Wireshark · Ethereal-dev: [Ethereal-dev] DCE-RPC Return Code dissecting

["Chuck L. Peterson" <clp@xxxxxxxxxx>]

Here's some info on DCE-RPC error codes. I'm not familiar with
ethereal or samba DCE, so it will be a while before I'm able to come
up with source changes for this.

The defines below from rpcsts.h seem to be the DCE/RPC Endpoint Mapper
error code values.

Talking to W2K, my packet gets back the error code 0x16c9a0d6, which
is DCE-rpc-0214 using the decoding instructions below. I can find no
lookup code for 0214 anywhere.

Here's a description of the error code encoding from:
  http://lost-contact.mit.edu/afs/net/project/afs32/transarc/public/hbalish/html/trouble.html

> The first hex digit is 1 for DCE, 2 for DFS, and 3 for Encina The next
> four hex digits are a quasi-base-40 encoding of the component name.
> For example, in "rpc", "r" is the 18th letter of the alphabet, "p" is
> the 16th letter, and "c" is the third. Do this calculation:
>
> (18 - 1) * 40 * 40 + (16 - 1) * 40 + (3 - 1) = 0x6c9a
>
> Finally, the last 3 hex digits are a translation of the terminal error
> number. In "DCE-rpc-0022", decimal 0022 is hex 016. So, "DCE-rpc-0022"
> is hex 0x16c9a016.

0x16c9a0d6 is 382312662, defined as ept_s_not_registered below. That's
definitely the correct error in my case.

#define rpc_s_mod 382312448
#define rpc_s_op_rng_error 382312449
#define rpc_s_cant_create_sock 382312450
#define rpc_s_cant_bind_sock 382312451
#define rpc_s_not_in_call 382312452
#define rpc_s_no_port 382312453
#define rpc_s_wrong_boot_time 382312454
#define rpc_s_too_many_sockets 382312455
#define rpc_s_illegal_register 382312456
#define rpc_s_cant_recv 382312457
#define rpc_s_bad_pkt 382312458
#define rpc_s_unbound_handle 382312459
#define rpc_s_addr_in_use 382312460
#define rpc_s_in_args_too_big 382312461
#define rpc_s_string_too_long 382312462
#define rpc_s_too_many_objects 382312463
#define rpc_s_binding_has_no_auth 382312464
#define rpc_s_unknown_authn_service 382312465
#define rpc_s_no_memory 382312466
#define rpc_s_cant_nmalloc 382312467
#define rpc_s_call_faulted 382312468
#define rpc_s_call_failed 382312469
#define rpc_s_comm_failure 382312470
#define rpc_s_rpcd_comm_failure 382312471
#define rpc_s_illegal_family_rebind 382312472
#define rpc_s_invalid_handle 382312473
#define rpc_s_coding_error 382312474
#define rpc_s_object_not_found 382312475
#define rpc_s_cthread_not_found 382312476
#define rpc_s_invalid_binding 382312477
#define rpc_s_already_registered 382312478
#define rpc_s_endpoint_not_found 382312479
#define rpc_s_invalid_rpc_protseq 382312480
#define rpc_s_desc_not_registered 382312481
#define rpc_s_already_listening 382312482
#define rpc_s_no_protseqs 382312483
#define rpc_s_no_protseqs_registered 382312484
#define rpc_s_no_bindings 382312485
#define rpc_s_max_descs_exceeded 382312486
#define rpc_s_no_interfaces 382312487
#define rpc_s_invalid_timeout 382312488
#define rpc_s_cant_inq_socket 382312489
#define rpc_s_invalid_naf_id 382312490
#define rpc_s_inval_net_addr 382312491
#define rpc_s_unknown_if 382312492
#define rpc_s_unsupported_type 382312493
#define rpc_s_invalid_call_opt 382312494
#define rpc_s_no_fault 382312495
#define rpc_s_cancel_timeout 382312496
#define rpc_s_call_cancelled 382312497
#define rpc_s_invalid_call_handle 382312498
#define rpc_s_cannot_alloc_assoc 382312499
#define rpc_s_cannot_connect 382312500
#define rpc_s_connection_aborted 382312501
#define rpc_s_connection_closed 382312502
#define rpc_s_cannot_accept 382312503
#define rpc_s_assoc_grp_not_found 382312504
#define rpc_s_stub_interface_error 382312505
#define rpc_s_invalid_object 382312506
#define rpc_s_invalid_type 382312507
#define rpc_s_invalid_if_opnum 382312508
#define rpc_s_different_server_instance 382312509
#define rpc_s_protocol_error 382312510
#define rpc_s_cant_recvmsg 382312511
#define rpc_s_invalid_string_binding 382312512
#define rpc_s_connect_timed_out 382312513
#define rpc_s_connect_rejected 382312514
#define rpc_s_network_unreachable 382312515
#define rpc_s_connect_no_resources 382312516
#define rpc_s_rem_network_shutdown 382312517
#define rpc_s_too_many_rem_connects 382312518
#define rpc_s_no_rem_endpoint 382312519
#define rpc_s_rem_host_down 382312520
#define rpc_s_host_unreachable 382312521
#define rpc_s_access_control_info_inv 382312522
#define rpc_s_loc_connect_aborted 382312523
#define rpc_s_connect_closed_by_rem 382312524
#define rpc_s_rem_host_crashed 382312525
#define rpc_s_invalid_endpoint_format 382312526
#define rpc_s_unknown_status_code 382312527
#define rpc_s_unknown_mgr_type 382312528
#define rpc_s_assoc_creation_failed 382312529
#define rpc_s_assoc_grp_max_exceeded 382312530
#define rpc_s_assoc_grp_alloc_failed 382312531
#define rpc_s_sm_invalid_state 382312532
#define rpc_s_assoc_req_rejected 382312533
#define rpc_s_assoc_shutdown 382312534
#define rpc_s_tsyntaxes_unsupported 382312535
#define rpc_s_context_id_not_found 382312536
#define rpc_s_cant_listen_sock 382312537
#define rpc_s_no_addrs 382312538
#define rpc_s_cant_getpeername 382312539
#define rpc_s_cant_get_if_id 382312540
#define rpc_s_protseq_not_supported 382312541
#define rpc_s_call_orphaned 382312542
#define rpc_s_who_are_you_failed 382312543
#define rpc_s_unknown_reject 382312544
#define rpc_s_type_already_registered 382312545
#define rpc_s_stop_listening_disabled 382312546
#define rpc_s_invalid_arg 382312547
#define rpc_s_not_supported 382312548
#define rpc_s_wrong_kind_of_binding 382312549
#define rpc_s_authn_authz_mismatch 382312550
#define rpc_s_call_queued 382312551
#define rpc_s_cannot_set_nodelay 382312552
#define rpc_s_not_rpc_tower 382312553
#define rpc_s_invalid_rpc_protid 382312554
#define rpc_s_invalid_rpc_floor 382312555
#define rpc_s_call_timeout 382312556
#define rpc_s_mgmt_op_disallowed 382312557
#define rpc_s_manager_not_entered 382312558
#define rpc_s_calls_too_large_for_wk_ep 382312559
#define rpc_s_server_too_busy 382312560
#define rpc_s_prot_version_mismatch 382312561
#define rpc_s_rpc_prot_version_mismatch 382312562
#define rpc_s_ss_no_import_cursor 382312563
#define rpc_s_fault_addr_error 382312564
#define rpc_s_fault_context_mismatch 382312565
#define rpc_s_fault_fp_div_by_zero 382312566
#define rpc_s_fault_fp_error 382312567
#define rpc_s_fault_fp_overflow 382312568
#define rpc_s_fault_fp_underflow 382312569
#define rpc_s_fault_ill_inst 382312570
#define rpc_s_fault_int_div_by_zero 382312571
#define rpc_s_fault_int_overflow 382312572
#define rpc_s_fault_invalid_bound 382312573
#define rpc_s_fault_invalid_tag 382312574
#define rpc_s_fault_pipe_closed 382312575
#define rpc_s_fault_pipe_comm_error 382312576
#define rpc_s_fault_pipe_discipline 382312577
#define rpc_s_fault_pipe_empty 382312578
#define rpc_s_fault_pipe_memory 382312579
#define rpc_s_fault_pipe_order 382312580
#define rpc_s_fault_remote_comm_failure 382312581
#define rpc_s_fault_remote_no_memory 382312582
#define rpc_s_fault_unspec 382312583
#define uuid_s_bad_version 382312584
#define uuid_s_socket_failure 382312585
#define uuid_s_getconf_failure 382312586
#define uuid_s_no_address 382312587
#define uuid_s_overrun 382312588
#define uuid_s_internal_error 382312589
#define uuid_s_coding_error 382312590
#define uuid_s_invalid_string_uuid 382312591
#define uuid_s_no_memory 382312592
#define rpc_s_no_more_entries 382312593
#define rpc_s_unknown_ns_error 382312594
#define rpc_s_name_service_unavailable 382312595
#define rpc_s_incomplete_name 382312596
#define rpc_s_group_not_found 382312597
#define rpc_s_invalid_name_syntax 382312598
#define rpc_s_no_more_members 382312599
#define rpc_s_no_more_interfaces 382312600
#define rpc_s_invalid_name_service 382312601
#define rpc_s_no_name_mapping 382312602
#define rpc_s_profile_not_found 382312603
#define rpc_s_not_found 382312604
#define rpc_s_no_updates 382312605
#define rpc_s_update_failed 382312606
#define rpc_s_no_match_exported 382312607
#define rpc_s_entry_not_found 382312608
#define rpc_s_invalid_inquiry_context 382312609
#define rpc_s_interface_not_found 382312610
#define rpc_s_group_member_not_found 382312611
#define rpc_s_entry_already_exists 382312612
#define rpc_s_nsinit_failure 382312613
#define rpc_s_unsupported_name_syntax 382312614
#define rpc_s_no_more_elements 382312615
#define rpc_s_no_ns_privilege 382312616
#define rpc_s_invalid_inquiry_type 382312617
#define rpc_s_profile_element_not_found 382312618
#define rpc_s_profile_element_replaced 382312619
#define rpc_s_import_already_done 382312620
#define rpc_s_database_busy 382312621
#define rpc_s_invalid_import_context 382312622
#define rpc_s_uuid_set_not_found 382312623
#define rpc_s_uuid_member_not_found 382312624
#define rpc_s_no_interfaces_exported 382312625
#define rpc_s_tower_set_not_found 382312626
#define rpc_s_tower_member_not_found 382312627
#define rpc_s_obj_uuid_not_found 382312628
#define rpc_s_no_more_bindings 382312629
#define rpc_s_invalid_priority 382312630
#define rpc_s_not_rpc_entry 382312631
#define rpc_s_invalid_lookup_context 382312632
#define rpc_s_binding_vector_full 382312633
#define rpc_s_cycle_detected 382312634
#define rpc_s_nothing_to_export 382312635
#define rpc_s_nothing_to_unexport 382312636
#define rpc_s_invalid_vers_option 382312637
#define rpc_s_no_rpc_data 382312638
#define rpc_s_mbr_picked 382312639
#define rpc_s_not_all_objs_unexported 382312640
#define rpc_s_no_entry_name 382312641
#define rpc_s_priority_group_done 382312642
#define rpc_s_partial_results 382312643
#define rpc_s_no_env_setup 382312644
#define twr_s_unknown_sa 382312645
#define twr_s_unknown_tower 382312646
#define twr_s_not_implemented 382312647
#define rpc_s_max_calls_too_small 382312648
#define rpc_s_cthread_create_failed 382312649
#define rpc_s_cthread_pool_exists 382312650
#define rpc_s_cthread_no_such_pool 382312651
#define rpc_s_cthread_invoke_disabled 382312652
#define ept_s_cant_perform_op 382312653
#define ept_s_no_memory 382312654
#define ept_s_database_invalid 382312655
#define ept_s_cant_create 382312656
#define ept_s_cant_access 382312657
#define ept_s_database_already_open 382312658
#define ept_s_invalid_entry 382312659
#define ept_s_update_failed 382312660
#define ept_s_invalid_context 382312661
#define ept_s_not_registered 382312662
#define ept_s_server_unavailable 382312663
#define rpc_s_underspecified_name 382312664
#define rpc_s_invalid_ns_handle 382312665
#define rpc_s_unknown_error 382312666
#define rpc_s_ss_char_trans_open_fail 382312667
#define rpc_s_ss_char_trans_short_file 382312668
#define rpc_s_ss_context_damaged 382312669
#define rpc_s_ss_in_null_context 382312670
#define rpc_s_socket_failure 382312671
#define rpc_s_unsupported_authn_level 382312672
#define rpc_s_invalid_checksum 382312673
#define rpc_s_invalid_credentials 382312674
#define rpc_s_credentials_too_large 382312675
#define rpc_s_call_id_not_found 382312676
#define rpc_s_key_id_not_found 382312677
#define rpc_s_auth_bad_integrity 382312678
#define rpc_s_auth_tkt_expired 382312679
#define rpc_s_auth_tkt_nyv 382312680
#define rpc_s_auth_repeat 382312681
#define rpc_s_auth_not_us 382312682
#define rpc_s_auth_badmatch 382312683
#define rpc_s_auth_skew 382312684
#define rpc_s_auth_badaddr 382312685
#define rpc_s_auth_badversion 382312686
#define rpc_s_auth_msg_type 382312687
#define rpc_s_auth_modified 382312688
#define rpc_s_auth_badorder 382312689
#define rpc_s_auth_badkeyver 382312690
#define rpc_s_auth_nokey 382312691
#define rpc_s_auth_mut_fail 382312692
#define rpc_s_auth_baddirection 382312693
#define rpc_s_auth_method 382312694
#define rpc_s_auth_badseq 382312695
#define rpc_s_auth_inapp_cksum 382312696
#define rpc_s_auth_field_toolong 382312697
#define rpc_s_invalid_crc 382312698
#define rpc_s_binding_incomplete 382312699
#define rpc_s_key_func_not_allowed 382312700
#define rpc_s_unknown_stub_rtl_if_vers 382312701
#define rpc_s_unknown_ifspec_vers 382312702