4.1.1 Client Request Buffer

A complete ROP request buffer in this example would appear as follows.

 0000: 41 00 01 00 01 00 01 08-00 1f 00 82 66 50 00 72
 0010: 00 6f 00 6a 00 65 00 63-00 74 00 20 00 58 00 00
 0020: 00 03 00 76 66 0a 00 00-00 03 00 77 66 01 00 00
 0030: 00 fd 00 79 66 03 01 00-01 00 1f 00 37 00 1f 00
 0040: 37 00 50 00 72 00 6f 00-6a 00 65 00 63 00 74 00
 0050: 20 00 58 00 00 00 fe 00-80 66 01 00 d0 00 01 00
 0060: 00 00 00 00 00 00 00 01-ad 00 00 00 00 00 38 a1
 0070: bb 10 05 e5 10 1a a1 bb-08 00 2b 2a 56 c2 00 00
 0080: 45 4d 53 4d 44 42 2e 44-4c 4c 00 00 00 00 00 00
 0090: 00 00 1b 55 fa 20 aa 66-11 cb 9b c8 00 aa 00 2f
 00a0: c4 5a 0c 00 00 00 4f 4c-45 58 44 4f 47 31 32 00
 00b0: 2f 6f 3d 46 69 72 73 74-4f 72 67 61 6e 69 7a 61
 00c0: 74 69 6f 6e 2f 6f 75 3d-45 78 63 68 61 6e 67 65
 00d0: 20 41 64 6d 69 6e 69 73-74 72 61 74 69 76 65 20
 00e0: 47 72 6f 75 70 20 28 46-59 44 49 42 4f 48 46 32
 00f0: 33 53 50 44 4c 54 29 2f-63 6e 3d 52 65 63 69 70
 0100: 69 65 6e 74 73 2f 63 6e-3d 74 65 72 72 79 6d 61
 0110: 68 44 31 32 2d 31 00 15-00 01 04 00 00 00 01 72
 0120: 00 0c 00 00 00 00 00 00-00 00 00 00 00 00 1f 00
 0130: 81 66 52 00 75 00 6c 00-65 00 4f 00 72 00 67 00
 0140: 61 00 6e 00 69 00 7a 00-65 00 72 00 00 00 03 00
 0150: 83 66 00 00 00 00 02 01-84 66 10 00 01 00 00 00
 0160: 01 00 00 00 55 55 55 55-d1 44 e3 40

The first 6 bytes refer to the RopId, LogonId, InputHandleIndex, ModifyRulesFlags, and RulesCount fields of the RopModifyRules format as described in [MS-OXCROPS] section 2.2.11.1.

  
 0000: 41 00 01 00 01 00

RopId: 0x41 (RopModifyRules)

LogonId: 0x00

InputHandleIndex: 0x01

ModifyRulesFlags: 0x00

RulesCount: 0x0001

The first and only RuleData structure for this request begins at byte 0x0006. The next 3 bytes are the RuleDataFlags and PropertyValueCount fields:

  
 0006: 01 08 00

RuleDataFlags: 0x01 (ROW_ADD)

PropertyValueCount: 0x0008

The first of the eight TaggedPropertyValues fields begin at byte 0x0009. They are summarized below. For more information on the PropertyValue structure format, see [MS-OXCDATA] section 2.11.2.

  
 0009: 1f 00 82 66 50 00 72 00-6f 00 6a 00 65 00 63-00
 0019: 74 00 20 00 58 00 00 00

PropertyTag: 0x6682001F (PidTagRuleName (section 2.2.1.3.1.4))

PropertyValue: Unicode string: "Project X"

  
 0021: 03 00 76 66 0a 00 00-00

PropertyTag: 0x66760003 (PidTagRuleSequence (section 2.2.1.3.1.2))

PropertyValue: 0x0000000A

  
 0029: 03 00 77 66 01 00 00-00

PropertyTag: 0x66770003 (PidTagRuleState (section 2.2.1.3.1.3))

PropertyValue: 0x00000001 (ST_ENABLED)

  
 0031: fd 00 79 66 03 01 00 01-00 1f 00 37 00 1f 00 37
 0041: 00 50 00 72 00 6f 00 6a-00 65 00 63 00 74 00 20
 0051: 00 58 00 00 00

PropertyTag: 0x667900FD (PidTagRuleCondition (section 2.2.1.3.1.9))

PropertyValue: "RES_CONTENT" condition, FuzzyLevel of 0x00010001 (FL_SUBSTRING | FL_IGNORECASE), where PropertyTag 0x0037001F (PidTagSubject ([MS-OXPROPS] section 2.1023) contains "Project X". For more information, see section 2.2.1.

  
 0056: fe 00 80 66 01 00 d0 00-01 00 00 00 00 00 00 00
 0066: 00 01 ad 00 00 00 00 00-38 a1 bb 10 05 e5 10 1a
 0076: a1 bb 08 00 2b 2a 56 c2-00 00 45 4d 53 4d 44 42
 0086: 2e 44 4c 4c 00 00 00 00-00 00 00 00 1b 55 fa 20
 0096: aa 66 11 cb 9b c8 00 aa-00 2f c4 5a 0c 00 00 00
 00a6: 4f 4c 45 58 44 4f 47 31-32 00 2f 6f 3d 46 69 72
 00b6: 73 74 4f 72 67 61 6e 69-7a 61 74 69 6f 6e 2f 6f
 00c6: 75 3d 45 78 63 68 61 6e-67 65 20 41 64 6d 69 6e
 00d6: 69 73 74 72 61 74 69 76-65 20 47 72 6f 75 70 20
 00e6: 28 46 59 44 49 42 4f 48-46 32 33 53 50 44 4c 54
 00f6: 29 2f 63 6e 3d 52 65 63-69 70 69 65 6e 74 73 2f
 0106: 63 6e 3d 74 65 72 72 79-6d 61 68 44 31 32 2d 31
 0116: 00 15 00 01 04 00 00 00-01 72 00 0c 00 00 00 00
 0126: 00 00 00 00 00 00 00 00

PropertyTag: 0x668000FE (PidTagRuleActions (section 2.2.1.3.1.10))

PropertyValue: 0x0001 actions (2), 0x00D0 bytes long, to ActionType is 0x01 ("OP_MOVE"), ActionFlavor is 0x00000000, ActionFlags is 0x00000000, FolderInThisStore is 0x01, followed by a StoreEID 0xAD bytes long, followed by a FolderEID 0x15 bytes long. For more details, see section 2.2.5.

  
 012e: 1f 00 81 66 52 00 75 00-6c 00 65 00 4f 00 72 00
 013e: 67 00 61 00 6e 00 69 00-7a 00 65 00 72 00 00 00

PropertyTag: 0x6681001F (PidTagRuleProvider (section 2.2.1.3.1.5))

PropertyValue: Unicode string: "RuleOrganizer"

  
 014e: 03 00 83 66 00 00 00 00

PropertyTag: 0x66830003 (PidTagRuleLevel (section 2.2.1.3.1.6))

PropertyValue: 0x00000000

  
 0156: 02 01 84 66 10 00 01 00-00 00 01 00 00 00 55 55
 0166: 55 55 d1 44 e3 40

PropertyTag: 0x66840102 (PidTagRuleProviderData (section 2.2.1.3.1.8)

PropertyValue: BLOB, 0x0010 bytes long, set by the client.

Show: