4 Protocol Examples

Starting with a "clean" folder (that is, a folder with no rules (2)), here is a sample sequence of ROP request buffers and ROP response buffers that a client and a server might exchange. Note that the examples listed here only show the relevant portions of the specified ROPs; this is not the final byte sequence that gets transmitted over the wire. Also note that the data for a multibyte field appear in little-endian format, with the bytes in the field presented from least significant to most significant. Generally speaking, these ROP request buffers are packed with other ROP request buffers, compressed and packed in one or more remote procedure calls (RPCs) as described in [MS-OXCROPS]. These examples assume the client has already successfully logged on to the server and opened the folder on which it will modify the rules (2).

Examples in this section use the following format for byte sequences.

 0080: 45 4d 53 4d 44 42 2e 44-4c 4c 00 00 00 00 00 00

The value at the far left is the offset of the following bytes into the buffer, expressed in hexadecimal notation. Following the offset is a series of up to 16 bytes, with each two-character sequence describing the value of one byte in hexadecimal notation. Here, for example, the byte "53" (01010011) is located 0x82 bytes (130 bytes) from the beginning of the buffer. The dash between the eighth byte ("44") and the ninth byte ("4C") has no semantic value and serves only to distinguish the 8-byte boundary for readability purposes.

Such a byte sequence is then followed by one or more lines interpreting it. In larger examples the byte sequence is shown once in its entirety and then repeated in smaller chunks, with each smaller chunk interpreted separately.

The following example shows how a property tag and its property value are represented in a buffer and interpreted directly from it (according to the PropertyValue structure format described in [MS-OXCDATA]). The data appears in the buffer in little-endian format.

 0021: 03 00 76 66 0a 00 00-00

PropertyTag: 0x66760003 (PidTagRuleSequence (section

PropertyValue: 10

Generally speaking, interpreted values will be shown in their native format, interpreted from the raw byte sequence as described in the specific section. Here, the byte sequence "0a 00 00 00" has been interpreted as a ULONG ([MS-DTYP]) with a value of 10 although the type of the PidTagRuleSequence property is PtypInteger32 ([MS-OXCDATA] section