2.2.7.1.2 Response

The NT_TRANSACT_CREATE response format is a special case of SMB_COM_NT_TRANSACT (section 2.2.4.62) SMB. The NT_TRANSACT_CREATE response specifics are described here. The outcome of the request is returned in the Status field of the SMB Header (section 2.2.3.1).

 NT_Trans_Parameters
   {
   UCHAR         OpLockLevel;
   UCHAR         Reserved;
   USHORT        FID;
   ULONG         CreateAction;
   ULONG         EAErrorOffset;
   FILETIME      CreationTime;
   FILETIME      LastAccessTime;
   FILETIME      LastWriteTime;
   FILETIME      LastChangeTime;
   SMB_EXT_FILE_ATTR ExtFileAttributes;
   LARGE_INTEGER AllocationSize;
   LARGE_INTEGER EndOfFile;
   USHORT        ResourceType;
   SMB_NMPIPE_STATUS NMPipeStatus;
   UCHAR         Directory;
   }
  

NT_Trans_Parameters (69 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
OpLockLevel								Reserved								FID
CreateAction
EAErrorOffset
CreationTime
...
LastAccessTime
...
LastWriteTime
...
LastChangeTime
...
ExtFileAttributes
AllocationSize
...
EndOfFile
...
ResourceType																NMPipeStatus
Directory

OpLockLevel (1 byte): UCHAR The OpLock level granted to the client process.

Value	Meaning
0x00	No OpLock granted.
0x01	Exclusive OpLock granted.
0x02	Batch OpLock granted.
0x03	Level II OpLock granted.

Reserved (1 byte): UCHAR Reserved and MUST be zero (0x00).

FID (2 bytes): USHORT The file ID value representing the file or directory that was created or opened.

CreateAction (4 bytes): ULONG The action taken in establishing the open. This field MUST contain one of the following values:

Value	Meaning
FILE_SUPERSEDED 0x00000000	An existing file was deleted and a new file was created in its place.
FILE_OPENED 0x00000001	An existing file was opened.
FILE_CREATED 0x00000002	A new file was created.
FILE_OVERWRITTEN 0x00000003	An existing file was overwritten.

EAErrorOffset (4 bytes): ULONG Offset of the extended attribute that caused an error if an error occurred with an extended attribute.

CreationTime (8 bytes): FILETIME A 64-bit integer value representing the time that the file was created. The time value is a signed 64-bit integer representing either an absolute time or a time interval. Times are specified in units of 100ns. A positive value expresses an absolute time, where the base time (the 64- bit integer with value 0) is the beginning of the year 1601 AD in the Gregorian calendar. A negative value expresses a time interval relative to some base time, usually the current time.

LastAccessTime (8 bytes): FILETIME The time that the file was last accessed, encoded in the same format as CreationTime.

LastWriteTime (8 bytes): FILETIME The time that the file was last written, encoded in the same format as CreationTime.

LastChangeTime (8 bytes): FILETIME The time that the file was last changed, encoded in the same format as CreationTime.

ExtFileAttributes (4 bytes): This field contains the extended file attributes the file, encoded as an SMB_EXT_FILE_ATTR (section 2.2.1.2.3) data type.

AllocationSize (8 bytes): LARGE_INTEGER The number of bytes allocated to the file by the server.

EndOfFile (8 bytes): LARGE_INTEGER The end of file offset value.

ResourceType (2 bytes): The file type. This field MUST be interpreted as follows.

Name and value	Meaning
FileTypeDisk 0x0000	File or directory
FileTypeByteModePipe 0x0001	Byte mode named pipe
FileTypeMessageModePipe 0x0002	Message mode named pipe
FileTypePrinter 0x0003	Printer device
FileTypeUnknown 0xFFFF	Unknown file type

NMPipeStatus (2 bytes):  A 16-bit field that shows the status of the named pipe if the resource type created is a named pipe. This field is formatted as an SMB_NMPIPE_STATUS (section 2.2.1.3).

Directory (1 byte): UCHAR If the returned FID represents a directory, the server MUST set this value to a nonzero (0x00) value. If the FID is not a directory, the server MUST set this value to 0x00 (FALSE).

NT_Trans_Data

The server does not return any NT_Trans data.

Error Codes