4.4.1 Client Request Buffer

A complete ROP request buffer for the RopQueryRows ROP ([MS-OXCROPS] section is a 7-byte sequence formatted as follows:

 0000: 15 00 01 00 01 32 00

The first 3 bytes are the RopId, LogonId, and InputHandleIndex fields as described in [MS-OXCROPS] section

 0000: 15 00 01

RopId: 0x15 (RopQueryRows)

LogonID: 0x00

InputHandleIndex: 0x01. The handle of the table to query.

The final 4 bytes of the ROP request buffer are the QueryRowsFlags, ForwardRead, and RowCount fields described in section

 0003: 00 01 32 00

QueryRowsFlags: 0x00. Advance the table cursor.

ForwardRead: 0x01. Read the table forward.

RowCount: 0x0032. Return a maximum of 50 rows.