samba - Aug 2003 - Samba joining Samba-based NT-Domain w/ 2.2

Hi,
I'm having terrible difficulties getting Samba to cooperate. I have the
following scenario:
Samba 2.2.3 set up as a PDC on a linux machine (turing, with the domain
set to DEFAULTDOMAIN), working fine with a win2k client.
Now I wish to join a Samba 2.2 linux machine was a domain member server
(moog), and I can't seem to convince samba to do what I want it to.

moog$ is set up on the PDC in /etc/passwd and in smbpasswd (added via
smbpasswd -a -m moog$). When I try to add moog to the domain via

moog:~# smbpasswd -j DEFAULTDOMAIN -r TURING -Uroot%XXXX

I get the following error:

error looking up rid for user moog$: NT_STATUS_NONE_MAPPED
Unable to join domain DEFAULTDOMAIN.

So, what does this mean? The logfiles aren't very helpful, all they say
is that root logged in successfully with root permissions (on the PDC).
No relevant log messages on moog at all.

Grateful for any help whatsoever.

Regs,
Sven

-- 
Sven Riedel                      sr@gimp.org
Liebigstr. 38 
30163 Hannover                  "Python is merely Perl for those who
                                 prefer Pascal to C" (anon)

Hi,
I'm still having the problem mentioned in the previous mail. I've
switched samba server machines, running on a different hardware, linux
distribution and samba version (2.2.7a), and rebuilt smb.conf from
scratch, but the problem persists.

The entry for the clientmachine in the servers /etc/passwd:
moog$:x:1017:100::/dev/null:/bin/false

and the entry in /etc/samba/smbpasswd:
moog$:1017:9ED6A7413B978B2AAAD3B435B51404EE:99A406CCACC644EADBA417B9957C3E51:[W 
         ]:LCT-3F545337:

The root-account in /etc/samba/smbpasswd:
root:0:315B02FDD7121D6FAAD3B435B51404EE:D1CD4A77400159A23C47CE7E8808513D:[UX    
     ]:LCT-3F51ADC6:

I went through the troubleshooting section of the howto, and everything
works fine, except for the actual joining of the domain (i.e. I can
nmblookup everything, I can attach to a share via smbclient, etc).

I've attached the debug output of 
smbpasswd -D 5 -r TURING -j DEFAULTDOMAIN -U root%XXX

maybe someone will see what's wrong. As stated before, windows 2000
machines have no problem joining the domain whatsoever, only samba
clients seem to have this problem.

Regs,
Sven


-- 
Sven Riedel                      sr@gimp.org
Liebigstr. 38 
30163 Hannover                  "Python is merely Perl for those who
                                 prefer Pascal to C" (anon)
-------------- next part --------------
added interface ip=192.168.13.1 bcast=192.168.13.255 nmask=255.255.255.0
resolve_lmhosts: Attempting lmhosts lookup for name TURING<0x20>
startlmhosts: Can't open lmhosts file /etc/samba/lmhosts. Error was No such
file or directory
resolve_hosts: Attempting host lookup for name TURING<0x20>
cli_establish_connection: MOOG<00> connecting to TURING<20>
(192.168.13.3) - root [DEFAULTDOMAIN]
Connecting to 192.168.13.3 at port 445
error connecting to 192.168.13.3:445 (Connection refused)
Connecting to 192.168.13.3 at port 139
socket option SO_KEEPALIVE = 0
socket option SO_REUSEADDR = 0
socket option SO_BROADCAST = 0
socket option TCP_NODELAY = 1
socket option IPTOS_LOWDELAY = 16
socket option IPTOS_THROUGHPUT = 16
socket option SO_SNDBUF = 8192
socket option SO_RCVBUF = 8192
socket option SO_SNDLOWAT = 1
socket option SO_RCVLOWAT = 1
socket option SO_SNDTIMEO = 0
socket option SO_RCVTIMEO = 0
Sent session request
size=0
smb_com=0x0
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=0
smb_tid=0
smb_pid=0
smb_uid=0
smb_mid=0
smt_wct=0
smb_bcc=0
size=91
smb_com=0x72
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=0
smb_pid=2683
smb_uid=0
smb_mid=1
smt_wct=17
smb_vwv[0]=6 (0x6)
smb_vwv[1]=12803 (0x3203)
smb_vwv[2]=256 (0x100)
smb_vwv[3]=65280 (0xFF00)
smb_vwv[4]=255 (0xFF)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=256 (0x100)
smb_vwv[7]=54272 (0xD400)
smb_vwv[8]=52 (0x34)
smb_vwv[9]=63744 (0xF900)
smb_vwv[10]=3 (0x3)
smb_vwv[11]=32768 (0x8000)
smb_vwv[12]=391 (0x187)
smb_vwv[13]=18177 (0x4701)
smb_vwv[14]=50033 (0xC371)
smb_vwv[15]=34817 (0x8801)
smb_vwv[16]=2303 (0x8FF)
smb_bcc=22
size=91
smb_com=0x72
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=0
smb_pid=2683
smb_uid=0
smb_mid=1
smt_wct=17
smb_vwv[0]=6 (0x6)
smb_vwv[1]=12803 (0x3203)
smb_vwv[2]=256 (0x100)
smb_vwv[3]=65280 (0xFF00)
smb_vwv[4]=255 (0xFF)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=256 (0x100)
smb_vwv[7]=54272 (0xD400)
smb_vwv[8]=52 (0x34)
smb_vwv[9]=63744 (0xF900)
smb_vwv[10]=3 (0x3)
smb_vwv[11]=32768 (0x8000)
smb_vwv[12]=391 (0x187)
smb_vwv[13]=18177 (0x4701)
smb_vwv[14]=50033 (0xC371)
smb_vwv[15]=34817 (0x8801)
smb_vwv[16]=2303 (0x8FF)
smb_bcc=22
size=87
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=0
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=3
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=0 (0x0)
smb_bcc=46
size=87
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=0
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=3
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=0 (0x0)
smb_bcc=46
session setup ok
Domain=[DEFAULTDOMAIN] OS=[Unix] Server=[Samba 2.2.3a-12 for Debian]
size=49
smb_com=0x75
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=3
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=1 (0x1)
smb_bcc=8
size=103
smb_com=0xa2
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=34
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=32512 (0x7F00)
smb_vwv[3]=373 (0x175)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_vwv[12]=0 (0x0)
smb_vwv[13]=0 (0x0)
smb_vwv[14]=0 (0x0)
smb_vwv[15]=0 (0x0)
smb_vwv[16]=0 (0x0)
smb_vwv[17]=0 (0x0)
smb_vwv[18]=0 (0x0)
smb_vwv[19]=0 (0x0)
smb_vwv[20]=0 (0x0)
smb_vwv[21]=32768 (0x8000)
smb_vwv[22]=0 (0x0)
smb_vwv[23]=0 (0x0)
smb_vwv[24]=0 (0x0)
smb_vwv[25]=0 (0x0)
smb_vwv[26]=0 (0x0)
smb_vwv[27]=0 (0x0)
smb_vwv[28]=0 (0x0)
smb_vwv[29]=0 (0x0)
smb_vwv[30]=0 (0x0)
smb_vwv[31]=512 (0x200)
smb_vwv[32]=65280 (0xFF00)
smb_vwv[33]=5 (0x5)
smb_bcc=0
Bind RPC Pipe[757f]: \PIPE\lsarpc
Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB  EF 00 01 23 45 67 89 AB 
xW4.4... ...#Eg..
[010] 00 00 00 00                                       .... 
Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60 
.]...... ....+.H`
[010] 02 00 00 00                                       .... 
000000 smb_io_rpc_hdr hdr
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 0b
    0003 flags     : 00
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0048
    000a auth_len  : 0000
    000c call_id   : 00000001
000010 smb_io_rpc_hdr_rb 
        0010 max_tsize: 1630
        0012 max_rsize: 1630
        0014 assoc_gid: 00000000
    0018 num_elements: 00000001
    001c context_id  : 0000
    001e num_syntaxes: 01
        0020 data   : 12345778
        0024 data   : 1234
        0026 data   : abcd
        0028 data   : ef 00 01 23 45 67 89 ab 
        0030 version: 00000000
        0034 data   : 8a885d04
        0038 data   : 1ceb
        003a data   : 11c9
        003c data   : 9f e8 08 00 2b 10 48 60 
        0044 version: 00000002
rpc_api_pipe: cmd:26 fnum:757f
size=146
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=72 (0x48)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=72 (0x48)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=72 (0x48)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30079 (0x757F)
smb_bcc=79
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
rpc_check_hdr: rdata->data_size = 68
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 0c
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0044
    000a auth_len  : 0000
    000c call_id   : 00000001
rpc_api_pipe: len left: 0 smbtrans read: 68
rpc_pipe_bind: rpc_api_pipe returned OK.
000010 smb_io_rpc_hdr_ba 
        0010 max_tsize: 1630
        0012 max_rsize: 1630
        0014 assoc_gid: 000053f0
        0018 len: 000c
        001a str: \PIPE\lsass.
        0028 num_results: 01
        002c result     : 0000
        002e reason     : 0000
        0030 data   : 8a885d04
        0034 data   : 1ceb
        0036 data   : 11c9
        0038 data   : 9f e8 08 00 2b 10 48 60 
        0040 version: 00000002
bind_rpc_pipe: server pipe_name found: \PIPE\lsass
bind_rpc_pipe: accepted!
init_lsa_sec_qos
init_open_pol: attr:0 da:33554432
init_lsa_obj_attr
000000 lsa_io_q_open_pol 
    0000 ptr       : 00000001
    0004 system_name: 005c
        0008 len         : 00000018
        000c ptr_root_dir: 00000000
        0010 ptr_obj_name: 00000000
        0014 attributes  : 00000000
        0018 ptr_sec_desc: 00000000
        001c ptr_sec_qos : 00000001
            0020 len           : 0000000c
            0024 sec_imp_level : 0002
            0026 sec_ctxt_mode : 01
            0027 effective_only: 00
            0028 unknown       : 02000000
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x6 data_len: 0x44
000000 smb_io_rpc_hdr hdr    
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 00
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0044
    000a auth_len  : 0000
    000c call_id   : 00000002
000010 smb_io_rpc_hdr_req hdr_req
    0010 alloc_hint: 00000034
    0014 context_id: 0000
    0016 opnum     : 0006
rpc_api_pipe: cmd:26 fnum:757f
size=142
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=68 (0x44)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=68 (0x44)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30079 (0x757F)
smb_bcc=75
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
rpc_check_hdr: rdata->data_size = 48
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 02
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0030
    000a auth_len  : 0000
    000c call_id   : 00000002
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
    0010 alloc_hint: 00000018
    0014 context_id: 0000
    0016 cancel_ct : 00
    0017 reserved  : 00
rpc_api_pipe: len left: 0 smbtrans read: 48
000018 lsa_io_r_open_pol 
        0018 data1: 00000000
        001c data2: 00000001
        0020 data3: 0000
        0022 data4: 0000
        0024 data5: ab 81 54 3f d4 34 00 00 
    002c status: NT_STATUS_OK
init_q_query
000000 lsa_io_q_query 
        0000 data1: 00000000
        0004 data2: 00000001
        0008 data3: 0000
        000a data4: 0000
        000c data5: ab 81 54 3f d4 34 00 00 
    0014 info_class: 0005
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x7 data_len: 0x2e
000000 smb_io_rpc_hdr hdr    
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 00
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 002e
    000a auth_len  : 0000
    000c call_id   : 00000003
000010 smb_io_rpc_hdr_req hdr_req
    0010 alloc_hint: 0000001e
    0014 context_id: 0000
    0016 opnum     : 0007
rpc_api_pipe: cmd:26 fnum:757f
size=120
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=46 (0x2E)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=46 (0x2E)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=46 (0x2E)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30079 (0x757F)
smb_bcc=53
size=102
smb_com=0x25
smb_rcls=5
smb_reh=0
smb_err=32768
smb_flg=136
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=46 (0x2E)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=46 (0x2E)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=47
size=102
smb_com=0x25
smb_rcls=5
smb_reh=0
smb_err=32768
smb_flg=136
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=46 (0x2E)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=46 (0x2E)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=47
rpc_check_hdr: rdata->data_size = 46
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 02
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0074
    000a auth_len  : 0000
    000c call_id   : 00000003
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
    0010 alloc_hint: 0000005c
    0014 context_id: 0000
    0016 cancel_ct : 00
    0017 reserved  : 00
rpc_api_pipe: len left: 70 smbtrans read: 46
rpc_read: data_to_read: 70 rdata offset: 46 extra_data_size: 70
rpc_read: grew buffer by 70 bytes to 116
size=129
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=12
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=70 (0x46)
smb_vwv[6]=59 (0x3B)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_bcc=70
rpc_read: num_read = 70, read offset: 0, to read: 70
000018 lsa_io_r_query 
    0018 undoc_buffer: 22000000
    001c info_class: 0005
        0020 uni_dom_max_len: 001a
        0022 uni_dom_str_len: 001c
        0024 buffer_dom_name: 00000001
        0028 buffer_dom_sid : 00000001
            002c uni_max_len: 0000000e
            0030 undoc      : 00000000
            0034 uni_str_len: 0000000d
            0038 buffer     : D.E.F.A.U.L.T.D.O.M.A.I.N.
            0054 num_auths: 00000004
                0058 sid_rev_num: 01
                0059 num_auths  : 04
                005a id_auth[0] : 00
                005b id_auth[1] : 00
                005c id_auth[2] : 00
                005d id_auth[3] : 00
                005e id_auth[4] : 00
                005f id_auth[5] : 05
                0060 sub_auths : 00000015 e871dbef 4b80203d f35c5cf2 
    0070 status: NT_STATUS_OK
init_lsa_q_close
000000 lsa_io_q_close 
        0000 data1: 00000000
        0004 data2: 00000001
        0008 data3: 0000
        000a data4: 0000
        000c data5: ab 81 54 3f d4 34 00 00 
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x0 data_len: 0x2c
000000 smb_io_rpc_hdr hdr    
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 00
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 002c
    000a auth_len  : 0000
    000c call_id   : 00000004
000010 smb_io_rpc_hdr_req hdr_req
    0010 alloc_hint: 0000001c
    0014 context_id: 0000
    0016 opnum     : 0000
rpc_api_pipe: cmd:26 fnum:757f
size=118
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=44 (0x2C)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=44 (0x2C)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30079 (0x757F)
smb_bcc=51
size=100
smb_com=0x25
smb_rcls=5
smb_reh=0
smb_err=32768
smb_flg=136
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
size=100
smb_com=0x25
smb_rcls=5
smb_reh=0
smb_err=32768
smb_flg=136
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
rpc_check_hdr: rdata->data_size = 44
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 02
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0030
    000a auth_len  : 0000
    000c call_id   : 00000004
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
    0010 alloc_hint: 00000018
    0014 context_id: 0000
    0016 cancel_ct : 00
    0017 reserved  : 00
rpc_api_pipe: len left: 4 smbtrans read: 44
rpc_read: data_to_read: 4 rdata offset: 44 extra_data_size: 4
rpc_read: grew buffer by 4 bytes to 48
size=63
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=12
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=4 (0x4)
smb_vwv[6]=59 (0x3B)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_bcc=4
rpc_read: num_read = 4, read offset: 0, to read: 4
000018 lsa_io_r_close 
        0018 data1: 00000000
        001c data2: 00000000
        0020 data3: 0000
        0022 data4: 0000
        0024 data5: 00 00 00 00 00 00 00 00 
    002c status: NT_STATUS_OK
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=0
smb_bcc=0
size=103
smb_com=0xa2
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=34
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=32768 (0x8000)
smb_vwv[3]=373 (0x175)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_vwv[12]=0 (0x0)
smb_vwv[13]=0 (0x0)
smb_vwv[14]=0 (0x0)
smb_vwv[15]=0 (0x0)
smb_vwv[16]=0 (0x0)
smb_vwv[17]=0 (0x0)
smb_vwv[18]=0 (0x0)
smb_vwv[19]=0 (0x0)
smb_vwv[20]=0 (0x0)
smb_vwv[21]=32768 (0x8000)
smb_vwv[22]=0 (0x0)
smb_vwv[23]=0 (0x0)
smb_vwv[24]=0 (0x0)
smb_vwv[25]=0 (0x0)
smb_vwv[26]=0 (0x0)
smb_vwv[27]=0 (0x0)
smb_vwv[28]=0 (0x0)
smb_vwv[29]=0 (0x0)
smb_vwv[30]=0 (0x0)
smb_vwv[31]=512 (0x200)
smb_vwv[32]=65280 (0xFF00)
smb_vwv[33]=5 (0x5)
smb_bcc=0
Bind RPC Pipe[7580]: \PIPE\samr
Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB  EF 00 01 23 45 67 89 AC 
xW4.4... ...#Eg..
[010] 01 00 00 00                                       .... 
Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60 
.]...... ....+.H`
[010] 02 00 00 00                                       .... 
000000 smb_io_rpc_hdr hdr
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 0b
    0003 flags     : 00
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0048
    000a auth_len  : 0000
    000c call_id   : 00000005
000010 smb_io_rpc_hdr_rb 
        0010 max_tsize: 1630
        0012 max_rsize: 1630
        0014 assoc_gid: 00000000
    0018 num_elements: 00000001
    001c context_id  : 0000
    001e num_syntaxes: 01
        0020 data   : 12345778
        0024 data   : 1234
        0026 data   : abcd
        0028 data   : ef 00 01 23 45 67 89 ac 
        0030 version: 00000001
        0034 data   : 8a885d04
        0038 data   : 1ceb
        003a data   : 11c9
        003c data   : 9f e8 08 00 2b 10 48 60 
        0044 version: 00000002
rpc_api_pipe: cmd:26 fnum:7580
size=146
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=72 (0x48)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=72 (0x48)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=72 (0x48)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30080 (0x7580)
smb_bcc=79
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
rpc_check_hdr: rdata->data_size = 68
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 0c
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0044
    000a auth_len  : 0000
    000c call_id   : 00000005
rpc_api_pipe: len left: 0 smbtrans read: 68
rpc_pipe_bind: rpc_api_pipe returned OK.
000010 smb_io_rpc_hdr_ba 
        0010 max_tsize: 1630
        0012 max_rsize: 1630
        0014 assoc_gid: 000053f0
        0018 len: 000c
        001a str: \PIPE\lsass.
        0028 num_results: 01
        002c result     : 0000
        002e reason     : 0000
        0030 data   : 8a885d04
        0034 data   : 1ceb
        0036 data   : 11c9
        0038 data   : 9f e8 08 00 2b 10 48 60 
        0040 version: 00000002
bind_rpc_pipe: server pipe_name found: \PIPE\lsass
bind_rpc_pipe: accepted!
init_samr_q_connect
000000 samr_io_q_connect 
    0000 ptr_srv_name: 00000001
        0004 uni_max_len: 00000007
        0008 undoc      : 00000000
        000c uni_str_len: 00000007
        0010 buffer     : T.U.R.I.N.G...
    0020 access_mask: 02000000
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x39 data_len: 0x3c
000000 smb_io_rpc_hdr hdr    
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 00
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 003c
    000a auth_len  : 0000
    000c call_id   : 00000006
000010 smb_io_rpc_hdr_req hdr_req
    0010 alloc_hint: 0000002c
    0014 context_id: 0000
    0016 opnum     : 0039
rpc_api_pipe: cmd:26 fnum:7580
size=134
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=60 (0x3C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=60 (0x3C)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=60 (0x3C)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30080 (0x7580)
smb_bcc=67
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
rpc_check_hdr: rdata->data_size = 48
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 02
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0030
    000a auth_len  : 0000
    000c call_id   : 00000006
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
    0010 alloc_hint: 00000018
    0014 context_id: 0000
    0016 cancel_ct : 00
    0017 reserved  : 00
rpc_api_pipe: len left: 0 smbtrans read: 48
000018 samr_io_r_connect 
        0018 data1: 00000000
        001c data2: 00000002
        0020 data3: 0000
        0022 data4: 0000
        0024 data5: ab 81 54 3f d4 34 00 00 
    002c status: NT_STATUS_OK
samr_init_samr_q_open_domain
000000 samr_io_q_open_domain 
        0000 data1: 00000000
        0004 data2: 00000002
        0008 data3: 0000
        000a data4: 0000
        000c data5: ab 81 54 3f d4 34 00 00 
    0014 flags: 02000000
        0018 num_auths: 00000004
            001c sid_rev_num: 01
            001d num_auths  : 04
            001e id_auth[0] : 00
            001f id_auth[1] : 00
            0020 id_auth[2] : 00
            0021 id_auth[3] : 00
            0022 id_auth[4] : 00
            0023 id_auth[5] : 05
            0024 sub_auths : 00000015 e871dbef 4b80203d f35c5cf2 
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x7 data_len: 0x4c
000000 smb_io_rpc_hdr hdr    
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 00
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 004c
    000a auth_len  : 0000
    000c call_id   : 00000007
000010 smb_io_rpc_hdr_req hdr_req
    0010 alloc_hint: 0000003c
    0014 context_id: 0000
    0016 opnum     : 0007
rpc_api_pipe: cmd:26 fnum:7580
size=150
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=76 (0x4C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=76 (0x4C)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=76 (0x4C)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30080 (0x7580)
smb_bcc=83
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
rpc_check_hdr: rdata->data_size = 48
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 02
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0030
    000a auth_len  : 0000
    000c call_id   : 00000007
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
    0010 alloc_hint: 00000018
    0014 context_id: 0000
    0016 cancel_ct : 00
    0017 reserved  : 00
rpc_api_pipe: len left: 0 smbtrans read: 48
000018 samr_io_r_open_domain 
        0018 data1: 00000000
        001c data2: 00000003
        0020 data3: 0000
        0022 data4: 0000
        0024 data5: ab 81 54 3f d4 34 00 00 
    002c status: NT_STATUS_OK
samr_init_samr_q_create_user
000000 samr_io_q_create_user 
        0000 data1: 00000000
        0004 data2: 00000003
        0008 data3: 0000
        000a data4: 0000
        000c data5: ab 81 54 3f d4 34 00 00 
        0014 uni_str_len: 000a
        0016 uni_max_len: 000a
        0018 buffer     : 00000001
        001c uni_max_len: 00000005
        0020 undoc      : 00000000
        0024 uni_str_len: 00000005
        0028 buffer     : m.o.o.g.$.
    0034 acb_info   : 00000080
    0038 access_mask: e005000b
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x32 data_len: 0x54
000000 smb_io_rpc_hdr hdr    
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 00
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0054
    000a auth_len  : 0000
    000c call_id   : 00000008
000010 smb_io_rpc_hdr_req hdr_req
    0010 alloc_hint: 00000044
    0014 context_id: 0000
    0016 opnum     : 0032
rpc_api_pipe: cmd:26 fnum:7580
size=158
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=84 (0x54)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=84 (0x54)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=84 (0x54)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30080 (0x7580)
smb_bcc=91
size=112
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=56 (0x38)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=56 (0x38)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=57
size=112
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=56 (0x38)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=56 (0x38)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=57
rpc_check_hdr: rdata->data_size = 56
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 02
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 0038
    000a auth_len  : 0000
    000c call_id   : 00000008
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
    0010 alloc_hint: 00000020
    0014 context_id: 0000
    0016 cancel_ct : 00
    0017 reserved  : 00
rpc_api_pipe: len left: 0 smbtrans read: 56
000018 samr_io_r_create_user 
        0018 data1: 00000000
        001c data2: 00000000
        0020 data3: 0000
        0022 data4: 0000
        0024 data5: 00 00 00 00 00 00 00 00 
    002c unknown_0: 00000000
    0030 user_rid : 00000000
    0034 status: NT_STATUS_USER_EXISTS
init_samr_q_lookup_names
000000 samr_io_q_lookup_names 
        0000 data1: 00000000
        0004 data2: 00000003
        0008 data3: 0000
        000a data4: 0000
        000c data5: ab 81 54 3f d4 34 00 00 
    0014 num_names1: 00000001
    0018 flags     : 000003e8
    001c ptr       : 00000000
    0020 num_names2: 00000001
        0024 uni_str_len: 000a
        0026 uni_max_len: 000a
        0028 buffer     : 00000001
        002c uni_max_len: 00000005
        0030 undoc      : 00000000
        0034 uni_str_len: 00000005
        0038 buffer     : m.o.o.g.$.
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x11 data_len: 0x5a
000000 smb_io_rpc_hdr hdr    
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 00
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 005a
    000a auth_len  : 0000
    000c call_id   : 00000009
000010 smb_io_rpc_hdr_req hdr_req
    0010 alloc_hint: 0000004a
    0014 context_id: 0000
    0016 opnum     : 0011
rpc_api_pipe: cmd:26 fnum:7580
size=164
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=16385
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=90 (0x5A)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=90 (0x5A)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=74 (0x4A)
smb_vwv[11]=90 (0x5A)
smb_vwv[12]=74 (0x4A)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=30080 (0x7580)
smb_bcc=97
size=100
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
size=100
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
rpc_check_hdr: rdata->data_size = 44
000000 smb_io_rpc_hdr rpc_hdr   
    0000 major     : 05
    0001 minor     : 00
    0002 pkt_type  : 02
    0003 flags     : 03
    0004 pack_type0: 10
    0005 pack_type1: 00
    0006 pack_type2: 00
    0007 pack_type3: 00
    0008 frag_len  : 002c
    000a auth_len  : 0000
    000c call_id   : 00000009
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
    0010 alloc_hint: 00000014
    0014 context_id: 0000
    0016 cancel_ct : 00
    0017 reserved  : 00
rpc_api_pipe: len left: 0 smbtrans read: 44
000018 samr_io_r_lookup_names 
    0018 num_rids1: 00000000
    001c ptr_rids : 00000000
    0020 num_types1: 00000000
    0024 ptr_types : 00000000
    0028 status: NT_STATUS_NONE_MAPPED
error looking up rid for user moog$: NT_STATUS_NONE_MAPPED
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=1
smb_pid=2683
smb_uid=100
smb_mid=1
smt_wct=0
smb_bcc=0