2.2.2.1 RPC_HEADER_EXT Structure
The RPC_HEADER_EXT structure provides information about the payload that follows.
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Version |
Flags |
||||||||||||||||||||||||||||||
|
Size |
SizeActual |
||||||||||||||||||||||||||||||
Version (2 bytes): The version of the structure. This value MUST be set to 0x0000.
Flags (2 bytes): The flags that specify how data that follows this header MUST be interpreted. The flags in the following table are valid.
|
Flag name |
Value |
Meaning |
|---|---|---|
|
Compressed |
0x0001 |
The data that follows the RPC_HEADER_EXT structure is compressed. The size of the data when uncompressed is in the SizeActual field. If this flag is not set, the Size and SizeActual fields MUST be the same. If this flag is set, the value of the Size field MUST be less than the value of the SizeActual field. |
|
XorMagic |
0x0002 |
The data following the RPC_HEADER_EXT structure has been obfuscated. For more details about the obfuscation algorithm, see section 3.1.4.1.1.3. |
|
Last |
0x0004 |
No other RPC_HEADER_EXT structure follows the data of the current RPC_HEADER_EXT structure. This flag indicates that there are multiple buffers, each with its own RPC_HEADER_EXT, one after the other. |
Size (2 bytes): The total length of the payload data that follows the RPC_HEADER_EXT structure. This length does not include the length of the RPC_HEADER_EXT structure.
SizeActual (2 bytes): The length of the payload data after it has been uncompressed. This field is only useful if the Compressed flag is set in the Flags field. If the Compressed flag is not set, this value MUST be equal to the value of the Size field.