4.8.1 Client Request Buffer

The client request buffer for the RopSetSearchCriteria ROP ([MS-OXCROPS] section 2.2.4.4) example consists of a 316-byte sequence, formatted as follows.

 0000: 30 00 01 29 01 00 02 00-00 07 00 02 03 02 00 01
 0010: 00 1F 00 1A 00 1F 00 1A-00 49 00 50 00 4D 00 2E
 0020: 00 41 00 70 00 70 00 6F-00 69 00 6E 00 74 00 6D
 0030: 00 65 00 6E 00 74 00 00-00 02 03 02 00 01 00 1F
 0040: 00 1A 00 1F 00 1A 00 49-00 50 00 4D 00 2E 00 43
 0050: 00 6F 00 6E 00 74 00 61-00 63 00 74 00 00 00 02
 0060: 03 02 00 01 00 1F 00 1A-00 1F 00 1A 00 49 00 50
 0070: 00 4D 00 2E 00 44 00 69-00 73 00 74 00 4C 00 69
 0080: 00 73 00 74 00 00 00 02-03 02 00 01 00 1F 00 1A
 0090: 00 1F 00 1A 00 49 00 50-00 4D 00 2E 00 41 00 63
 00A0: 00 74 00 69 00 76 00 69-00 74 00 79 00 00 00 02
 00B0: 03 02 00 01 00 1F 00 1A-00 1F 00 1A 00 49 00 50
 00C0: 00 4D 00 2E 00 53 00 74-00 69 00 63 00 6B 00 79
 00D0: 00 4E 00 6F 00 74 00 65-00 00 00 02 03 00 00 01
 00E0: 00 1F 00 1A 00 1F 00 1A-00 49 00 50 00 4D 00 2E
 00F0: 00 54 00 61 00 73 00 6B-00 00 00 02 03 02 00 01
 0100: 00 1F 00 1A 00 1F 00 1A-00 49 00 50 00 4D 00 2E
 0110: 00 54 00 61 00 73 00 6B-00 2E 00 00 00 00 01 00
 0120: 04 04 03 00 17 00 03 00-17 00 02 00 00 00 01 00
 0130: 01 00 00 00 00 00 14 88-2A 00 02 00

The first three bytes of the request buffer map to the RopId and LogonID fields, as described in [MS-OXCROPS] section 2.2.4.4.1, and the InputHandleIndex field, as specified in section 2.2.1.4.1, of the RopSetSearchCriteria ROP format.

  
 0000: 30 00 01

RopId: 0x30 (RopSetSearchCriteria ROP)

LogonID: 0x00

InputHandleIndex: 0x01. The location where the handle for the search folder to configure is stored.

The next 299 bytes comprise the restriction that defines the search criteria for the search folder, broken down in further detail as follows.

  
 0003: 29 01 00 02 00 00 07 00-02 03 02 00 01 00 1F 00
 0013: 1A 00 1F 00 1A 00 49 00-50 00 4D 00 2E 00 41 00
 0023: 70 00 70 00 6F 00 69 00-6E 00 74 00 6D 00 65 00
 0033: 6E 00 74 00 00 00 02 03-02 00 01 00 1F 00 1A 00
 0043: 1F 00 1A 00 49 00 50 00-4D 00 2E 00 43 00 6F 00
 0053: 6E 00 74 00 61 00 63 00-74 00 00 00 02 03 02 00
 0063: 01 00 1F 00 1A 00 1F 00-1A 00 49 00 50 00 4D 00
 0073: 2E 00 44 00 69 00 73 00-74 00 4C 00 69 00 73 00
 0083: 74 00 00 00 02 03 02 00-01 00 1F 00 1A 00 1F 00
 0093: 1A 00 49 00 50 00 4D 00-2E 00 41 00 63 00 74 00
 00A3: 69 00 76 00 69 00 74 00-79 00 00 00 02 03 02 00
 00B3: 01 00 1F 00 1A 00 1F 00-1A 00 49 00 50 00 4D 00
 00C3: 2E 00 53 00 74 00 69 00-63 00 6B 00 79 00 4E 00
 00D3: 6F 00 74 00 65 00 00 00-02 03 00 00 01 00 1F 00
 00E3: 1A 00 1F 00 1A 00 49 00-50 00 4D 00 2E 00 54 00
 00F3: 61 00 73 00 6B 00 00 00-02 03 02 00 01 00 1F 00
 0103: 1A 00 1F 00 1A 00 49 00-50 00 4D 00 2E 00 54 00
 0113: 61 00 73 00 6B 00 2E 00-00 00 00 01 00 04 04 03
 0123: 00 17 00 03 00 17 00 02-00 00 00

RestrictionDataSize: 0x0129. The size of the restriction block is 297 bytes.

RestrictionData: Bytes 0005-012A, which translate into the following restriction:

RestrictType: 0x00 (RES_AND)

RestrictCount: 0x0002

RestrictType: 0x00 (RES_AND)

RestrictCount: 0x0007

RestrictType: 0x02 (RES_NOT)

RestrictType: 0x03 (RES_CONTENT)

FuzzyLevel: 0x00010002 (FL_PREFIX | FL_IGNORECASE)

PropTag1: 0x001A001F (PidTagMessageClass property ([MS-OXCMSG] section 2.2.1.3))

PropTag2: 0x001A001F (PidTagMessageClass property)

PropRule: "IPM.Appointment"

RestrictType: 0x02 RES_NOT)

RestrictType: 0x03 (RES_CONTENT)

FuzzyLevel: 0x00010002 (FL_PREFIX | FL_IGNORECASE)

PropTag1: 0x001A001F" (PidTagMessageClass property)

PropTag2: "0x001A001F " (PidTagMessageClass property)

PropRule: "IPM.Contact"

RestrictType: 0x02 (RES_NOT)

RestrictType: 0x03 (RES_CONTENT)

FuzzyLevel: 0x00010002 (FL_PREFIX | FL_IGNORECASE)

PropTag1: 0x001A001F (PidTagMessageClass property)

PropTag2: 0x001A001F (PidTagMessageClass property)

PropRule: "IPM.DistList"

RestrictType: 0x02 (RES_NOT)

RestrictType: 0x03 (RES_CONTENT)

FuzzyLevel: 0x00010002 (FL_PREFIX | FL_IGNORECASE)

PropTag1: 0x001A001F (PidTagMessageClass property)

PropTag2: 0x001A001F (PidTagMessageClass property)

PropRule:  "IPM.Activity"

RestrictType: 0x02 (RES_NOT)

RestrictType: 0x03 (RES_CONTENT)

FuzzyLevel: 0x00010002 (FL_PREFIX | FL_IGNORECASE)

PropTag1: 0x001A001F (PidTagMessageClass property)

PropTag2: 0x001A001F (PidTagMessageClass property)

PropRule: "IPM.StickyNote"

RestrictType: 0x02 (RES_NOT)

RestrictType: 0x03 (RES_CONTENT)

FuzzyLevel: 0x00010000 (FL_FULLSTRING | FL_IGNORECASE)

PropTag1: 0x001A001F (PidTagMessageClass property)

PropTag2: 0x001A001F (PidTagMessageClass property)

PropRule: "IPM.Task"

RestrictType: 0x02 (RES_NOT)

RestrictType: 0x03 (RES_CONTENT)

FuzzyLevel: 0x00010002 (FL_PREFIX | FL_IGNORECASE)

PropTag1: 0x001A001F (PidTagMessageClass property)

PropTag2: 0x001A001F (PidTagMessageClass property)

PropRule: "IPM.Task. "

RestrictType: 0x00 (RES_AND)

RestrictCount: 0x0001

RestrictType: 0x04 (RES_PROPERTY)

RelOp: 0x04 (RELOP_EQ)

PropTag1: 0x00170003 (PidTagImportance property ([MS-OXCMSG] section 2.2.1.11))

PropTag2: 0x00170003 (PidTagImportance property)

PropValue: 0x00000002

A shorthand description of the restriction is as follows:

(PidTagMessageClass is not equal to "IPM.Appointment" AND

PidTagMessageClass is not equal to "IPM.Contact" AND

PidTagMessageClass is not equal to "IPM.DistList" AND

PidTagMessageClass is not equal to "IPM.Activity" AND

PidTagMessageClass is not equal to "IPM.StickyNote" AND

PidTagMessageClass is not equal to "IPM.Task" AND

PidTagMessageClass is not equal to "IPM.Task.")

AND (PidTagImportance is equal to 0x00000002)

The next 10 bytes consist of the FolderIdCount and FolderIds fields, as described in section 2.2.1.4.1.

  
 012E: 01 00 01 00 00 00 00 00-14 88

FolderIdCount: 0x0001. The number of folders within the scope of the search folder.

FolderIds: 0001-000000001488. Identifies the folder to be searched.

The remaining four bytes represent the SearchFlags field, as described in section 2.2.1.4.1.

  
 0138: 2A 00 02 00

SearchFlags: 0x0002002A (RESTART_SEARCH | SHALLOW_SEARCH | BACKGROUND_SEARCH | NON_CONTENT_INDEXED_SEARCH)

Show: