2.2.4.64.2 Response

 SMB_Parameters
   {
   UCHAR WordCount;
   Words
     {
     UCHAR     AndXCommand; 
     UCHAR     AndXReserved; 
     USHORT    AndXOffset; 
     UCHAR     OpLockLevel; 
     USHORT    FID; 
     ULONG     CreateDisposition; 
     FILETIME  CreateTime; 
     FILETIME  LastAccessTime; 
     FILETIME  LastWriteTime; 
     FILETIME  LastChangeTime; 
     SMB_EXT_FILE_ATTR ExtFileAttributes; 
     LARGE_INTEGER AllocationSize; 
     LARGE_INTEGER EndOfFile; 
     USHORT    ResourceType; 
     SMB_NMPIPE_STATUS NMPipeStatus; 
     UCHAR     Directory;
     }
   }
 SMB_Data
   {
   USHORT ByteCount;
   }
            

SMB_Parameters (69 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
WordCount								Words (68 bytes)
...
...
...

WordCount (1 byte): This field MUST be 0x22.

Words (68 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
AndXCommand								AndXReserved								AndXOffset
OpLockLevel								FID																CreateDisposition
...																								CreateTime
...
...																								LastAccessTime
...
...																								LastWriteTime
...
...																								LastChangeTime
...
...																								ExtFileAttributes
...																								AllocationSize
...
...																								EndOfFile
...
...																								ResourceType
...								NMPipeStatus																Directory

AndXCommand (1 byte): The command code for the next SMB command in the packet. This value MUST be set to 0xFF if there are no additional SMB command responses in the server response packet.

AndXReserved (1 byte): A reserved field. The server MUST set this field to 0x00 when this response is sent, and the client MUST ignore this field.

AndXOffset (2 bytes): This field MUST be set to the offset in bytes from the start of the SMB Header (section 2.2.3.1) to the start of the WordCount field in the next SMB command response in this packet. This field is valid only if the AndXCommand field is not set to 0xFF. If AndXCommand is 0xFF, this field MUST be ignored by the client.

OpLockLevel (1 byte): The OpLock level granted to the client process.

Value	Meaning
0x00	No OpLock granted.
0x01	Exclusive OpLock granted.
0x02	Batch OpLock granted.
0x03	Level II OpLock granted.

FID (2 bytes): A FID representing the file or directory that was created or opened.

CreateDisposition (4 bytes): A 32-bit value that represents the action to take if the file already exists or if the file is a new file and does not already exist.

Name and bitmask	Meaning
FILE_SUPERSEDE 0x00000000	The file has been superseded.
FILE_OPEN 0x00000001	The file or directory has been opened.
FILE_CREATE 0x00000002	The file or directory has been created.
FILE_OPEN_IF 0x00000003	The file has been overwritten.
FILE_OVERWRITE 0x00000004	The file already exists.
FILE_OVERWRITE_IF 0x00000005	The file does not exist.

CreateTime (8 bytes): A 64-bit integer value representing the time that the file was created. The time value is a signed 64-bit integer representing either an absolute time or a time interval. Times are specified in units of 100ns. A positive value expresses an absolute time, where the base time (the 64- bit integer with value 0x0000000000000000) is the beginning of the year 1601 AD in the Gregorian calendar. A negative value expresses a time interval relative to some base time, usually the current time.

LastAccessTime (8 bytes): The time that the file was last accessed encoded in the same format as CreateTime.

LastWriteTime (8 bytes): The time that the file was last written, encoded in the same format as CreateTime.

LastChangeTime (8 bytes): The time that the file was last changed, encoded in the same format as CreateTime.

ExtFileAttributes (4 bytes): This field contains the extended file attributes that the server assigned to the file or directory as a result of the command, encoded as an SMB_EXT_FILE_ATTR (section 2.2.1.2.3) data type.

AllocationSize (8 bytes): The number of bytes allocated to the file by the server.

EndOfFile (8 bytes): The end of file offset value.

ResourceType (2 bytes): The file type. This field MUST be interpreted as follows.

Name and value	Meaning
FileTypeDisk 0x0000	File or directory
FileTypeByteModePipe 0x0001	Byte mode named pipe
FileTypeMessageModePipe 0x0002	Message mode named pipe
FileTypePrinter 0x0003	Printer device
FileTypeCommDevice 0x0004	Character mode device. When an extended protocol has been negotiated, this value allows a device to be opened for driver-level I/O. This provides direct access to devices such as modems, scanners, and so forth.

NMPipeStatus (2 bytes): A 16-bit field that shows the status of the named pipe if the resource type opened is a named pipe. This field is formatted as an SMB_NMPIPE_STATUS (section 2.2.1.3).

Directory (1 byte): If the returned FID represents a directory, the server MUST set this value to a nonzero value (0x01 is commonly used). If the FID is not a directory, the server MUST set this value to 0x00 (FALSE).

SMB_Data (2 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
ByteCount

ByteCount (2 bytes): This field MUST be 0x0000. No data is sent by this message.

Error Codes