2.2.4.48.1 Request

 SMB_Parameters
   {
   UCHAR  WordCount;
   Words
     {
     USHORT SearchHandle;
     }
   }
 SMB_Data
   {
   USHORT ByteCount;
   }

SMB_Header:

TID (2 bytes): A valid TID MUST be provided. The TID MUST refer to a connected server share.

UID (2 bytes): A valid UID MUST be provided and MUST match the UID used to initiate the directory search.

SMB_Parameters (3 bytes):

WordCount (1 byte): This field MUST be 0x01.

Words (2 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
SID

SID (2 bytes): A search handle, also known as a Search ID (SID). This MUST be the SID value returned in the initial TRANS2_FIND_FIRST2 subcommand request.

SMB_Data (2 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
ByteCount

ByteCount (2 bytes): This field MUST be 0x0000. No data is sent by this message.