4.4.1.1 Client Request Buffer

  • Article

A complete RopOpenStream ROP request buffer ([MS-OXCROPS] section 2.2.9.1) is nine bytes in length, formatted as follows. 

 0000: 2B 01 00 01 02 01 9A 0E-01

The first four bytes of the buffer refer to the RopId, LogonId, InputHandleIndex, and OutputHandleIndex fields of the RopOpenStream ROP.

 0000: 2B 01 00 01

RopId: 0x2B (RopOpenStream)

LogonId: 0x01

InputHandleIndex: 0x00

OutputHandleIndex: 0x01. Index in the Server object handle table for the object created by this ROP.

The next five bytes refer to the PropertyTag and OpenModeFlags fields defined in section 2.2.14.1.

 0004: 02 01 9A 0E-01

PropertyTag: 0x0E9A0102 (PidTagExtendedRuleMessageCondition ([MS-OXORULE] section 2.2.4.1.10))

OpenModeFlags: 0x01. ReadWrite mode