4.4 Structure Example of LSAPR_TRUSTED_DOMAIN_AUTH_BLOB

The following is an annotated dump of LSAPR_TRUSTED_DOMAIN_AUTH_BLOB.

 00000000  93 1e 54 57 83 78 c6 c1 15 f1 13 85 3d 93 18 1d  ..TW.x......=...
 00000010  b4 eb ee 6b fa 79 f5 2e 8d cb b4 e3 e3 54 8a 81  ...k.y.......T..
 00000020  b6 38 0f 6c 4d 6b 2b 36 4f a5 ce d8 82 44 52 23  .8.lMk+6O....DR#
 00000030  fc 40 b4 fd e2 71 78 95 f4 d5 29 e1 11 7a 8c 67  .@...qx...)..z.g
 00000040  2f 3d 69 a3 54 cd 47 79 ca 3f a8 a9 4f 08 85 9d  /=i.T.Gy.?..O...
 00000050  93 fb 56 0b db 84 9e bb da c4 fd 58 3d 88 55 c7  ..V........X=.U.
 00000060  bb 5a 2d aa e3 26 23 a5 12 b1 1c 23 1a aa 72 26  .Z-..&#....#..r&
 00000070  9f 57 b2 89 be 37 ec 32 83 25 6c fe 7c ae 09 2b  .W...7.2.%l.|..+
 00000080  27 15 20 01 c2 7a d3 2a e1 e5 5e 0c 16 17 10 4d  '. ..z.*..^....M
 00000090  6a dc 9b 3e 09 43 5a 66 8e 17 4c 27 d1 40 9b 19  j..>.CZf..L'.@..
 000000a0  82 ab d4 81 07 83 78 98 78 a1 f8 2a b2 9b 7c 5f  ......x.x..*..|_
 000000b0  81 6f 11 37 e1 e5 90 4b 47 b4 0d 9a ac 3b 35 40  .o.7...KG....;5@
 000000c0  79 45 04 0e 59 07 67 ea f2 ea 57 c2 5d 25 03 94  yE..Y.g...W.]%..
 000000d0  46 35 7c 1f 01 e4 89 d9 1b 9d fe 94 e8 9e 3f 4e  F5|...........?N
 000000e0  b1 18 43 2f 27 a7 f1 0a ff 1d 42 e2 ce 54 f9 2a  ..C/'.....B..T.*
 000000f0  b9 b2 43 81 f0 ed 22 2d e0 a0 37 2a c1 19 67 f0  ..C..."-..7*..g.
 00000100  fa 5f 37 0a 9f 58 90 77 eb 0a 95 1c fe 5f a0 e7  ._7..X.w....._..
 00000110  dc 4f 28 fa 18 d7 22 23 9b 54 e7 fd e5 ed 67 a2  .O(..."#.T....g.
 00000120  da a4 3d cb 0b f3 5a ce e9 dd de 0b d6 e7 e5 91  ..=...Z.........
 00000130  92 20 8f ac 2f bc be 11 55 b1 5e 0a 79 ed 00 4a  . ../...U.^.y..J
 00000140  e6 94 34 8e 29 09 ef b5 2e 36 62 73 84 4d 4a 77  ..4.)....6bs.MJw
 00000150  3f df 9a 6f 4f 3c 3e 1a 11 e7 1c 8d 84 43 2e 1a  ?..oO<>......C..
 00000160  aa 59 88 96 47 0b f0 6d 29 27 7b 68 c2 7b 2e be  .Y..G..m)'{h.{..
 00000170  03 07 43 bf 8a 96 80 30 b9 1c 1e 36 e4 c0 d1 a6  ..C....0...6....
 00000180  a0 35 75 71 d5 ac f1 a3 1c d4 29 ee 40 50 68 93  .5uq......).@Ph.
 00000190  02 e7 aa 96 43 c2 46 1d cd f3 ba 9c 94 ff f6 74  ....C.F........t
 000001a0  3c 19 5f f6 1d 1c 11 42 ff 3e 34 0b 94 48 dc de  <._....B.>4..H..
 000001b0  5d 74 7e 33 d8 cd 58 20 20 38 1a d5 e4 b6 fd 1d  ]t~3..X  8......
 000001c0  c3 a7 ef 40 82 11 4c dc 2b 7e b4 ea 1a 85 ce f8  ...@..L.+~......
 000001d0  87 a3 ed 20 ff 50 4f ee 6c c3 b1 4c 2a 17 96 61  ... .PO.l..L*..a
 000001e0  bc 5b 5e 17 52 d0 92 9e 11 70 d0 1d 98 a7 56 fa  .[^.R....p....V.
 000001f0  69 95 6c 78 22 34 70 03 75 77 60 c5 3b 2f 42 e0  i.lx"4p.uw`.;/B.
 00000200  01 00 00 00 0c 00 00 00 30 00 00 00 49 42 b8 1c  ........0...IB..
 00000210  b4 55 c9 01 02 00 00 00 11 00 00 00 4f 75 74 67  .U..........Outg
 00000220  6f 69 6e 67 41 75 74 68 49 6e 66 6f 00 00 00 00  oingAuthInfo....
 00000230  49 42 b8 1c b4 55 c9 01 02 00 00 00 19 00 00 00  IB...U..........
 00000240  4f 75 74 67 6f 69 6e 67 50 72 65 76 69 6f 75 73  OutgoingPrevious
 00000250  41 75 74 68 49 6e 66 6f 00 00 00 00 01 00 00 00  AuthInfo........
 00000260  0c 00 00 00 30 00 00 00 49 42 b8 1c b4 55 c9 01  ....0...IB...U..
 00000270  02 00 00 00 11 00 00 00 49 6e 63 6f 6d 69 6e 67  ........Incoming
 00000280  41 75 74 68 49 6e 66 6f 00 00 00 00 49 42 b8 1c  AuthInfo....IB..
 00000290  b4 55 c9 01 02 00 00 00 19 00 00 00 49 6e 63 6f  .U..........Inco
 000002a0  6d 69 6e 67 50 72 65 76 69 6f 75 73 41 75 74 68  mingPreviousAuth
 000002b0  49 6e 66 6f 00 00 00 00 5c 00 00 00 5c 00 00 00  Info....\...\...

The LSAPR_TRUSTED_DOMAIN_AUTH_BLOB leads with 512 bytes of random data:

 00000000  93 1e 54 57 83 78 c6 c1 15 f1 13 85 3d 93 18 1d  ..TW.x......=...
 00000010  b4 eb ee 6b fa 79 f5 2e 8d cb b4 e3 e3 54 8a 81  ...k.y.......T..
 00000020  b6 38 0f 6c 4d 6b 2b 36 4f a5 ce d8 82 44 52 23  .8.lMk+6O....DR#
 00000030  fc 40 b4 fd e2 71 78 95 f4 d5 29 e1 11 7a 8c 67  .@...qx...)..z.g
 00000040  2f 3d 69 a3 54 cd 47 79 ca 3f a8 a9 4f 08 85 9d  /=i.T.Gy.?..O...
 00000050  93 fb 56 0b db 84 9e bb da c4 fd 58 3d 88 55 c7  ..V........X=.U.
 00000060  bb 5a 2d aa e3 26 23 a5 12 b1 1c 23 1a aa 72 26  .Z-..&#....#..r&
 00000070  9f 57 b2 89 be 37 ec 32 83 25 6c fe 7c ae 09 2b  .W...7.2.%l.|..+
 00000080  27 15 20 01 c2 7a d3 2a e1 e5 5e 0c 16 17 10 4d  '. ..z.*..^....M
 00000090  6a dc 9b 3e 09 43 5a 66 8e 17 4c 27 d1 40 9b 19  j..>.CZf..L'.@..
 000000a0  82 ab d4 81 07 83 78 98 78 a1 f8 2a b2 9b 7c 5f  ......x.x..*..|_
 000000b0  81 6f 11 37 e1 e5 90 4b 47 b4 0d 9a ac 3b 35 40  .o.7...KG....;5@
 000000c0  79 45 04 0e 59 07 67 ea f2 ea 57 c2 5d 25 03 94  yE..Y.g...W.]%..
 000000d0  46 35 7c 1f 01 e4 89 d9 1b 9d fe 94 e8 9e 3f 4e  F5|...........?N
 000000e0  b1 18 43 2f 27 a7 f1 0a ff 1d 42 e2 ce 54 f9 2a  ..C/'.....B..T.*
 000000f0  b9 b2 43 81 f0 ed 22 2d e0 a0 37 2a c1 19 67 f0  ..C..."-..7*..g.
 00000100  fa 5f 37 0a 9f 58 90 77 eb 0a 95 1c fe 5f a0 e7  ._7..X.w....._..
 00000110  dc 4f 28 fa 18 d7 22 23 9b 54 e7 fd e5 ed 67 a2  .O(..."#.T....g.
 00000120  da a4 3d cb 0b f3 5a ce e9 dd de 0b d6 e7 e5 91  ..=...Z.........
 00000130  92 20 8f ac 2f bc be 11 55 b1 5e 0a 79 ed 00 4a  . ../...U.^.y..J
 00000140  e6 94 34 8e 29 09 ef b5 2e 36 62 73 84 4d 4a 77  ..4.)....6bs.MJw
 00000150  3f df 9a 6f 4f 3c 3e 1a 11 e7 1c 8d 84 43 2e 1a  ?..oO<>......C..
 00000160  aa 59 88 96 47 0b f0 6d 29 27 7b 68 c2 7b 2e be  .Y..G..m)'{h.{..
 00000170  03 07 43 bf 8a 96 80 30 b9 1c 1e 36 e4 c0 d1 a6  ..C....0...6....
 00000180  a0 35 75 71 d5 ac f1 a3 1c d4 29 ee 40 50 68 93  .5uq......).@Ph.
 00000190  02 e7 aa 96 43 c2 46 1d cd f3 ba 9c 94 ff f6 74  ....C.F........t
 000001a0  3c 19 5f f6 1d 1c 11 42 ff 3e 34 0b 94 48 dc de  <._....B.>4..H..
 000001b0  5d 74 7e 33 d8 cd 58 20 20 38 1a d5 e4 b6 fd 1d  ]t~3..X  8......
 000001c0  c3 a7 ef 40 82 11 4c dc 2b 7e b4 ea 1a 85 ce f8  ...@..L.+~......
 000001d0  87 a3 ed 20 ff 50 4f ee 6c c3 b1 4c 2a 17 96 61  ... .PO.l..L*..a
 000001e0  bc 5b 5e 17 52 d0 92 9e 11 70 d0 1d 98 a7 56 fa  .[^.R....p....V.
 000001f0  69 95 6c 78 22 34 70 03 75 77 60 c5 3b 2f 42 e0  i.lx"4p.uw`.;/B.

The data following that is for CountOutgoingAuthInfos, in little-endian byte order:

 00000200  01 00 00 00  ....

This indicates that there is one entry present in the CurrentOutgoingAuthInfos field.

The data following that is for ByteOffsetCurrentOutgoingAuthInfo, in little-endian byte order:

 00000204  0c 00 00 00  ....

This means that the byte offset from the beginning of CountOutgoingAuthInfos to the start of the CurrentOutgoingAuthInfos field is 0x0000000c.

The data following that is for ByteOffsetPreviousOutgoingAuthInfo, in little-endian byte order:

 00000208  30 00 00 00  0...

This means that the byte offset from the beginning of CountOutgoingAuthInfos to the start of the PreviousOutgoingAuthInfos field is 0x00000030, so the size of CurrentOutgoingAuthInfos is 0x30 – 0xc = 0x24 bytes.

The data following that is for CurrentOutgoingAuthInfos; the last 3 padding bytes are for data alignment purposes:

 0000020c                                      49 42 b8 1c              IB..
 00000210  b4 55 c9 01 02 00 00 00 11 00 00 00 4f 75 74 67  .U..........Outg
 00000220  6f 69 6e 67 41 75 74 68 49 6e 66 6f 00 00 00 00  oingAuthInfo....

This is an array of CountOutgoingAuthInfos of LSAPR_AUTH_INFORMATION (section 2.2.7.17) entries in self-relative format.

The data following that is for PreviousOutgoingAuthInfos; the last 3 padding bytes are for data alignment purposes:

 00000230  49 42 b8 1c b4 55 c9 01 02 00 00 00 19 00 00 00  IB...U..........
 00000240  4f 75 74 67 6f 69 6e 67 50 72 65 76 69 6f 75 73  OutgoingPrevious
 00000250  41 75 74 68 49 6e 66 6f 00 00 00 00              AuthInfo....

This is an array of CountOutgoingAuthInfos of LSAPR_AUTH_INFORMATION entries in self-relative format.

The data following that is for CountIncomingAuthInfos, in little-endian byte order:

 0000025c  01 00 00 00  ....

This means there is one entry present in the CountIncomingAuthInfos field.

The data following that is for ByteOffsetCurrentIncomingAuthInfo, in little-endian byte order:

 00000260  0c 00 00 00  ....

This means that the byte offset from the beginning of CountIncomingAuthInfos to the start of the CurrentIncomingAuthInfos field is 0x0000000c.

The data following that is for ByteOffsetPreviousIncomingAuthInfo, in little-endian byte order:

 00000264  30 00 00 00  0...

This means that the byte offset from the beginning of CountIncomingAuthInfos to the start of the PreviousIncomingAuthInfos field is 0x00000030, so the size of CurrentIncomingAuthInfos is 0x30 – 0xc = 0x24 bytes.

The data following that is for CurrentIncomingAuthInfos; the last 3 padding bytes are for data alignment purposes:

 00000268                          49 42 b8 1c b4 55 c9 01          IB...U..
 00000270  02 00 00 00 11 00 00 00 49 6e 63 6f 6d 69 6e 67  ........Incoming
 00000280  41 75 74 68 49 6e 66 6f 00 00 00 00              AuthInfo....

This is an array of CountIncomingAuthInfos of LSAPR_AUTH_INFORMATION entries in self-relative format.

The data following that is for PreviousIncomingAuthInfos; the last 3 padding bytes are for data alignment purposes:

 0000028c                                      49 42 b8 1c              IB..
 00000290  b4 55 c9 01 02 00 00 00 19 00 00 00 49 6e 63 6f  .U..........Inco
 000002a0  6d 69 6e 67 50 72 65 76 69 6f 75 73 41 75 74 68  mingPreviousAuth
 000002b0  49 6e 66 6f 00 00 00 00                          Info....

This is an array of CountIncomingAuthInfos of LSAPR_AUTH_INFORMATION entries in self-relative format.

The data following that is for OutgoingAuthInfoSize, in little-endian byte order:

 000002b8  5c 00 00 00  \...

This means that the size, in bytes, of the sub-portion of the structure from the beginning of the CountOutgoingAuthInfos field through the end of the of the PreviousOutgoingAuthInfos field is 0x0000005c.

The data following that is for IncomingAuthInfoSize, in little-endian byte order:

 000002bc  5c 00 00 00  \...

This means that the size, in bytes, of the sub-portion of the structure from the beginning of the CountIncomingAuthInfos field through the end of the of the PreviousIncomingAuthInfos field is 0x0000005c.

Show: