23": "RpcEndDocPrinter", "24": "RpcAddJob", "25": "RpcScheduleJob", "26": "RpcGetPrinterData", "27": "RpcSetPrinterData", "28": "RpcWaitForPrinterChange", "29": "RpcClosePrinter", "30": "RpcAddForm", "31": "RpcDeleteForm", "32": "RpcGetForm", "33": "RpcSetForm", "34": "RpcEnumForms", "35": "RpcEnumPorts", "36": "RpcEnumMonitors", "37": "RpcAddPort", "38": "RpcConfigurePort", "39": "RpcDeletePort", "40": "RpcCreatePrinterIC", "41": "RpcPlayGdiScriptOnPrinterIC", "42": "RpcDeletePrinterIC", "43": "RpcAddPrinterConnection", "44": "RpcDeletePrinterConnection", "45": "RpcPrinterMessageBox", "46": "RpcAddMonitor", "47": "RpcDeleteMonitor", "48": "RpcDeletePrintProcessor", "49": "RpcAddPrintProvidor", "50": "RpcDeletePrintProvidor", "51": "RpcEnumPrintProcessorDatatypes", "52": "RpcResetPrinter", "53": "RpcGetPrinterDriver2", "54": "RpcClientFindFirstPrinterChangeNotification", "55": "RpcFindNextPrinterChangeNotification", "56": "RpcFindClosePrinterChangeNotification", "57": "RpcRouterFindFirstPrinterChangeNotificationOld", "58": "RpcReplyOpenPrinter", "59": "RpcRouterReplyPrinter", "60": "RpcReplyClosePrinter", "61": "RpcAddPortEx", "62": "RpcRemoteFindFirstPrinterChangeNotification", "63": "RpcSpoolerInit", "64": "RpcResetPrinterEx", "65": "RpcRemoteFindFirstPrinterChangeNotificationEx", "66": "RpcRouterReplyPrinterEx", "67": "RpcRouterRefreshPrinterChangeNotification", "68": "RpcSetAllocFailCount", "69": "RpcSplOpenPrinter", "70": "RpcAddPrinterEx", "71": "RpcSetPort", "72": "RpcEnumPrinterData", "73": "RpcDeletePrinterData", "74": "RpcClusterSplOpen", "75": "RpcClusterSplClose", "76": "RpcClusterSplIsAlive", "77": "RpcSetPrinterDataEx", "78": "RpcGetPrinterDataEx", "79": "RpcEnumPrinterDataEx", "80": "RpcEnumPrinterKey", "81": "RpcDeletePrinterDataEx", "82": "RpcDeletePrinterKey", "83": "RpcSeekPrinter", "84": "RpcDeletePrinterDriverEx", "85": "RpcAddPerMachineConnection", "86": "RpcDeletePerMachineConnection", "87": "RpcEnumPerMachineConnections", "88": "RpcXcvData", "89": "RpcAddPrinterDriverEx", "90": "RpcSplOpenPrinter", "91": "RpcGetSpoolFileInfo", "92": "RpcCommitSpoolData", "93": "RpcCloseSpoolFileHandle", "94": "RpcFlushPrinter", "95": "RpcSendRecvBidiData", "96": "RpcAddDriverCatalog", "97": "RpcAddPrinterConnection2", "98": "RpcDeletePrinterConnection2", "99": "RpcInstallPrinterDriverFromPackage", "100": "RpcUploadPrinterDriverPackage", "101": "RpcGetCorePrinterDrivers", "102": "RpcCorePrinterDriverInstalled", "103": "RpcGetPrinterDriverPackagePath", "104": "RpcReportJobProcessingProgress", "110": "RpcGetJobNamedPropertyValue", "111": "RpcSetJobNamedProperty", "112": "RpcDeleteJobNamedProperty", "113": "RpcEnumJobNamedProperties", "116": "RpcLogJobInfoForBranchOffice"}}
{"uuid": "12345678-1234-abcd-ef00-01234567cffb", "service": "netlogon", "opcodes": {"0": "NetrLogonUasLogon", "1": "NetrLogonUasLogoff", "2": "NetrLogonSamLogon", "3": "NetrLogonSamLogoff", "4": "NetrServerReqChallenge", "5": "NetrServerAuthenticate", "6": "NetrServerPasswordSet", "7": "NetrDatabaseDeltas", "8": "NetrDatabaseSync", "9": "NetrAccountDeltas", "10": "NetrAccountSync", "11": "NetrGetDCName", "12": "NetrLogonControl", "13": "NetrGetAnyDCName", "14": "NetrLogonControl2", "15": "NetrServerAuthenticate2", "16": "NetrDatabaseSync2", "17": "NetrDatabaseRedo", "18": "NetrLogonControl2Ex", "19": "NetrEnumerateTrustedDomains", "20": "DsrGetDcName", "21": "NetrLogonGetCapabilities", "22": "NetrLogonSetServiceBits", "23": "NetrLogonGetTrustRid", "24": "NetrLogonComputeServerDigest", "25": "NetrLogonComputeClientDigest", "26": "NetrServerAuthenticate3", "27": "DsrGetDcNameEx", "28": "DsrGetSiteName", "29": "NetrLogonGetDomainInfo", "30": "NetrServerPasswordSet2", "31": "NetrServerPasswordGet", "32": "NetrLogonSendToSam", "33": "DsrAddressToSiteNamesW", "34": "DsrGetDcNameEx2", "35": "NetrLogonGetTimeServiceParentDomain", "36": "NetrEnumerateTrustedDomainsEx", "37": "DsrAddressToSiteNamesExW", "38": "DsrGetDcSiteCoverageW", "39": "NetrLogonSamLogonEx", "40": "DsrEnumerateDomainTrusts", "41": "DsrDeregisterDnsHostRecords", "42": "NetrServerTrustPasswordsGet", "43": "DsrGetForestTrustInformation", "44": "NetrGetForestTrustInformation", "45": "NetrLogonSamLogonWithFlags", "46": "NetrServerGetTrustInfo", "47": "unused", "48": "DsrUpdateReadOnlyServerDnsRecords", "49": "NetrChainSetClientAttributes"}}
{"uuid": "12345778-1234-abcd-ef00-0123456789ab", "service": "lsarpc", "opcodes": {"0": "LsarClose", "1": "LsarDelete", "2": "LsarEnumeratePrivileges", "3": "LsarQuerySecurityObject", "4": "LsarSetSecurityObject", "5": "LsarChangePassword", "6": "LsarOpenPolicy", "7": "LsarQueryInformationPolicy", "8": "LsarSetInformationPolicy", "9": "LsarClearAuditLog", "10": "LsarCreateAccount", "11": "LsarEnumerateAccounts", "12": "LsarCreateTrustedDomain", "13": "LsarEnumerateTrustedDomains", "14": "LsarLookupNames", "15": "LsarLookupSids", "16": "LsarCreateSecret", "17": "LsarOpenAccount", "18": "LsarEnumeratePrivilegesAccount", "19": "LsarAddPrivilegesToAccount", "20": "LsarRemovePrivilegesFromAccount", "21": "LsarGetQuotasForAccount", "22": "LsarSetQuotasForAccount", "23": "LsarGetSystemAccessAccount", "24": "LsarSetSystemAccessAccount", "25": "LsarOpenTrustedDomain", "26": "LsarQueryInfoTrustedDomain", "27": "LsarSetInformationTrustedDomain", "28": "LsarOpenSecret", "29": "LsarSetSecret", "30": "LsarQuerySecret", "31": "LsarLookupPrivilegeValue", "32": "LsarLookupPrivilegeName", "33": "LsarLookupPrivilegeDisplayName", "34": "LsarDeleteObject", "35": "LsarEnumerateAccountsWithUserRight", "36": "LsarEnumerateAccountRights", "37": "LsarAddAccountRights", "38": "LsarRemoveAccountRights", "39": "LsarQueryTrustedDomainInfo", "40": "LsarSetTrustedDomainInfo", "41": "LsarDeleteTrustedDomain", "42": "LsarStorePrivateData", "43": "LsarRetrievePrivateData", "44": "LsarOpenPolicy2", "45": "LsarGetUserName", "46": "LsarQueryInformationPolicy2", "47": "LsarSetInformationPolicy2", "48": "LsarQueryTrustedDomainInfoByName", "49": "LsarSetTrustedDomainInfoByName", "50": "LsarEnumerateTrustedDomainsEx", "51": "LsarCreateTrustedDomainEx", "52": "LsarCloseTrustedDomainEx", "53": "LsarQueryDomainInformationPolicy", "54": "LsarSetDomainInformationPolicy", "55": "LsarOpenTrustedDomainByName", "56": "LsarTestCall", "57": "LsarLookupSids2", "58": "LsarLookupNames2", "59": "LsarCreateTrustedDomainEx2", "60": "CredrWrite", "61": "CredrRead", "62": "CredrEnumerate", "63": "CredrWriteDomainCredentials", "64": "CredrReadDomainCredentials", "65": "CredrDelete", "66": "CredrGetTargetInfo", "67": "CredrProfileLoaded", "68": "LsarLookupNames3", "69": "CredrGetSessionTypes", "70": "LsarRegisterAuditEvent", "71": "LsarGenAuditEvent", "72": "LsarUnregisterAuditEvent", "73": "LsarQueryForestTrustInformation", "74": "LsarSetForestTrustInformation", "75": "CredrRename", "76": "LsarLookupSids3", "77": "LsarLookupNames4", "78": "LsarOpenPolicySce", "79": "LsarAdtRegisterSecurityEventSource", "80": "LsarAdtUnregisterSecurityEventSource", "81": "LsarAdtReportSecurityEvent", "82": "CredrFindBestCredential", "83": "LsarSetAuditPolicy", "84": "LsarQueryAuditPolicy", "85": "LsarEnumerateAuditPolicy", "86": "LsarEnumerateAuditCategories", "87": "LsarEnumerateAuditSubCategories", "88": "LsarLookupAuditCategoryName", "89": "LsarLookupAuditSubCategoryName", "90": "LsarSetAuditSecurity", "91": "LsarQueryAuditSecurity", "92": "CredReadByTokenHandle", "93": "CredrRestoreCredentials", "94": "CredrBackupCredentials", "129": "LsarCreateTrustedDomainEx3", "130": "LsarOpenPolicy3", "133": "LsarSetForestTrustInformation2"}}
{"uuid": "12345778-1234-abcd-ef00-0123456789ac", "service": "samr", "opcodes": {"0": "SamrConnect", "1": "SamrCloseHandle", "2": "SamrSetSecurityObject", "3": "SamrQuerySecurityObject", "4": "SamrShutdownSamServer", "5": "SamrLookupDomainInSamServer", "6": "SamrEnumerateDomainsInSamServer", "7": "SamrOpenDomain", "8": "SamrQueryInformationDomain", "9": "SamrSetInformationDomain", "10": "SamrCreateGroupInDomain", "11": "SamrEnumerateGroupsInDomain", "12": "SamrCreateUserInDomain", "13": "SamrEnumerateUsersInDomain", "14": "SamrCreateAliasInDomain", "15": "SamrEnumerateAliasesInDomain", "16": "SamrGetAliasMembership", "17": "SamrLookupNamesInDomain", "18": "SamrLookupIdsInDomain", "19": "SamrOpenGroup", "20": "SamrQueryInformationGroup", "21": "SamrSetInformationGroup", "22": "SamrAddMemberToGroup", "23": "SamrDeleteGroup", "24": "SamrRemoveMemberFromGroup", "25": "SamrGetMembersInGroup", "26": "SamrSetMemberAttributesOfGroup", "27": "SamrOpenAlias", "28": "SamrQueryInformationAlias", "29": "SamrSetInformationAlias", "30": "SamrDeleteAlias", "31": "SamrAddMemberToAlias", "32": "SamrRemoveMemberFromAlias", "33": "SamrGetMembersInAlias", "34": "SamrOpenUser", "35": "SamrDeleteUser", "36": "SamrQueryInformationUser", "37": "SamrSetInformationUser", "38": "SamrChangePasswordUser", "39": "SamrGetGroupsForUser", "40": "SamrQueryDisplayInformation", "41": "SamrGetDisplayEnumerationIndex", "42": "SamrTestPrivateFunctionsDomain", "43": "SamrTestPrivateFunctionsUser", "44": "SamrGetUserDomainPasswordInformation", "45": "SamrRemoveMemberFromForeignDomain", "46": "SamrQueryInformationDomain2", "47": "SamrQueryInformationUser2", "48": "SamrQueryDisplayInformation2", "49": "SamrGetDisplayEnumerationIndex2", "50": "SamrCreateUser2InDomain", "51": "SamrQueryDisplayInformation3", "52": "SamrAddMultipleMembersToAlias", "53": "SamrRemoveMultipleMembersFromAlias", "54": "SamrOemChangePasswordUser2", "55": "SamrUnicodeChangePasswordUser2", "56": "SamrGetDomainPasswordInformation", "57": "SamrConnect2", "58": "SamrSetInformationUser2", "59": "SamrSetBootKeyInformation", "60": "SamrGetBootKeyInformation", "61": "SamrConnect3", "62": "SamrConnect4", "63": "SamrUnicodeChangePasswordUser3", "64": "SamrConnect5", "65": "SamrRidToSid", "66": "SamrSetDSRMPassword", "67": "SamrValidatePassword", "68": "SamrQueryLocalizableAccountsInDomain", "69": "SamrPerformGenericOperation", "73": "SamrUnicodeChangePasswordUser4"}}
{"uuid": "1257b580-ce2f-4109-82d6-a9459d0bf6bc", "service": "SessEnvPublicRpc", "opcodes": {"0": "RpcShadow2"}}
{"uuid": "12b81e99-f207-4a4c-85d3-77b42f76fd14", "service": "ISeclogon", "opcodes": {"0": "SeclCreateProcessWithLogonW", "1": "SeclCreateProcessWithLogonExW"}}
{"uuid": "135698d2-3a37-4d26-99df-e2bb6ae3ac61", "service": "IVolumeClient3", "opcodes": {"3": "EnumDisksEx", "4": "EnumDiskRegionsEx", "5": "CreatePartition", "6": "CreatePartitionAssignAndFormat", "7": "CreatePartitionAssignandFormatEx", "8": "DeletePartition", "9": "InitializeDiskStyle", "10": "MarkActivePartition", "11": "Eject", "12": "Opnum12NotUsedOnWire", "13": "FTEnumVolumes", "14": "FTEnumLogicalDiskMembers", "15": "FTDeleteVolume", "16": "FTBreakMirror", "17": "FTResyncMirror", "18": "FTRegenerateParityStripe", "19": "FTReplaceMirrorPartition", "20": "FTReplaceParityStripePartition", "21": "EnumDriveLetters", "22": "AssignDriveLetter", "23": "FreeDriveLetter", "24": "EnumLocalFileSystems", "25": "GetInstalledFileSystems", "26": "Format", "27": "EnumVolumes", "28": "EnumVolumeMembers", "29": "CreateVolume", "30": "CreateVolumeAssignAndFormat", "31": "CreateVolumeAssignAndFormatEx", "32": "GetVolumeMountName", "33": "GrowVolume", "34": "DeleteVolume", "35": "CreatePartitionsForVolume", "36": "DeletePartitionsForVolume", "37": "GetMaxAdjustedFreeSpace", "38": "AddMirror", "39": "RemoveMirror", "40": "SplitMirror", "41": "InitializeDiskEx", "42": "UninitializeDisk", "43": "ReConnectDisk", "44": "ImportDiskGroup", "45": "DiskMergeQuery", "46": "DiskMerge", "47": "ReAttachDisk", "48": "ReplaceRaid5Column", "49": "RestartVolume", "50": "GetEncapsulateDiskInfoEx", "51": "EncapsulateDiskEx", "52": "QueryChangePartitionNumbers", "53": "DeletePartitionNumberInfoFromRegistry", "54": "SetDontShow", "55": "GetDontShow", "56": "Opnum56NotUsedOnWire", "57": "Opnum57NotUsedOnWire", "58": "Opnum58NotUsedOnWire", "59": "Opnum59NotUsedOnWire", "60": "Opnum60NotUsedOnWire", "61": "Opnum61NotUsedOnWire", "62": "Opnum62NotUsedOnWire", "63": "Opnum63NotUsedOnWire", "64": "EnumTasks", "65": "GetTaskDetail", "66": "AbortTask", "67": "HrGetErrorData", "68": "Initialize", "69": "Uninitialize", "70": "Refresh", "71": "RescanDisks", "72": "RefreshFileSys", "73": "SecureSystemPartition", "74": "ShutDownSystem", "75": "EnumAccessPath", "76": "EnumAccessPathForVolume", "77": "AddAccessPath", "78": "DeleteAccessPath"}}
{"uuid": "1544f5e0-613c-11d1-93df-00c04fd7bd09", "service": "exchange_rfr"}
{"uuid": "17fdd703-1827-4e34-79d4-24a55c53bb37", "service": "msgsvc", "opcodes": {"0": "NetrMessageNameAdd", "1": "NetrMessageNameEnum", "2": "NetrMessageNameGetInfo", "3": "NetrMessageNameDel"}}
{"uuid": "1a1bb35f-abb8-451c-a1ae-33d98f1bef4a", "service": "ITpmVirtualSmartCardManagerStatusCallback", "opcodes": {"3": "ReportProgress", "4": "ReportError"}}
{"uuid": "1a9134dd-7b39-45ba-ad88-44d01ca47f28", "service": "RemoteRead"}
{"uuid": "1a927394-352e-4553-ae3f-7cf4aafca620", "service": "WdsRpcInterface", "opcodes": {"0": "WdsRpcMessage"}}
{"uuid": "1c1c45ee-4395-11d2-b60b-00104b703efd", "service": "IWbemFetchSmartEnum interface"}
{"uuid": "1ff70682-0a51-30e8-076d-740be8cee98b", "service": "atsvc", "opcodes": {"0": "NetrJobAdd", "1": "NetrJobDel", "2": "NetrJobEnum", "3": "NetrJobGetInfo"}}
{"uuid": "20610036-fa22-11cf-9823-00a0c911e5df", "service": "rasrpc"}
{"uuid": "20d15747-6c48-4254-a358-65039fd8c63c", "service": "IServerHealthReport2", "opcodes": {"9": "GetReport", "16": "GetCompressedReport"}}
{"uuid": "214a0f28-b737-4026-b847-4f9e37d79529", "service": "IVssDifferentialSoftwareSnapshotMgmt", "opcodes": {"3": "AddDiffArea", "4": "ChangeDiffAreaMaximizeSize", "5": "QueryVolumesSupportedForDiffAreas", "6": "QueryDiffAreasForVolume", "7": "QueryDiffAreaOnVolume", "8": "Opnum08NotUsedOnWire"}}
{"uuid": "21546ae8-4da5-445e-987f-627fea39c5e8", "service": "IWRMConfig", "opcodes": {"7": "GetConfig", "8": "SetConfig", "9": "IsEnabled", "10": "EnableDisable", "11": "GetExclusionList", "12": "SetExclusionList", "13": "WSRMActivate", "14": "IsWSRMActivated", "15": "RestoreExclusionList"}}
{"uuid": "22e5386d-8b12-4bf0-b0ec-6a1ea419e366", "service": "NetEventForwarder", "opcodes": {"0": "RpcNetEventOpenSession", "1": "RpcNetEventReceiveData", "2": "RpcNetEventCloseSession"}}
{"uuid": "29822ab7-f302-11d0-9953-00c04fd919c1", "service": "IWamAdmin", "opcodes": {"3": "AppCreate", "4": "AppDelete", "5": "AppUnLoad", "6": "AppGetStatus", "7": "AppDeleteRecoverable", "8": "AppRecover"}}
{"uuid": "29822ab8-f302-11d0-9953-00c04fd919c1", "service": "IWamAdmin2", "opcodes": {"9": "AppCreate2"}}
{"uuid": "2a3eb639-d134-422d-90d8-aaa1b5216202", "service": "IResourceManager2", "opcodes": {"7": "ExportObjects", "8": "GetImportConflicts", "9": "ImportXml", "10": "ExportXml"}}
{"uuid": "2c9273e0-1dc3-11d3-b364-00105a1f8177", "service": "IWbemRefreshingServices interface"}
{"uuid": "2f59a331-bf7d-48cb-9ec5-7c090d76e8b8", "service": "lcrpc", "opcodes": {"0": "RpcLicensingOpenServer", "1": "RpcLicensingCloseServer", "2": "RpcLicensingLoadPolicy", "3": "RpcLicensingUnloadPolicy", "4": "RpcLicensingSetPolicy", "5": "RpcLicensingGetAvailablePolicyIds", "6": "RpcLicensingGetPolicy", "7": "RpcLicensingGetPolicyInformation", "8": "RpcLicensingDeactivateCurrentPolicy"}}
{"uuid": "2f5f3220-c126-1076-b549-074d078619da", "service": "nddeapi", "opcodes": {"0": "NDdeShareAddW", "1": "NDdeShareDelA", "2": "NDdeShareDelW", "3": "NDdeGetShareSecurityA", "4": "NDdeGetShareSecurityW", "5": "NDdeSetShareSecurityA", "6": "NDdeSetShareSecurityW", "7": "NDdeShareEnumA", "8": "NDdeShareEnumW", "9": "NDdeShareGetInfoW", "10": "NDdeShareSetInfoW", "11": "NDdeSetTrustedShareA", "12": "NDdeSetTrustedShareW", "13": "NDdeGetTrustedShareA", "14": "NDdeGetTrustedShareW", "15": "NDdeTrustedShareEnumA", "16": "NDdeTrustedShareEnumW", "18": "NDdeSpecialCommand"}}
{"uuid": "2f5f6520-ca46-1067-b319-00dd010662da", "service": "tapsrv", "opcodes": {"0": "ClientAttach", "1": "ClientRequest", "2": "ClientDetach"}}
{"uuid": "2f5f6521-ca47-1068-b319-00dd010662db", "service": "remotesp", "opcodes": {"0": "RemoteSPAttach", "1": "RemoteSPEventProc", "2": "RemoteSPDetach"}}
{"uuid": "300f3532-38cc-11d0-a3f0-0020af6b0add", "service": "trkwks", "opcodes": {"0": "Opnum0NotUsedOnWire", "1": "Opnum1NotUsedOnWire", "2": "Opnum2NotUsedOnWire", "3": "Opnum3NotUsedOnWire", "4": "Opnum4NotUsedOnWire", "5": "Opnum5NotUsedOnWire", "6": "Opnum6NotUsedOnWire", "7": "Opnum7NotUsedOnWire", "8": "Opnum8NotUsedOnWire", "9": "Opnum9NotUsedOnWire", "10": "Opnum10NotUsedOnWire", "11": "Opnum11NotUsedOnWire", "12": "LnkSearchMachine"}}
{"uuid": "338cd001-2244-31f1-aaaa-900038001003", "service": "winreg", "opcodes": {"0": "OpenClassesRoot", "1": "OpenCurrentUser", "2": "OpenLocalMachine", "3": "OpenPerformanceData", "4": "OpenUsers", "5": "BaseRegCloseKey", "6": "BaseRegCreateKey", "7": "BaseRegDeleteKey", "8": "BaseRegDeleteValue", "9": "BaseRegEnumKey", "10": "BaseRegEnumValue", "11": "BaseRegFlushKey", "12": "BaseRegGetKeySecurity", "13": "BaseRegLoadKey", "14": "BaseRegNotifyChangeKeyValue", "15": "BaseRegOpenKey", "16": "BaseRegQueryInfoKey", "17": "BaseRegQueryValue", "18": "BaseRegReplaceKey", "19": "BaseRegRestoreKey", "20": "BaseRegSaveKey", "21": "BaseRegSetKeySecurity", "22": "BaseRegSetValue", "23": "BaseRegUnLoadKey", "24": "BaseInitiateSystemShutdown", "25": "BaseAbortSystemShutdown", "26": "BaseRegGetVersion", "27": "OpenCurrentConfig", "28": "OpenDynData", "29": "BaseRegQueryMultipleValues", "30": "BaseInitiateSystemShutdownEx", "31": "BaseRegSaveKeyEx", "32": "OpenPerformanceText", "33": "OpenPerformanceNlsText", "34": "BaseRegQueryMultipleValues2", "35": "BaseRegDeleteKeyEx"}}
{"uuid": "342cfd40-3c6c-11ce-a893-08002b2e9c6d", "service": "llsrpc", "opcodes": {"0": "LlsrConnect", "1": "LlsrClose", "2": "LlsrLicenseEnumW", "3": "LlsrLicenseEnumA", "4": "LlsrLicenseAddW", "5": "LlsrLicenseAddA", "6": "LlsrProductEnumW", "7": "LlsrProductEnumA", "8": "LlsrProductAddW", "9": "LlsrProductAddA", "10": "LlsrProductUserEnumW", "11": "LlsrProductUserEnumA", "12": "LlsrProductServerEnumW", "13": "LlsrProductServerEnumA", "14": "LlsrProductLicenseEnumW", "15": "LlsrProductLicenseEnumA", "16": "LlsrUserEnumW", "17": "LlsrUserEnumA", "18": "LlsrUserInfoGetW", "19": "LlsrUserInfoGetA", "20": "LlsrUserInfoSetW", "21": "LlsrUserInfoSetA", "22": "LlsrUserDeleteW", "23": "LlsrUserDeleteA", "24": "LlsrUserProductEnumW", "25": "LlsrUserProductEnumA", "26": "LlsrUserProductDeleteW", "27": "LlsrUserProductDeleteA", "28": "LlsrMappingEnumW", "29": "LlsrMappingEnumA", "30": "LlsrMappingInfoGetW", "31": "LlsrMappingInfoGetA", "32": "LlsrMappingInfoSetW", "33": "LlsrMappingInfoSetA", "34": "LlsrMappingUserEnumW", "35": "LlsrMappingUserEnumA", "36": "LlsrMappingUserAddW", "37": "LlsrMappingUserAddA", "38": "LlsrMappingUserDeleteW", "39": "LlsrMappingUserDeleteA", "40": "LlsrMappingAddW", "41": "LlsrMappingAddA", "42": "LlsrMappingDeleteW", "43": "LlsrMappingDeleteA", "44": "LlsrServerEnumW", "45": "LlsrServerEnumA", "46": "LlsrServerProductEnumW", "47": "LlsrServerProductEnumA", "48": "LlsrLocalProductEnumW", "49": "LlsrLocalProductEnumA", "50": "LlsrLocalProductInfoGetW", "51": "LlsrLocalProductInfoGetA", "52": "LlsrLocalProductInfoSetW", "53": "LlsrLocalProductInfoSetA", "54": "LlsrServiceInfoGetW", "55": "LlsrServiceInfoGetA", "56": "LlsrServiceInfoSetW", "57": "LlsrServiceInfoSetA", "58": "LlsrReplConnect", "59": "LlsrReplClose", "60": "LlsrReplicationRequestW", "61": "LlsrReplicationServerAddW", "62": "LlsrReplicationServerServiceAddW", "63": "LlsrReplicationServiceAddW", "64": "LlsrReplicationUserAddW", "65": "LlsrProductSecurityGetW", "66": "LlsrProductSecurityGetA", "67": "LlsrProductSecuritySetW", "68": "LlsrProductSecuritySetA", "69": "LlsrProductLicensesGetA", "70": "LlsrProductLicensesGetW", "71": "LlsrCertificateClaimEnumA", "72": "LlsrCertificateClaimEnumW", "73": "LlsrCertificateClaimAddCheckA", "74": "LlsrCertificateClaimAddCheckW", "75": "LlsrCertificateClaimAddA", "76": "LlsrCertificateClaimAddW", "77": "LlsrReplicationCertDbAddW", "78": "LlsrReplicationProductSecurityAddW", "79": "LlsrReplicationUserAddExW", "80": "LlsrCapabilityGet", "81": "LlsrLocalServiceEnumW", "82": "LlsrLocalServiceEnumA", "83": "LlsrLocalServiceAddA", "84": "LlsrLocalServiceAddW", "85": "LlsrLocalServiceInfoSetW", "86": "LlsrLocalServiceInfoSetA", "87": "LlsrLocalServiceInfoGetW", "88": "LlsrLocalServiceInfoGetA", "89": "LlsrCloseEx"}}
{"uuid": "367abb81-9844-35f1-ad32-98f038001003", "service": "svcctl", "opcodes": {"0": "CloseServiceHandle", "1": "ControlService", "2": "DeleteService", "3": "LockServiceDatabase", "4": "QueryServiceObjectSecurity", "5": "SetServiceObjectSecurity", "6": "QueryServiceStatus", "7": "SetServiceStatus", "8": "UnlockServiceDatabase", "9": "NotifyBootConfigStatus", "10": "ScSetServiceBitsW", "11": "ChangeServiceConfigW", "12": "CreateServiceW", "13": "EnumDependentServicesW", "14": "EnumServicesStatusW", "15": "OpenSCManagerW", "16": "OpenServiceW", "17": "QueryServiceConfigW", "18": "QueryServiceLockStatusW", "19": "StartServiceW", "20": "GetServiceDisplayNameW", "21": "GetServiceKeyNameW", "22": "ScSetServiceBitsA", "23": "ChangeServiceConfigA", "24": "CreateServiceA", "25": "EnumDependentServicesA", "26": "EnumServicesStatusA", "27": "OpenSCManagerA", "28": "OpenServiceA", "29": "QueryServiceConfigA", "30": "QueryServiceLockStatusA", "31": "StartServiceA", "32": "GetServiceDisplayNameA", "33": "GetServiceKeyNameA", "34": "ScGetCurrentGroupStateW", "35": "EnumServiceGroupW", "36": "ChangeServiceConfig2A", "37": "ChangeServiceConfig2W", "38": "QueryServiceConfig2A", "39": "QueryServiceConfig2W", "40": "QueryServiceStatusEx", "41": "EnumServicesStatusExA", "42": "EnumServicesStatusExW", "43": "ScSendTSMessage", "44": "CreateServiceWOW64A", "45": "CreateServiceWOW64W", "46": "ScQueryServiceTagInfo", "47": "NotifyServiceStatusChange", "48": "GetNotifyResult", "49": "CloseNotifyHandle", "50": "ControlServiceExA", "51": "ControlServiceExW", "52": "ScSendPnPMessage", "53": "ScValidatePnPService", "54": "ScOpenServiceStatusHandle", "56": "QueryServiceConfigEx", "60": "CreateWowService", "64": "OpenSCManager2"}}
{"uuid": "378e52b0-c0a9-11cf-822d-00aa0051e40f", "service": "sasec", "opcodes": {"0": "SASetAccountInformation", "1": "SASetNSAccountInformation", "2": "SAGetNSAccountInformation", "3": "SAGetAccountInformation"}}
{"uuid": "3919286a-b10c-11d0-9ba8-00c04fd92ef5", "service": "dssetup", "opcodes": {"0": "DsRolerGetPrimaryDomainInformation", "1": "DsRolerDnsNameToFlatName", "2": "DsRolerDcAsDc", "3": "DsRolerDcAsReplica", "4": "DsRolerDemoteDc", "5": "DsRolerGetDcOperationProgress", "6": "DsRolerGetDcOperationResults", "7": "DsRolerCancel", "8": "DsRolerServerSaveStateForUpgrade", "9": "DsRolerUpgradeDownlevelServer", "10": "DsRolerAbortDownlevelServerUpgrade"}}
{"uuid": "3a410f21-553f-11d1-8e5e-00a0c92c9d5d", "service": "IDMRemoteServer", "opcodes": {"3": "CreateRemoteObject"}}
{"uuid": "3bbed8d9-2c9a-4b21-8936-acb2f995be6c", "service": "INtmsObjectManagement3"}
{"uuid": "3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5", "service": "RpcSrvDHCPC", "opcodes": {"0": "RpcSrvEnableDhcp", "1": "RpcSrvRenewLease", "2": "RpcSrvRenewLeaseByBroadcast", "3": "RpcSrvReleaseLease", "4": "RpcSrvSetFallbackParams", "5": "RpcSrvGetFallbackParams", "6": "RpcSrvFallbackRefreshParams", "7": "RpcSrvStaticRefreshParams", "8": "RpcSrvRemoveDnsRegistrations", "9": "RpcSrvRequestParams", "10": "RpcSrvPersistentRequestParams", "11": "RpcSrvRegisterParams", "12": "RpcSrvDeRegisterParams", "13": "RpcSrvEnumInterfaces", "14": "RpcSrvQueryLeaseInfo", "15": "RpcSrvSetClassId", "16": "RpcSrvGetClassId", "17": "RpcSrvSetClientId", "18": "RpcSrvGetClientId", "19": "RpcSrvNotifyMediaReconnected", "20": "RpcSrvGetOriginalSubnetMask", "21": "RpcSrvSetMSFTVendorSpecificOptions", "22": "RpcSrvRequestCachedParams", "23": "RpcSrvRegisterConnectionStateNotification", "24": "RpcSrvDeRegisterConnectionStateNotification", "25": "RpcSrvGetNotificationStatus", "26": "RpcSrvGetDhcpServicedConnections"}}
{"uuid": "3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6", "service": "dhcpcsvc6", "opcodes": {"0": "RpcSrvRequestPrefix", "1": "RpcSrvRenewPrefix", "2": "RpcSrvReleasePrefix", "3": "RpcSrvRequestParams"}}
{"uuid": "3c745a97-f375-4150-be17-5950f694c699", "service": "ITpmVirtualSmartCardManager3", "opcodes": {"6": "CreateVirtualSmartCardWithAttestation"}}
{"uuid": "3d267954-eeb7-11d1-b94e-00c04fa3080d", "service": "HydraLsPipe"}
{"uuid": "3dde7c30-165d-11d1-ab8f-00805f14db40", "service": "BackupKey", "opcodes": {"0": "bkrp_BackupKey"}}
{"uuid": "3faf4738-3a21-4307-b46c-fdda9bb8c0d5", "service": "AudioSrv", "opcodes": {"0": "gfxCreateZoneFactoriesList", "1": "gfxCreateGfxFactoriesList", "2": "gfxCreateGfxList", "3": "gfxRemoveGfx", "4": "gfxAddGfx", "5": "gfxModifyGx", "6": "gfxOpenGfx", "7": "gfxLogon", "8": "gfxLogoff", "9": "winmmRegisterSessionNotificationEvent", "10": "winmmUnregisterSessionNotification", "11": "winmmSessionConnectState", "12": "wdmDriverOpenDrvRegKey", "13": "winmmAdvisePreferredDeviceChange", "14": "winmmGetPnpInfo"}}
{"uuid": "41208ee0-e970-11d1-9b9e-00e02c064c39", "service": "qmmgmt"}
{"uuid": "423ec01e-2e35-11d2-b604-00104b703efd", "service": "IWbemWCOSmartEnum interface"}
{"uuid": "44aca674-e8fc-11d0-a07c-00c04fb68820", "service": "IWbemContext interface"}
{"uuid": "44aca675-e8fc-11d0-a07c-00c04fb68820", "service": "IWbemCallResult interface"}
{"uuid": "44e265dd-7daf-42cd-8560-3cdb6e7a2729", "service": "TsProxyRpcInterface", "opcodes": {"0": "Opnum0NotUsedOnWire", "1": "TsProxyCreateTunnel", "2": "TsProxyAuthorizeTunnel", "3": "TsProxyMakeTunnelCall", "4": "TsProxyCreateChannel", "5": "Opnum5NotUsedOnWire", "6": "TsProxyCloseChannel", "7": "TsProxyCloseTunnel", "8": "TsProxySetupReceivePipe", "9": "TsProxySendToServer"}}
{"uuid": "4590f812-1d3a-11d0-891f-00aa004b2e24", "service": "IWbemClassObject unmarshaler"}
{"uuid": "45f52c28-7f9f-101a-b52b-08002b2efabe", "service": "winspipe", "opcodes": {"0": "R_WinsRecordAction", "1": "R_WinsStatus", "2": "R_WinsTrigger", "3": "R_WinsDoStaticInit", "4": "R_WinsDoScavenging", "5": "R_WinsGetDbRecs", "6": "R_WinsTerm", "7": "R_WinsBackup", "8": "R_WinsDelDbRecs", "9": "R_WinsPullRange", "10": "R_WinsSetPriorityClass", "11": "R_WinsResetCounters", "12": "R_WinsWorkerThdUpd", "13": "R_WinsGetNameAndAdd", "14": "R_WinsGetBrowserNames_Old", "15": "R_WinsDeleteWins", "16": "R_WinsSetFlags", "17": "R_WinsGetBrowserNames", "18": "R_WinsGetDbRecsByName", "19": "R_WinsStatusNew", "20": "R_WinsStatusWHdl", "21": "R_WinsDoScavengingNew"}}
{"uuid": "481e06cf-ab04-4498-8ffe-124a0a34296d", "service": "IWRMCalendar", "opcodes": {"7": "GetCalendarInfo", "8": "CreateCalendar", "9": "ModifyCalendar", "10": "DeleteCalendar", "11": "RenameCalendar", "12": "ComputeEvents", "13": "GetScheduleInfo", "14": "CreateSchedule", "15": "ModifySchedule", "16": "DeleteSchedule", "17": "RenameSchedule", "18": "MoveBeforeCalendar", "19": "MoveAfterCalendar", "20": "GetServerTimeZone"}}
{"uuid": "484809d6-4239-471b-b5bc-61df8c23ac48", "service": "TermSrvSession", "opcodes": {"0": "RpcWaitForSessionState", "1": "RpcRegisterAsyncNotification", "2": "RpcWaitAsyncNotification", "3": "RpcUnRegisterAsyncNotification"}}
{"uuid": "497d95a6-2d27-4bf5-9bbd-a6046957133c", "service": "RCMListener", "opcodes": {"0": "RpcOpenListener", "1": "RpcCloseListener", "2": "RpcStopListener", "3": "RpcStartListener", "4": "RpcIsListening"}}
{"uuid": "4b112204-0e19-11d3-b42b-0000f81feb9f", "service": "ssdpsrv", "opcodes": {"0": "RegisterServiceRpc", "1": "DeregisterServiceRpcByUSN", "2": "DeregisterServiceRpc", "3": "UpdateCacheRpc", "4": "LookupCacheRpc", "5": "CleanupCacheRpc", "6": "InitializeSyncHandle", "7": "RemoveSyncHandle", "8": "RegisterNotificationRpc", "9": "GetNotificationRpc", "10": "WakeupGetNotificationRpc", "11": "DeregisterNotificationRpc", "12": "EnableDeviceHost", "13": "DisableDeviceHost", "14": "SetICSInterfaces", "15": "SetICSOff"}}
{"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188", "service": "srvsvc", "opcodes": {"0": "NetrCharDevEnum", "1": "NetrCharDevGetInfo", "2": "NetrCharDevControl", "3": "NetrCharDevQEnum", "4": "NetrCharDevQGetInfo", "5": "NetrCharDevQSetInfo", "6": "NetrCharDevQPurge", "7": "NetrCharDevQPurgeSelf", "8": "NetrConnectionEnum", "9": "NetrFileEnum", "10": "NetrFileGetInfo", "11": "NetrFileClose", "12": "NetrSessionEnum", "13": "NetrSessionDel", "14": "NetrShareAdd", "15": "NetrShareEnum", "16": "NetrShareGetInfo", "17": "NetrShareSetInfo", "18": "NetrShareDel", "19": "NetrShareDelSticky", "20": "NetrShareCheck", "21": "NetrServerGetInfo", "22": "NetrServerSetInfo", "23": "NetrServerDiskEnum", "24": "NetrServerStatisticsGet", "25": "NetrServerTransportAdd", "26": "NetrServerTransportEnum", "27": "NetrServerTransportDel", "28": "NetrRemoteTOD", "29": "NetrServerSetServiceBits", "30": "NetprPathType", "31": "NetprPathCanonicalize", "32": "NetprPathCompare", "33": "NetprNameValidate", "34": "NetprNameCanonicalize", "35": "NetprNameCompare", "36": "NetrShareEnumSticky", "37": "NetrShareDelStart", "38": "NetrShareDelCommit", "39": "NetrpGetFileSecurity", "40": "NetrpSetFileSecurity", "41": "NetrServerTransportAddEx", "42": "NetrServerSetServiceBitsEx", "43": "NetrDfsGetVersion", "44": "NetrDfsCreateLocalPartition", "45": "NetrDfsDeleteLocalPartition", "46": "NetrDfsSetLocalVolumeState", "47": "NetrDfsSetServerInfo", "48": "NetrDfsCreateExitPoint", "49": "NetrDfsDeleteExitPoint", "50": "NetrDfsModifyPrefix", "51": "NetrDfsFixLocalVolume", "52": "NetrDfsManagerReportSiteInfo", "53": "NetrServerTransportDelEx", "55": "NetrServerAliasEnum", "56": "NetrServerAliasDel", "57": "NetrShareDelEx"}}
{"uuid": "4bb8ab1d-9ef9-4100-8eb6-dd4b4e418b72", "service": "IADProxy", "opcodes": {"3": "CreateObject", "4": "DeleteObject", "5": "ModifyObject"}}
{"uuid": "4bdafc52-fe6a-11d2-93f8-00105a11164a", "service": "IVolumeClient2", "opcodes": {"3": "GetMaxAdjustedFreeSpace"}}
{"uuid": "4d9f4ab8-7d1c-11cf-861e-0020af6e7c57", "service": "IActivation", "opcodes": {"0": "RemoteActivation"}}
{"uuid": "4da1c422-943d-11d1-acae-00c04fc2aa3f", "service": "trksvr", "opcodes": {"0": "LnkSvrMessage", "1": "LnkSvrMessageCallback"}}
{"uuid": "4e934f30-341a-11d1-8fb1-00a024cb6019", "service": "INtmsLibraryControl1"}
{"uuid": "4f7ca01c-a9e5-45b6-b142-2332a1339c1d", "service": "IWRMAccounting", "opcodes": {"7": "CreateAccountingDb", "8": "GetAccountingMetadata", "9": "ExecuteAccountingQuery", "10": "GetRawAccountingData", "11": "GetNextAccountingDataBatch", "12": "DeleteAccountingData", "13": "DefragmentDB", "14": "CancelAccountingQuery", "15": "RegisterAccountingClient", "16": "DumpAccountingData", "17": "GetAccountingClients", "18": "SetAccountingClientStatus", "19": "CheckAccountingConnection", "20": "SetClientPermissions"}}
{"uuid": "4fc742e0-4a10-11cf-8273-00aa004ae673", "service": "netdfs", "opcodes": {"0": "NetrDfsManagerGetVersion", "1": "NetrDfsAdd", "2": "NetrDfsRemove", "3": "NetrDfsSetInfo", "4": "NetrDfsGetInfo", "5": "NetrDfsEnum", "6": "NetrDfsRename", "7": "NetrDfsMove", "8": "NetrDfsManagerGetConfigInfo", "9": "NetrDfsManagerSendSiteInfo", "10": "NetrDfsAddFtRoot", "11": "NetrDfsRemoveFtRoot", "12": "NetrDfsAddStdRoot", "13": "NetrDfsRemoveStdRoot", "14": "NetrDfsManagerInitialize", "15": "NetrDfsAddStdRootForced", "16": "NetrDfsGetDcAddress", "17": "NetrDfsSetDcAddress", "18": "NetrDfsFlushFtTable", "19": "NetrDfsAdd2", "20": "NetrDfsRemove2", "21": "NetrDfsEnumEx", "22": "NetrDfsSetInfo2", "23": "NetrDfsAddRootTarget", "24": "NetrDfsRemoveRootTarget", "25": "NetrDfsGetSupportedNamespaceVersion"}}
{"uuid": "50abc2a4-574d-40b3-9d66-ee4fd5fba076", "service": "dnsserver", "opcodes": {"0": "DnssrvOperation", "1": "DnssrvQuery", "2": "DnssrvComplexOperation", "3": "DnssrvEnumRecords", "4": "DnssrvUpdateRecord", "5": "DnssrvOperation2", "6": "DnssrvQuery2", "7": "DnssrvComplexOperation2", "8": "DnssrvEnumRecords2", "9": "DnssrvUpdateRecord2", "10": "DnssrvUpdateRecord3", "11": "DnssrvEnumRecords3", "12": "DnssrvOperation3", "13": "DnssrvQuery3", "14": "DnssrvComplexOperation3", "15": "DnssrvOperation4", "16": "DnssrvQuery4", "17": "DnssrvUpdateRecord4", "18": "DnssrvEnumRecords4"}}
{"uuid": "51c82175-844e-4750-b0d8-ec255555bc06", "service": "KMS"}
{"uuid": "5261574a-4572-206e-b268-6b199213b4e4", "service": "AsyncEMSMDB"}
{"uuid": "53b46b02-c73b-4a3e-8dee-b16b80672fc0", "service": "TSVIPPublic", "opcodes": {"0": "RpcGetSessionIP"}}
{"uuid": "541679ab-2e5f-11d3-b34e-00104bcc4b4a", "service": "IWbemLoginHelper interface"}
{"uuid": "5422fd3a-d4b8-4cef-a12e-e87d4ca22e90", "service": "ICertRequestD2", "opcodes": {"3": "Request", "4": "GetCACert", "5": "Ping", "6": "Request2", "7": "GetCAProperty", "8": "GetCAPropertyInfo", "9": "Ping2"}}
{"uuid": "57674cd0-5200-11ce-a897-08002b2e9c6d", "service": "lls_license", "opcodes": {"0": "LlsrLicenseRequestW", "1": "LlsrLicenseFree"}}
{"uuid": "59602eb6-57b0-4fd8-aa4b-ebf06971fe15", "service": "IWRMPolicy", "opcodes": {"7": "GetPolicyInfo", "8": "CreatePolicy", "9": "ModifyPolicy", "10": "DeletePolicy", "11": "RenameAllocationPolicy", "12": "MoveBefore", "13": "MoveAfter", "14": "SetCalDefaultPolicyName", "15": "GetCalDefaultPolicyName", "16": "GetProcessList", "17": "GetCurrentPolicy", "18": "SetCurrentPolicy", "19": "GetCurrentStateAndActivePolicyName", "20": "GetConditionalPolicy", "21": "SetConditionalPolicy"}}
{"uuid": "5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc", "service": "msgsvcsend", "opcodes": {"0": "NetrSendMessage"}}
{"uuid": "5b821720-f63b-11d0-aad2-00c04fc324db", "service": "dhcpsrv2", "opcodes": {"0": "R_DhcpEnumSubnetClientsV5", "1": "R_DhcpSetMScopeInfo", "2": "R_DhcpGetMScopeInfo", "3": "R_DhcpEnumMScopes", "4": "R_DhcpAddMScopeElement", "5": "R_DhcpEnumMScopeElements", "6": "R_DhcpRemoveMScopeElement", "7": "R_DhcpDeleteMScope", "8": "R_DhcpScanMDatabase", "9": "R_DhcpCreateMClientInfo", "10": "R_DhcpSetMClientInfo", "11": "R_DhcpGetMClientInfo", "12": "R_DhcpDeleteMClientInfo", "13": "R_DhcpEnumMScopeClients", "14": "R_DhcpCreateOptionV5", "15": "R_DhcpSetOptionInfoV5", "16": "R_DhcpGetOptionInfoV5", "17": "R_DhcpEnumOptionsV5", "18": "R_DhcpRemoveOptionV5", "19": "R_DhcpSetOptionValueV5", "20": "R_DhcpSetOptionValuesV5", "21": "R_DhcpGetOptionValueV5", "22": "R_DhcpEnumOptionValuesV5", "23": "R_DhcpRemoveOptionValueV5", "24": "R_DhcpCreateClass", "25": "R_DhcpModifyClass", "26": "R_DhcpDeleteClass", "27": "R_DhcpGetClassInfo", "28": "R_DhcpEnumClasses", "29": "R_DhcpGetAllOptions", "30": "R_DhcpGetAllOptionValues", "31": "R_DhcpGetMCastMibInfo", "32": "R_DhcpAuditLogSetParams", "33": "R_DhcpAuditLogGetParams", "34": "R_DhcpServerQueryAttribute", "35": "R_DhcpServerQueryAttributes", "36": "R_DhcpServerRedoAuthorization", "37": "R_DhcpAddSubnetElementV5", "38": "R_DhcpEnumSubnetElementsV5", "39": "R_DhcpRemoveSubnetElementV5", "40": "R_DhcpGetServerBindingInfo", "41": "R_DhcpSetServerBindingInfo", "42": "R_DhcpQueryDnsRegCredentials", "43": "R_DhcpSetDnsRegCredentials", "44": "R_DhcpBackupDatabase", "45": "R_DhcpRestoreDatabase", "46": "R_DhcpGetServerSpecificStrings", "47": "R_DhcpCreateOptionV6", "48": "R_DhcpSetOptionInfoV6", "49": "R_DhcpGetOptionInfoV6", "50": "R_DhcpEnumOptionsV6", "51": "R_DhcpRemoveOptionV6", "52": "R_DhcpSetOptionValueV6", "53": "R_DhcpEnumOptionValuesV6", "54": "R_DhcpRemoveOptionValueV6", "55": "R_DhcpGetAllOptionsV6", "56": "R_DhcpGetAllOptionValuesV6", "57": "R_DhcpCreateSubnetV6", "58": "R_DhcpEnumSubnetsV6", "59": "R_DhcpAddSubnetElementV6", "60": "R_DhcpEnumSubnetElementsV6", "61": "R_DhcpRemoveSubnetElementV6", "62": "R_DhcpDeleteSubnetV6", "63": "R_DhcpGetSubnetInfoV6", "64": "R_DhcpEnumSubnetClientsV6", "65": "R_DhcpServerSetConfigV6", "66": "R_DhcpServerGetConfigV6", "67": "R_DhcpGetMibInfoV6", "69": "R_DhcpGetServerBindingInfoV6", "70": "R_DhcpSetServerBindingInfoV6", "71": "R_DhcpSetClientInfoV6", "72": "R_DhcpGetClientInfoV6", "73": "R_DhcpDeleteClientInfoV6", "74": "R_DhcpCreateClassV6", "75": "R_DhcpModifyClassV6", "76": "R_DhcpDeleteClassV6", "77": "R_DhcpEnumClassesV6", "78": "R_DhcpGetOptionValueV6", "79": "R_DhcpSetSubnetDelayOffer", "80": "R_DhcpGetSubnetDelayOffer", "81": "R_DhcpGetMibInfoV5", "82": "R_DhcpAddFilterV4", "83": "R_DhcpDeleteFilterV4", "84": "R_DhcpSetFilterV4", "85": "R_DhcpGetFilterV4", "86": "R_DhcpEnumFilterV4", "87": "R_DhcpSetDnsRegCredentialsV5", "88": "R_DhcpEnumSubnetClientsFilterStatusInfo", "89": "R_DhcpV4FailoverCreateRelationship", "90": "R_DhcpV4FailoverSetRelationship", "91": "R_DhcpV4FailoverDeleteRelationship", "92": "R_DhcpV4FailoverGetRelationship", "93": "R_DhcpV4FailoverEnumRelationship", "94": "R_DhcpV4FailoverAddScopeToRelationship", "95": "R_DhcpV4FailoverDeleteScopeFromRelationship", "96": "R_DhcpV4FailoverGetScopeRelationship", "97": "R_DhcpV4FailoverGetScopeStatistics", "98": "R_DhcpV4FailoverGetClientInfo", "99": "R_DhcpV4FailoverGetSystemTime", "100": "R_DhcpV4FailoverTriggerAddrAllocation", "101": "R_DhcpV4SetOptionValue", "102": "R_DhcpV4SetOptionValues", "103": "R_DhcpV4GetOptionValue", "104": "R_DhcpV4RemoveOptionValue", "105": "R_DhcpV4GetAllOptionValues", "106": "R_DhcpV4QueryPolicyEnforcement", "107": "R_DhcpSetPolicyEnforcement", "108": "R_DhcpV4CreatePolicy", "109": "R_DhcpV4GetPolicy", "110": "R_DhcpV4SetPolicy", "111": "R_DhcpV4DeletePolicy", "112": "R_DhcpV4EnumPolicies", "113": "R_DhcpV4AddPolicyRange", "114": "R_DhcpV4RemovePolicyRange", "115": "R_DhcpV4EnumSubnetClients", "116": "R_DhcpV6SetStatelessStoreParams", "117": "R_DhcpV6GetStatelessStoreParams", "118": "R_DhcpV6GetStatelessStatistics", "119": "R_DhcpV4EnumSubnetReservations", "120": "R_DhcpV4GetFreeIPAddress", "121": "R_DhcpV6GetFreeIPAddress", "122": "R_DhcpV4CreateClientInfo", "123": "R_DhcpV4GetClientInfo", "124": "R_DhcpV6CreateClientInfo", "125": "R_DhcpV4FailoverGetAddressStatus", "126": "R_DhcpV4CreatePolicyEx", "127": "R_DhcpV4GetPolicyEx", "128": "R_DhcpV4SetPolicyEx", "129": "R_DhcpV4EnumPoliciesEx", "130": "R_DhcpV4EnumSubnetClientsEx", "131": "R_DhcpV4CreateClientInfoEx", "132": "R_DhcpV4GetClientInfoEx"}}
{"uuid": "5ca4a760-ebb1-11cf-8611-00a0245420ed", "service": "winstation_rpc", "opcodes": {"0": "RpcWinStationOpenServer", "1": "RpcWinStationCloseServer", "2": "RpcIcaServerPing", "3": "RpcWinStationEnumerate", "4": "RpcWinStationRename", "5": "RpcWinStationQueryInformation", "6": "RpcWinStationSetInformation", "7": "RpcWinStationSendMessage", "8": "RpcLogonIdFromWinStationName", "9": "RpcWinStationNameFromLogonId", "10": "RpcWinStationConnect", "11": "RpcWinStationVirtualOpen", "12": "RpcWinStationBeepOpen", "13": "RpcWinStationDisconnect", "14": "RpcWinStationReset", "15": "RpcWinStationShutdownSystem", "16": "RpcWinStationWaitSystemEvent", "17": "RpcWinStationShadow", "18": "RpcWinStationShadowTargetSetup", "19": "RpcWinStationShadowTarget", "20": "RpcWinStationGenerateLicense", "21": "RpcWinStationInstallLicense", "22": "RpcWinStationEnumerateLicenses", "23": "RpcWinStationActivateLicense", "24": "RpcWinStationRemoveLicense", "25": "RpcWinStationQueryLicense", "26": "RpcWinStationSetPoolCount", "27": "RpcWinStationQueryUpdateRequired", "28": "RpcWinStationCallback", "29": "RpcWinStationGetApplicationInfo", "30": "RpcWinStationReadRegistry", "31": "RpcWinStationWaitForConnect", "32": "RpcWinStationNotifyLogon", "33": "RpcWinStationNotifyLogoff", "34": "RpcWinStationEnumerateProcesses", "35": "RpcWinStationAnnoyancePopup", "36": "RpcWinStationEnumerateProcesses", "37": "RpcWinStationTerminateProcess", "38": "RpcServerNWLogonSetAdmin", "39": "RpcServerNWLogonQueryAdmin", "40": "RpcWinStationNtsdDebug", "41": "RpcWinStationBreakPoint", "42": "RpcWinStationCheckForApplicationName", "43": "RpcWinStationGetAllProcesses", "44": "RpcWinStationGetProcessSid", "45": "RpcWinStationGetTermSrvCountersValue", "46": "RpcWinStationReInitializeSecurity", "47": "RpcWinStationBroadcastSystemMessage", "48": "RpcWinStationSendWindowMessage", "49": "RpcWinStationNotifyNewSession", "50": "RpcServerGetInternetConnectorStatus", "51": "RpcServerSetInternetConnectorStatus", "52": "RpcServerQueryInetConnectorInformation", "53": "RpcWinStationGetLanAdapterName", "54": "RpcWinStationUpdateUserConfig", "55": "RpcWinStationQueryLogonCredentials", "56": "RpcWinStationRegisterConsoleNotification", "57": "RpcWinStationUnRegisterConsoleNotification", "58": "RpcWinStationUpdateSettings", "59": "RpcWinStationShadowStop", "60": "RpcWinStationCloseServerEx", "61": "RpcWinStationIsHelpAssistantSession", "62": "RpcWinStationGetMachinePolicy", "63": "RpcWinStationUpdateClientCachedCredentials", "64": "RpcWinStationFUSCanRemoteUserDisconnect", "65": "RpcWinStationCheckLoopBack", "66": "RpcConnectCallback", "67": "RpcWinStationNotifyDisconnectPipe", "68": "RpcWinStationSessionInitialized", "69": "RpcRemoteAssistancePrepareSystemRestore", "70": "RpcWinStationGetAllProcesses_NT6", "71": "RpcWinStationRegisterNotificationEvent", "72": "RpcWinStationUnRegisterNotificationEvent", "73": "RpcWinStationAutoReconnect", "74": "RpcWinStationCheckAccess", "75": "RpcWinStationOpenSessionDirectory"}}
{"uuid": "5ff9bdf6-bd91-4d8b-a614-d6317acc8dd8", "service": "IRemoteSstpCertCheck"}
{"uuid": "6099fc12-3eff-11d0-abd0-00c04fd91a4e", "service": "faxclient"}
{"uuid": "6139d8a4-e508-4ebb-bac7-d7f275145897", "service": "IRemoteIPV6Config"}
{"uuid": "6619a740-8154-43be-a186-0319578e02db", "service": "IRemoteDispatch", "opcodes": {"7": "RemoteDispatchAutoDone", "8": "RemoteDispatchNotAutoDone"}}
{"uuid": "66a2db1b-d706-11d0-a37b-00c04fc9da04", "service": "IRemoteNetworkConfig"}
{"uuid": "66a2db20-d706-11d0-a37b-00c04fc9da04", "service": "IRemoteRouterRestart"}
{"uuid": "66a2db21-d706-11d0-a37b-00c04fc9da04", "service": "IRemoteSetDnsConfig"}
{"uuid": "66a2db22-d706-11d0-a37b-00c04fc9da04", "service": "IRemoteICFICSConfig"}
{"uuid": "674b6698-ee92-11d0-ad71-00c04fd8fdff", "service": "IWbemContext unmarshaler"}
{"uuid": "67e08fc2-2984-4b62-b92e-fc1aae64bbbb", "service": "IRemoteStringIdConfig"}
{"uuid": "68b58241-c259-4f03-a2e5-a2651dcbc930", "service": "IKeySvc2", "opcodes": {"0": "KSrSubmitRequest", "1": "KSrGetTemplates", "2": "KSrGetCAs"}}
{"uuid": "69ab7050-3059-11d1-8faf-00a024cb6019", "service": "INtmsObjectInfo1"}
{"uuid": "6b5bdd1e-528c-422c-af8c-a4079be4fe48", "service": "RemoteFW", "opcodes": {"0": "RRPC_FWOpenPolicyStore", "1": "RRPC_FWClosePolicyStore", "2": "RRPC_FWRestoreDefaults", "3": "RRPC_FWGetGlobalConfig", "4": "RRPC_FWSetGlobalConfig", "5": "RRPC_FWAddFirewallRule", "6": "RRPC_FWSetFirewallRule", "7": "RRPC_FWDeleteFirewallRule", "8": "RRPC_FWDeleteAllFirewallRules", "9": "RRPC_FWEnumFirewallRules", "10": "RRPC_FWGetConfig", "11": "RRPC_FWSetConfig", "12": "RRPC_FWAddConnectionSecurityRule", "13": "RRPC_FWSetConnectionSecurityRule", "14": "RRPC_FWDeleteConnectionSecurityRule", "15": "RRPC_FWEnumConnectionSecurityRules", "16": "RRPC_FWEnumConnectionSecurityRules", "17": "RRPC_FWAddAuthenticationSet", "18": "RRPC_FWSetAuthenticationSet", "19": "RRPC_FWDeleteAuthenticationSet", "20": "RRPC_FWDeleteAllAuthenticationSets", "21": "RRPC_FWEnumAuthenticationSets", "22": "RRPC_FWAddCryptoSet", "23": "RRPC_FWSetCryptoSet", "24": "RRPC_FWDeleteCryptoSet", "25": "RRPC_FWDeleteAllCryptoSets", "26": "RRPC_FWEnumCryptoSets", "27": "RRPC_FWEnumPhase1SAs", "28": "RRPC_FWEnumPhase2SAs", "29": "RRPC_FWDeletePhase1SAs", "30": "RRPC_FWDeletePhase2SAs", "31": "RRPC_FWEnumProducts", "32": "RRPC_FWAddMainModeRule", "33": "RRPC_FWSetMainModeRule", "34": "RRPC_FWDeleteMainModeRule", "35": "RRPC_FWDeleteAllMainModeRules", "36": "RRPC_FWEnumMainModeRules", "37": "RRPC_FWQueryFirewallRules", "38": "RRPC_FWQueryConnectionSecurityRules", "39": "RRPC_FWQueryMainModeRules", "40": "RRPC_FWQueryAuthenticationSets", "41": "RRPC_FWQueryCryptoSets", "42": "RRPC_FWEnumNetworks", "43": "RRPC_FWEnumAdapters", "44": "RRPC_FWGetGlobalConfig2_10", "45": "RRPC_FWGetConfig2_10", "46": "RRPC_FWAddFirewallRule2_10", "47": "RRPC_FWSetFirewallRule2_10", "48": "RRPC_FWEnumFirewallRules2_10", "49": "RRPC_FWAddConnectionSecurityRule2_10", "50": "RRPC_FWSetConnectionSecurityRule2_10", "51": "RRPC_FWEnumConnectionSecurityRules2_10", "52": "RRPC_FWAddAuthenticationSet2_10", "53": "RRPC_FWSetAuthenticationSet2_10", "54": "RRPC_FWEnumAuthenticationSets2_10", "55": "RRPC_FWAddCryptoSet2_10", "56": "RRPC_FWSetCryptoSet2_10", "57": "RRPC_FWEnumCryptoSets2_10", "58": "RRPC_FWAddConnectionSecurityRule2_20", "59": "RRPC_FWSetConnectionSecurityRule2_20", "60": "RRPC_FWEnumConnectionSecurityRules2_20", "61": "RRPC_FWQueryConnectionSecurityRules2_20", "62": "RRPC_FWAddAuthenticationSet2_20", "63": "RRPC_FWEnumAuthenticationSets2_20", "64": "RRPC_FWQueryAuthenticationSets2_20", "65": "RRPC_FWAddFirewallRule2_20", "66": "RRPC_FWSetFirewallRule2_20", "67": "RRPC_FWEnumFirewallRules2_20", "69": "RRPC_FWQueryFirewallRules2_20", "70": "RRPC_FWAddFirewallRule2_24", "71": "RRPC_FWSetFirewallRule2_24", "72": "RRPC_FWEnumFirewallRules2_24", "73": "RRPC_FWQueryFirewallRules2_24", "74": "RRPC_FWAddFirewallRule2_25", "75": "RRPC_FWSetFirewallRule2_25", "76": "RRPC_FWEnumFirewallRules2_25", "77": "RRPC_FWQueryFirewallRules2_25", "78": "RRPC_FWAddFirewallRule2_26", "79": "RRPC_FWSetFirewallRule2_26", "80": "RRPC_FWEnumFirewallRules2_26", "81": "RRPC_FWQueryFirewallRules2_26"}}
{"uuid": "6bffd098-a112-3610-9833-012892020162", "service": "browser", "opcodes": {"0": "BrowserrServerEnum", "1": "BrowserrDebugCall", "2": "BrowserrQueryOtherDomains", "3": "BrowserrResetNetlogonState", "4": "BrowserrDebugTrace", "5": "BrowserrQueryStatistics", "6": "BrowserrResetStatistics", "7": "NetrBrowserStatisticsClear", "8": "NetrBrowserStatisticsGet", "9": "BrowserrSetNetlogonState", "10": "BrowserrQueryEmulatedDomains", "11": "BrowserrServerEnumEx"}}
{"uuid": "6bffd098-a112-3610-9833-46c3f874532d", "service": "dhcpsrv", "opcodes": {"0": "R_DhcpCreateSubnet", "1": "R_DhcpSetSubnetInfo", "2": "R_DhcpGetSubnetInfo", "3": "R_DhcpEnumSubnets", "4": "R_DhcpAddSubnetElement", "5": "R_DhcpEnumSubnetElements", "6": "R_DhcpRemoveSubnetElement", "7": "R_DhcpDeleteSubnet", "8": "R_DhcpCreateOption", "9": "R_DhcpSetOptionInfo", "10": "R_DhcpGetOptionInfo", "11": "R_DhcpRemoveOption", "12": "R_DhcpSetOptionValue", "13": "R_DhcpGetOptionValue", "14": "R_DhcpEnumOptionValues", "15": "R_DhcpRemoveOptionValue", "16": "R_DhcpCreateClientInfo", "17": "R_DhcpSetClientInfo", "18": "R_DhcpGetClientInfo", "19": "R_DhcpDeleteClientInfo", "20": "R_DhcpEnumSubnetClients", "21": "R_DhcpGetClientOptions", "22": "R_DhcpGetMibInfo", "23": "R_DhcpEnumOptions", "24": "R_DhcpSetOptionValues", "25": "R_DhcpServerSetConfig", "26": "R_DhcpServerGetConfig", "27": "R_DhcpScanDatabase", "28": "R_DhcpGetVersion", "29": "R_DhcpAddSubnetElementV4", "30": "R_DhcpEnumSubnetElementsV4", "31": "R_DhcpRemoveSubnetElementV4", "32": "R_DhcpCreateClientInfoV4", "33": "R_DhcpSetClientInfoV4", "34": "R_DhcpGetClientInfoV4", "35": "R_DhcpEnumSubnetClientsV4", "36": "R_DhcpSetSuperScopeV4", "37": "R_DhcpGetSuperScopeInfoV4", "38": "R_DhcpDeleteSuperScopeV4", "39": "R_DhcpServerSetConfigV4", "40": "R_DhcpServerGetConfigV4", "41": "R_DhcpServerSetConfigVQ", "42": "R_DhcpServerGetConfigVQ", "43": "R_DhcpGetMibInfoVQ", "44": "R_DhcpCreateClientInfoVQ", "45": "R_DhcpSetClientInfoVQ", "46": "R_DhcpGetClientInfoVQ", "47": "R_DhcpEnumSubnetClientsVQ", "48": "R_DhcpCreateSubnetVQ", "49": "R_DhcpGetSubnetInfoVQ", "50": "R_DhcpSetSubnetInfoVQ"}}
{"uuid": "6bffd098-a112-3610-9833-46c3f87e345a", "service": "wkssvc", "opcodes": {"0": "NetrWkstaGetInfo", "1": "NetrWkstaSetInfo", "2": "NetrWkstaUserEnum", "3": "NetrWkstaUserGetInfo", "4": "NetrWkstaUserSetInfo", "5": "NetrWkstaTransportEnum", "6": "NetrWkstaTransportAdd", "7": "NetrWkstaTransportDel", "8": "NetrUseAdd", "9": "NetrUseGetInfo", "10": "NetrUseDel", "11": "NetrUseEnum", "12": "NetrMessageBufferSend", "13": "NetrWorkstationStatisticsGet", "14": "NetrLogonDomainNameAdd", "15": "NetrLogonDomainNameDel", "16": "NetrJoinDomain", "17": "NetrUnjoinDomain", "18": "NetrValidateName", "19": "NetrRenameMachineInDomain", "20": "NetrGetJoinInformation", "21": "NetrGetJoinableOUs", "22": "NetrJoinDomain2", "23": "NetrUnjoinDomain2", "24": "NetrRenameMachineInDomain2", "25": "NetrValidateName2", "26": "NetrGetJoinableOUs2", "27": "NetrAddAlternateComputerName", "28": "NetrRemoveAlternateComputerName", "29": "NetrSetPrimaryComputerName", "30": "NetrEnumerateComputerNames", "31": "NetrWorkstationResetDfsCache"}}
{"uuid": "708cca10-9569-11d1-b2a5-0060977d8118", "service": "dscomm2", "opcodes": {"0": "S_DSGetComputerSites", "1": "S_DSGetPropsEx", "2": "S_DSGetPropsGuidEx", "3": "S_DSBeginDeleteNotification", "4": "S_DSNotifyDelete", "5": "S_DSEndDeleteNotification", "6": "S_DSIsServerGC", "7": "Opnum7NotUsedOnWire", "8": "S_DSGetGCListInDomain"}}
{"uuid": "70b51430-b6ca-11d0-b9b9-00a0c922e750", "service": "IMSAdminBaseW", "opcodes": {"3": "AddKey", "4": "DeleteKey", "5": "DeleteChildKEys", "6": "EnumKeys", "7": "CopyKey", "8": "RenameKey", "9": "R_SetData", "10": "R_GetData", "11": "DeleteDate", "12": "R_EnumData", "13": "R_GetAllData", "14": "DeleteAllData", "15": "CopyData", "16": "GetDataPaths", "17": "OpenKey", "18": "CloseKey", "19": "ChangePermissions", "20": "SaveData", "21": "GetHandleInfo", "22": "GetSystemChangeNumber", "23": "GetDataSetNumber", "24": "SetLastChangeTime", "25": "GetLastChangeTime", "26": "R_KeyExchangePhase1", "27": "R_KeyExchangePhase2", "28": "Backup", "29": "Restore", "30": "EnumBackups", "31": "DeleteBackup", "32": "UnmarshalInterface", "33": "R_GetServerGuid"}}
{"uuid": "76d12b80-3467-11d3-91ff-0090272f9ea3", "service": "qmcomm2"}
{"uuid": "76f03f96-cdfd-44fc-a22c-64950a001209", "service": "IRemoteWinspool", "opcodes": {"0": "RpcAsyncOpenPrinter", "1": "RpcAsyncAddPrinter", "2": "RpcAsyncSetJob", "3": "RpcAsyncGetJob", "4": "RpcAsyncEnumJobs", "5": "RpcAsyncAddJob", "6": "RpcAsyncScheduleJob", "7": "RpcAsyncDeletePrinter", "8": "RpcAsyncSetPrinter", "9": "RpcAsyncGetPrinter", "10": "RpcAsyncStartDocPrinter", "11": "RpcAsyncStartPagePrinter", "12": "RpcAsyncWritePrinter", "13": "RpcAsyncEndPagePrinter", "14": "RpcAsyncEndDocPrinter", "15": "RpcAsyncAbortPrinter", "16": "RpcAsyncGetPrinterData", "17": "RpcAsyncGetPrinterDataEx", "18": "RpcAsyncSetPrinterData", "19": "RpcAsyncSetPrinterDataEx", "20": "RpcAsyncClosePrinter", "21": "RpcAsyncAddForm", "22": "RpcAsyncDeleteForm", "23": "RpcAsyncGetForm", "24": "RpcAsyncSetForm", "25": "RpcAsyncEnumForms", "26": "RpcAsyncGetPrinterDriver", "27": "RpcAsyncEnumPrinterData", "28": "RpcAsyncEnumPrinterDataEx", "29": "RpcAsyncEnumPrinterKey", "30": "RpcAsyncDeletePrinterData", "31": "RpcAsyncDeletePrinterDataEx", "32": "RpcAsyncDeletePrinterKey", "33": "RpcAsyncXcvData", "34": "RpcAsyncSendRecvBidiData", "35": "RpcAsyncCreatePrinterIC", "36": "RpcAsyncPlayGdiScriptOnPrinterIC", "37": "RpcAsyncDeletePrinterIC", "38": "RpcAsyncEnumPrinters", "39": "RpcAsyncAddPrinterDriver", "40": "RpcAsyncEnumPrinterDrivers", "41": "RpcAsyncGetPrinterDriverDirectory", "42": "RpcAsyncDeletePrinterDriver", "43": "RpcAsyncDeletePrinterDriverEx", "44": "RpcAsyncAddPrintProcessor", "45": "RpcAsyncEnumPrintProcessors", "46": "RpcAsyncGetPrintProcessorDirectory", "47": "RpcAsyncEnumPorts", "48": "RpcAsyncEnumMonitors", "49": "RpcAsyncAddPort", "50": "RpcAsyncSetPort", "51": "RpcAsyncAddMonitor", "52": "RpcAsyncDeleteMonitor", "53": "RpcAsyncDeletePrintProcessor", "54": "RpcAsyncEnumPrintProcessorDatatypes", "55": "RpcAsyncAddPerMachineConnection", "56": "RpcAsyncDeletePerMachineConnection", "57": "RpcAsyncEnumPerMachineConnections", "58": "RpcSyncRegisterForRemoteNotifications", "59": "RpcSyncUnRegisterForRemoteNotifications", "60": "RpcSyncRefreshRemoteNotifications", "61": "RpcAsyncGetRemoteNotifications", "62": "RpcAsyncInstallPrinterDriverFromPackage", "63": "RpcAsyncUploadPrinterDriverPackage", "64": "RpcAsyncGetCorePrinterDrivers", "65": "RpcAsyncCorePrinterDriverInstalled", "66": "RpcAsyncGetPrinterDriverPackagePath", "67": "RpcAsyncDeletePrinterDriverPackage", "68": "RpcAsyncReadPrinter", "69": "RpcAsyncResetPrinter", "70": "RpcAsyncGetJobNamedPropertyValue", "71": "RpcAsyncSetJobNamedProperty", "72": "RpcAsyncDeleteJobNamedProperty", "73": "RpcAsyncEnumJobNamedProperties", "74": "RpcAsyncLogJobInfoForBranchOffice"}}
{"uuid": "77df7a80-f298-11d0-8358-00a024c480a8", "service": "dscomm", "opcodes": {"0": "S_DSCreateObject", "1": "S_DSDeleteObject", "2": "S_DSGetProps", "3": "S_DSSetProps", "4": "S_DSGetObjectSecurity", "5": "S_DSSetObjectSecurity", "6": "S_DSLookupBegin", "7": "S_DSLookupNext", "8": "S_DSLookupEnd", "9": "Opnum9NotUsedOnWire", "10": "S_DSDeleteObjectGuid", "11": "S_DSGetPropsGuid", "12": "S_DSSetPropsGuid", "13": "S_DSGetObjectSecurityGuid", "14": "S_DSSetObjectSecurityGuid", "15": "Opnum15NotUsedOnWire", "16": "Opnum16NotUsedOnWire", "17": "Opnum17NotUsedOnWire", "18": "Opnum18NotUsedOnWire", "19": "S_DSQMSetMachineProperties", "20": "S_DSCreateServersCache", "21": "S_DSQMGetObjectSecurity", "22": "S_DSValidateServer", "23": "S_DSCloseServerHandle", "24": "Opnum24NotUsedOnWire", "25": "Opnum25NotUsedOnWire", "26": "Opnum26NotUsedOnWire", "27": "S_DSGetServerPort"}}
{"uuid": "784b693d-95f3-420b-8126-365c098659f2", "service": "IOCSPAdminD"}
{"uuid": "7c44d7d4-31d5-424c-bd5e-2b3e1f323d22", "service": "dsaop", "opcodes": {"0": "IDL_DSAPrepareScript", "1": "IDL_DSAExecuteScript"}}
{"uuid": "7c4e1804-e342-483d-a43e-a850cfcc8d18", "service": "IIISApplicationAdmin", "opcodes": {"3": "CreateApplication", "4": "DeleteApplication", "5": "CreateApplicationPool", "6": "DeleteApplicationPool", "7": "EnumerateApplicationsInPool", "8": "RecycleApplicationPool", "9": "GetProcessMode"}}
{"uuid": "7c857801-7381-11cf-884d-00aa004b2e24", "service": "IWbemObjectSink interface"}
{"uuid": "7d07f313-a53f-459a-bb12-012c15b1846e", "service": "IRobustNtmsMediaServices1"}
{"uuid": "7fe0d935-dda6-443f-85d0-1cfb58fe41dd", "service": "ICertAdminD2", "opcodes": {"31": "PublishCRLs", "32": "GetCAProperty", "33": "SetCAProperty", "34": "GetCAPropertyInfo", "35": "EnumViewColumnTable", "36": "GetCASecurity", "37": "SetCASecurity", "38": "Ping2", "39": "GetArchivedKey", "40": "GetAuditFilter", "41": "SetAuditFilter", "42": "GetOfficerRights", "43": "SetOfficerRights", "44": "GetConfigEntry", "45": "SetConfigEntry", "46": "ImportKey", "47": "GetMyRoles", "48": "DeleteRow"}}
{"uuid": "811109bf-a4e1-11d1-ab54-00a0c91e9b45", "service": "winsi2", "opcodes": {"0": "R_WinsTombstoneDbRecs", "1": "R_WinsCheckAccess"}}
{"uuid": "8165b19e-8d3a-4d0b-80c8-97de310db583", "service": "IServicedComponentInfo", "opcodes": {"3": "GetComponentInfo"}}
{"uuid": "82273fdc-e32a-18c3-3f78-827929dc23ea", "service": "eventlog", "opcodes": {"0": "ElfrClearELFW", "1": "ElfrBackupELFW", "2": "ElfrCloseEL", "3": "ElfrDeregisterEventSource", "4": "ElfrNumberOfRecords", "5": "ElfrOldestRecord", "6": "ElfrChangeNotify", "7": "ElfrOpenELW", "8": "ElfrRegisterEventSourceW", "9": "ElfrOpenBELW", "10": "ElfrReadELW", "11": "ElfrReportEventW", "12": "ElfrClearELFA", "13": "ElfrBackupELFA", "14": "ElfrOpenELA", "15": "ElfrRegisterEventSourceA", "16": "ElfrOpenBELA", "17": "ElfrReadELA", "18": "ElfrReportEventA", "19": "ElfrRegisterClusterSvc", "20": "ElfrDeregisterClusterSvc", "21": "ElfrWriteClusterEvents", "22": "ElfrGetLogInformation", "23": "ElfrFlushEL", "24": "ElfrReportEventAndSourceW", "25": "ElfrReportEventExW", "26": "ElfrReportEventExA"}}
{"uuid": "8298d101-f992-43b7-8eca-5052d885b995", "service": "IMSAdminBase2W", "opcodes": {"34": "BackupWithPasswrd", "35": "RestoreWithPasswrd", "36": "Export", "37": "Import", "38": "RestoreHistory", "39": "EnumHistory"}}
{"uuid": "82ad4280-036b-11cf-972c-00aa006887b0", "service": "inetinfo", "opcodes": {"0": "R_InetInfoGetVersion", "1": "R_InetInfoGetAdminInformation", "2": "R_InsetInfoGetSites", "3": "R_InetInfoSetAdminInformation", "4": "R_InetInfoGetGlobalAdminInformation", "5": "R_InetInfoSetGlobalAdminInformation", "6": "R_InetInfoQueryStatistics", "7": "R_InetInfoClearStatistics", "8": "R_InetInfoFlushMemoryCache", "9": "R_InetInfoGetServerCapabilities", "10": "R_W3QueryStatistics2", "11": "R_W3ClearStatistics2", "12": "R_FtpQueryStatistics2", "13": "R_FtpClearStatistics2", "14": "R_IISDEnumerateUsers", "15": "R_IISDisconnectedUser", "16": "Opnum16NotUsedOnWire", "17": "Opnum17NotUsedOnWire"}}
{"uuid": "833e4100-aff7-4ac3-aac2-9f24c1457bce", "service": "IPCHCollection"}
{"uuid": "833e41aa-aff7-4ac3-aac2-9f24c1457bce", "service": "ISAFSession"}
{"uuid": "833e4200-aff7-4ac3-aac2-9f24c1457bce", "service": "IPCHService"}
{"uuid": "83da7c00-e84f-11d2-9807-00c04f8ec850", "service": "sfcapi", "opcodes": {"0": "SfcSrv_GetNextProtectedFile", "1": "SfcSrv_IsFileProtected", "2": "SfcSrv_FileException", "3": "SfcSrv_InitiateScan", "4": "SfcSrv_PurgeCache", "5": "SfcSrv_SetCacheSize", "6": "SfcSrv_SetDisable", "7": "SfcSrv_InstallProtectedFiles"}}
{"uuid": "86d35949-83c9-4044-b424-db363231fd0c", "service": "ITaskSchedulerService", "opcodes": {"0": "SchRpcHighestVersion", "1": "SchRpcRegisterTask", "2": "SchRpcRetrieveTask", "3": "SchRpcCreateFolder", "4": "SchRpcSetSecurity", "5": "SchRpcGetSecurity", "6": "SchRpcEnumFolder", "7": "SchRpcEnumTasks", "8": "SchRpcEnumInstances", "9": "SchRpcGetInstanceInfo", "10": "SchRpcStopInstance", "11": "SchRpcStop", "12": "SchRpcRun", "13": "SchRpcDelete", "14": "SchRpcRename", "15": "SchRpcScheduledRuntimes", "16": "SchRpcGetLastRunInfo", "17": "SchRpcGetTaskInfo", "18": "SchRpcGetNumberOfMissedRuns", "19": "SchRpcEnableTask"}}
{"uuid": "879c8bbe-41b0-11d1-be11-00c04fb6bf70", "service": "IClientSink"}
{"uuid": "88143fd0-c28d-4b2b-8fef-8d882f6a9390", "service": "TermServEnumeration", "opcodes": {"0": "RpcOpenEnum", "1": "RpcCloseEnum", "2": "RpcFilterByState", "3": "RpcFilterByCallersName", "4": "RpcEnumAddFilter", "5": "RpcGetEnumResult", "6": "RpcFilterBySessionType", "7": "Opnum7NotUsedOnWire", "8": "RpcGetSessionIds", "9": "RpcGetEnumResultEx", "10": "RpcGetAllSessions", "11": "RpcGetAllSessionsEx"}}
{"uuid": "894de0c0-0d55-11d3-a322-00c04fa321a1", "service": "InitShutdown", "opcodes": {"0": "BaseInitiateShutdown", "1": "BaseAbortShutdown", "2": "BaseInitiateShutdownEx"}}
{"uuid": "895a2c86-270d-489d-a6c0-dc2a9b35280e", "service": "INtmsObjectManagement2"}
{"uuid": "897e2e5f-93f3-4376-9c9c-fd2277495c27", "service": "FrsTransport", "opcodes": {"0": "CheckConnectivity", "1": "EstablishConnection", "2": "EstablishSession", "3": "RequestUpdates", "4": "RequestVersionVector", "5": "AsyncPoll", "6": "RequestRecords", "7": "UpdateCancel", "8": "RawGetFileData", "9": "RdcGetSignatures", "10": "RdcPushSourceNeeds", "11": "RdcGetFileData", "12": "RdcClose", "13": "InitializeFileTransferAsync", "14": "Opnum14NotUsedOnWire", "15": "RawGetFileDataAsync", "16": "RdcGetFileDataAsync", "17": "RdcFileDataTransferKeepAlive"}}
{"uuid": "8d0ffe72-d252-11d0-bf8f-00c04fd9126b", "service": "IKeySvc", "opcodes": {"0": "KeyrOpenKeyService", "1": "KeyrEnumerateProviders", "2": "KeyrEnumerateProviderTypes", "3": "KeyrEnumerateProvContainers", "4": "KeyrCloseKeyService", "5": "KeyrGetDefaultProvider", "6": "KeyrSetDefaultProvider", "7": "KeyrEnroll", "8": "KeyrExportCert", "9": "KeyrImportCert", "10": "KeyrEnumerateAvailableCertTypes", "11": "KeyrEnumerateCAs", "12": "KeyrEnroll_V2", "13": "KeyrQueryRequestStatus"}}
{"uuid": "8d9f4e40-a03d-11ce-8f69-08003e30051b", "service": "pnp", "opcodes": {"0": "PNP_Disconnect", "1": "PNP_Connect", "2": "PNP_GetVersion", "3": "PNP_GetGlobalState", "4": "PNP_InitDetection", "5": "PNP_ReportLogOn", "6": "PNP_ValidateDeviceInstance", "7": "PNP_GetRootDeviceInstance", "8": "PNP_GetRelatedDeviceInstance", "9": "PNP_EnumerateSubKeys", "10": "PNP_GetDeviceList", "11": "PNP_GetDeviceListSize", "12": "PNP_GetDepth", "13": "PNP_GetDeviceRegProp", "14": "PNP_SetDeviceRegProp", "15": "PNP_GetClassInstance", "16": "PNP_CreateKey", "17": "PNP_DeleteRegistryKey", "18": "PNP_GetClassCount", "19": "PNP_GetClassName", "20": "PNP_DeleteClassKey", "21": "PNP_GetInterfaceDeviceAlias", "22": "PNP_GetInterfaceDeviceList", "23": "PNP_GetInterfaceDeviceListSize", "24": "PNP_RegisterDeviceClassAssociation", "25": "PNP_UnregisterDeviceClassAssociation", "26": "PNP_GetClassRegProp", "27": "PNP_SetClassRegProp", "28": "PNP_CreateDevInst", "29": "PNP_DeviceInstanceAction", "30": "PNP_GetDeviceStatus", "31": "PNP_SetDeviceProblem", "32": "PNP_DisableDevInst", "33": "PNP_UninstallDevInst", "34": "PNP_AddID", "35": "PNP_RegisterDriver", "36": "PNP_QueryRemove", "37": "PNP_RequestDeviceEject", "38": "PNP_IsDockStationPresent", "39": "PNP_RequestEjectPC", "40": "PNP_HwProfFlags", "41": "PNP_GetHwProfInfo", "42": "PNP_AddEmptyLogConf", "43": "PNP_FreeLogConf", "44": "PNP_GetFirstLogConf", "45": "PNP_GetNextLogConf", "46": "PNP_GetLogConfPriority", "47": "PNP_AddResDes", "48": "PNP_FreeResDes", "49": "PNP_GetNextResDes", "50": "PNP_GetResDesData", "51": "PNP_GetResDesDataSize", "52": "PNP_ModifyResDes", "53": "PNP_DetectResourceConflict", "54": "PNP_QueryResConfList", "55": "PNP_SetHwProf", "56": "PNP_QueryArbitratorFreeData", "57": "PNP_QueryArbitratorFreeSize", "58": "PNP_RunDetection", "59": "PNP_RegisterNotification", "60": "PNP_UnregisterNotification", "61": "PNP_GetCustomDevProp", "62": "PNP_GetVersionInternal", "63": "PNP_GetBlockedDriverInfo", "64": "PNP_GetServerSideDeviceInstallFlags", "65": "PNP_GetObjectPropKeys", "66": "PNP_GetObjectProp", "67": "PNP_SetObjectProp", "68": "PNP_InstallDevInst", "69": "PNP_ApplyPowerSettings", "70": "PNP_DriverStoreAddDriverPackage", "71": "PNP_DriverStoreDeleteDriverPackage", "72": "PNP_RegisterServiceNotification", "73": "PNP_SetActiveService", "74": "PNP_DeleteServiceDevices"}}
{"uuid": "8da03f40-3419-11d1-8fb1-00a024cb6019", "service": "INtmsSession1"}
{"uuid": "8f09f000-b7ed-11ce-bbd2-00001a181cad", "service": "dimsvc"}
{"uuid": "8fb6d884-2388-11d0-8c35-00c04fda2795", "service": "W32Time", "opcodes": {"0": "W32TimeSync", "1": "W32TimeGetNetlogonServiceBits", "2": "W32TimeQueryProviderStatus", "3": "W32TimeQuerySource", "4": "W32TimeQueryProviderConfiguration", "5": "W32TimeQueryConfiguration", "6": "W32TimeQueryStatus", "7": "W32TimeLog"}}
{"uuid": "906b0ce0-c70b-1067-b317-00dd010662da", "service": "IXnRemote"}
{"uuid": "91ae6020-9e3c-11cf-8d7c-00aa00c091be", "service": "ICertPassage", "opcodes": {"0": "CertServerRequest"}}
{"uuid": "943991a5-b3fe-41fa-9696-7f7b656ee34b", "service": "IWRMMachineGroup", "opcodes": {"7": "CreateMachineGroup", "8": "GetMachineGroupInfo", "9": "ModifyMachineGroup", "10": "DeleteMachineGroup", "11": "RenameMachineGroup", "12": "AddMachine", "13": "GetMachineInfo", "14": "ModifyMachineInfo", "15": "DeleteMachine"}}
{"uuid": "9556dc99-828c-11cf-a37e-00aa003240c7", "service": "IWbemServices", "opcodes": {"3": "OpenNamespace", "4": "CancelAsyncCall", "5": "QueryObjectSink", "6": "GetObject", "7": "GetObjectAsync", "8": "PutClass", "9": "PutClassAsync", "10": "DeleteClass", "11": "DeleteClassAsync", "12": "CreateClassEnum", "13": "CreateClassEnumAsync", "14": "PutInstance", "15": "PutInstanceAsync", "16": "DeleteClass", "17": "DeleteClassAsync", "18": "CreateInstanceEnum", "19": "CreateInstanceEnumAsync", "20": "ExecQuery", "21": "ExecQueryAsync", "22": "ExecNotificationQuery", "23": "ExecNotificationQueryAsync", "24": "ExecMethod", "25": "ExecMethodAsync"}}
{"uuid": "99fcfec4-5260-101b-bbcb-00aa0021347a", "service": "IObjectExporter", "opcodes": {"0": "ResolveOxid", "1": "SimplePing", "2": "ComplexPing", "3": "ServerAlive", "4": "ResolveOxid2", "5": "ServerAlive2"}}
{"uuid": "9a653086-174f-11d2-b5f9-00104b703efd", "service": "IWbemClassObject interface"}
{"uuid": "a359dec5-e813-4834-8a2a-ba7f1d777d76", "service": "IWbemBackupRestoreEx interface"}
{"uuid": "a4f1db00-ca47-1067-b31f-00dd010662da", "service": "exchange_mapi", "opcodes": {"0": "EcDoConnect", "1": "EcDoDisconnect", "2": "EcDoRpc", "3": "EcGetMoreRpc", "4": "EcRRegisterPushNotification", "5": "EcRUnregisterPushNotification", "6": "EcDummyRpc", "7": "EcRGetDCName", "8": "EcRNetGetDCName", "9": "EcDoRpcExt", "10": "EcDoConnectEx", "11": "EcDoRpcExt2", "12": "EcUnknown0xC", "13": "EcUnknown0xD", "14": "EcDoAsyncConnectEx"}}
{"uuid": "a8e0653c-2744-4389-a61d-7373df8b2292", "service": "FileServerVssAgent", "opcodes": {"0": "GetSupportedVersion", "1": "SetContext", "2": "StartShadowCopySet", "3": "AddToShadowCopySet", "4": "CommitShadowCopySet", "5": "ExposeShadowCopySet", "6": "RecoveryCompleteShadowCopySet", "7": "AbortShadowCopySet", "8": "IsPathSupported", "9": "IsPathShadowCopied", "10": "GetShareMapping", "11": "DeleteShareMapping", "12": "PrepareShadowCopy"}}
{"uuid": "ae1c7110-2f60-11d3-8a39-00c04f72d8e3", "service": "IVssEnumObject", "opcodes": {"3": "Next", "4": "Skip", "5": "Reset", "6": "Clone"}}
{"uuid": "ae33069b-a2a8-46ee-a235-ddfd339be281", "service": "IRPCRemoteObject"}
{"uuid": "afa8bd80-7d8a-11c9-bef4-08002b102989", "service": "mgmt", "opcodes": {"0": "inq_if_ids", "1": "inq_stats", "2": "is_server_listening", "3": "stop_server_listening", "4": "inq_princ_name"}}
{"uuid": "afc07e2e-311c-4435-808c-c483ffeec7c9", "service": "lsacap", "opcodes": {"0": "LsarGetAvailableCAPIDs"}}
{"uuid": "b057dc50-3059-11d1-8faf-00a024cb6019", "service": "INtmsObjectManagement1"}
{"uuid": "b9785960-524f-11df-8b6d-83dcded72085", "service": "ISDKey", "opcodes": {"0": "GetKey"}}
{"uuid": "b97db8b2-4c63-11cf-bff6-08002be23f2f", "service": "clusapi", "opcodes": {"0": "ApiOpenCluster", "1": "ApiCloseCluster", "2": "ApiSetClusterName", "3": "ApiGetClusterName", "4": "ApiGetClusterVersion", "5": "ApiGetQuorumResource", "6": "ApiSetQuorumResource", "7": "ApiCreateEnum", "8": "ApiOpenResource", "9": "ApiCreateResource", "10": "ApiDeleteResource", "11": "ApiCloseResource", "12": "ApiGetResourceState", "13": "ApiSetResourceName", "14": "ApiGetResourceId", "15": "ApiGetResourceType", "16": "ApiFailResource", "17": "ApiOnlineResource", "18": "ApiOfflineResource", "19": "ApiAddResourceDependency", "20": "ApiRemoveResourceDependency", "21": "ApiCanResourceBeDependent", "22": "ApiCreateResEnum", "23": "ApiAddResourceNode", "24": "ApiRemoveResourceNode", "25": "ApiChangeResourceGroup", "26": "ApiCreateResourceType", "27": "ApiDeleteResourceType", "28": "ApiGetRootKey", "29": "ApiCreateKey", "30": "ApiOpenKey", "31": "ApiEnumKey", "32": "ApiSetValue", "33": "ApiDeleteValue", "34": "ApiQueryValue", "35": "ApiDeleteKey", "36": "ApiEnumValue", "37": "ApiCloseKey", "38": "ApiQueryInfoKey", "39": "ApiSetKeySecurity", "40": "ApiGetKeySecurity", "41": "ApiOpenGroup", "42": "ApiCreateGroup", "43": "ApiDeleteGroup", "44": "ApiCloseGroup", "45": "ApiGetGroupState", "46": "ApiSetGroupName", "47": "ApiGetGroupId", "48": "ApiGetNodeId", "49": "ApiOnlineGroup", "50": "ApiOfflineGroup", "51": "ApiMoveGroup", "52": "ApiMoveGroupToNode", "53": "ApiCreateGroupResourceEnum", "54": "ApiSetGroupNodeList", "55": "ApiCreateNotify", "56": "ApiCloseNotify", "57": "ApiAddNotifyCluster", "58": "ApiAddNotifyNode", "59": "ApiAddNotifyGroup", "60": "ApiAddNotifyResource", "61": "ApiAddNotifyKey", "62": "ApiReAddNotifyNode", "63": "ApiReAddNotifyGroup", "64": "ApiReAddNotifyResource", "65": "ApiGetNotify", "66": "ApiOpenNode", "67": "ApiCloseNode", "68": "ApiGetNodeState", "69": "ApiPauseNode", "70": "ApiResumeNode", "71": "ApiEvictNode", "72": "ApiNodeResourceControl", "73": "ApiResourceControl", "74": "ApiNodeResourceTypeControl", "75": "ApiResourceTypeControl", "76": "ApiNodeGroupControl", "77": "ApiGroupControl", "78": "ApiNodeNodeControl", "79": "ApiNodeControl", "80": "Opnum80NotUsedOnWire", "81": "ApiOpenNetwork", "82": "ApiCloseNetwork", "83": "ApiGetNetworkState", "84": "ApiSetNetworkName", "85": "ApiCreateNetworkEnum", "86": "ApiGetNetworkId", "87": "ApiSetNetworkPriorityOrder", "88": "ApiNodeNetworkControl", "89": "ApiNetworkControl", "90": "ApiAddNotifyNetwork", "91": "ApiReAddNotifyNetwork", "92": "ApiOpenNetInterface", "93": "ApiCloseNetInterface", "94": "ApiGetNetInterfaceState", "95": "ApiGetNetInterface", "96": "ApiGetNetInterfaceId", "97": "ApiNodeNetInterfaceControl", "98": "ApiNetInterfaceControl", "99": "ApiAddNotifyNetInterface", "100": "ApiReAddNotifyNetInterface", "101": "ApiCreateNodeEnum", "102": "ApiGetClusterVersion2", "103": "ApiCreateResTypeEnum", "104": "ApiBackupClusterDatabase", "105": "ApiNodeClusterControl", "106": "ApiClusterControl", "107": "ApiUnblockGetNotifyCall", "108": "ApiSetServiceAccountPassword", "109": "ApiSetResourceDependencyExpression", "110": "ApiGetResourceDependencyExpression", "112": "ApiGetResourceNetworkName", "113": "ApiExecuteBatch", "114": "ApiCreateBatchPort", "115": "ApiGetBatchNotification", "116": "ApiCloseBatchPort", "117": "ApiOpenClusterEx", "118": "ApiOpenNodeEx", "119": "ApiOpenGroupEx", "120": "ApiOpenResourceEx", "121": "ApiOpenNetworkEx", "122": "ApiOpenNetInterfaceEx", "123": "ApiChangeCsvState", "124": "ApiCreateNodeEnumEx", "125": "ApiCreateEnumEx", "126": "ApiPauseNodeEx", "127": "ApiPauseNodeWithDrainTarget", "128": "ApiResumeNodeEx", "129": "ApiCreateGroupEx", "130": "ApiOnlineGroupEx", "131": "ApiOfflineGroupEx", "132": "ApiMoveGroupEx", "133": "ApiMoveGroupToNodeEx", "134": "ApiCancelClusterGroupOperation", "135": "ApiOnlineResourceEx", "136": "ApiOfflineResourceEx", "137": "ApiCreateNotifyV2", "138": "ApiAddNotifyV2", "139": "ApiGetNotifyV2", "143": "ApiCreateGroupEnum", "144": "ApiCreateResourceEnum", "145": "ApiExecuteReadBatch", "146": "ApiRestartResource", "147": "ApiGetNotifyAsync", "155": "ApiAddNotifyResourceTypeV2", "157": "ApiExecuteReadBatchEx", "163": "ApiCreateGroupSet", "164": "ApiOpenGroupSet", "165": "ApiCloseGroupSet", "166": "ApiDeleteGroupSet", "167": "ApiAddGroupToGroupSet", "168": "ApiRemoveGroupFromGroupSet", "169": "ApiMoveGroupToGroupSet", "171": "ApiAddGroupSetDependency", "172": "ApiAddGroupToGroupSetDependency", "173": "ApiNodeGroupSetControl", "174": "ApiGroupSetControl", "175": "ApiSetGroupDependencyExpression", "176": "ApiRemoveClusterGroupDependency", "177": "ApiSetGroupSetDependencyExpression", "178": "ApiRemoveGroupSetDependency", "179": "ApiRemoveClusterGroupToGroupSetDependency", "180": "ApiCreateGroupSetEnum", "181": "ApiCreateNetInterfaceEnum", "182": "ApiChangeCsvStateEx", "183": "ApiAddGroupToGroupSetEx", "184": "ApiChangeResourceGroupEx"}}
{"uuid": "bb39332c-bfee-4380-ad8a-badc8aff5bb6", "service": "INtmsNotifySink"}
{"uuid": "bc681469-9dd9-4bf4-9b3d-709f69efe431", "service": "IWRMResourceGroup", "opcodes": {"7": "GetResourceGroupInfo", "8": "ModifyResourceGroup", "9": "CreateResourceGroup", "10": "DeleteResourceGroup", "11": "RenameResourceGroup"}}
{"uuid": "bd0c73bc-805b-4043-9c30-9a28d64dd7d2", "service": "IIISCertObj", "opcodes": {"7": "Opnum7NotUsedOnWire", "8": "Opnum8NotUsedOnWire", "9": "Opnum9NotUsedOnWire", "10": "InstanceName", "11": "Opnum11NotUsedOnWire", "12": "IsInstallRemote", "13": "Opnum13NotUsedOnWire", "14": "IsExportableRemote", "15": "Opnum15NotUsedOnWire", "16": "GetCertInfoRemote", "17": "Opnum17NotUsedOnWire", "18": "Opnum18NotUsedOnWire", "19": "Opnum19NotUsedOnWire", "20": "Opnum20NotUsedOnWire", "21": "Opnum21NotUsedOnWire", "22": "ImportFromBlob", "23": "ImportFromBlobGetHash", "24": "Opnum24NotUsedOnWire", "25": "ExportToBlob"}}
{"uuid": "bde95fdf-eee0-45de-9e12-e5a61cd0d4fe", "service": "RCMPublic", "opcodes": {"0": "RpcGetClientData", "1": "RpcGetConfigData", "2": "RpcGetProtocolStatus", "3": "RpcGetLastInputTime", "4": "RpcGetRemoteAddress", "5": "Opnum5NotUsedOnWire", "6": "Opnum6NotUsedOnWire", "7": "Opnum7NotUsedOnWire", "8": "RpcGetAllListeners", "9": "RpcGetSessionProtocolLastInputTime", "10": "RpcGetUserCertificates", "11": "RpcQuerySessionData"}}
{"uuid": "c386ca3e-9061-4a72-821e-498d83be188f", "service": "AudioRpc", "opcodes": {"0": "AudioServerConnect", "1": "AudioServerDisconnect", "2": "AudioServerInitialize", "3": "AudioServerGetAudioSession", "4": "AudioServerCreateStream", "5": "AudioServerDestroyStream", "6": "AudioServerGetStreamLatency", "7": "AudioServerGetMixFormat", "8": "AudioServerIsFormatSupported", "9": "AudioServerGetDevicePeriod", "10": "AudioVolumeGetMasterVolumeLevelScalar", "11": "AudioSessionGetProcessId", "12": "AudioSessionGetState", "13": "AudioSessionGetLastActivation", "14": "AudioSessionGetLastInactivation", "15": "AudioSessionIsSystemSoundsSession", "16": "AudioSessionGetDisplayName", "17": "AudioSessionSetDisplayName", "18": "AudioSessionGetSessionClass", "19": "AudioSessionSetSessionClass", "20": "AudioSessionGetVolume", "21": "AudioSessionSetVolume", "22": "AudioSessionGetMute", "23": "AudioSessionSetMute", "24": "AudioSessionGetChannelCount", "25": "AudioSessionSetChannelVolume", "26": "AudioSessionGetChannelVolume", "27": "AudioSessionSetAllVolumes", "28": "AudioSessionGetAllVolumes", "29": "AudioServerDisconnect", "30": "AudioServerGetMixFormat", "31": "PolicyConfigGetDeviceFormat", "32": "PolicyConfigSetDeviceFormat", "33": "AudioServerGetDevicePeriod", "34": "PolicyConfigSetProcessingPeriod", "35": "PolicyConfigGetShareMode", "36": "PolicyConfigSetShareMode", "37": "GetAudioSessionManager", "38": "AudioSessionManagerDestroy", "39": "AudioSessionManagerGetAudioSession", "40": "AudioSessionManagerGetCurrentSession", "41": "AudioSessionManagerGetExistingSession", "42": "AudioSessionManagerAddAudioSessionClientNotification", "43": "AudioSessionManagerDeleteAudioSessionClientNotification", "44": "AudioSessionManagerAddAudioSessionClientNotification", "45": "AudioVolumeConnect", "46": "AudioVolumeDisconnect", "47": "AudioVolumeGetChannelCount", "48": "AudioVolumeSetMasterVolumeLevel", "49": "AudioVolumeSetMasterVolumeLevelScalar", "50": "AudioVolumeGetMasterVolumeLevel", "51": "AudioVolumeGetMasterVolumeLevelScalar", "52": "AudioVolumeSetChannelVolumeLevel", "53": "AudioVolumeSetChannelVolumeLevelScalar", "54": "AudioVolumeGetChannelVolumeLevel", "55": "AudioVolumeGetChannelVolumeLevelScalar", "56": "AudioVolumeSetMute", "57": "AudioSessionGetDisplayName", "58": "AudioVolumeAddMasterVolumeNotification", "59": "AudioVolumeDeleteMasterVolumeNotification", "60": "AudioMeterGetAverageRMS", "61": "AudioMeterGetChannelsRMS", "62": "AudioMeterGetPeakValue", "63": "AudioMeterGetChannelsPeakValues", "64": "AudioVolumeGetStepInfo", "65": "AudioVolumeStepUp", "66": "AudioVolumeStepDown"}}
{"uuid": "c3fcc19e-a970-11d2-8b5a-00a0c9b7c9c4", "service": "IManagedObject", "opcodes": {"3": "GetSerializedBuffer", "4": "GetObjectIdentify"}}
{"uuid": "c49e32c6-bc8b-11d2-85d4-00105a1f8304", "service": "IWbemBackupRestoreEx interface"}
{"uuid": "c49e32c7-bc8b-11d2-85d4-00105a1f8304", "service": "IWbemBackupRestore interface"}
{"uuid": "c4b0c7d9-abe0-4733-a1e1-9fdedf260c7a", "service": "IADProxy2", "opcodes": {"6": "CreateObject", "7": "DeleteObject", "8": "ModifyObject"}}
{"uuid": "c5cebee2-9df5-4cdd-a08c-c2471bc144b4", "service": "IResourceManager", "opcodes": {"7": "RetrieveEventList", "8": "GetSystemAffinity", "9": "ImportXMLFiles", "10": "ExportXMLFiles", "11": "RestoreXMLFiles", "12": "GetDependencies", "13": "GetServiceList", "14": "GetllSAppPoolNames", "15": "GetServerName", "16": "GetCurrentMemory"}}
{"uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e", "service": "efsrpc2", "opcodes": {"0": "EfsRpcOpenFileRaw", "1": "EfsRpcReadFileRaw", "2": "EfsRpcWriteFileRaw", "3": "EfsRpcCloseRaw", "4": "EfsRpcEncryptFileSrv", "5": "EfsDecryptFileSrv", "6": "EfsRpcQueryUsersOnFile", "7": "EfsRpcQueryRecoveryAgents", "8": "EfsRpcRemoveUsersFromFile", "9": "EfsRpcAddUsersToFile", "10": "Opnum10NotUsedOnWire", "11": "EfsRpcNotSupported", "12": "EfsRpcFileKeyInfo", "13": "EfsRpcDuplicateEncryptionInfoFile", "14": "Opnum14NotUsedOnWire", "15": "EfsRpcAddUsersToFileEx", "16": "EfsRpcFileKeyInfoEx", "17": "Opnum17NotUsedOnWire", "18": "EfsRpcGetEncryptedFileMetadata", "19": "EfsRpcSetEncryptedFileMetadata", "20": "EfsRpcFlushEfsCache", "21": "EfsRpcEncryptFileExServ", "22": "EfsRpcQueryProtectors", "23": "Opnum23NotUsedOnWire", "24": "Opnum24NotUsedOnWire", "25": "Opnum25NotUsedOnWire", "26": "Opnum26NotUsedOnWire", "27": "Opnum27NotUsedOnWire", "28": "Opnum28NotUsedOnWire", "29": "Opnum29NotUsedOnWire", "30": "Opnum30NotUsedOnWire", "31": "Opnum31NotUsedOnWire", "32": "Opnum32NotUsedOnWire", "33": "Opnum33NotUsedOnWire", "34": "Opnum34NotUsedOnWire", "35": "Opnum35NotUsedOnWire", "36": "Opnum36NotUsedOnWire", "37": "Opnum37NotUsedOnWire", "38": "Opnum38NotUsedOnWire", "39": "Opnum39NotUsedOnWire", "40": "Opnum40NotUsedOnWire", "41": "Opnum41NotUsedOnWire", "42": "Opnum42NotUsedOnWire", "43": "Opnum43NotUsedOnWire", "44": "Opnum44NotUsedOnWire"}}
{"uuid": "c8cb7687-e6d3-11d2-a958-00c04f682e16", "service": "DAV RPC SERVICE"}
{"uuid": "ccd8c074-d0e5-4a40-92b4-d074faa6ba28", "service": "Witness", "opcodes": {"0": "WitnessrGetInterfaceList", "1": "WitnessrRegister", "2": "WitnessrUnRegister", "3": "WitnessrAsyncNotify", "4": "WitnessrRegisterEx"}}
{"uuid": "d02e4be0-3419-11d1-8fb1-00a024cb6019", "service": "INtmsMediaServices1"}
{"uuid": "d049b186-814f-11d1-9a3c-00c04fc9b232", "service": "NtFrsApi", "opcodes": {"0": "Opnum0NotUsedOnWire", "1": "Opnum1NotUsedOnWire", "2": "Opnum2NotUsedOnWire", "3": "Opnum3NotUsedOnWire", "4": "NtFrsApi_Rpc_Set_DsPollingIntervalW", "5": "NtFrsApi_Rpc_Get_DsPollingIntervalW", "6": "Opnum6NotUsedOnWire", "7": "NtFrsApi_Rpc_InfoW", "8": "NtFrsApi_Rpc_IsPathReplicated", "9": "NtFrsApi_Rpc_WriterCommand", "10": "NtFrsApi_Rpc_ForceReplication"}}
{"uuid": "d2d79df5-3400-11d0-b40b-00aa005ff586", "service": "IVolumeClient", "opcodes": {"3": "EnumDisksEx", "4": "EnumDiskRegionsEx", "5": "CreatePartition", "6": "CreatePartitionAssignAndFormat", "7": "CreatePartitionAssignandFormatEx", "8": "DeletePartition", "9": "WriteSignature", "10": "MarkActivePartition", "11": "Eject", "12": "Opnum12NotUsedOnWire", "13": "FTEnumVolumes", "14": "FTEnumLogicalDiskMembers", "15": "FTDeleteVolume", "16": "FTBreakMirror", "17": "FTResyncMirror", "18": "FTRegenerateParityStripe", "19": "FTReplaceMirrorPartition", "20": "FTReplaceParityStripePartition", "21": "EnumDriveLetters", "22": "AssignDriveLetter", "23": "FreeDriveLetter", "24": "EnumLocalFileSystems", "25": "GetInstalledFileSystems", "26": "Format", "27": "Opnum27NotUsedOnWire", "28": "EnumVolumes", "29": "EnumVolumeMembers", "30": "CreateVolume", "31": "CreateVolumeAssignAndFormat", "32": "CreateVolumeAssignAndFormatEx", "33": "GetVolumeMountName", "34": "GrowVolume", "35": "DeleteVolume", "36": "AddMirror", "37": "RemoveMirror", "38": "SplitMirror", "39": "InitializeDiskEx", "40": "UninitializeDisk", "41": "ReConnectDisk", "42": "Opnum42NotUsedOnWire", "43": "ImportDiskGroup", "44": "DiskMergeQuery", "45": "DiskMerge", "46": "Opnum46NotUsedOnWire", "47": "ReAttachDisk", "48": "Opnum48NotUsedOnWire", "49": "Opnum49NotUsedOnWire", "50": "Opnum50NotUsedOnWire", "51": "ReplaceRaid5Column", "52": "RestartVolume", "53": "GetEncapsulateDiskInfoEx", "54": "EncapsulateDiskEx", "55": "QueryChangePartitionNumbers", "56": "DeletePartitionNumberInfoFromRegistry", "57": "SetDontShow", "58": "GetDontShow", "59": "Opnum59NotUsedOnWire", "60": "Opnum60NotUsedOnWire", "61": "Opnum61NotUsedOnWire", "62": "Opnum62NotUsedOnWire", "63": "Opnum63NotUsedOnWire", "64": "Opnum64NotUsedOnWire", "65": "Opnum65NotUsedOnWire", "66": "Opnum66NotUsedOnWire", "67": "EnumTasks", "68": "GetTaskDetail", "69": "AbortTask", "70": "HrGetErrorData", "71": "Initialize", "72": "Uninitialize", "73": "Refresh", "74": "RescanDisks", "75": "RefreshFileSys", "76": "SecureSystemPartition", "77": "ShutDownSystem", "78": "EnumAccessPath", "79": "EnumAccessPathForVolume", "80": "AddAccessPath", "81": "DeleteAccessPath"}}
{"uuid": "d2d79df7-3400-11d0-b40b-00aa005ff586", "service": "IDMNotify", "opcodes": {"3": "ObjectsChanged"}}
{"uuid": "d3fbb514-0e3b-11cb-8fad-08002b1d29c3", "service": "NsiC", "opcodes": {"0": "nsi_binding_lookup_begin", "1": "nsi_binding_lookup_done", "2": "nsi_binding_lookup_next", "3": "nsi_mgmt_handle_set_exp_age"}}
{"uuid": "d4781cd6-e5d3-44df-ad94-930efe48a887", "service": "IWbemLoginClientID"}
{"uuid": "d61a27c6-8f53-11d0-bfa0-00a024151983", "service": "CNtmsSvr"}
{"uuid": "d6d70ef0-0e3b-11cb-acc3-08002b1d29c3", "service": "NsiS", "opcodes": {"0": "nsi_binding_export", "1": "nsi_binding_unexport"}}
{"uuid": "d6d70ef0-0e3b-11cb-acc3-08002b1d29c4", "service": "NsiM", "opcodes": {"0": "nsi_group_delete", "1": "nsi_group_mbr_add", "2": "nsi_group_mbr_remove", "3": "nsi_group_mbr_inq_begin", "4": "nsi_group_mbr_inq_next", "5": "nsi_group_mbr_inq_done", "6": "nsi_profile_delete", "7": "nsi_profile_elt_add", "8": "nsi_profile_elt_remove", "9": "nsi_profile_elt_inq_begin", "10": "nsi_profile_elt_inq_next", "11": "nsi_profile_elt_inq_done", "12": "nsi_entry_object_inq_begin", "13": "nsi_entry_object_inq_next", "14": "nsi_entry_object_inq_done", "15": "nsi_entry_expand_name", "16": "nsi_mgmt_binding_unexport", "17": "nsi_mgmt_entry_delete", "18": "nsi_mgmt_entry_create", "19": "nsi_mgmt_entry_inq_if_ids", "20": "nsi_mgmt_inq_exp_age", "21": "nsi_mgmt_inq_set_age"}}
{"uuid": "d95afe70-a6d5-4259-822e-2c84da1ddb0d", "service": "WindowsShutdown", "opcodes": {"0": "WsdrInitiateShutdown", "1": "WsdrAbortShutdown"}}
{"uuid": "d99e6e70-fc88-11d0-b498-00a0c90312f3", "service": "ICertRequestD", "opcodes": {"3": "Request", "4": "GetCACert", "5": "Ping"}}
{"uuid": "d99e6e71-fc88-11d0-b498-00a0c90312f3", "service": "ICertAdminD", "opcodes": {"3": "SetExtension", "4": "SetAttributes", "5": "ResubmitRequest", "6": "DenyRequest", "7": "IsValidCertificate", "8": "PublishCRL", "9": "GetCRL", "10": "RevokeCertificate", "11": "EnumViewColumn", "12": "GetViewDefaultColumnSet", "13": "EnumAttributesOrExtensions", "14": "OpenView", "15": "EnumView", "16": "CloseView", "17": "ServerControl", "18": "Ping", "19": "GetServerState", "20": "BackupPrepare", "21": "BackupEnd", "22": "BackupGetAttachmentInformation", "23": "BackupGetBackupLogs", "24": "BackupOpenFile", "25": "BackupReadFile", "26": "BackupCloseFile", "27": "BackupTruncateLogs", "28": "ImportCertificate", "29": "BackupGetDynamicFiles", "30": "RestoreGetDatabaseLocations"}}
{"uuid": "da5a86c5-12c2-4943-ab30-7f74a813d853", "service": "PerflibV2"}
{"uuid": "db90832f-6910-4d46-9f5e-9fd6bfa73903", "service": "INtmsLibraryControl2"}
{"uuid": "dc12a681-737f-11cf-884d-00aa004b2e24", "service": "IWbemClassObject interface"}
{"uuid": "deb01010-3a37-4d26-99df-e2bb6ae3ac61", "service": "IVolumeClient4", "opcodes": {"3": "RefreshEx", "4": "GetVolumeDeviceName"}}
{"uuid": "df1941c5-fe89-4e79-bf10-463657acf44d", "service": "efsrpc", "opcodes": {"0": "EfsRpcOpenFileRaw", "1": "EfsRpcReadFileRaw", "2": "EfsRpcWriteFileRaw", "3": "EfsRpcCloseRaw", "4": "EfsRpcEncryptFileSrv", "5": "EfsDecryptFileSrv", "6": "EfsRpcQueryUsersOnFile", "7": "EfsRpcQueryRecoveryAgents", "8": "EfsRpcRemoveUsersFromFile", "9": "EfsRpcAddUsersToFile", "10": "Opnum10NotUsedOnWire", "11": "EfsRpcNotSupported", "12": "EfsRpcFileKeyInfo", "13": "EfsRpcDuplicateEncryptionInfoFile", "14": "Opnum14NotUsedOnWire", "15": "EfsRpcAddUsersToFileEx", "16": "EfsRpcFileKeyInfoEx", "17": "Opnum17NotUsedOnWire", "18": "EfsRpcGetEncryptedFileMetadata", "19": "EfsRpcSetEncryptedFileMetadata", "20": "EfsRpcFlushEfsCache", "21": "EfsRpcEncryptFileExServ", "22": "EfsRpcQueryProtectors", "23": "Opnum23NotUsedOnWire", "24": "Opnum24NotUsedOnWire", "25": "Opnum25NotUsedOnWire", "26": "Opnum26NotUsedOnWire", "27": "Opnum27NotUsedOnWire", "28": "Opnum28NotUsedOnWire", "29": "Opnum29NotUsedOnWire", "30": "Opnum30NotUsedOnWire", "31": "Opnum31NotUsedOnWire", "32": "Opnum32NotUsedOnWire", "33": "Opnum33NotUsedOnWire", "34": "Opnum34NotUsedOnWire", "35": "Opnum35NotUsedOnWire", "36": "Opnum36NotUsedOnWire", "37": "Opnum37NotUsedOnWire", "38": "Opnum38NotUsedOnWire", "39": "Opnum39NotUsedOnWire", "40": "Opnum40NotUsedOnWire", "41": "Opnum41NotUsedOnWire", "42": "Opnum42NotUsedOnWire", "43": "Opnum43NotUsedOnWire", "44": "Opnum44NotUsedOnWire"}}
{"uuid": "e1af8308-5d1f-11c9-91a4-08002b14a0fa", "service": "epmapper", "opcodes": {"0": "ept_insert", "1": "ept_delete", "2": "ept_lookup", "3": "ept_map", "4": "ept_lookup_handle_free", "5": "ept_inq_object", "6": "ept_mgmt_delete", "7": "ept_map_auth", "8": "ept_map_auth_async"}}
{"uuid": "e33c0cc4-0482-101a-bc0c-02608c6ba218", "service": "locator", "opcodes": {"0": "I_nsi_lookup_begin", "1": "I_nsi_lookup_done", "2": "I_nsi_lookup_next", "3": "I_nsi_entry_object_inq_next", "4": "I_nsi_ping_locator", "5": "I_nsi_entry_object_inq_done", "6": "I_nsi_entry_object_inq_begin"}}
{"uuid": "e3514235-4b06-11d1-ab04-00c04fc2dcd2", "service": "drsuapi", "opcodes": {"0": "DRSBind", "1": "DRSUnbind", "2": "DRSReplicaSync", "3": "DRSGetNCChanges", "4": "DRSUpdateRefs", "5": "DRSReplicaAdd", "6": "DRSReplicaDel", "7": "DRSReplicaModify", "8": "DRSVerifyNames", "9": "DRSGetMemberships", "10": "DRSInterDomainMove", "11": "DRSGetNT4ChangeLog", "12": "DRSCrackNames", "13": "DRSWriteSPN", "14": "DRSRemoveDsServer", "15": "DRSRemoveDsDomain", "16": "DRSDomainControllerInfo", "17": "DRSAddEntry", "18": "DRSExecuteKCC", "19": "DRSGetReplInfo", "20": "DRSAddSidHistory", "21": "DRSGetMemberships2", "22": "DRSReplicaVerifyObjects", "23": "DRSGetObjectExistence", "24": "DRSQuerySitesByCost", "25": "IDL_DRSInitDemotion", "26": "IDL_DRSReplicaDemotion", "27": "IDL_DRSFinishDemotion", "28": "IDL_DRSAddCloneDC", "29": "IDL_DRSWriteNgcKey", "30": "IDL_DRSReadNgcKey"}}
{"uuid": "e3d0d746-d2af-40fd-8a7a-0d7078bb7092", "service": "BitsPeerAuth", "opcodes": {"0": "ExchangePublicKeys"}}
{"uuid": "e65e8028-83e8-491b-9af7-aaf6bd51a0ce", "service": "IServerHealthReport", "opcodes": {"3": "GetReport", "4": "GetCompressedReport", "5": "GetRawReportEx", "6": "GetReferenceVersionVectors", "7": "Opnum7NotUsedOnWire", "8": "GetReferenceBacklogCounts"}}
{"uuid": "e8fb8620-588f-11d2-9d61-00c04f79c5fe", "service": "IIisServiceControl", "opcodes": {"7": "Stop", "8": "Start", "9": "Reboot", "10": "Status", "11": "Kill"}}
{"uuid": "ea0a3165-4834-11d2-a6f8-00c04fa346cc", "service": "fax"}
{"uuid": "f120a684-b926-447f-9df4-c966cb785648", "service": "IRASrv"}
{"uuid": "f1e9c5b2-f59b-11d2-b362-00105a1f8177", "service": "IWbemRemoteRefresher interface"}
{"uuid": "f309ad18-d86a-11d0-a075-00c04fb68820", "service": "IWbemLevel1Login", "opcodes": {"3": "EstablishPosition", "4": "RequestChallenge", "5": "WBEMLogin", "6": "NTLMLogin"}}
{"uuid": "f31931a9-832d-481c-9503-887a0e6a79f0", "service": "IWRMProtocol", "opcodes": {"7": "GetSupportedClient"}}
{"uuid": "f50aac00-c7f3-428e-a022-a6b71bfb9d43", "service": "ICatDBSvc", "opcodes": {"0": "SSCatDBAddCatalog", "1": "SSCatDBDeleteCatalog", "2": "SSCatDBEnumCatalogs", "3": "SSCatDBRegisterForChangeNotification", "4": "KeyrCloseKeyService", "5": "SSCatDBRebuildDatabase"}}
{"uuid": "f5cc59b4-4264-101a-8c59-08002b2f8426", "service": "FrsRpc", "opcodes": {"0": "FrsRpcSendCommPkt", "1": "FrsRpcVerifyPromotionParent", "2": "FrsRpcStartPromotionParent", "3": "FrsNOP", "4": "FrsBackupComplete", "5": "FrsBackupComplete", "6": "FrsBackupComplete", "7": "FrsBackupComplete", "8": "FrsBackupComplete", "9": "FrsBackupComplete", "10": "FrsRpcVerifyPromotionParentEx"}}
{"uuid": "f5cc5a18-4264-101a-8c59-08002b2f8426", "service": "nspi", "opcodes": {"0": "NspiBind", "1": "NspiUnbind", "2": "NspiUpdateStat", "3": "NspiQueryRows", "4": "NspiSeekEntries", "5": "NspiGetMatches", "6": "NspiResortRestriction", "7": "NspiDNToEph", "8": "NspiGetPropList", "9": "NspiGetProps", "10": "NspiCompareMIds", "11": "NspiModProps", "12": "NspiGetSpecialTable", "13": "NspiGetTemplateInfo", "14": "NspiModLinkAtt", "16": "NspiQueryColumns", "17": "NspiGetNamesFromIDs", "18": "NspiGetIDsFromNames", "19": "NspiResolveNames", "20": "NspiResolveNamesW"}}
{"uuid": "f612954d-3b0b-4c56-9563-227b7be624b4", "service": "IMSAdminBase3W", "opcodes": {"40": "GetChildPaths"}}
{"uuid": "f6beaff7-1e19-4fbb-9f8f-b89e2018337c", "service": "IEventService", "opcodes": {"0": "EvtRpcRegisterRemoteSubscription", "1": "EvtRpcRemoteSubscriptionNextAsync", "2": "EvtRpcRemoteSubscriptionNext", "3": "EvtRpcRemoteSubscriptionWaitAsync", "4": "EvtRpcRegisterControllableOperation", "5": "EvtRpcRegisterLogQuery", "6": "EvtRpcClearLog", "7": "EvtRpcExportLog", "8": "EvtRpcLocalizeExportLog", "9": "EvtRpcMessageRender", "10": "EvtRpcMessageRenderDefault", "11": "EvtRpcQueryNext", "12": "EvtRpcQuerySeek", "13": "EvtRpcClose", "14": "EvtRpcCancel", "15": "EvtRpcAssertConfig", "16": "EvtRpcRetractConfig", "17": "EvtRpcOpenLogHandle", "18": "EvtRpcGetLogFileInfo", "19": "EvtRpcGetChannelList", "20": "EvtRpcGetChannelConfig", "21": "EvtRpcPutChannelConfig", "22": "EvtRpcGetPublisherList", "23": "EvtRpcGetPublisherListForChannel", "24": "EvtRpcGetPublisherMetadata", "25": "EvtRpcGetPublisherResourceMetadata", "26": "EvtRpcGetEventMetadataEnum", "27": "EvtRpcGetNextEventMetadata", "28": "EvtRpcGetClassicLogDisplayName"}}
{"uuid": "fa7df749-66e7-4986-a27f-e2f04ae53772", "service": "IVssSnapshotMgmt", "opcodes": {"3": "GetProviderMgmtInterface", "4": "QueryVolumesSupportedForSnapshots", "5": "QuerySnapshotsByVolume"}}
{"uuid": "fc910418-55ca-45ef-b264-83d4ce7d30e0", "service": "IWRMRemoteSessionMgmt", "opcodes": {"7": "GetRemoteUserCategories", "8": "SetRemoteUserCategories", "9": "RefreshRemoteSessionWeights"}}
{"uuid": "fdb3a030-065f-11d1-bb9b-00a024ea5525", "service": "qmcomm"}
{"uuid": "fdf8a2b9-02de-47f4-bc26-aa85ab5e5267", "service": "ITpmVirtualSmartCardManager2", "opcodes": {"5": "CreateVirtualSmartCardWithPinPolicy"}}

66
scripts/extract_dce_rpc_interfaces.py
Unescape Escape View File

@ -0,0 +1,66 @@
#!/usr/bin/env python3
"""Extract DCE-RPC interface metadata from the Zeek consts documentation and
emit it as NDJSON, one interface (UUID) per line:
{"uuid": "<uuid>", "service": "<service>", "opcodes": {"<opnum>": "<procedure>", ...}}
The source documents two kinds of entries, both keyed by interface UUID:
["<uuid>"] = "<service>", # interface -> service name
["<uuid>", <opnum>] = "<procedure>", # (interface, opnum) -> procedure name
They are merged here so each UUID appears once, with its service name and the
full opnum -> procedure map nested under "opcodes". Opcodes use the opnum as a
(string) key so the runtime can deserialize straight into a HashMap<u16, String>
keyed by opnum -- the direction lookups actually query.
The final output is saved in rust/src/dcerpc/dcerpc_interfaces.json
"""
import json
import re
import sys
RST_PATH = "doc/scripts/base/protocols/dce-rpc/consts.zeek.rst"
# ["943991a5-...-656ee34b"] = "IWRMMachineGroup",
SERVICE_RE = re.compile(r'\["([0-9a-fA-F-]+)"\]\s*=\s*"([^"]*)"')
# ["367abb81-...-98f038001003", 16] = "OpenServiceW",
PROCEDURE_RE = re.compile(r'\["([0-9a-fA-F-]+)",\s*(\d+)\]\s*=\s*"([^"]*)"')
def main(path=RST_PATH):
services = {} # uuid -> service name
opcodes = {} # uuid -> {opnum: procedure name}
with open(path) as f:
for line in f:
# A procedure line also contains a '[uuid",' prefix, so try the
# more specific (uuid, opnum) pattern first.
m = PROCEDURE_RE.search(line)
if m:
uuid, opnum, procedure = m.groups()
opcodes.setdefault(uuid.lower(), {})[int(opnum)] = procedure
continue
m = SERVICE_RE.search(line)
if m:
uuid, service = m.groups()
services[uuid.lower()] = service
# Every UUID that has opcodes is expected to also have a service name;
# fail loudly if the source ever violates that so we never emit a record
# the runtime cannot deserialize.
orphans = sorted(set(opcodes) - set(services))
if orphans:
sys.exit(f"opcodes without a service name: {', '.join(orphans)}")
for uuid in sorted(services):
entry = {"uuid": uuid, "service": services[uuid]}
ops = opcodes.get(uuid)
if ops:
# Stringify and sort by opnum for stable, diff-friendly output.
entry["opcodes"] = {str(n): ops[n] for n in sorted(ops)}
sys.stdout.write(json.dumps(entry) + "\n")
if __name__ == "__main__":
main(*sys.argv[1:])
Write Preview
Loading…
Cancel
Save