SMB2/Ioctl/Function

This is a 4 byte field in the SMB2/Ioctl command that describes what kind of ioctl or fsctl is being used.

Structure

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            Device             | A :       Function        : M |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Device

• 0x0001 FILE_DEVICE_BEEP

• 0x0002 FILE_DEVICE_CD_ROM

• 0x0003 FILE_DEVICE_CD_ROM_FILE_SYSTEM

• 0x0004 FILE_DEVICE_CONTROLLER

• 0x0005 FILE_DEVICE_DATALINK

• 0x0006 FILE_DEVICE_DFS

• 0x0007 FILE_DEVICE_DISK

• 0x0008 FILE_DEVICE_DISK_FILE_SYSTEM

• 0x0009 FILE_DEVICE_FILE_SYSTEM

• 0x000a FILE_DEVICE_INPORT_PORT

• 0x000b FILE_DEVICE_KEYBOARD

• 0x000c FILE_DEVICE_MAILSLOT

• 0x000d FILE_DEVICE_MIDI_IN

• 0x000e FILE_DEVICE_MIDI_OUT

• 0x000f FILE_DEVICE_MOUSE

• 0x0010 FILE_DEVICE_MULTI_UNC_PROVIDER

• 0x0011 FILE_DEVICE_NAMED_PIPE

• 0x0012 FILE_DEVICE_NETWORK

• 0x0013 FILE_DEVICE_NETWORK_BROWSER

• 0x0014 FILE_DEVICE_NETWORK_FILE_SYSTEM

• 0x0015 FILE_DEVICE_NULL

• 0x0016 FILE_DEVICE_PARALLEL_PORT

• 0x0017 FILE_DEVICE_PHYSICAL_NETCARD

• 0x0018 FILE_DEVICE_PRINTER

• 0x0019 FILE_DEVICE_SCANNER

• 0x001a FILE_DEVICE_SERIAL_MOUSE_PORT

• 0x001b FILE_DEVICE_SERIAL_PORT

• 0x001c FILE_DEVICE_SCREEN

• 0x001d FILE_DEVICE_SOUND

• 0x001e FILE_DEVICE_STREAMS

• 0x001f FILE_DEVICE_TAPE

• 0x0020 FILE_DEVICE_TAPE_FILE_SYSTEM

• 0x0021 FILE_DEVICE_TRANSPORT

• 0x0022 FILE_DEVICE_UNKNOWN

• 0x0023 FILE_DEVICE_VIDEO

• 0x0024 FILE_DEVICE_VIRTUAL_DISK

• 0x0025 FILE_DEVICE_WAVE_IN

• 0x0026 FILE_DEVICE_WAVE_OUT

• 0x0027 FILE_DEVICE_8042_PORT

• 0x0028 FILE_DEVICE_NETWORK_REDIRECTOR

• 0x0029 FILE_DEVICE_BATTERY

• 0x002a FILE_DEVICE_BUS_EXTENDER

• 0x002b FILE_DEVICE_MODEM

• 0x002c FILE_DEVICE_VDM

• 0x002d FILE_DEVICE_MASS_STORAGE

• 0x002e FILE_DEVICE_SMB

• 0x002f FILE_DEVICE_KS

• 0x0030 FILE_DEVICE_CHANGER

• 0x0031 FILE_DEVICE_SMARTCARD

• 0x0032 FILE_DEVICE_ACPI

• 0x0033 FILE_DEVICE_DVD

• 0x0034 FILE_DEVICE_FULLSCREEN_VIDEO

• 0x0035 FILE_DEVICE_DFS_FILE_SYSTEM

• 0x0036 FILE_DEVICE_DFS_VOLUME

• 0x0037 FILE_DEVICE_SERENUM

• 0x0038 FILE_DEVICE_TERMSRV

• 0x0039 FILE_DEVICE_KSEC

A

 0x00  FILE_ANY_ACCESS
 0x01  FILE_READ_ACCESS
 0x02  FILE_WRITE_ACCESS
 0x03  FILE_READ_WRITE_ACCESS

Method

 0x00  METHOD_BUFFERED
 0x01  METHOD_IN_DIRECT
 0x02  METHOD_OUT_DIRECT
 0x03  METHOD_NEITHER

Function

Function depends on the device used.

Discussion

http://www.osronline.com/article.cfm?article=229 contains an online conversion tool.

Imported from https://wiki.wireshark.org/SMB2/Ioctl/Function on 2020-08-11 23:25:03 UTC