7 commits

Author	SHA1	Message	Date
Seth Hall	68d0f697eb	Move some of the last DCE_RPC scripts out of SMB scripts.	2016-04-03 15:48:47 -04:00
Seth Hall	ff3437d157	Clean up and moving a few SMB2 commands out into their own files. ... I assume that the upcoming SMB lock thing might be something related to the SMB2 LOCK command...	2016-04-01 22:45:07 -04:00
Seth Hall	dbb4404b7d	Improve DCE_RPC logging reliability.	2016-04-01 16:53:17 -04:00
Seth Hall	b1f8f0c099	Improvements for DCE_RPC ... - Binding context versions are provided correctly now. - RPC stubs are no longer provided and instead only the length is given. - Some parsing problems related to handling the optional auth fields in RPC messages are fixed. This removes some dpd log messages I was seeing.	2016-04-01 14:48:07 -04:00
Seth Hall	03d5b655af	Add epmapper operations to dce_rpc scripts.	2016-04-01 13:01:23 -04:00
Seth Hall	086519e851	Adding more dcerpc operations and fixing a bug with how log records are handled.	2016-04-01 10:16:02 -04:00
Seth Hall	5721db4be7	Lots of cleanup and improvement to DCE/RPC analyzer. ... - It works with DCE/RPC over SMB1+2 now. - Using named pipes in 1+2 and the transaction cmd in SMB1. - Base scripts based on work by Josh Liburdi. - New dce_rpc.log. Feedback on how to make this log more compact and useful would be appreciated.	2016-04-01 09:38:52 -04:00