4.7 RopBackoff ROP Response

  • Article

In the RopBackoff ROP response scenario, the client has sent a RopOpenFolder ROP request (section 2.2.4.1) and a RopCreateFolder ROP request (section 2.2.4.2) in the same input buffer. The output buffer contains a RopBackoff ROP response (section 2.2.15.2) and a successful RopOpenFolder ROP response. The RopBackoff ROP response contains information about only the RopCreateFolder ROP. The server is including the RopBackoff ROP response because it is too busy to complete processing of the RopCreateFolder ROP request. 

 18 00 02 01 00 00 00 00 00 00 F9 00 00 00 00 00 01 1C 17 4F 04 00 00 00 0A 00 00 00 24 00 00 00

RopSize: 18 00

Rops:

RopId: 02 (RopOpenFolder)

OutputHandleIndex: 01

ReturnValue: 00 00 00 00 (success response for RopOpenFolder)

HasRules: 00

IsGhosted: 00

RopId: F9 (RopBackoff)

LogonId: 00

Duration: 00 00 00 00

BackoffRopCount: 01

RopIdBackoff: 1C (RopCreateFolder)

Duration: 17 4F 04 00 (Suggested time in milliseconds before retrying RopCreateFolder)

AdditionalDataSize: 00 00

ServerObjectHandleTable:

0A 00 00 00 (Handle 0, unused)

24 00 00 00 (Handle 1, output of RopOpenFolder)