Partager via

2.2.3.3 Data Block

  • Article

The general structure of the data block is similar to that of the Parameter block, except that the length of the buffer portion is measured in bytes.

 SMB_Data
   {
   USHORT ByteCount;
   UCHAR  Bytes[ByteCount] (variable);
   }


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

ByteCount

Bytes (variable)

...

ByteCount (2 bytes): The size, in bytes, of the Bytes field. This field can be 0x0000, indicating that the Bytes field is empty. Because the SMB_Parameters.Words field is unaligned and the SMB_Data.ByteCount field is two bytes in size, the first byte of SMB_Data.Bytes is also unaligned.

Bytes (variable): The message-specific data structure. The size of this field MUST be ByteCount bytes. If ByteCount is 0x0000, this field is not included.