[Snort-devel] [PATCH 4/5]: dcerpc2: Add bitmasking support for calculated bytes (byte_extract, byte_jump), and bitwise OR (byte_test)

Joshua.Kinard at ...3108... Joshua.Kinard at ...3108...
Fri Apr 29 00:44:16 EDT 2011


Since dcerpc2 overrides the three byte-frobbing options with its own
versions if the 'dce' parameter is specified, I have tried to match the
changes introduced in the first three patches to the variants defined in
dcerpc2.  However, I do not have a very good testcase to actually verify
the logic.  It does compile, but this may need a second pair of eyeballs
to make sure I touched all the right places.

Cheers!

--J
-------------- next part --------------
A non-text attachment was scrubbed...
Name: snort-2905-dcerpc2-bitmasking.patch
Type: application/octet-stream
Size: 4692 bytes
Desc: snort-2905-dcerpc2-bitmasking.patch
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20110428/8ebfa021/attachment.obj>


More information about the Snort-devel mailing list