4.5.2.1 Client Request Buffer

A complete ROP request buffer is a 13-byte sequence, formatted as follows:

 0000: 59 00 01 00 00 01 00 00-00 00 f1 88 bd

The first 3 bytes of the ROP request buffer are the RopId, LogonID, and InputHandleIndex fields of the RopExpandRow ROP, as described in [MS-OXCROPS] section 2.2.5.16.1.

  
 0000: 59 00 00

RopId: 0x59 (RopExpandRow ([MS-OXCROPS] section 2.2.5.16))

LogonID: 0x00

InputHandleIndex: 0x01

The remaining 10 bytes are the MaxRowCount and CategoryId fields described in section 2.2.2.17.1.

  
 0003: 00 00 01 00 00 00 00 f1-88 bd

MaxRowCount: 0x0000. Rows will be expanded but not returned in the response.

CategoryId: 0xbd88f10000000001. The PidTagInstID (section 2.2.1.1) of the category row to expand.

Show: