Client Request Buffer

A complete ROP request buffer is a variable length sequence, with 10 required bytes and 5 bytes for each sorting flag used. An example of the ROP request buffer is as follows:

 0000: 13 00 00 00 02 00 01 00-01 00 1f 30 08 80 00 40
 0010: 00 06 0e 01

The first 3 bytes of the ROP request buffer are the RopId, LogonID, and InputHandleIndex fields of the RopSortTable ROP, as described in [MS-OXCROPS] section

 0000: 13 00 00

RopId: 0x13 (RopSortTable)

LogonID: 0x00

InputHandleIndex: 0x00. Index in handle array for the table to be sorted.

The next 7 bytes are the SortTableFlags, SortOrderCount, CategoryCount, and ExpandedCount fields defined in section

 0003: 00 02 00 01 00 01 00

SortTableFlags: 0x00. Perform the operation synchronously.

SortOrderCount: 0x0002. Number of sort order structures to follow.

CategoryCount: 0x0001. There is one category column.

ExpandedCount: 0x0001. All categories are expanded.

The remaining bytes are the SortOrders field, which contain properties to sort by (where there has to be exactly the number of properties given in the SortOrderCount field) and a sorting method (defined in section

 000a: 1f 30 08 80 00 40 00 06-0e 01

PropertyTag: 0x8008301F (PidTagAddressBookIsMemberOfDistributionList ([MS-OXOABK] section

Order: 0x00 (Flag: TABLE_SORT_ASCEND)

PropertyTag: 0x0E060040 (PidTagMessageDeliveryTime ([MS-OXOMSG] section

Order: 0x01 (Flag: TABLE_SORT_DESCEND)